If you sell products in California, you are legally required to provide "clear and reasonable" warnings when your product exposes consumers to any chemical listed under California Proposition 65. With over 900 listed substances and frequent updates, tracking your obligations manually is impractical at scale. Prop 65 compliance software automates the screening, declaration, and warning-label workflow so you can ship to California with confidence.
The ICO's June 2026 guidance on IoT products explicitly states that manufacturers must conduct DPIAs before processing personal data from connected devices, and that consent must be obtained for any tracking technologies used. With penalties under PECR now aligned to UK GDPR levels — up to £17.5 million or 4% of global turnover — the cost of manual compliance management is no longer just administrative.
Compliance teams managing GDPR manually spend roughly 60% of their time on record-keeping alone — ROPA maintenance, DPIA documentation, consent logs, breach reports. That is time most product companies don't have.
GDPR compliance software automates these workflows. On the Sustalium platform, we built the GDPR module specifically for product companies — not tech firms — because the data flows are different when you're managing IoT data, supplier records, and customer shipments rather than SaaS user accounts.
Conflict minerals regulations in both the US (Dodd-Frank Section 1502) and the EU (Regulation 2017/821) require companies to trace the sourcing of tin, tantalum, tungsten, and gold (3TG) through their supply chains, conduct due diligence, and file compliant disclosures. With supply chains spanning multiple tiers and continents, manual CMRT collection and verification is error-prone and resource-intensive.
Conflict minerals software automates the collection of Conflict Minerals Reporting Templates (CMRTs), conducts reasonable country of origin inquiries (RCOI), and generates compliant disclosures for SEC and EU filing.
If you make or import batteries for the EU market, you've got a February 2027 deadline that's coming faster than it looks. The EU Battery Regulation (2023/1542) isn't just an update to the old directive — it's a complete rewrite covering carbon footprint declarations, recycled content targets, the Digital Battery Passport, and supply chain due diligence for cobalt, lithium, and nickel.
Here's the problem: the regulation treats batteries differently by type (portable, LMT, SLI, industrial, EV), each with its own deadlines and requirements. Battery compliance software won't write your LCA for you, but it'll keep you from missing one of the five parallel timelines.
NIS2 isn't just GDPR's cybersecurity cousin — it's a fundamentally different beast. The Directive (2022/2555) expands mandatory cybersecurity far beyond the original NIS, covering everything from energy and transport to digital infrastructure and public administration. Penalties hit €10 million or 2% of global turnover, and management faces personal liability.
If you're in a "highly critical" sector (energy, transport, health, digital infrastructure), the compliance bar is higher than you think. NIS2 compliance software won't make your network secure, but it'll document the risk management measures and incident reporting that regulators look for.
If you're in scope for CSRD (250+ employees, €50M+ turnover, or €25M+ balance sheet), you're looking at 1,100+ datapoints across ESRS standards. That's not a number you spreadsheet your way through. The first wave of companies reporting on 2024 data already found that manual processes don't scale when you need auditable, double-materiality-assessed sustainability reports with XBRL tagging.
CSRD compliance software won't decide what's material for you, but it'll handle the data collection, validation, and ESRS tagging that makes the difference between a report that passes assurance and one that doesn't.
ESG reporting has moved from voluntary to mandatory for thousands of companies under the EU's CSRD, with the first compliance deadlines already passing in 2025 and phased rollout continuing through 2028. Whether you're subject to mandatory reporting or responding to supply chain requests from larger buyers, getting ESG data collection and disclosure right requires dedicated software.
ESG reporting software automates data collection across environmental, social, and governance metrics, maps them to reporting frameworks (CSRD, ESRS, TNFD, SASB, GRI), and generates auditable disclosures.
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI regulation, classifying AI systems by risk level and imposing strict requirements on high-risk systems. While most provisions apply from August 2026, the rules for high-risk AI systems come into full force by December 2027.
AI Act compliance software helps you classify your AI systems, build the required technical documentation, implement risk management, and maintain ongoing conformity — whether you're an AI developer, deployer, or both.
The EU General Product Safety Regulation (GPSR, Regulation 2023/988) has been in effect since December 2024, replacing the old GPS Directive. It requires every product sold in the EU to have an accountable EU Responsible Person, accessible safety documentation, and a traceability system — regardless of whether the product is covered by sector-specific legislation like CE marking.
GPSR compliance software automates responsible person appointment, safety document management, incident reporting, and marketplace compliance — keeping your products selling on Amazon, eBay, and other EU marketplaces.
EUDR is the regulation that forces you to know exactly where every raw material came from — down to the GPS coordinates of the production plot. If you're importing cattle, cocoa, coffee, palm oil, rubber, soya, or wood into the EU, you need geolocation data, legal compliance proof, and risk assessments for every shipment. Not per supplier. Per shipment.
What most companies underestimate: it's not the big growers with mapped plantations that cause the problem. It's the thousands of smallholder farmers who don't have GPS devices. EUDR compliance software won't go to the field and collect coordinates for you, but it'll manage the data once you've got it.