Skip to content

Compliance

Actionable checklists, data requirements, and compliance strategies for EU sustainability regulations. Covering ESPR readiness, DPP data completeness, and sustainability reporting obligations.

RSPO for Small Brands: Palm Oil Without the Chaos

The email usually arrives from a retail buyer or a hotel group: "Can you confirm your palm oil is RSPO certified?" And the founder, who runs a six-person granola or cosmetics brand, types "RSPO" into a search engine for the first time.

Here's the thing nobody explains clearly: brands don't get "RSPO certified" in the way they get certified for other things. RSPO certifies palm oil production and its supply chain. Your job as a brand is to make claims that follow RSPO's rules — and there are four different ways to do it, with very different price tags.

KC, PSE, BIS: Asia's Three Big Product Marks

Three markets, roughly 1.7 billion consumers between them, and three marks that decide whether your electronics get sold or returned. Korea's KC, Japan's PSE, and India's BIS all sit on top of international safety standards, which means the good news up front: one test program can feed all three. What follows is what each mark actually requires.

Mexico's NOM Mark: The Rules Nobody Tells You

Say you sell furniture into Mexico City through a distributor and it goes fine for a year. Then you add a lamp with a USB port to the range, and the next shipment is held at customs. The furniture sails through. The lamp needed a NOM certificate.

Mexico's Normas Oficiales Mexicanas, the NOM standards, apply selectively: some categories sail through, others can't cross the border without a certificate. These are the ones that matter, and what to do about them.

Brazil's INMETRO: Why Goods Sit at the Port

It usually goes like this: a distributor in São Paulo is selling your product well, and then a second container gets held at Santos for three weeks while customs keep asking for something called INMETRO.

Brazil has one of the strictest product certification regimes in the Americas, and it catches first-time exporters who assumed a CE mark or an FCC ID would be enough. It isn't. Here's how the system works and what to do about it before you ship.

The Gulf G-Mark: Selling Electronics to the GCC

Six countries, one customs union, and one mark for your power adapters. The Gulf region gets treated as a single market in trade agreements, but most small exporters learn the details one rejected shipment at a time. Here is the version we wish every electronics brand got before their first Dubai order.

The Gulf Cooperation Council (GCC) — Saudi Arabia, the UAE, Qatar, Kuwait, Bahrain and Oman — requires the G-Mark for low-voltage electrical equipment sold in the region. If you sell chargers, appliances, lighting or AV gear there, this is your entry ticket.

Selling into China? The CCC Mark Is the Gate

Look at the label of any iPhone sold in mainland China and you'll see the CCC mark stamped next to the model number. It's a condition of sale, and Apple complies because there is no alternative: China has its own compulsory certification system, and it doesn't care about your CE mark or your FCC ID. Goods without the right certificate don't clear customs.

If you sell physical products into mainland China, the China Compulsory Certification (CCC) system decides whether your goods cross the border. This post covers how it works, what it costs, and what a small company can realistically do.

Your Compliance Calendar: The Deadlines That Matter

The biggest packaging law in EU history already applies. If you missed that one, you're not alone — it arrived on 12 August 2026 and most small businesses didn't notice. The next eighteen months bring a cluster of deadlines that will do more to change what you can sell than anything in the last five years. Here they are, in one place, with what each one actually means for a small company.

Services Carry More Compliance Than You Think

Ask a small agency owner about compliance and they'll point at the privacy policy in the footer and move on. Ask their biggest client's procurement team, and the list is longer: GDPR record, data processing agreement, security questionnaire, insurance certificate, accessibility statement, maybe NIS2 alignment if they touch critical infrastructure, maybe ISO 27001 if they handle data.

Selling a service means complying as a company, not as a product. And most service businesses are missing half the list.

Getting Supplier Data (And Keeping It Current)

Every compliance system has the same silent failure: the data was true when you collected it, and now it isn't. Your dyehouse changed its finish. Your co-packer reformulated the soap. Your battery supplier swapped the cell chemistry. Nothing told you, so your declaration still claims the old reality — until a customs officer or an auditor finds the difference first.

The fix isn't asking more politely. It's changing who maintains the data.

Which Regulations Apply to My Product?

The first week of a new market usually goes to research. Someone opens a spreadsheet, types "what certificates do I need to sell kettles in Germany", and wades through government sites, lab blogs and forum threads. A week later they have forty tabs open, two conflicting answers, and no decision.

There's a shorter way. It takes about ten minutes, and it works for every market, every product. This post is the method.