The biggest packaging law in EU history already applies. If you missed that one, you're not alone — it arrived on 12 August 2026 and most small businesses didn't notice. The next eighteen months bring a cluster of deadlines that will do more to change what you can sell than anything in the last five years. Here they are, in one place, with what each one actually means for a small company.
Ask a small agency owner about compliance and they'll point at the privacy policy in the footer and move on. Ask their biggest client's procurement team, and the list is longer: GDPR record, data processing agreement, security questionnaire, insurance certificate, accessibility statement, maybe NIS2 alignment if they touch critical infrastructure, maybe ISO 27001 if they handle data.
Selling a service means complying as a company, not as a product. And most service businesses are missing half the list.
Every compliance system has the same silent failure: the data was true when you collected it, and now it isn't. Your dyehouse changed its finish. Your co-packer reformulated the soap. Your battery supplier swapped the cell chemistry. Nothing told you, so your declaration still claims the old reality — until a customs officer or an auditor finds the difference first.
The fix isn't asking more politely. It's changing who maintains the data.
The first week of a new market usually goes to research. Someone opens a spreadsheet, types "what certificates do I need to sell kettles in Germany", and wades through government sites, lab blogs and forum threads. A week later they have forty tabs open, two conflicting answers, and no decision.
There's a shorter way. It takes about ten minutes, and it works for every market, every product. This post is the method.
Amazon's compliance enforcement works differently from government regulation. The FCC does not scan Amazon listings for missing FCC IDs. The CPSC does not crawl Seller Central for missing CPCs. But Amazon does. Its automated compliance systems flag listings, request documentation, and suppress ASINs — and the seller gets a notification with a deadline.
The most common reason a product listing gets removed on Amazon is not a safety violation. It is that the seller could not produce the required compliance documents within the deadline Amazon gave them. The compliance existed, or could have existed — but it was not structured, not accessible, and not upload-ready when Amazon asked.
This guide covers the compliance documentation Amazon requires by product category and how to have it ready before the enforcement notice arrives.
On the Sustalium platform, the sellers who survive Amazon's compliance sweeps without listing disruptions are not the ones with the best compliance programs — they are the ones who can produce every required document for every ASIN within the 72-hour window Amazon gives them. Compliance that exists but cannot be found might as well not exist.
Not sure which documents your Amazon category requires? Use the Sustalium Global Compliance Map — select your product type and the US, and see every certificate, test report, and warning Amazon's system expects for that category.
There is no comprehensive federal PFAS ban in the United States — yet. Instead, a rapidly growing patchwork of state laws is creating one of the most administratively complex compliance landscapes in the country. Maine and Minnesota have passed the most sweeping PFAS restrictions. California, New York, Vermont, Washington, Colorado, and more than a dozen other states have enacted product-specific PFAS bans covering food packaging, cosmetics, textiles, carpets, firefighting foam, and children's products. For a manufacturer selling into multiple US states, the question is no longer "does my product contain PFAS?" but "which state's threshold applies to which product category?"
PFAS (per- and polyfluoroalkyl substances) — often called "forever chemicals" — are a class of approximately 12,000 synthetic chemicals used for their water, grease, and stain-resistant properties. The EPA has designated PFOA and PFOS as hazardous substances under CERCLA, and the agency has set enforceable drinking water standards for six PFAS compounds. But for product manufacturers, the compliance obligation today comes primarily from state laws — and the two most sweeping are Maine's LD 1503 and Minnesota's Amara's Law.
The gap between making a great lipstick in your kitchen and selling it legally in the United States is wider than most founders expect. Since MoCRA was signed into law in 2022, cosmetic regulation in the US changed fundamentally — facility registration is now mandatory, product listing is mandatory, safety substantiation is mandatory, and adverse event reporting is mandatory. And if you also sell in Europe, you need a separate EU Cosmetic Product Safety Report (CPSR) before your product reaches the market.
This guide walks through launching a cosmetics brand with the regulatory steps at each stage — so you are not discovering MoCRA requirements the week your product is supposed to ship.
On the Sustalium platform, the pattern we see with cosmetics brands is consistent: the founder handles formulation, packaging, branding, and website — then discovers MoCRA product listing and safety substantiation exist when Amazon requests the documentation. The compliance obligation has been in place for two years. The brand simply did not know it applied to them.
Not sure which regulations govern your cosmetics brand? Use the Sustalium Global Compliance Map — select Cosmetics and your target market, and see every framework from FDA MoCRA to the EU CPSR and UK SCPN notification.
New York is the fashion capital of the United States, and the New York Fashion Sustainability and Social Accountability Act (originally introduced in 2021 as Senate Bill S7428 / Assembly Bill A8352 and reintroduced in 2023) is the most aggressive state-level fashion regulation proposed in the country. If passed, it would require fashion brands and retailers doing business in New York with more than $100 million in global revenue to map their supply chains, disclose environmental and social impacts, and set binding targets for improvement.
The NY Fashion Act is modeled in part on the French Duty of Vigilance Law (LdV) and the EU's CSDDD — but specifically tailored to the fashion, footwear, and apparel industry. On the Sustalium platform, we are already seeing fashion brands begin to structure their supply chain data in anticipation of the legislation, because the mapping and disclosure requirements mirror what their European operations are already doing under CSRD and CSDDD.
Before the Modernization of Cosmetics Regulation Act (MoCRA) was signed into law in December 2022, cosmetic manufacturers could legally sell products in the US without ever registering with the FDA or listing a single product ingredient. The FDA had no authority to recall unsafe cosmetics, no mandatory adverse event reporting system for cosmetics, and no requirement that manufacturers substantiate product safety. MoCRA changed all of that in a single legislative package — the most significant overhaul of US cosmetic regulation since the Federal Food, Drug, and Cosmetic Act of 1938.
MoCRA imposes mandatory facility registration, product listing, safety substantiation, adverse event reporting, and — for the first time — gives the FDA mandatory recall authority over cosmetics. On the Sustalium platform, the MoCRA-related compliance activity we see most is cosmetic brands and contract manufacturers reconciling their ingredient lists with the FDA's product listing format — because the FDA's electronic submission portal requires structured ingredient data, and most brands' internal records are not yet structured to match.
Starting an electronics brand costs more than most founders expect and not because of manufacturing. It is the testing and certification. Every electronic product sold in the US requires FCC compliance as a matter of federal law. UL certification is commercially mandatory even where it is not legally required. And if you sell on Amazon, you need both plus a General Certificate of Conformity before your listing goes live.
This guide walks through launching an electronics product with the compliance planned and budgeted from the start.
On the Sustalium platform, the gap we see between electronics brands that launch on time and electronics brands that delay their launch by months is pre-compliance testing. The brands that send a prototype to the lab for a pre-scan before the formal FCC test identify emissions problems while they can still fix them at the PCB stage. The brands that go straight to formal testing discover the problem when the test report says "fail" and they have already cut tooling.
Not sure which regulations apply to your electronics product? Use the Sustalium Global Compliance Map select Electronics and your target market, and see every framework from FCC and UL to e-waste and Prop 65.