Skip to content

Compliance

ISO 27001 Certification: ISMS & Buyer Sharing

As of the ISO Survey 2023, there were 71,549 valid ISO 27001 certificates across 175 countries — making it the second most adopted ISO management system standard after ISO 9001. In a 2024 Vanta survey, 78% of companies reported that ISO 27001 certification directly helped them close deals faster. The transition from ISO 27001:2013 to ISO 27001:2022 completed in October 2025, and any organization still holding a certificate against the 2013 version must now recertify against the updated standard. The market message is unambiguous: in B2B procurement, ISO 27001 has become less a security posture indicator and more a market access prerequisite.

ISO 27001 is the international standard for Information Security Management Systems (ISMS). For B2B companies — SaaS platforms, IT service providers, cloud infrastructure companies, and any organization handling client data — it is the single most requested compliance credential in vendor assessments. On the Sustalium platform, we see the real bottleneck is rarely the technical controls themselves — it is the inability to produce the certificate, Statement of Applicability, and audit reports in a single verifiable package when procurement asks for them.

CPC Requirements for Toys: ASTM F963 (US)

Toys are the most heavily regulated consumer product category in the United States — and the compliance path is fundamentally different from general consumer goods. The key difference is that toys require a Children's Product Certificate (CPC) , not the General Certificate of Conformity (GCC) that covers adult products. The CPC demands third-party testing at a CPSC-accepted laboratory, additional chemical restrictions beyond what applies to general consumer goods, and specific labeling requirements — including a tracking label on every product.

This guide covers every compliance requirement for toys sold in the US, from federal testing standards to state-level chemical warnings, and compares the US framework to the EU Toy Safety Directive for brands selling in both markets.

EU MDR Class I Device Compliance Guide

In 2024, the European Commission acknowledged that only 45 Notified Bodies had been designated under the MDR — down from roughly 80 under the previous Medical Device Directive. The resulting bottleneck has delayed recertification across all device classes, and several EU Member States have reported that up to 20% of Class I manufacturers had not fully transitioned their technical documentation from MDD to MDR format during spot checks. A non-sterile Class I device may not need a Notified Body, but that self-declaration must still be built on the new regulation's structure — and outdated documentation is treated the same as no documentation during a competent authority audit.

Under the EU Medical Device Regulation (MDR — Regulation [EU] 2017/745), all medical devices placed on the European market require a Declaration of Conformity. Class I devices are the lowest-risk category but the documentation burden is far from trivial. On the Sustalium platform, the area where we see Class I manufacturers submit incomplete documentation most frequently is the new clinical evaluation and post-market surveillance requirements — obligations that simply did not exist under MDD.

MoCRA vs. CPSR: US & EU Cosmetic Safety Files

A cosmetic brand selling in both the United States and the European Union must comply with two regulatory frameworks that are structurally similar but operationally distinct — and neither framework accepts the other's documentation. The US system, modernized in 2022 by MoCRA, emphasizes manufacturer self-declaration of safety. The EU system, established under the Cosmetic Products Regulation (EC) 1223/2009, requires a qualified safety assessor to prepare a formal Cosmetic Product Safety Report (CPSR) and mandates notification to the EU's Cosmetic Product Notification Portal (CPNP) before the product reaches the market.

For brands selling in both markets, the compliance cost is additive — you need both a MoCRA safety substantiation and an EU CPSR. But the ingredient data and toxicological assessments that support one can inform the other, and building both in parallel from the same product data is significantly more efficient than treating them as separate compliance projects.

Importing US Furniture: Complete Compliance Checklist

Furniture is the rare product category that triggers nearly every major US import compliance framework at once. A single wooden dresser imported into the United States requires a Lacey Act plant declaration for the wood, a CPSC General Certificate of Conformity for the safety standards, a TSCA Title VI certification for formaldehyde emissions from composite wood panels, and packaging that complies with California TPPA heavy metal limits. If the dresser has upholstery, add a flammability standard. If it contains stain-resistant treatments, add PFAS state-law considerations.

This guide maps every US compliance requirement for imported furniture into a single checklist — so you know exactly what you need before your container reaches the port.

General Certificate of Conformity: CPSC Guide

In 2023, the US Consumer Product Safety Commission levied over $45 million in civil penalties across multiple enforcement actions — and a recurring finding in compliance investigations is that the General Certificate of Conformity either did not exist, was incomplete, or cited the wrong safety standard. When a GCC is missing or inaccurate, the product is legally non-compliant regardless of how safe it actually is. Amazon has increasingly codified this into its own enforcement: in categories like children's furniture, apparel, and electronics, sellers must upload a valid GCC directly to Seller Central or face listing suppression.

The US General Certificate of Conformity (GCC) is a mandatory document under the Consumer Product Safety Improvement Act (CPSIA) Section 14. It certifies that your consumer product has been tested and complies with all applicable CPSC safety rules. On the Sustalium platform, the most common GCC error we see is not a missing certificate — it's a certificate that lists one or two applicable standards while omitting others that apply to the same product.

Stop Overthinking Compliance: Start Selling Today

The most expensive compliance strategy in the world is not doing compliance badly. It is avoiding compliance until enforcement finds you. And enforcement always finds you — through a CBP hold in Long Beach, an Amazon suppression of your ASIN, a Prop 65 notice from a California plaintiff's attorney, an EU customs authority flagging your goods at Rotterdam, a Saudi SABER rejection, a Chinese environmental inspection shutting down your supplier, or a retailer audit that discovers your documentation does not exist.

The businesses we see on the Sustalium platform fall into two camps. The overthinkers believe compliance requires an expensive consultant, a full-time regulatory specialist, and months of preparation before they can sell anything. The avoiders know compliance exists but they are shipping product now and will deal with it later. Both camps end up in the same place: a compliance emergency that costs significantly more than proactive compliance would have cost.

UK REACH Compliance: Registration & SVHC Guide

When the UK left the EU's single market, it established an independent chemicals regulatory framework — UK REACH — enforced by the Health and Safety Executive (HSE) rather than ECHA. DEFRA has since estimated that full transition to the UK REACH model could cost British industry over £2 billion in duplicative testing, and in May 2024 the government published an Alternative Transition Model (ATR) proposal to reduce that burden by accepting certain EU REACH data. The registration deadlines have been extended to October 2026, 2028, and 2030 depending on tonnage band — but the fundamental requirement has not changed: EU REACH registrations have zero legal standing in Great Britain.

UK REACH is now a distinct regulatory framework governing chemicals placed on the Great Britain market. If your company moves chemicals, mixtures, or articles containing substances of very high concern (SVHCs) between the EU and the UK, you are navigating two separate regimes. On the Sustalium platform, UK-specific registration is the single most misunderstood requirement we see — companies consistently assume their EU REACH dossier covers the UK market, and they are consistently wrong.

US Electronics Compliance: FCC, UL, Prop 65 Guide

An electronic product sold in the US is subject to a minimum of four separate regulatory frameworks and that is before counting state-level requirements, retailer demands, or packaging rules. The frameworks do not talk to each other. The FCC does not care about Prop 65. UL certification does not substitute for an FCC test report. And a CE Mark means nothing to US Customs.

This guide bundles every US compliance requirement that applies to electronic products into a single reference so you can see what you need, how the pieces connect, and where the overlaps with EU requirements exist if you are selling into both markets.

How to Answer a CSDDD Supplier Due Diligence Request

If you've noticed your customers' procurement questionnaires getting longer and more demanding, you're not imagining it. That's the CSDDD effect: large companies subject to the Corporate Sustainability Due Diligence Directive need data from every supplier in their chain of activities — including you, regardless of your size.

Here's the thing most suppliers miss: responding well to these questionnaires isn't just about keeping the customer happy. It's a competitive advantage. Suppliers who answer in days instead of weeks, who have their data organised and accessible, consistently rank higher in procurement evaluations.