Regulatory analysis and compliance roadmaps for EU sustainability legislation including the Ecodesign for Sustainable Products Regulation (ESPR), Corporate Sustainability Reporting Directive (CSRD), and Green Claims Directive.
EU regulation explainers for businesses selling into Europe: CE marking, GPSR, CBAM, EUDR, ESPR, the AI Act, and what each one requires from manufacturers and importers.
An Amazon EU seller needs four documents in order before listing: the CE declaration (where applicable), the GPSR technical file and safety information, the Responsible Person details, and the product warnings. Each one must be verifiable when the marketplace asks.
Small importers can meet EUDR due diligence without an enterprise budget: collect plot geolocations from suppliers, run a documented risk assessment, and submit a due diligence statement. The cost driver is process, not software.
The EU passed a law in 2024 that almost nobody in the SME world has felt yet. It has no reporting duty for small companies. No questionnaire season. No annual filing. And yet it might be the single most expensive EU regulation for any business that sells physical products into the bloc.
Regulation (EU) 2024/3015 bans products made with forced labour from the EU market. It starts applying on 14 December 2027. Here's why a business of any size should treat that date as a deadline, not a footnote.
In 2024, the European Commission acknowledged that only 45 Notified Bodies had been designated under the MDR — down from roughly 80 under the previous Medical Device Directive. The resulting bottleneck has delayed recertification across all device classes, and several EU Member States have reported that up to 20% of Class I manufacturers had not fully transitioned their technical documentation from MDD to MDR format during spot checks. A non-sterile Class I device may not need a Notified Body, but that self-declaration must still be built on the new regulation's structure — and outdated documentation is treated the same as no documentation during a competent authority audit.
Under the EU Medical Device Regulation (MDR — Regulation [EU] 2017/745), all medical devices placed on the European market require a Declaration of Conformity. Class I devices are the lowest-risk category but the documentation burden is far from trivial. On the Sustalium platform, the area where we see Class I manufacturers submit incomplete documentation most frequently is the new clinical evaluation and post-market surveillance requirements — obligations that simply did not exist under MDD.
If you manufacture or distribute products with digital elements in the European Union, the Cyber Resilience Act (CRA) is now your most important regulatory obligation. Manual compliance is slow, expensive, and error-prone. CRA compliance software automates risk assessments, generates declarations of conformity, and keeps your engineering and legal teams aligned — without the spreadsheet chaos.
The CSDDD (Directive 2024/1760, also called CS3D) is the regulation that turns voluntary ESG commitments into legal obligations with teeth. If your company has >1,000 employees or >€450M turnover, you're legally required to identify, prevent, and remediate human rights and environmental harms in your supply chain — and if you don't, you can be sued.
It closes a gap that's existed for decades: companies could talk about ethical supply chains without any legal framework forcing them to actually do something about problems they found. CSDDD changes that.
If you've ever described a product as "eco-friendly," "green," or "sustainable," you need to read this closely. The EU Green Claims Directive makes vague environmental claims illegal and requires every specific claim to be verified by an accredited third party before it can appear on a product, website, or advertisement.
The core principle is simple and brutal: any explicit environmental claim must be substantiated before publication, verified by a third party before marketing, and accessible to consumers at the point of sale. If you can't prove it, you can't say it.
Here's a problem you might not have thought about: before the Cyber Resilience Act, most hardware and software products had no mandatory cybersecurity requirements at all. A smart camera, a connected thermostat, a SaaS platform — none of them needed to meet any baseline security standard to be sold in the EU. The CRA (Regulation 2024/2847) changes that, and it's going to affect every company that makes or sells products with digital elements.
The Act entered into force in 2024, with obligations phasing in through 2027. If you make connected devices, operating systems, or even mobile apps sold in the EU, you're in scope.
The EU Deforestation Regulation (2023/1115) is in full enforcement, and it's already reshaping global supply chains. If you deal in cattle, cocoa, coffee, oil palm, rubber, soya, or wood, you need a Due Diligence Statement for every shipment — backed by geolocation coordinates down to the plot level. No exceptions, no phase-ins for small operators.
Most companies underestimate how hard the geolocation requirement is. Your supplier in Côte d'Ivoire needs to provide plot-level GPS coordinates that match satellite imagery. If they can't, your shipment doesn't clear customs.
If you think the CSRD is just an expanded version of the old NFRD, you're in for a shock. The Corporate Sustainability Reporting Directive (2022/2464) doesn't just expand the scope from 11,000 companies to 50,000 — it fundamentally changes what reporting means. 1,100+ datapoints. Double materiality. Limited assurance. iXBRL tagging. And for the first time, your sustainability data needs to stand up to external scrutiny.
The European Sustainability Reporting Standards (ESRS) are the rulebook, and they cover environmental, social, and governance topics in granular detail. If you already report under GRI or SASB, there's overlap — but the bar is significantly higher.