Skip to content

EU Regulations

Preparing for the EU CRA: SBOM Requirements

If you manufacture hardware, connected consumer electronics, IoT devices, or develop commercial software sold in the European Union, a massive regulatory wave is about to hit your engineering team.

The EU Cyber Resilience Act (CRA) represents the most sweeping cybersecurity law for physical and digital products in the world.

Under the CRA, cybersecurity is no longer treated as a post-launch software update or a marketing feature. It has become a mandatory condition for CE Marking.

If your "product with digital elements" does not meet the CRA's strict security-by-design standards, you cannot legally affix the CE Mark, and your product is banned from entering the European market. Penalties for non-compliance are severe, reaching up to €15 million or 2.5% of global turnover.

To maintain EU market access, software and hardware product teams must master the CRA's core technical requirement: the Software Bill of Materials (SBOM).

CBAM Certificates: Costs, Purchasing & Deadlines

With the definitive phase of the Carbon Border Adjustment Mechanism (CBAM) now in full force, EU compliance is no longer just a regulatory reporting exercise for the sustainability department. It has become a critical liquidity and treasury management issue for the Chief Financial Officer (CFO).

Importers of covered goods must now purchase, hold, and surrender CBAM certificates that directly correspond to the greenhouse gas (GHG) emissions embedded in their imported products. These certificates introduce a fluctuating, carbon-linked cost variable into your global supply chain.

To protect your profit margins and ensure uninterrupted customs clearance, you must master the mechanics of EU CBAM Declarations and the lifecycle of the CBAM certificate.

Packaging & Food Compliance: FSMA 204 & EU PPWR

For SMEs in the food, beverage, and consumer goods sectors, the product inside the box is only half the battle. In 2026, the box itself—and the data attached to it—is under extreme regulatory scrutiny.

Between the US FDA's FSMA 204 Traceability Rule and the EU Packaging and Packaging Waste Regulation (PPWR), companies are facing a tsunami of data requirements. If your operation still runs on spreadsheets and email, you are a massive liability to your retail partners.

Recycled Content & Packaging: Plastic Taxes

For decades, packaging compliance was purely a weight-reporting exercise. Brands calculated the total kilograms of cardboard or plastic they placed on the market, paid a nominal fee to a national recycling scheme, and filed the paperwork away.

Today, packaging has become a high-risk tax liability. Governments worldwide are introducing aggressive plastic taxes and packaging regulations designed to force a shift toward circular economies.

In the UK, the Plastic Packaging Tax (PPT) levies a charge of over £210 per tonne on plastic packaging that does not contain at least 30% recycled plastic. Spain and Italy have enacted similar taxes, and the EU's sweeping Packaging and Packaging Waste Regulation (PPWR) will soon mandate strict recycled content targets, void-space limits, and material bans across all 27 Member States.

To avoid these heavy taxes, qualify for tax exemptions, and satisfy corporate retail buyers, you must be able to produce a verifiable Recycled Content & Packaging Data Declaration. Here is how to audit your packaging and declare compliance.

How to Create a CE Declaration of Conformity

If you are importing physical products into the European Economic Area (EEA), you cannot legally sell them without a CE Mark. However, many importers mistakenly believe that the CE Mark is simply a sticker you buy and slap onto a product box.

In reality, the CE Mark is a visible declaration of a much deeper legal process. The cornerstone of this process is the EU Declaration of Conformity (DoC).

The DoC is a legally binding document drafted and signed by the manufacturer (or the importer assuming the manufacturer's liability) stating that the product meets all essential health, safety, and environmental protection requirements of the applicable European directives. If a customs officer at an EU border, a distributor, or an online marketplace like Amazon requests this document and you cannot provide a valid, properly formatted copy, your shipments will be seized, and your listings will be suspended.

Here is the definitive, step-by-step guide to creating a legally compliant CE Declaration of Conformity.

GPSR Compliance Checklist: EU Product Safety Rules

Amazon, Ebay, Vinted, and marketplace sellers are getting blocked daily because they lack a GPSR-compliant file for their products. On the Sustalium platform, the #1 question we get from new clients is: "What exactly do I need to document to stay compliant?"

The EU General Product Safety Regulation (GPSR — Regulation [EU] 2023/988) is now in full force, and it specifically targets e-commerce, third-country imports, and direct-to-consumer brands. Online marketplaces like Amazon, Zalando, eBay, Vinted, and Shopify now act as legal gatekeepers — if you cannot provide a verified compliance dossier for every SKU, your listings get pulled.

Here is the step-by-step checklist we use internally when onboarding sellers onto our platform.

In June 2026, German and French market surveillance authorities jointly flagged over 2,000 ASINs for missing Responsible Person data, and Amazon has begun sending final-notice compliance emails with 14-day deadlines before permanent ASIN removal. The message is clear: GPSR enforcement is no longer advisory.

Avoiding Greenwashing for SMEs

For modern small businesses, being sustainable is a massive competitive advantage. You've worked hard to source organic cotton, use recycled packaging, or implement an ISO 14001 environmental management system. But when it comes time to put "Eco-Friendly" on your label, you freeze.

The fear of greenwashing—making false, misleading, or unsubstantiated environmental claims—is paralyzing well-meaning brands. And regulators are watching closely.

The Trickle-Down Effect: CSRD & CS3D Impact on SMEs

You are a mid-sized manufacturer, and you’ve just been handed a 50-page ESG questionnaire from your biggest enterprise client. They need your carbon footprint, human rights due diligence policies, and raw material sourcing data by the end of the week.

Wait—aren't small and medium enterprises (SMEs) exempt from the EU's Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CS3D)?

Legally, yes. Practically, no. Welcome to the trickle-down effect.

Demystifying Compliance: Regulations & Frameworks

Navigating the world of corporate compliance often feels like drowning in alphabet soup. Between the EU, international bodies, and national governments, businesses are bombarded with mandates, standards, and guidelines. But what actually is the difference between a Regulation and a Directive? And when does a voluntary standard become legally binding?

To make sense of this, we can look to the highly structured legal framework used in the Netherlands (Verordening, Richtlijn, Norm, Standaard, Raamwerk). This Dutch blueprint is one of the clearest ways to understand the global and European compliance hierarchy.

In this guide, we will decode these terms, explain why they matter, and show you exactly how they impact your business using real-world examples from the Sustalium compliance library.