The Australian Government has introduced mandatory security requirements under the Cyber Security Act 2024 and the Cyber Security (Security Standards for Smart Devices) Rules 2025. These standards ensure that internet connected devices are secure by design, protecting consumers from common cyber threats.

When do these changes come into effect?
The new standards apply to all in-scope products manufactured on and from 4 March 2026.

What products are covered?
The rules apply to "relevant connectable products." These are smart devices that connect to the internet either directly or indirectly (such as via a Bluetooth phone app). This includes products intended for personal, domestic, or household use, or those that could reasonably be expected to be acquired for such use.

What products are excluded?
Specific categories are exempt because they are managed under other regulations. These include:

• Desktop computers, laptops, smartphones, and tablet computers.
• Therapeutic goods as defined by the Therapeutic Goods Act 1989.
• Road vehicles and road vehicle components under the Road Vehicle Standards Act 2018.

Note: Aftermarket vehicle systems, such as audio and navigation units, are not considered road vehicle components and must comply with these new standards.

What are the four key requirements?

1. Provided passwords must be unique per product or defined by the user. This applies to the device hardware and any pre-installed software required for its intended use. This requirement ensures that a single leaked password cannot be used to compromise thousands of different devices. Note: this requirement only applies to products that use a password for the smart device’s hardware or pre-installed software and where software is required to be installed for the product’s intended usage
2. Manufacturers must publish a clear way for people to report security vulnerabilities. This reporting process must be available in English, free of charge, and accessible without requiring personal information from the reporter (email address only). Manufacturers must also provide status updates on the resolution of any reported issues.
3. Manufacturers must be transparent about how long a device will receive security updates. This information must be clear and accessible to consumers before they buy the product. The security standards require the defined support period to be a period of time with an end date, rather than an end to a period of time. Examples of fixed end dates are "no earlier than 30 June 2027" or "ending on 30 June 2029".
4. Every in-scope product must be accompanied by a formal Statement of Compliance (SoC). This document must be provided with the supply of the product and can also be published on the manufacturer's website. Both manufacturers and suppliers are required to retain a copy of this statement for five years. The Statement of Compliance must accompany the product. This can be achieved by including a physical copy in the box or by providing a prominent QR code or URL on the packaging or in the user manual that links directly to the digital statement.

 
What must be included in the Statement of Compliance?
At minimum, the statement must include:

• The product type and batch identifier.
• The name and address of the manufacturer.
• The name and address of an authorised representative of the manufacturer, including any representatives located in Australia.
• A declaration that the statement was prepared by or for the manufacturer.
• A declaration that, in the manufacturer's opinion, the product complies with the security standards.
• The defined support period for the product at the date the statement is issued.
• The signature, name, and function of the signatory.
• The place and date of issue.
  

An example statement of compliance template is available on the Department of Home Affairs website.
 
Disclaimer: This information is a general summary for informational purposes only. For definitive requirements, the official regulatory documents, including the Cyber Security Act 2024 and associated Rules, should always be referred to.

What is it?

The U.S. Consumer Product Safety Commission (CPSC) now requires electronic filing (eFiling) of safety certificate data. Instead of just keeping a PDF on file, importers (or manufacturers on their behalf) must now submit digital proof that their products meet U.S. safety standards at the exact moment the goods enter the country.

Who is the "Importer"?

For these rules, the Importer of Record (usually the U.S. company buying the goods) is the responsible party. They must create the CPSC Business Account. While a Customs Broker is often hired by the importer to handle the digital paperwork at the border, the legal burden of providing accurate safety data and maintaining the original test records falls on the importer.

Do manufacturers need to do anything?
Manufacturers cannot create their own independent "Global ID." Instead, you work as a Collaborator within your customers' (importers) accounts.

• You can use one email address to manage data across multiple importer accounts.
  
• To avoid manual entry, manufacturers should maintain a Master CSV file. You can upload this file into each importer's account to generate their specific Reference IDs instantly.
  
• Request that importers use the "Trade Party Privacy" setting so your data is only visible to that specific customer.
  

What products are impacted?
Any products that require a General Certificate of Conformity (GCC) or a Children’s Product Certificate (CPC) must be eFiled. This includes, but is not limited to:

• Apparel: Children's sleepwear and most "general wear" clothing.
• Children's Goods: Toys, strollers, high chairs, and juvenile furniture.
• Home & Safety: Mattresses, bicycle helmets, lighters, and paint/surface coatings.
• Furniture: Clothing storage units (due to tip-over standards).
• Products containing coin cell or button batteries

Low-Value Shipments: A major change is that low-value shipments (those valued under $800) are no longer exempt from safety paperwork. If your product is regulated, it must be eFiled, even if it is a single small package or a "de minimis" shipment that previously entered the country with no documentation.

Special Mention: Reese’s Law (Battery Products)If you sell products containing button cell or coin batteries, they are now subject to strict safety standards (16 CFR § 1263). Because these products require a GCC or CPC, they fall directly under this new eFiling mandate. Impacted battery products include:

• Electronics: Remote controls, key fobs, and digital watches.
• Household Items: Kitchen scales, thermometers, and lighted decorations.
• Children's Products: Any battery-operated toy (requires a CPC).
• Wearables: Fitness trackers and small medical devices.

What is the deadline?

July 8, 2026: Mandatory eFiling begins for all standard imports. After this date, shipments missing this digital data will likely be flagged, delayed, or seized at the port.

How should Manufacturers Prepare?

1. Identify Regulated Goods: Audit your inventory for anything containing button/coin batteries or subject to CoC/CPC requirements.
2. Use the Product Registry: Upload your certificate data to the CPSC Product Registry in advance. This creates a "Master File" for your products (https://www.cpsc.gov/eFiling-CPSC-Product-Registry)
3. Provide the Reference ID: Include this ID number clearly on your Commercial Invoice and Packing List. This allows the importer’s Customs Broker to clear your goods instantly without needing to manually re-type your test data into the U.S. system.
4. Talk to Your Freight Forwarder: Ensure they know the Reference ID is a critical piece of shipping documentation, just like a tracking number.

If you need help identifying which of your products fall under this requirement or Reese's Law, or need a strategy for the Product Registry, Email me.

What is the New Construction Products Regulation (CPR)?
The Construction Products Regulation (CPR) sets harmonised rules for placing construction products on the EU Market. The new CPR (Regulation (EU) 2024/3110) modernises the existing framework (Regulation (EU) No 305/2011) by placing a strong emphasis on sustainability, digitalisation, and market surveillance, making it a key element of the EU's Green Deal.

What is Classified as a Construction Product?

"Any formed or formless physical item, including -printed products, or a kit that is produced and placed on the market... for incorporation in a permanent manner in construction works or parts thereof, and the performance of which has an effect on the performance of the construction works with respect to the basic requirements for construction works."

Construction Works includes both buildings (like houses, offices, and factories) and civil engineering works (like bridges, roads, and dams).

Excluded are:

• Individually Manufactured or Custom-Made Products
• Heritage Products

Who Does It Affect?

The regulation affects all economic operators in the construction product supply chain, including:

• Manufacturers: Primarily responsible for the product's compliance.
• Importers and Distributors: Must ensure products bear the CE marking and are accompanied by the required documentation.
• Fulfilment Service Providers and Online Marketplace Operators: Now subject to specific obligations for the first time.

Compliance is essential for continued, or new, market access in the EU for any product considered a construction product and covered by a harmonised technical specification (harmonised standards or European Technical Assessments).

Note that micro-enterprises (having fewer than 10 employees and an annual turnover or balance sheet total of less than EUR2 million) benefit from simplified procedures for the product assessment process.
 
What are the Key Changes and Requirements?

The new CPR introduces fundamental shifts in product information, environmental reporting, and market access:

1. Environmental Sustainability
The CPR significantly expands beyond traditional safety and technical performance to include new essential requirements related to environmental sustainability.

• Mandatory Environmental Reporting: Manufacturers will be required to declare and report on the environmental performance of their products, initially focusing on climate change impacts (e.g., CO2​ emissions and energy consumption) over the product's lifecycle.
• Expanded Scope of the Declaration of Performance (DoP): The DoP must now incorporate this environmental data, aligning with standards like EN 15804 (which defines rules for Environmental Product Declarations - EPDs).
• Future Requirements: The Commission is empowered to define additional product requirements on durability, repairability, and recyclability through delegated acts for specific product families.

2. Digital Product Passport (DPP)
One of the most significant changes is the introduction of the Digital Product Passport (DPP).

• The DPP is an electronic record that will store and provide access to all the product-specific information required by the CPR (including the Declaration of Performance and environmental data).
• The information will be accessible via a data carrier (like a QR code or RFID tag) affixed to the product or its packaging alongside the CE marking.
• It aims to enhance transparency, improve traceability throughout the value chain (from production to end-of-life), and facilitate market surveillance.

3. CE Marking
The CE marking remains the product's "passport" for the EU market, but its meaning is expanded. The CE marking now indicates conformity with both technical performance and environmental sustainability requirements as outlined in the new CPR.

What is the Timeline for Application?

The application of different provisions is phased:

• 8 January 2026  Most of the new regulatory articles become applicable (e.g., new operator obligations).
• Within 18 months of relevant delegated act the Digital Product Passport (DPP) becomes mandatory for the specific product category covered by the act. (Expect first delegated acts to be issued in the coming years).
• Two years after entry into force  penalty provisions for non-compliance will become applicable.
• Ongoing (2025 onwards), harmonised product standards are gradually reviewed and updated. The old and new CPR regulations will coexist until all new standards are in place.

 
What Should You Do Now?

To prepare for compliance and maintain market access, companies should take proactive steps:

• Review your Product Portfolio: Determine which products fall under harmonised technical specifications and assess your current DoP and CE marking compliance.
• Begin Environmental Data Collection: Start calculating and collecting the necessary life-cycle environmental data, especially CO2​ emissions and energy consumption, aligned with EN 15804. This data is the foundation for the new environmental DoP and the DPP.
• Plan for Digital Product Passport: Begin planning the required data infrastructure and carrier solution (e.g., QR codes, data management systems) to store and provide access to the DPP information seamlessly.
• Ensure your compliance, product development, sustainability, and legal teams are aligned and trained on the new requirements and their staggered application.

Share this article with your cross-functional teams to align on a strategy for CPR compliance. Next further help? Contact me.

Who Does It Affect?
The Directive affects a wider range of economic operators than the previous rules, with the core aim of ensuring there is always an EU-based entity that can be held liable.
Liable parties now explicitly include:

• Manufacturers (or "quasi-manufacturers" who brand a product).
• Developers or Producers of Software and AI systems.
• Importers placing a product onto the EU market.
• Authorised Representatives of non-EU manufacturers.
• Fulfilment Service Providers (under subsidiary liability, if no importer or authorised representative exists).
• Online Platforms (in specific circumstances where the platform appears to be the provider).
• Any entity that substantially modifies a product (e.g., through remanufacturing) and places it on the market.

What Counts as a 'Product' and What is 'Defective'?
The scope of what constitutes a 'product' has been significantly broadened.

• Product Definition: Now also explicitly covers software (including operating systems, firmware, applications, and AI systems), digital manufacturing files (e.g., for 3D printing), raw materials, components, and electricity. It also covers related services (integrated digital services necessary for a product to function, like a health monitoring service for a wearable device).
• Defectiveness: A product is defective if it does not provide the safety a person is entitled to expect. Courts must now specifically consider:
  • Cybersecurity requirements and other mandatory safety laws.
  • The effect of the product's ability to learn (e.g., an AI system acquiring new, unforeseen features).
  • The time the manufacturer retains control over the product (e.g., via software updates), extending liability beyond the point of initial sale.

 
When Does It Take Effect?
The new Directive entered into force in December 2024. However, Member States have a period to integrate it into their national laws. The new rules will apply to products placed on the market from 9 December 2026 onwards. Products placed on the market before this date remain subject to the old 1985 Directive.
 
What are the Key Changes that Relate to Injured Parties?
The Directive introduces major changes to lower the burden of proof for claimants, particularly in complex digital or scientific cases.

Damage
Previous Regime (1985 Directive): Physical injury, death, and property damage (subject to a EUR500 threshold).
New PLD (2024/2853): Includes medically recognised psychological damage and the destruction or corruption of data (non-professional use). The EUR500 minimum threshold for property damage is removed.

Burden of Proof
Previous Regime (1985 Directive): Claimant must prove the defect, the damage, and the causal link between them.
New PLD (2024/2853): The new law makes it easier for a person to prove their case in court, even without perfect evidence. The court will now assume the product was defective, or that the defect caused the injury, if:

• The case is so complex (like with advanced AI or tech products) that it's extremely hard for the injured person to find proof.
• The company that made the product refuses to hand over important evidence that the court asked for.

Evidence Disclosure
Previous Regime (1985 Directive): No explicit harmonised right to disclosure.
New PLD (2024/2853): Courts can order the disclosure of relevant evidence from the defendant to the claimant, provided the claim is plausible and the request is necessary and proportionate.

Limitation Period
Previous Regime (1985 Directive): 10 years "long-stop" from when the product was placed on the market.
New PLD (2024/2853): Extends the "long-stop" to 25 years in cases of latent personal injury where the injury only becomes apparent after the standard 10-year period has expired.

What Does It Mean for My Product Business?
This change significantly increases the risk and liability for companies that place products on the EU market, especially those involving software, AI, or advanced technology.

1. Your Burden of Proof is Higher: In a complex case, an injured person no longer has to do all the heavy lifting to prove the defect. The court can assume your product was defective, and you must then provide clear, strong evidence to disprove that assumption.
2. Software is Now a "Product": The new rules explicitly cover standalone software, AI systems, and digital manufacturing files. This means software developers and AI providers now face the same strict liability as makers of physical goods.
3. New Reasons for a Defect: A product can now be considered defective if you fail to provide necessary security updates, if it has a weak cybersecurity defence, or if an AI system's self-learning behaviour leads to harm.
4. Evidence is Crucial: If a court thinks you have relevant internal documents or data, they can order you to disclose that evidence. Refusing to hand it over can lead directly to the court assuming the product was defective.

What Should I Be Doing in Light of These Changes?
You need to shift from a reactive to a proactive approach in how you design, document, and defend your products.

• Product Design

Integrate safety and cybersecurity by design from the very start. Ensure continuous monitoring for your digital products and have a clear, well-tested plan for issuing security updates and patches over the product's entire life cycle.

• Documentation

Establish meticulous, detailed record-keeping for the entire product lifecycle: design choices, risk assessments, testing protocols, software updates, and vulnerability management. You need a clear paper trail to rebut any presumption of defectiveness in court.

• Supply Chain

Review all contracts with suppliers, component manufacturers, and software developers (including cloud service providers). Clearly define who is responsible for software updates, cybersecurity, and providing documentation in the event of a claim.

• Legal Preparedness

Review your document retention policies to ensure you can quickly find and produce relevant evidence if ordered by a court, while still protecting trade secrets. Also, review your insurance coverage to ensure it addresses the expanded scope of liability, including software, AI, and the longer liability period in some cases.

• Compliance
  

Ensure you are compliant with other related EU laws, particularly the AI Act and the Cyber Resilience Act (CRA), as well as the relevant cybersecurity and data protection standards under the Radio Equipment Directive (RED) and the GDPR, as non-compliance with these safety, security, and privacy requirements can be used to argue that your product is defective.

If you need some help to strengthen your Risk Management Strategy and put practical improvements in place, Email me.

EU 2023/1115  
 
What is the EUDR?         
The European Union Deforestation Regulation is a mandatory law designed to ensure that specific products placed on, made available on, or exported from the EU market are not contributing to global deforestation or forest degradation.

Who does it affect?
For developers, manufacturers and importers whose products use 'in-scope' commodities, preparing your supply chain and documentation is essential for continued market access.

What Products and Commodities are in Scope?
The regulation applies to seven key commodities and a wide range of derivative products made from them (listed under specific CN/HS codes in Annex I).
Commodities include: Cattle, Cocoa, Coffee, Oil Palm, Rubber, Soy, and Wood.
Examples of Derived Products include: Beef, leather, chocolate, furniture, certain printed paper products such as books and magazines, palm oil derivatives used in various consumer goods, and rubber-based products like tyres and gloves.

Are the packaging and the user instructions of my product included?
Packaging used exclusively to protect or carry another product is generally not covered by the EUDR. This includes things like: The cardboard box a consumer product is shipped in. Wooden pallets or crates used for transport, as long as they are not the product being sold. Packaging in a closed-loop system (e.g., reusable pallets). User manuals, assembly instructions, or warranty cards that simply accompany the main product shipment are typically not covered by the EUDR, as they are not the primary product being placed on the market.

When Does It Take Effect?
The regulation entered into force in June 2023, but the main compliance deadlines for mandatory due diligence are phased:

• Large and Medium Enterprises: 30 December 2025
• Small and Micro Enterprises: 30 June 2026

Note that the enterprise size relates to the operator or importer (if that differs from the manufacturer).
These above dates are currently under review and it is possible that they will be moved out by 1 year. Check the European Commission's official pages for the definitive final application dates
For an enterprise to be considered small it must satisfy 2 of these 3 requirements:

• Staff Headcount <50
• Annual Global Turnover ≤€10 million
• Annual Global Balance Sheet Total ≤€10 million

What are the Key Compliance Requirements?
Check if any component or material in your product is derived from one of these seven commodities.

To be compliant, your product must meet three strict conditions, which you must prove through a rigorous Due Diligence System:

Deforestation-Free: The product must have been produced on land that was not deforested or subject to forest degradation after 31 December 2020.

Legal Production: The product must have been produced in accordance with all relevant laws of the country of production (including land use rights, labour laws, environmental protection, etc.).

Covered by a Due Diligence Statement (DDS): A formal declaration must be submitted to the EU's Information System (TRACES NT) before the product can be placed on the EU market or exported from it. Note that this submission is waived for small or micro-operator processing a product already covered by DDS. They only need to collect the reference number of the already-submitted DDS from their supplier.

What is the Mandatory Due Diligence System?
Operators (the company first placing the product on the EU market or exporting it) must establish and implement a formal three-step Due Diligence System.

Step 1. Information Collection
Collect, verify, and store information for at least five years, including: Product description (including HS/CN code). Quantity (net mass/volume). Country of production. Geolocation coordinates (latitude and longitude) of the plots of land where the commodity was produced or harvested. Date or time range of production/harvest. Supplier and recipient details. Evidence of legal production.

Step 2. Risk Assessment
Use the collected information to assess the risk of non-compliance (deforestation or illegality). Factors to consider include:

• Country-level risk (to be benchmarked by the EU Commission).
• Supply chain complexity.
• Proximity of the land to protected areas.
• Substantiated concerns about supplier compliance.

Step 3. Risk Mitigation
If the risk is assessed as not negligible, you must take action to reduce it to a negligible level. This may involve:

• Implementing on-site audits or field inspections.
• Switching to more compliant suppliers.
• Using satellite monitoring for verification.
• Contractual clauses with suppliers.

 
The EUDR also introduces a crucial country benchmarking system that classifies countries, or parts thereof, into three risk categories, low, standard, and high, based on their association with deforestation and forest degradation linked to seven key commodities. For countries classified as low risk, operators can implement a simplified due diligence procedure, exempting them from the full risk assessment and mitigation steps, though they must still collect all essential information like geolocation data and submit a Due Diligence Statement.

Share this article with your procurement, sustainability, and legal teams to align on a cross-functional strategy for EUDR compliance. Contact me for further information.

How does it work?
National market surveillance authorities (the relevant authority in each EU market + Iceland, Norway and Liechtenstein) monitor products to check they meet EU requirements. If a national authority detects a dangerous product on the market, it may ban or restrict its sale, stop it at the border or order for it to be recalled. When one national authority takes such a measure, it has to inform all the other countries in the EU, which happens through Safety Gate. The Safety Gate rapid alert enables swift and effective action to be taken across the EU when a dangerous or potentially dangerous product is found.

What products are covered?
Safety Gate alerts cover consumer products and products for professional use but excludes pharmaceuticals, medical devices, food or animal feed (which have their own alert systems).

What types of risks are commonly covered?
Threats to human health and safety, such as choking, strangulation and damage to hearing or sight, electric shock and burns, or various hazards caused by chemicals. Products that pose a security risk or risks to the environment and/or animals are also included.

How are dangerous products found?
National authorities carry out inspections and test products on the market under their national market surveillance programmes. They also act on any complaints or information they receive. Additionally, where manufacturers, retailers, importers or other businesses become aware they have inadvertently placed products on the market that may pose a danger, they must report this to the authorities.

How are incidents reported?
A web portal called Safety Business Gateway is available for this purpose and its use is mandatory.

Who uses the Safety Gate system?
National authorities from 30 countries (EU Member States, plus Iceland, Liechtenstein and Norway) enter information into Safety Gate in the form of alerts on a daily basis. Businesses can enter information directly into the Safety Business Gateway if they are aware they have an unsafe product. The Safety Gate Portal can be used by anyone to find information on unsafe products and the Consumer Safety Gateway can be used by consumers to report unsafe products.

What information is recorded?
The alerts contain information about the product, the risks it poses, and the measures taken to stop or restrict its sale. The measures can be imposed by the authorities (compulsory measures) or taken directly by the economic operators (voluntary measures).

How is each country notified?
National authorities are responsible for monitoring the alerts in the system and checking whether the product identified as dangerous is also for sale in their own country. They are required to report on the results of their checks with a follow-up notification on the Safety Gate. The notifications report any additional measures taken and any additional information available e.g. on distribution channels and affected batches. The public website is updated to show in which countries the product has been found and additional measures taken.

What about online market places?
Online marketplaces that have signed the Product Safety Pledge also check the Safety Gate to make sure they are not selling dangerous products online. The Pledge also commits them to remove such products from their listings within 2 days when requested by a national authority. In those cases, that measure is also inputted on Safety Gate in the form of a follow-up notification

What did the 2024 Safety Gate report show?
In 2024, Safety Gate featured the highest number of alerts (4,137) since the system was created (double the number in 2022). Cosmetics remained the product category with most alerts due to increased surveillance, followed by toys and electrical appliances which had similar numbers to previous years.

What were the most prevalent risks identified in 2024?
Chemical risks remained high in 2024 and were followed by injuries and environment related hazards.

Why should I monitor Safety Gate as a product supplier in or to the EU or elsewhere?
Reviewing product recalls of products similar to yours or of risks that have the potential to be found in your products under certain situations, can be helpful input to your product risk assessments and continuous improvement programs. Market expectations can change overtime and what might be considered acceptable at one point in time can change as new information comes to light. Reviewing product recall information will help you to spot trends and pre-empt potential legislation or standards changes that are likely to occur overtime as they are updated to address newly identified risks.

Don’t have time to monitor Safety Gate or similar databases used in other markets? Contact me about receiving a customised monthly report summarising key information pertinent to your business and product range.
www.rbdevelopment.co.nz, fiona@rbdevelopment.co.nz

(EU) 2024/1689

What is the purpose of this new AI regulation?
To set clear, consistent rules for how AI systems are developed, used, and sold in the EU. The goal is to encourage human-centred, trustworthy AI while protecting people’s health, safety, rights, democracy, and the environment—and supporting innovation.

Who does this regulation apply to?
It applies to anyone who develops, sells, or uses AI systems or general-purpose AI models in the EU market.

What counts as an AI system?
An AI system is any machine-based system that uses data to make predictions, create content, give recommendations, or make decisions—on its own or with limited human input—and can adapt.

What types of AI are banned under this regulation?
The following AI uses are not allowed in the EU:

• Manipulative AI: AI that uses hidden or deceptive techniques to influence decisions in harmful ways.
• Exploiting vulnerabilities: AI that takes advantage of a person’s age, disability, or social/economic status to influence decisions in harmful ways.
• Social scoring: AI that ranks people based on behaviour or traits, leading to unfair treatment.
• Predicting crime: AI that judges whether someone might commit a crime based only on profiling or personality traits (except when supporting decisions based on verified facts).
• Mass facial recognition: AI that builds facial recognition databases by scraping the internet or CCTV footage.
• Emotion detection at work or school: AI that reads emotions in workplaces or education settings, unless it’s for medical or safety reasons.
• Biometric categorisation: AI that categorises people using sensitive data (like race or beliefs), unless it’s part of a lawful, specific dataset for law enforcement.
• Real-time biometric ID in public spaces by law enforcement, unless strictly necessary for things like searching for a missing child or preventing a terrorist threat.

What is a high-risk AI system (subject to restrictions)?
High-risk AI systems are:
Systems built into products that are regulated in the EU, as a safety component and are required to undergo a 3rd party conformity assessment or are themselves regulated products that are required to undergo a 3rd party conformity assessment.

What kinds of AI are likely to be considered high-risk (subject to restrictions or other requirements)?
These AI systems could be high-risk if they can significantly harm people or unfairly influence decisions:

• Biometric tech: Systems for identifying people remotely or categorising them based on sensitive traits.
• Emotion recognition: AI that detects emotions in people.
• Critical infrastructure: AI used to manage roads, electricity, water, gas, or digital systems.
• Education: AI used for admissions, evaluating students, guiding learning, or monitoring test conduct.
• Employment: AI used for hiring, promotions, firing, monitoring workers, or assigning tasks.
• Essential services: AI that decides access to public services like healthcare or financial support.
• Credit and insurance: AI used to assess credit scores or determine life/health insurance risk.
• Emergency response: AI used to assess emergency calls, triage patients, or dispatch services.
• Law enforcement: AI used to assess crime risk, detect lies, evaluate evidence, or create profiles.
• Migration and border control: AI used to assess risks, review visa/asylum applications, or identify people crossing borders.
• Justice system: AI used by judges to apply laws, assess evidence, or help resolve disputes.
• Elections: AI used to influence voting decisions or election outcomes.

 
What do I need to do if I consider an AI system (that may be high-risk) to be not high-risk?
You’ll need to document your assessment before placing the system on the market or putting it into service. You'll also be subject to a registration obligation.
 
What are the requirements for a high-risk AI system?

1. A risk management system
2. Data governance and management practices
3. Technical documentation
4. Specific record-keeping
5. Transparency and provision of information to users
6. Human oversight
7. Accuracy, robustness, and cybersecurity throughout the system’s lifecycle

 
What else does a provider need to do?

• Indicate their trade name and address on the product, packaging, or accompanying documentation
• Have a quality management system in place
• Keep logs
• Undergo a conformity assessment procedure
• Draw up an EU declaration of conformity
• Affix the CE mark
• Register the product and authorised representative
• Appoint an authorised representative in the EU (if not established there already)

 
When do these rules apply?
The regulation’s main obligations apply from 2 August 2026.
However, prohibited AI practices must cease from 2 February 2025.

(EU) 2019/1021
What are POPs?
POPs (Persistent organic pollutants), are substances that persist in the environment and accumulate in living organisms, posing a risk to our health.

How are they regulated?
POPs are regulated globally by the Stockholm Convention and the Aarhus Protocol. These treaties are implemented in the EU by the POPs Regulation.

What does the regulation do?
The Regulation prohibits or severely restricts the production, the placing on the market and use of POPs. The use of around 30 different substances and their derivatives or salts are prohibited.

Could there be POPs in my products?
This is a list of some of the most commonly found POPs and in what products they can often be found:

Polychlorinated Biphenyls (PCBs)
Older transformers, capacitors, industrial oils, hydraulic fluids, some paints, sealants, adhesives

Polybrominated Diphenyl Ethers (PBDEs) (DecaBDE, PentaBDE, OctaBDE)
Electronics (circuit boards, casings), upholstered furniture, mattresses, car seats, textiles, children’s toys

Hexabromocyclododecane (HBCDD)
Insulation foams, building materials, upholstered furniture, textiles, automotive parts

Short-Chain Chlorinated Paraffins (SCCPs)
PVC cables, wiring insulation, electronic casings, lubricants, adhesives, industrial metalworking fluids

Perfluorooctane Sulfonic Acid (PFOS) & Perfluorooctanoic Acid (PFOA)
Stain-resistant and waterproof textiles, non-stick cookware, food packaging (fast-food wrappers, popcorn bags), firefighting foams, coatings

Per- and polyfluoroalkyl substances (PFAS, broader group)
Cosmetics (waterproof mascaras, eyeliners), automotive coatings, food packaging, firefighting foams

Pentachlorophenol (PCP)
Wood preservatives, treated lumber, agricultural pesticides (historically used)

Lindane, Chlordane, DDT, Mirex (Legacy Pesticides)
Insecticides, termite treatments, soil and grain treatments (historical use, some legacy contamination)

How is this regulation being enforced?
In recent months there have been a spate of product recalls across Europe related to POPs. The most common of these has been from the use of SCCPs (short-chain chlorinated paraffins) in everything from electronic cables such as USB cables, toys and children’s products, stationery and sports equipment and games.

What other countries have regulations around POPs?
Most other countries have regulations that include bans or restrictions on POPs.

What should I be doing?
Make sure your supply chain is aware of these bans, and for any soft plastics you have on your products, ensure you or your supplier has tested them for SCCPs.

If you are yet to put together a robust strategy for managing materials compliance within your business, I can help.

This regulation (EU 2025/40) aims to minimize packaging waste, improve recycling rates, and reduce environmental impact. Non-compliant packaging could result in restricted market access or penalties—so taking action now is crucial.

What Does This Regulation Apply To?

The new rules apply to all packaging and packaging waste of products placed on the European market, including product packaging, some shipping materials, and retail packaging. Note that reusable packaging is not classified as waste. Waste refers to packaging that is not reusable.

When Does It Take Effect?
The regulation officially applies from 12 August 2026, but compliance deadlines vary depending on specific requirements.

What are the Key Compliance Requirements?

1. Material Restrictions

• The combined concentration of lead, cadmium, mercury, and hexavalent chromium in packaging must not exceed 100 mg/kg.
• Food-contact packaging cannot contain per- and polyfluorinated alkyl substances (PFAS) above specified limits.
• Plastic packaging must contain a minimum amount of recycled material (ranging from 10–35%, depending on the product) from 1 January 2030. These percentages will increase by 2040. (Exemptions apply to food-contact materials and plastic components under 5% of the total packaging weight.)

2. Labeling & Information Requirements

• Packaging must include a type, batch, or serial number for identification.
• Manufacturers must display their name, registered trade name, trademark, and contact details (postal address + electronic contact method, if available).
• From 12 August 2028, packaging must include a label specifying its material composition to aid recycling.

3. Packaging Design Rules

• By 1 January 2030, packaging must be optimized for minimal weight and volume, ensuring functionality while limiting empty space to 50% max.

4. Recyclability Requirements

• From 1 January 2030, all packaging must be recyclable (if not reusable) with a minimum 70% recycling performance grade.
• This percentage will increase in 2035 and 2038.

5. Reusability of Packaging

• From 12 February 2029, reusable packaging must include a label informing consumers of its reusability, with additional details accessible via a QR code or similar method.

6. Compostability Rules

• From 12 February 2028, certain items—such as fruit & vegetable stickers and tea/beverage bags—must be compostable.

7. Documentation Requirements

• Manufacturers must prepare an EU Declaration of Conformity and technical documentation for their packaging.

What Should You Do Next?
As a product developer selling in the EU, your packaging may require redesign to comply with these regulations. Don’t wait until the last minute, start planning now!

Need expert guidance? Contact us today to schedule a consultation and ensure your packaging is fully compliant.