(EU) 2024/1689

What is the purpose of this new AI regulation?
To set clear, consistent rules for how AI systems are developed, used, and sold in the EU. The goal is to encourage human-centred, trustworthy AI while protecting people’s health, safety, rights, democracy, and the environment—and supporting innovation.

Who does this regulation apply to?
It applies to anyone who develops, sells, or uses AI systems or general-purpose AI models in the EU market.

What counts as an AI system?
An AI system is any machine-based system that uses data to make predictions, create content, give recommendations, or make decisions—on its own or with limited human input—and can adapt.

What types of AI are banned under this regulation?
The following AI uses are not allowed in the EU:

• Manipulative AI: AI that uses hidden or deceptive techniques to influence decisions in harmful ways.
• Exploiting vulnerabilities: AI that takes advantage of a person’s age, disability, or social/economic status to influence decisions in harmful ways.
• Social scoring: AI that ranks people based on behaviour or traits, leading to unfair treatment.
• Predicting crime: AI that judges whether someone might commit a crime based only on profiling or personality traits (except when supporting decisions based on verified facts).
• Mass facial recognition: AI that builds facial recognition databases by scraping the internet or CCTV footage.
• Emotion detection at work or school: AI that reads emotions in workplaces or education settings, unless it’s for medical or safety reasons.
• Biometric categorisation: AI that categorises people using sensitive data (like race or beliefs), unless it’s part of a lawful, specific dataset for law enforcement.
• Real-time biometric ID in public spaces by law enforcement, unless strictly necessary for things like searching for a missing child or preventing a terrorist threat.

What is a high-risk AI system (subject to restrictions)?
High-risk AI systems are:
Systems built into products that are regulated in the EU, as a safety component and are required to undergo a 3rd party conformity assessment or are themselves regulated products that are required to undergo a 3rd party conformity assessment.

What kinds of AI are likely to be considered high-risk (subject to restrictions or other requirements)?
These AI systems could be high-risk if they can significantly harm people or unfairly influence decisions:

• Biometric tech: Systems for identifying people remotely or categorising them based on sensitive traits.
• Emotion recognition: AI that detects emotions in people.
• Critical infrastructure: AI used to manage roads, electricity, water, gas, or digital systems.
• Education: AI used for admissions, evaluating students, guiding learning, or monitoring test conduct.
• Employment: AI used for hiring, promotions, firing, monitoring workers, or assigning tasks.
• Essential services: AI that decides access to public services like healthcare or financial support.
• Credit and insurance: AI used to assess credit scores or determine life/health insurance risk.
• Emergency response: AI used to assess emergency calls, triage patients, or dispatch services.
• Law enforcement: AI used to assess crime risk, detect lies, evaluate evidence, or create profiles.
• Migration and border control: AI used to assess risks, review visa/asylum applications, or identify people crossing borders.
• Justice system: AI used by judges to apply laws, assess evidence, or help resolve disputes.
• Elections: AI used to influence voting decisions or election outcomes.

 
What do I need to do if I consider an AI system (that may be high-risk) to be not high-risk?
You’ll need to document your assessment before placing the system on the market or putting it into service. You'll also be subject to a registration obligation.
 
What are the requirements for a high-risk AI system?

1. A risk management system
2. Data governance and management practices
3. Technical documentation
4. Specific record-keeping
5. Transparency and provision of information to users
6. Human oversight
7. Accuracy, robustness, and cybersecurity throughout the system’s lifecycle

 
What else does a provider need to do?

• Indicate their trade name and address on the product, packaging, or accompanying documentation
• Have a quality management system in place
• Keep logs
• Undergo a conformity assessment procedure
• Draw up an EU declaration of conformity
• Affix the CE mark
• Register the product and authorised representative
• Appoint an authorised representative in the EU (if not established there already)

 
When do these rules apply?
The regulation’s main obligations apply from 2 August 2026.
However, prohibited AI practices must cease from 2 February 2025.

(EU) 2019/1021
What are POPs?
POPs (Persistent organic pollutants), are substances that persist in the environment and accumulate in living organisms, posing a risk to our health.

How are they regulated?
POPs are regulated globally by the Stockholm Convention and the Aarhus Protocol. These treaties are implemented in the EU by the POPs Regulation.

What does the regulation do?
The Regulation prohibits or severely restricts the production, the placing on the market and use of POPs. The use of around 30 different substances and their derivatives or salts are prohibited.

Could there be POPs in my products?
This is a list of some of the most commonly found POPs and in what products they can often be found:

Polychlorinated Biphenyls (PCBs)
Older transformers, capacitors, industrial oils, hydraulic fluids, some paints, sealants, adhesives

Polybrominated Diphenyl Ethers (PBDEs) (DecaBDE, PentaBDE, OctaBDE)
Electronics (circuit boards, casings), upholstered furniture, mattresses, car seats, textiles, children’s toys

Hexabromocyclododecane (HBCDD)
Insulation foams, building materials, upholstered furniture, textiles, automotive parts

Short-Chain Chlorinated Paraffins (SCCPs)
PVC cables, wiring insulation, electronic casings, lubricants, adhesives, industrial metalworking fluids

Perfluorooctane Sulfonic Acid (PFOS) & Perfluorooctanoic Acid (PFOA)
Stain-resistant and waterproof textiles, non-stick cookware, food packaging (fast-food wrappers, popcorn bags), firefighting foams, coatings

Per- and polyfluoroalkyl substances (PFAS, broader group)
Cosmetics (waterproof mascaras, eyeliners), automotive coatings, food packaging, firefighting foams

Pentachlorophenol (PCP)
Wood preservatives, treated lumber, agricultural pesticides (historically used)

Lindane, Chlordane, DDT, Mirex (Legacy Pesticides)
Insecticides, termite treatments, soil and grain treatments (historical use, some legacy contamination)

How is this regulation being enforced?
In recent months there have been a spate of product recalls across Europe related to POPs. The most common of these has been from the use of SCCPs (short-chain chlorinated paraffins) in everything from electronic cables such as USB cables, toys and children’s products, stationery and sports equipment and games.

What other countries have regulations around POPs?
Most other countries have regulations that include bans or restrictions on POPs.

What should I be doing?
Make sure your supply chain is aware of these bans, and for any soft plastics you have on your products, ensure you or your supplier has tested them for SCCPs.

If you are yet to put together a robust strategy for managing materials compliance within your business, I can help.

This regulation (EU 2025/40) aims to minimize packaging waste, improve recycling rates, and reduce environmental impact. Non-compliant packaging could result in restricted market access or penalties—so taking action now is crucial.

Who Does This Regulation Apply To?

The new rules apply to all packaging and packaging waste of products placed on the European market—including product packaging, some shipping materials, and retail packaging.

• Reusable packaging is not classified as waste.
• Waste refers to packaging that is not reusable.

When Does It Take Effect?
The regulation officially applies from 12 August 2026, but compliance deadlines vary depending on specific requirements.

What are the Key Compliance Requirements?

1. Material Restrictions

• The combined concentration of lead, cadmium, mercury, and hexavalent chromium in packaging must not exceed 100 mg/kg.
• Food-contact packaging cannot contain per- and polyfluorinated alkyl substances (PFAS) above specified limits.
• Plastic packaging must contain a minimum amount of recycled material (ranging from 10–35%, depending on the product) from 1 January 2030. These percentages will increase by 2040. (Exemptions apply to food-contact materials and plastic components under 5% of the total packaging weight.)

2. Labeling & Information Requirements

• Packaging must include a type, batch, or serial number for identification.
• Manufacturers must display their name, registered trade name, trademark, and contact details (postal address + electronic contact method, if available).
• From 12 August 2028, packaging must include a label specifying its material composition to aid recycling.

3. Packaging Design Rules

• By 1 January 2030, packaging must be optimized for minimal weight and volume, ensuring functionality while limiting empty space to 50% max.

4. Recyclability Requirements

• From 1 January 2030, all packaging must be recyclable (if not reusable) with a minimum 70% recycling performance grade.
• This percentage will increase in 2035 and 2038.

5. Reusability of Packaging

• From 12 February 2029, reusable packaging must include a label informing consumers of its reusability, with additional details accessible via a QR code or similar method.

6. Compostability Rules

• From 12 February 2028, certain items—such as fruit & vegetable stickers and tea/beverage bags—must be compostable.

7. Documentation Requirements

• Manufacturers must prepare an EU Declaration of Conformity and technical documentation for their packaging.

What Should You Do Next?
As a product developer selling in the EU, your packaging may require redesign to comply with these regulations. Don’t wait until the last minute—start planning now!

Need expert guidance? Contact us today to schedule a consultation and ensure your packaging is fully compliant.

2011/65/EU
What is RoHS?
RoHS stands for Restriction of Hazardous Substances. It is a European directive that restricts the use of certain hazardous materials in electrical and electronic equipment (EEE).

What is its objective?
The goal of RoHS is to reduce environmental and health risks associated with various substances, particularly during the production, recycling, and disposal processes of electronic devices.

What products need to comply with RoHS?
RoHS applies to almost all electronic and electrical equipment, including household appliances, IT equipment, lighting, toys and medical devices with some specific exclusions. The restrictions therefore also apply to all materials or components that will be used in EEE products.

What does RoHS restrict?
RoHS limits the use of the following hazardous materials in electronic products:

• Lead (Pb)
• Mercury (Hg)
• Cadmium (Cd)
• Hexavalent chromium (Cr⁶⁺)
• Polybrominated biphenyls (PBBs)
• Polybrominated diphenyl ethers (PBDEs)
• Four phthalates (DEHP, BBP, DBP, and DIBP)

What are the concentration limits?
The maximum allowable concentration of these substances in each material is:

• 0.1% (1,000 ppm) for all substances except cadmium.
• 0.01% (100 ppm) for cadmium.

Does it only apply to the EU?
The UK RoHS requirements mirror those of the EU. China and India have similar regulations.

How do I comply?
Key requirements include ensuring each of the materials in your EEE meet the requirements, create your technical documentation, create your EU declaration of conformity and affix a CE mark to your EEE product.

If I supply components or materials for EEE products, what are my obligations?
If your customers are selling their products into countries with RoHS regulations, they will need to ensure all of the materials they use comply. Therefore they will likely ask you for test certificates or declarations before they purchase from you. They could also choose to test your materials themselves. If you are placing your components directly onto the EU market or a market with RoHS requirements, and they are very obviously components for EEE (such as cables) then they need to comply with RoHS although they will not necessarily need a CE mark.

Need help with your RoHS compliance? Make contact and we will arrange a time to talk.

How do I pronounce Phthalate?
Phthalate is pronounced “Fell-late”

What is a phthalate?
Phthalates are a group of man-made chemicals that are structurally related to the organic acid, phthalic acid.

What are phthalates used for?
The most common use of phthalates is in plastics, especially PVC, where they act as plasticisers. A plasticiser is a chemical additive that makes materials softer and more flexible. As an additive they will generally not appear on product or material labels. Another common use is in products that contain fragrances. Phthalates are used as solvents and fixatives to help preserve fragrances and help them to linger.
As well as being found in plastics and vinyl products, and products containing fragrances, they are also found in safety glass, lubricating oils, food packaging, adhesives, paints, inks, medical tubing, blood bags, pharmaceuticals, footwear, electrical cables, stationery, nail polish. Here is a list of some common phthalates and their applications:

What are the risks associated with the use of phthalates?
Exposure to phthalates happens through food, skin, and air. Phthalates are not chemically bound in the materials they are added to, so they can easily leach out or evaporate.

Several phthalates, for example DEHP, DBP, DIBP and BBP may damage fertility or the unborn baby and interfere with our hormonal system (Endocrine Disrupting). In particular, they affect the sexual development of boys which can lead to infertility in adults. Pregnant women and young children have been found to be the most vulnerable groups to the effects of phthalates. DEHP, DBP and BBP, are also harmful to the environment, more specifically are very toxic to aquatic life, and often with long lasting effects.

What bans and restrictions exist around the use of phthalates? (non-exhaustive list of some key regulations):

How do I know if my products contain phthalates?
Talk to your material suppliers and ask for declarations or certification for the relevant regulations. You can also send samples of your products to a test laboratory for testing.

Need help getting your material compliance up to date? Talk to us about we can support you.

In what products are Lithium-Ion batteries commonly used?
Lithium-Ion batteries are rechargable batteries that are generally found in products such smart phones, laptops, scooters and E-bikes.

In what products are Lithium metal batteries commonly used?
Lithium metal batteries use lithium metal as an anode and are commonly used in items such as watches, car key fobs, remote controls and some toys.

What is the risk?
Lithium batteries present a safety risk to aviation because they use a positively charged electrode that contains oxygen and if the battery is exposed to excessive heat or pressure, it can catch fire. Currently there is more than one aviation incident a week related to lithium batteries in the USA alone. Additionally, the number of batteries in increasing rapidly across the globe as is the energy density in the batteries which is further increasing the risk.

What requirements must my product fulfil for air freighting?
It is important to talk to your shipping company or freight forwarder to make sure they are across the requirements for shipping of batteries in or with your products. They will need to be providing a shippers declaration in most instances. The key requirements you will need to be aware of are:

• All cells and batteries much be tested in accordance with the UN manual of tests and criteria Part III Subsection 38.3 (DGR 3.9.2.6) – and a test summary must be provided to your shipper
• For rechargable batteries, the maximum state of charge for the shipment must be 30%
• When Lithium batteries are not installed in the equipment they power, they must be carried on a cargo aircraft (or if they are over the weight restriction – see below)
• All terminals must be protected against short circuits and inner and outer packaging must be appropriate as per the Wh rating
• See the tables below for further requirements:

The above table is based on the provisions set out in the 2023-2024 Edition of the ICAO Technical Instructions for the Safe Transport of Dangerous Goods by Air (Technical Instructions) and the 65th Edition (2024) of the IATA Dangerous Goods Regulations (DGR): http://www.iata.org/dgr
 
The provisions of the DGR with respect to lithium batteries may also be found in the IATA lithium Battery Shipping Regulations (LBSR) 11th Edition: http://www.iata.org/lbsr                  

Refer to our article on the new EU battery regulation for additional battery related requirements.

When will these product standards become mandatory under the RED?
It is expected that this will be 1 August 2025 meaning you have one year to prepare. The standards still need to be added to the harmonised standards journal by the EU.

What are the EN18031 series of standards?
EN 18031-1:2024 Common security requirements for radio equipment - Part 1: Internet connected radio equipment
EN 18031-2: 2024 Common security requirements for radio equipment - Part 2: radio equipment processing data, namely Internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment
EN 18031-3:2024 Common security requirements for radio equipment - Part 3: Internet connected radio equipment processing virtual money or monetary value

What are the objectives of compliance with these product standards?
From Article 3.3 of the RED, these standards seek to:

1. Enhance network protection by requiring devices to have features that prevent harm to communication networks and avoid disrupting the functionality of websites or services.
2. Strengthen the protection of personal data and privacy. This includes measures to prevent unauthorized access or transmission of consumers' personal data.
3. Reduce the risk of fraud, through mandating features like improved user authentication controls to minimise fraudulent electronic payments and monetary transfers

What products are covered by these standards?
Connected products. Any devices capable of communicating over the internet, either directly or through other equipment. This includes devices that may handle sensitive data, including personal data, traffic data and location data. Examples include: mobile phones, tablets, laptops, wireless toys, children’s safety equipment (such as baby monitors) and wearable devices, such as smartwatches and fitness trackers.

What are the product testing requirements?
Product Developers or manufacturers must conduct tests focusing on network security, data protection, and the integrity of communication protocols. Devices should be evaluated for their resilience against unauthorized access and potential fraud scenarios.

Why should I as a product developer, become familiar with these product standards and start planning for compliance now?
The forthcoming Cyber Resilience Act is aiming to strengthen cybersecurity across the EU for digital products, meaning that these standards are only the start. It is important to get on top of these now so that you are better prepared for what else is coming.

https://www.rbdevelopment.co.nz/connect
_____

What is Proposition 65 (also known as Prop65) and how does it relate to products?
Proposition 65, officially known as the Safe Drinking Water and Toxic Enforcement Act of 1986, is a proposition of the State of California enacted as a ballot initiative in November 1986. The proposition protects the state's drinking water sources from being contaminated with chemicals known to cause cancer, birth defects or other reproductive harm, and requires businesses to inform Californians about exposures to such chemicals. These chemicals are found in many products.

What is the Proposition 65 List?
The Proposition 65 list is a list of a wide range of naturally occurring and synthetic chemicals that cause cancer or birth defects or other reproductive harm. These chemicals include additives or ingredients in pesticides, common household products, food, drugs, dyes, or solvents. Listed chemicals may also be used in manufacturing and construction, or they may be byproducts of chemical processes, such as motor vehicle exhaust. They could also occur as contaminants in commonly used materials. In plastics and electronics, fire retardants, heavy metals and phthalates are commonly used.

What is included in the current list?
The current list includes over 1000 chemicals and is regularly updated. Many of these can be found in plastics, coatings, textiles and electronic components.

What do I have to do as a product developer, supplier or manufacturer?
If you supply products to the USA that may be sold in California, whether through a physical store or online, you need to ensure warnings are provided that relate to any of the chemicals in the list that may be found in your products. The warning must be present at the point of sale and must be in a particular format.

How do I know whether my products contain any of the listed chemicals?
There are a number of different ways you can determine this. The first step is to talk to your supply chain and request certifications or declarations as to the Proposition65 status of the materials or parts you purchase. If your product contains batteries, plastics, electronics, metal coatings, dyes or fire retardants, there is a higher chance that your product will contain some of the listed chemicals.  Contaminants, particularly in recycled plastics, may also be a source.

Are there any exemptions for the warning label requirements?
The OEHHA has developed safe harbor levels for many Proposition 65 chemicals under which a warning would not be required.  Where the OEHHA has not established a safe harbor level for a chemical, businesses that expose individuals to that chemical would be required to provide a Proposition 65 warning, unless the business can show that the anticipated exposure level will not pose a significant risk of cancer or reproductive harm.

How does the process of compliance benefit my product development business?
While the process of determining what chemicals are found in your products can seem like a lot of work, greater transparency into your supply chain and the composition of your products is part of the process of building greater knowledge within your business. Gaining this level of insight and detail can help you make better product decisions that benefit your customers and the environment, and can also protect the health of those throughout your supply chain. Additionally, you can better anticipate future scarcities around materials, further future restrictions in other markets and improve the properties of your products.

How do I get started?
We can help you to put together and implement a strategy around addressing the requirements of this and other similar chemical regulations for products.

www.rbdevelopment.co.nz/connect
_____

EU 2016/679

What is the GDPR?
The GDPR defines precise rules on the management of security incidents such as data breaches, the use and erasing of collected personal data, and the keeping of records relating to data processing activities.

When did the GDPR take effect?
The General Data Protection Regulation (GDPR), took effect on the 25th of May 2018, and last year (2023) there were over a billion euros in fines for breaches, demonstrating there is still some work to do to ensure that everyone is in compliance.

What are the rules around the reporting of data breaches?
The regulation requires that personal data breaches (this includes all personal data such as contact details) must be reported to the competent supervisory authority within 72 hours. Data subjects must also be notified. Violation of the duty to report data breaches, can be punished by fines of up to EUR 1 million or, in case of companies, of up to 2 % of the total global annual turnover of the preceding financial year, whichever is the higher.

What information am I obliged to provide when collecting personal data from subjects via my product or other means?
The identity of the controller and deputy controller of the data and their contact details, the purpose and categories of recipient, contact details of the data protection officer, the controller’s legitimate interests, any intention to transfer data to a third country or to an international organisation (and the Commission’s associated adequacy decision), how long the data will be stored, the data subjects’ rights to information, erasure, correction, restriction the right to revoke consent, the right to appeal to a supervisory authority and so forth. Additionally, the reasoning behind, and consequences of, any profiling activities that may be performed.

How long can personal data be held for?
Personal data must be held only for as long as it is necessary to carry out the purpose for which the data is processed. Once the data is no longer needed for the purpose for which it was collected, personal data must be deleted. If data subjects withdraw their consent to the use or processing of their personal data, organizations are obliged to delete the relevant information.

Under this regulation, when is it lawful to process personal data?
This is only lawful when at least one of the following criteria has been fulfilled:

• consent has been obtained for one or more purposes (by someone over 16 years of age)
• processing is required on the basis of a contract (or pre-contractual measures)
• a legal basis is present OR
• processing personal data is necessitated by a legitimate interest of the controller or of a third party

Data processing may not be based on the law of a third state. Consent is conditional on it being given voluntarily, and must be in an easily comprehensible form, including simple language. Consent in written form is not explicitly required. However, as documentation of the consent must be retained.
The data subject is entitled to revoke their consent at any time. This process must be as simple as granting consent. The awarding of a contract, or provision of a service, may not be made dependent on the data subject’s consent, unless the data processing to which the data subject is to give his consent is required in order to fulfill the contract.
The processing of sensitive data is forbidden as a matter of principle unless the data subject’s consent has been obtained.

What are my requirements as a product development business in terms of protecting personal data?
The controller responsible for processing is required to take appropriate technical and organisational measures in order to ensure that personal data is processed in conformity with this regulation and must provide evidence that this is the case. A (documented) risk assessment is required.
 
Need some help to get started or to review your existing activities for compliance? Get in touch.

www.rbdevelopment.co.nz/connect

__________

What products are covered by this regulation?
This Regulation applies to any physical goods that are placed on the market or put into service, including components and intermediate products.

What products are excluded?
Food; feed; medicinal products; living plants, animals and micro-organisms; products of human origin; products of plants and animals relating directly to their future reproduction; vehicles (but not including scooters and bicycles – these are included); items for defense.

From when does it apply?
This regulation entered into force on the 18th of July 2024 and enforcement will begin in 2 years from that date. However, if you are developing new product, now is the time to ensure you are aware of the requirements.

What are some of the requirements?
Product durability, reusability, upgradability and repairability, as well as the use of substances that inhibit circularity are mentioned. Additionally, it covers energy and resource efficiency, recycled content, remanufacturing and recycling, and the carbon and environmental footprints of products. This Regulation also establishes a ‘digital product passport’, provides for the setting of mandatory green public procurement requirements and creates a framework to prevent unsold consumer products from being destroyed. An EU declaration of conformity will also be needed for your product, along with CE marking. There are also a number of information requirements that must accompany a product.

What is a Digital Product Passport?
A 'Digital Product Passport' requires a QR code on a product that takes a consumer to information that enables them to make informed purchasing decisions by offering details about a product's environmental sustainability. It thereby allows consumers to access and compare information contained within these product passports.

What ‘unsold products’ can no longer be destroyed under this regulation?
The regulation imposes a direct ban on the destruction of unsold textiles and footwear, which will take effect two years after enactment. Small and micro companies are exempt, while medium-sized companies have a six-year exemption. It also authorizes the Commission to introduce similar bans for other products in the future. From 19 July 2030, medium sized enterprizes that discard unsold consumer products directly or have unsold consumer products discarded on their behalf must disclose the amount, the reason and any recovery actions taken annually on their websites.

What is ‘ecodesign’?
The regulation defines ecodesign as “the integration of environmental sustainability considerations into the characteristics of a product and the processes taking place throughout the product’s value chain”

What ecodesign requirements will be implemented?
Further detailed requirements will be adopted going forward to improve the following product aspects:
(a) durability;
(b) reliability;
(c) reusability;
(d) upgradability;
(e) repairability;
(f) the possibility of maintenance and refurbishment;
(g) the presence of substances of concern;
(h) energy use and energy efficiency;
(i) water use and water efficiency;
(j) resource use and resource efficiency;
(k) recycled content;
(l) the possibility of remanufacturing;
(m) recyclability;
(n) the possibility of the recovery of materials;
(o) environmental impacts, including carbon footprint and environmental footprint;
(p) expected generation of waste.
 
What products are the priorities for what is yet to come?
(a) iron and steel;
(b) aluminium;
(c) textiles, in particular garments and footwear;
(d) furniture, including mattresses;
(e) tyres;
(f) detergents;
(g) paints;
(h) lubricants;
(i) chemicals;
(j) energy related products;
(k) information and communication technology products and other electronics.
 
Want to understand how to prepare your product development business and products for this regulation?
Contact us for a free no- obligation 30 minute online consultation to discuss what assistance may be of most relevance to you.

www.rbdevelopment.co.nz/connect

__________