Who signs, who is liable, and from which date.

The hardware is usually the same; the paperwork is not. A device cleared for the EU on CE and RoHS still needs FCC for the US if it has wireless, and the labelling and manual requirements differ by market. Confirm the destination market before you approve packaging, because reprinting a manual after a container ships costs more than the printing did.

We can tell you what each market requires and what to ask a supplier for, which is the part most founders get wrong. The EU's General Product Safety Regulation requires a Responsible Person established in the EU — a Chinese OEM cannot hold that role — and if you are not incorporated in the EU that is a contracted service, commonly a few hundred to a few thousand euros a year. It belongs in the budget rather than in the small print. See the certificate pack by market in our startup guide.

On top of the baseline CE / RoHS / REACH and the UN38.3 / IEC 62133 battery transport tests, a wireless device needs radio approval: an FCC ID for the US market and CE RED conformity for the EU. Scope these during the brief, not after sampling, because firmware white-labeling and certification lead time are what slow app-connected launches more than the plastic does.

Increasingly, yes — in the rechargeable segment IPX7 is becoming a baseline expectation rather than a premium specification, and buyers are asking for it up front. Ask for the per-batch IPX and dielectric test reports, not a one-off marketing claim, because waterproofing is what fails after the seal is stressed in cleaning.

For EU and US retail buyers it is increasingly a baseline RFQ input: FSC-certified paper, soy-based inks, plastic-free inserts and recyclable outer cartons. Budget a 10–20% packaging cost increase over standard materials, partly offset by higher retail price points in sustainability-conscious channels — and scope it into the brief so artwork approval does not slip the timeline.

For intimate-wellness products entering gated marketplaces, an ISO 13485 (medical-device quality management) or ISO 22716 (cosmetic GMP) certificate on the factory is the document a compliance reviewer respects, because it speaks to the manufacturing environment rather than a single product test. Pair it with CE / RoHS / REACH, UN38.3 and IEC 62133 on the battery, and FCC or CE RED on anything wireless. Ask for the report that names the accredited lab and a sample ID — a certificate with no lab and no sample is a document-shaped risk.

Yes. The EU General Product Safety Regulation has been enforced since 13 December 2024, and a non-EU maker without a Responsible Person established in the EU faces marketplace listing removals and customs holds. The obligations are per product page — manufacturer details, EU responsible person, product ID, local-language safety warnings and instructions. On 4 February 2026 ECHA added n-hexane and bisphenol AF to the REACH SVHC list (now 253 substances), so silicone and plastic parts above 0.1% w/w need updated Safety Data Sheets. Budget the responsible-person service into the EU cost. See the certificate pack by market in our startup guide.

The broad 10% tariff on China-origin goods remained in place through 2026 after a May 2026 US court ruling limited relief to a few importer plaintiffs, leaving most traders still paying it. Do not count on a refund; build the 10% into the landed-cost model from the brief. The UK is on its own track — its product-safety consultation closed in June 2026 and will add an online-marketplace duty to verify safety before listing. Latin America is tightening too: Brazil's ANVISA and Indonesia's local-distributor licence add clearance steps. Confirm the HTS code with a licensed broker, because the code drives the duty.

ISO 3533 is the reference for intimate-use design and materials, but a rechargeable or app-connected device needs wider coverage: chemical and material safety (REACH, RoHS, POPs), biocompatibility for prolonged skin contact, mechanical and electrical safety, battery and charging safety, and — for anything Bluetooth — wireless conformity plus a cybersecurity review of the app. Independent bodies such as TÜV SÜD frame this as a GPSR product-safety review. Ask the factory for per-SKU test reports naming the accredited lab and a sample ID; a certificate with no lab and no sample is a document-shaped risk. See our body-safe silicone explainer for the material tests to request.

The UK is diverging from the EU. Its Office for Product Safety and Standards closed a consultation on 23 June 2026 on a framework that will replace the General Product Safety Regulations 2005 and introduce a duty for online marketplaces to verify product safety before listing — which directly affects dropshipping and wholesale listings on Amazon UK and eBay. CE recognition is indefinite for now, but UK-specific labelling is likely by late 2026. An EU Responsible Person does not cover Great Britain, so a UK importer needs its own accountable entity. Scope the UK as a separate compliance track rather than assuming an EU certificate carries across the Channel.

Since 25 July 2025, services that publish or allow pornographic content must use "highly effective age assurance" (HEAA) to keep under-18s out, and Ofcom enforces it. Self-declaration and age inference are not acceptable. Accepted methods include facial age estimation, photo-ID matching, open banking, digital ID and mobile-network checks; a credit-card check is weak on its own. Penalties reach £18m or 10% of global turnover, with senior-manager liability and service-restriction orders. Outsourcing the check does not outsource the liability, and it applies to services used by UK users wherever the company is based.

Yes, in practice. Major marketplaces and wholesale buyers require a certificate of insurance — Amazon triggers it around $10,000 a month in sales, and wholesale COI requests commonly ask for $1M per occurrence / $2M aggregate. Claims follow the brand on the label, not the factory: as a private-label brand you carry the exposure even if the manufacturer has its own cover, so you need a brand-owner policy with a private-label endorsement. Expect specialist carriers, because mainstream insurers exclude adult products silently. Budget cyber liability too — purchase data in this category is uniquely sensitive.

Three layers, cheapest to strongest. First, a signed NNN agreement (non-disclosure, non-use, non-circumvention) before any CAD or mould file leaves your hands — name moulds and tooling as yours, put real penalties in it, and use a bilingual English–Chinese text for Chinese plants. Second, a design patent on the visible form (outer silhouette, inner texture, entry shape), typically a few thousand dollars per filing, plus trademark registration for your name and logo. Third, keep the golden sample and put tooling ownership in writing. OEM gives you the design; ODM usually does not, so the same shape can ship to a competitor.

A granted design patent or registered trademark is what turns a complaint into a takedown; without one you rely on the marketplace's goodwill. File the design patent on the visible silhouette and texture and register the brand and logo early. When a copy appears, submit the registration number through the platform's IP portal, not a support ticket, and keep your golden sample and dated artwork as evidence of first use. Cheap copies usually fail on material and motor anyway, so body-safe documentation is both a legal and a marketing moat.

The EU Packaging and Packaging Waste Regulation (PPWR, EU 2025/40) became fully applicable on 12 August 2026. Every packaged product placed on the EU market must meet a heavy-metals limit (lead, cadmium, mercury and hexavalent chromium together at or below 100 mg/kg), be recyclable by design, and be registered under EPR in each country of sale — non-EU sellers need an EU authorised representative.

You also need a Declaration of Conformity and a technical file (keep five years; ten for reusable). Amazon and Temu verify EPR registration before a SKU can list, and fines can reach 6% of global turnover. PPWR is not CE — do not confuse the two documents. See the certificate pack by market in our startup guide.

GPSR is Regulation (EU) 2023/988, the General Product Safety Regulation, applicable across the EU since 13 December 2024. It replaces the old General Product Safety Directive and covers non-food consumer goods sold in the EU, including online and this category. The two obligations a new brand feels first are an EU-established Responsible Person (Art. 16) named on the product, and a technical file with a risk assessment kept for at least ten years. The full document load per market is on our brand page.

Yes. Article 16 of GPSR makes a named EU-based Responsible Person mandatory for any non-EU manufacturer; without one the product cannot be lawfully placed on the EU market, and marketplaces will deactivate the listing until it is supplied. The Responsible Person is the contact point enforcement and buyers reach, so treat it as a line item in the compliance budget, not a formality.

Marketplaces have been deactivating ASINs that lack Responsible Person, manufacturer and warning details since December 2024, and a listing can drop later if the Responsible-Person contract lapses — even if it was compliant at launch. Fix it through Seller Central with the missing details and a valid contract; the faster path is to keep the Responsible-Person record current rather than scramble after a takedown.

No. The UK retained the General Product Safety Regulations 2005 and is updating the framework through the Product Regulation and Metrology Act 2025; it did not adopt EU GPSR. OPSS enforces with fines up to £20,000 (unlimited in some sectors) and, for connectable products, the PSTI Act allows penalties up to £10m or 4% of global turnover. The practical effect is the same shape of duty — named contact, genuine documentation — under a different authority.

Not in our 2025 search; OPSS is active on consumer electricals and on online sellers, including China-based marketplace traders, which is directly relevant to device importers even though the category-specific action did not surface. Read it as: the enforcement appetite for unsafe consumer electronics is real, and the documentation that clears a UK border is the same documentation that answers an OPSS information request.

Use Seller Central → Account Health → dispute the decision, with a plan of action (root cause, corrective step, preventive step) plus evidence: product photographs, the material and electrical test reports, and proof the listing is in the correct category. Vibrating and massager listings are frequently mis-flagged as adult; the appeal path is identical, and a complete test-report package is what converts a rejection into a reinstatement.

The store itself can be built — the restriction is the payments rail. The Shop channel and Shopify Payments exclude adult content, so a store can exist while the default payment rail will not clear the category. Plan a specialist processor (below) before launch rather than discovering the gap at the first declined transaction, and keep imagery non-explicit regardless of processor.

Specialist high-risk processors — CCBill, SegPay, Epoch, Verotel, PaymentCloud and Durango among them — are built for the category. Mainstream processors (Stripe, PayPal, Square, Adyen) generally decline explicit adult in their standard terms and terminate accounts detected in the category. The trade is a higher discount rate and a reserve in exchange for approval; model both before you price.

Typically a 5–10% rolling reserve held for 90–180 days, on top of a 4–15% discount rate. SegPay is commonly cited around a 5% reserve for six months; mainstream high-risk holds can reach 15% with 180-day release windows. None of these are a quote for your account — they are the published range this category pays, and the reserve is the line that most often breaks a first-year cash-flow plan if it is not priced in.

A high-risk classification triggers rolling holds, and PayPal additionally limits adult to US-only physical goods shipped — international direct-to-consumer is uncovered. If your model is subscription or cross-border, a mainstream account will not serve it; that is the gap the specialist processors exist to fill, at the reserve and discount cost above.

Request the business licence and Unified Social Credit Code, a live unscripted video walkthrough of production running that week, and cross-check the line shown against the licensed address; add a third-party audit (SGS or Bureau Veritas) before any deposit moves. The sequence is spelled out in our startup guide, and the reason per-batch tests beat a brand-level certificate is on how we verify claims.

EU: CE (Low Voltage and EMC directives), RoHS and REACH, plus the GPSR Responsible Person; wireless models add the Radio Equipment Directive. US: FDA material compliance (21 CFR 177.2600) and FCC on wireless devices. Any device with a lithium cell needs UN38.3 and IEC 62133 in every market. Our brand page lists what ships with an order, and the count per market is plotted on the page so you can see the load before you brief a run.

Work backwards from the shelf date: production runs 25–35 days, sea freight another 25–38, plus check-in and customs. December is the annual search peak, so the honest plan is to place the order by late August. Google Trends shows the seasonal shape clearly; the startup guide turns that shape into a 90-day first-order plan.

PPWR is Regulation (EU) 2025/40, the Packaging and Packaging Waste Regulation, which applies from 12 August 2026. For an intimate-wellness brand it lands on the box, not the device: recyclability and minimisation requirements, reuse and recycled-content targets, and EPR (extended producer responsibility) fees that the importer — not the factory — is accountable for. EU retailers increasingly require FSC-certified paper, soy inks and reduced plastic inserts before they will list a line, so the packaging brief belongs in the sourcing specification, not in a rework after a buyer rejects the carton. The provision dates are staged, so confirm the exact obligation against your pack format with your EU Responsible Person rather than assuming the 12 August date covers every element.

For the EU and UK, effectively yes. Under GPSR the Responsible Person and the other economic operators carry liability, and distributors, retail chains and most marketplaces will not onboard a brand without evidence of product liability cover — it is the policy that responds when a device causes bodily injury or property damage. In the US the same cover sits under general and product liability insurance and is the document that converts a single adverse incident from an existential event into a managed claim. Treat it as a launch line item alongside the certificate pack and the payment reserve; the compliance load per market shows where it sits in the order.

OPSS — the Office for Product Safety and Standards — is the UK authority that can require a recall, a corrective action or a public safety notice, and it has been active on unsafe consumer electronics and on online sellers including China-based marketplace traders, which is directly relevant to device importers.

The UK retained the General Product Safety Regulations 2005 and is reshaping the framework through the Product Regulation and Metrology Act 2025, so the practical duty — named UK contact, genuine documentation, a responsive recall path — is the same shape as GPSR under a different authority. The cheapest version of compliance is the same as everywhere else: a per-batch test report, a matched licence and beneficiary, and an inspection before the container, documented on how we verify claims.

Yes — a connected device is a data product as well as a hardware one. Under the EU GDPR (Regulation (EU) 2016/679) and California's CCPA/CPRA, an app that collects usage or personal data needs a lawful basis, a privacy notice, a retention limit and privacy-by-design at the architecture stage; a Bluetooth model sold into the EU also carries the Radio Equipment Directive. The failure modes are asymmetric — a hardware fault is a bounded recall, a data breach is open-ended — which is why privacy is a build-time requirement, not a launch-week checklist. The connected-device section is worked through in the startup guide, and the per-market mark count is plotted there.

Match it to the price tier and write it into the contract. AQL — acceptance quality limit — 1.5 suits a premium line, 2.5 is the norm for standard retail, and 4.0 is only defensible for a budget line, because the defect rate you accept at the factory becomes the return and chargeback rate you absorb later. Ask for the level in writing and confirm the inspector will sample against it before shipment; the MOQ guide and the startup guide both treat AQL as a contract term, not a courtesy.

Six lines most quotes omit: tooling for a private mould ($500–15,000 depending on geometry), the certification pack (CE + FCC + UN38.3 + ISO 13485, roughly $1,000–5,000), sea freight (15–20% of order value), custom FSC packaging ($1,500–2,500), a pre-shipment inspection ($300–800 per batch) and the sample round ($200–500). Two quotes can differ by pennies a unit and by thousands across these lines, so build all six into the total before you choose — the stack is plotted on the wholesale catalogue and broken down in the MOQ guide.

Whoever first makes the packaged product available in a given member state, which is almost always you. PPWR (Regulation (EU) 2025/40, applying from 12 August 2026) defines six economic operator roles — manufacturer, importer, distributor, supplier, authorised representative and fulfilment service provider — and "producer" is not one of them. It is a derived status: the same company can be a distributor on its org chart and the producer in the Netherlands, and the brand on the carton makes you the manufacturer for the declaration of conformity even when the box was printed in Shenzhen.

That is exactly why the disposal fee does not travel upstream to the converter, and why registration is done market by market — Lucid in Germany, Citeo in France, Verpact in the Netherlands. Put recyclability, recycled content and pack weight into the sourcing brief, because a pack has to be reportable before it can be printed; the startup guide walks the sequence and the brands page lists what ships with an order.

Check the two thresholds instead of the story. UK EPR obligations bite for a business that handles more than 50 tonnes of packaging and turns over more than £2 million in a year; below both you are not an obligated producer, but the retailers you sell to still ask for packaging data, and many ask earlier than the law requires.

The Plastic Packaging Tax is a separate test with its own threshold and its own evidence requirement — recycled-content proof has to come from the supplier before the goods land, which is where importers get caught. The practical move is to start recording pack weights by material now: it costs nothing while you are small, and it is the first document a buyer asks for when you are not.

A lawful basis, a privacy notice written for the person using the device rather than for a regulator, a retention limit, a deletion path that actually works, and privacy-by-design in the app architecture — all before the firmware ships. For a connected intimate device the data category matters: usage patterns and pelvic-health feedback are health-adjacent, which in the EU raises the bar to explicit consent and a data-protection impact assessment.

You also need a data-processing agreement with whoever writes or hosts the firmware, a named EU representative where GDPR applies, and a breach path that can notify a regulator within 72 hours. Ask the factory who owns the telemetry, where it is stored and whether the app runs without an account — the hardware certificate pack covers none of it, and §3.8 of the startup guide sets the data pack beside the certificate pack.

It applies by risk category, not by sector, so a wellness app does not escape it by not being a medical device. Regulation (EU) 2024/1689 entered into force on 1 August 2024 and phases in: most prohibitions from 2 February 2025, general-purpose model obligations from 2 August 2025, and the Article 50 transparency obligations from 2 August 2026, the same date enforcement by the AI Office and national authorities began. In practice an interactive AI feature in a device app must tell the user they are dealing with an AI rather than a human, and AI-generated or altered content must be labelled and carry machine-readable marks.

Systems already on the market before that date had until 2 December 2026 for the marking obligation; high-risk systems embedded in regulated products run to 2 August 2028. The practical point for a brand is that this is a firmware decision, not a marketing one — the disclosure has to be specified before the firmware is frozen. It is the third regime in §3.8 of our startup guide, alongside the hardware marks and the GDPR/CCPA data obligations.

They do two completely different jobs, and conflating them is how a dispute is lost. The 997 is a functional acknowledgement: the receiver confirming that your transmission arrived and is syntactically valid. It is not acceptance of the content - a clean 997 on an invoice with the wrong totals is still a wrong invoice, and that distinction decides whether you have an argument when a deduction lands. The 852 is product activity data: the sell-through and inventory report the retailer sends back to you, usually per store or per distribution centre.

It is the retailer telling you what actually sold rather than what it bought, and it is the input for replenishment, for spotting a store that has gone to zero, and for catching a discrepancy between shipments and sales before it becomes a chargeback. You pay for both because they are per-trading-partner requirements, not one-time certifications: each retailer names its own versions, timing and mandatory segments, so the integration you built for the first account has to be adapted rather than reused. The five sets a new vendor is usually asked for first are listed in the startup guide.

Not by itself, and a reprint driven by panic is the expensive mistake here. Sunrise 2027 is GS1's industry target for retail point-of-sale scanners to be able to read 2D barcodes - a QR code carrying a GS1 Digital Link - alongside the linear barcode by the end of 2027, with the linear code continuing to work after that date. So the practical answer for a small brand is: keep the linear barcode, because that is what item setup and receiving check today; add a 2D code only when you were already going to reprint, or when a named retail account asks for it; and if you do add one, make it a GS1 Digital Link URI rather than a marketing QR code, because the first resolves to structured product data and the second usually resolves to a homepage. The packaging decision that actually has a deadline in front of it is the PPWR one - recyclability and the reporting data your EPR filing needs - because that has to be specified before the carton is printed, whereas a barcode can be added at the next reprint. That timing is set out in the compliance section.

Six things, in the order a brand should action them. (1) Decide whether the app has an AI feature at all - an adaptive recommendation, a coach, a companion, anything that responds rather than replays. If it does, the regulation applies by risk category rather than by sector, so "we are not a medical device" does not settle it. (2) Disclose the AI in the interface. Since 2 August 2026 the Article 50 transparency obligations require a user to be told when they are dealing with an AI rather than a human, and enforcement by the AI Office and national authorities began on that date. (3) Label AI-generated or altered content, including text, images and audio the app produces. (4) Add machine-readable marks to that content; systems already on the market before 2 August 2026 had until 2 December 2026 to meet the marking and detection obligation. (5) Keep the documentation - what the model does, what data it sees, what it outputs - because the technical file is what an authority asks for, not the marketing page. (6) Check the high-risk timeline separately: rules for high-risk systems embedded in regulated products run to 2 August 2028, which matters only if the app makes a decision that affects safety. The reason this belongs in the brief rather than in the handbook is that items 2 and 3 are firmware and interface decisions, and they have to be specified before the firmware is frozen. The full context is in the startup guide.

Yes, and it is the change most often missed in a first-year plan. The $800 de minimis allowance under Section 321 of the Tariff Act - the rule that let a small commercial shipment enter the United States duty-free - was suspended for all countries during 2025, so a first order that used to be priced as goods plus freight now carries a duty line on every unit rather than only on large consignments. Three consequences follow for a brand.

First, landed cost has to be recalculated per HTS classification before a retail price is set, not after the first invoice arrives, because the duty rate is a property of the code and a massager and a silicone accessory do not necessarily share one. Second, the arithmetic that made several small shipments attractive largely disappears, which changes the choice between one bulk order and three staggered ones. Third, the factory FOB price stops being the number your accountant needs - ask for the ten-digit HTS code in writing on the quotation itself. The landed-cost calculation is worked through in our MOQ and pricing guide, and what has to appear on the commercial invoice is on this page.

It applies to the exposure rather than to the category, so a device is in scope if any material in it can expose a user to a listed chemical.

Proposition 65 is formally the Safe Drinking Water and Toxic Enforcement Act of 1986, passed by voter initiative 63–37 and administered by the CalEPA Office of Environmental Health Hazard Assessment, and it requires a clear and reasonable warning before a business knowingly exposes anyone to a listed substance — a list that passed 900 entries in 2020. In this category the substances that actually trigger a warning are the phthalate plasticisers used to soften PVC and lead in coatings or solder, which is the commercial case for platinum-cure silicone sitting beside the body-safety one: a silicone body does not need the warning line and a jelly or PVC one usually does.

Two consequences follow. The warning is a California disclosure that travels on the carton, so a US retail or marketplace buyer asks for it at item setup rather than at the border, and it is not a substitute for FDA material compliance or FCC. And enforcement runs through civil suits — the Attorney General, district attorneys, some city attorneys and private enforcers after a 60-day notice — with civil penalties reaching $2,500 per day per violation, so a missing warning is a litigation exposure rather than a paperwork gap. The law is summarised on Wikipedia: 1986 California Proposition 65, and the document load per market is on this page.

No, and treating it as one is an expensive detour in the wrong direction. ASTM F963, the Standard Consumer Safety Specification for Toy Safety, covers toys intended for children under 14, and since the Consumer Product Safety Improvement Act of 2008 it has been a mandatory US federal rule at 16 CFR 1250, tested at a CPSC-accepted laboratory with a Children's Product Certificate behind it. An adult device is not a toy and does not fall under it. The reason it still belongs in a brand file is the opposite direction of travel: the moment a product is shaped, coloured, packaged or advertised in a way a compliance reviewer could read as appealing to children, the children's-product regime becomes the thing you have to disprove, and the cheap way to disprove it is a documented adult-only position — explicit 18+ labelling, no child-appealing artwork, no toy-adjacent product name, and a packaging brief that says all three. Ask a US buyer which of the two regimes they are applying to your listing before you quote, because it decides whether the shipment travels with a general conformity file or with a children's-product certificate, and the two are not interchangeable. The standards that do apply are listed on this page.

A Digital Product Passport is a machine-readable record of a product composition, repairability, carbon footprint and end-of-life handling, reached by scanning a data carrier on the product or its packaging. It sits under the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, which establishes the framework rather than one deadline: each product group receives its own delegated act, and intimate-wellness devices are not among the groups in the first working plan, so there is no passport obligation on a massager today. The part that does have a date attached is the battery passport - Regulation (EU) 2023/1542 requires one for the light-means-of-transport, industrial and electric-vehicle batteries it covers, and a rechargeable cell inside a massager does not automatically fall into those classes. The practical answer for a brand is therefore not yet, but build the pack as if it will carry one: keep the material declaration, the recycled-content figures and the supplier names in a structured file now, because that is the data a passport will ask for and the data a retail buyer already asks for during vendor setup. The carrier question is the same one the barcode entry above answers, and the packaging sequence sits in the compliance section of this page.

Probably, and the redesign is cheaper done once. PPWR, Regulation (EU) 2025/40, applies from 12 August 2026 and adds a packaging-minimisation duty on top of the recyclability and EPR obligations - including a limit on empty space in e-commerce and grouped packaging, phased in after the regulation itself applies. We deliberately do not state the ratio or its start date as a number here, because both are set in the minimisation article and are easy to get wrong from a secondary summary; confirm the exact obligation for your pack format with your EU Responsible Person before you cut a new die.

What is already certain is the direction: a mailer sized around a standard retail carton, with void fill, is the shape the regulation is aimed at, and a right-sized carton with no filler is the shape that survives it. That decision has to be made at the packaging brief, alongside recycled content, because both are printed into the carton and neither can be retrofitted onto a run. If you are also weighing a 2D barcode for Sunrise 2027, do both at the same reprint - one artwork change, one tooling change, one approval cycle.