Guide
Global Consumer Product Safety: CPSIA, GPSR, Prop 65, REACH and RoHS on One Spine
Consumer-goods brands sold into the US and EU sit under four overlapping regimes: the Consumer Product Safety Improvement Act (CPSIA) and the Consumer Product Safety Act in the US, the EU General Product Safety Regulation (GPSR 2023/988) effective 13 December 2024, California Proposition 65, and the EU substance regimes REACH and RoHS. The obligations rhyme — designate a responsible economic operator, assemble a technical file, certify or self-declare conformity, label correctly, monitor the market — but each regime places the burden on a different entity with different portals, deadlines and severity tests. This hub stitches them into one operating model and links to the deep dives. It is written for QA, regulatory and compliance leads at consumer-goods brands, importers and online sellers.
Start free trial Free trial, no credit card, onboard in days, not months.
The economic operator chain: who carries the duty
CPSIA puts the certification duty on the US importer (for imported goods) or domestic manufacturer (for goods made in the US). GPSR 2023/988 introduced the EU 'responsible economic operator' requirement: every product placed on the EU market must have a manufacturer, an EU-based importer, an EU-based authorised representative, OR a fulfilment service provider acting in that role — and that operator's name and address must be on the product or its packaging. Online marketplaces (Amazon, Etsy, AliExpress) now carry independent obligations under GPSR Article 22 and the Digital Services Act. The recurring failure is selling into the EU under the pre-2024 'EU rep optional' assumption and discovering at customs or via a marketplace audit that the responsible operator block is missing.
Technical file: one composite, multiple regimes
CPSIA expects a General Certificate of Conformity (GCC) for general-use products and a Children's Product Certificate (CPC) for products designed for children 12 and under, each backed by test reports from a CPSC-accepted third-party laboratory for children's products. GPSR Article 9 requires a technical documentation package: design and manufacturing data, risk assessment, list of harmonised or applicable standards, conformity evidence, post-market surveillance plan. REACH Article 33 demands SVHC notification down the chain and to consumers on request. RoHS requires the EU Declaration of Conformity (DoC) and technical file for EEE. A single per-SKU technical file that holds all these is the efficient default; running four parallel files is the common drag on launch velocity.
Substance regimes: CPSIA limits, REACH SVHC, RoHS, Prop 65
CPSIA Section 101 sets lead limits in children's products (100 ppm in accessible substrate, 90 ppm in surface coatings) and Section 108 limits eight phthalates to 0.1% in children's toys and child-care articles. REACH Annex XVII restricts hundreds of substances by use; the SVHC candidate list updates twice a year and triggers Article 33 notification at 0.1% (w/w) per article (the ECJ 'once an article, always an article' ruling). RoHS limits six substances (Pb, Hg, Cd, Cr(VI), PBB, PBDE) plus four phthalates in EEE. California Prop 65 lists 900+ substances with a 'safe harbor' warning duty if exposure exceeds the No Significant Risk Level or Maximum Allowable Dose Level. Substance non-conformance is the single largest cause of marketplace delisting in 2024–2026.
Conformity, certification and the third-party testing rule
Children's products under CPSIA require third-party testing at a CPSC-accepted laboratory; general-use products are certified by the manufacturer or importer on the basis of a 'reasonable testing program.' GPSR does not have a CE-marking requirement of its own — CE-marking comes from the relevant New Approach directives (toys, electrical, machinery, RED) — but GPSR is the safety net for any consumer product NOT covered by a specific directive. Both regimes expect a documented testing rationale; the audit gap is testing done at launch and never repeated when components, suppliers or formulations change.
Post-market: CPSIA Section 15(b), GPSR Article 20, Safety Gate
CPSIA Section 15(b) requires reporting to the CPSC within 24 hours of obtaining information that reasonably supports the conclusion that a product fails to comply with a CPSC rule or contains a defect that could create a substantial product hazard. GPSR Article 20 requires economic operators to report accidents caused by their products via the Safety Business Gateway and to launch corrective action where a risk is identified. The EU Safety Gate portal (formerly RAPEX) lists weekly notifications of dangerous consumer products; appearing on Safety Gate is now the leading indicator of retailer delisting and class-action exposure. Recall capability — reconstructing distribution from records — is the underlying test.
A 90-day multi-regime readiness path
Days 1–15: economic operator identity check across CPSIA importer, GPSR responsible operator and REACH-only representative for the top 50 SKUs. Days 16–35: technical file reconstructability test on the top 20 SKUs; SVHC declarations refresh against the latest candidate list. Days 36–55: substance compliance — CPSIA lead/phthalate, RoHS 6+4, Prop 65 exposure assessment, REACH Annex XVII check. Days 56–75: post-market drill — 15(b) clock, GPSR Article 20 Safety Business Gateway, mock recall with 24-hour distribution reconstruction. Days 76–90: artwork refresh for GPSR responsible operator block, Prop 65 warnings and tracking labels; freeze the baseline.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Industries this hits hardest
Frequently asked
We sell on Amazon EU — do we still need an EU responsible operator under GPSR?
Yes. GPSR 2023/988 came into force on 13 December 2024 and applies to every product placed on the EU market regardless of sales channel. If you are a non-EU brand selling via Amazon EU, you need an EU-based manufacturer entity, an EU importer, an EU authorised representative, or a fulfilment service provider acting in that role — and their name and address must be on the product or its packaging. Amazon's marketplace compliance team enforces this and has delisted thousands of SKUs since December 2024.
Does CPSIA apply to products sold only to adults?
The general CPSA framework, Section 15(b) reporting, and many CPSC rules apply to all consumer products. CPSIA Section 101 (lead) and Section 108 (phthalates) apply specifically to children's products — defined as products designed or intended primarily for children 12 and under. The CPSC's four-factor analysis (manufacturer statements, packaging, marketing, common usage) decides borderline cases; assuming 'adults only' without documenting the analysis is risky.
How does Prop 65 interact with CPSIA on lead?
They are independent. CPSIA Section 101 sets a maximum lead content (90–100 ppm) in children's products; Prop 65 triggers a warning duty when exposure exceeds the lead Maximum Allowable Dose Level (0.5 µg/day) regardless of substrate concentration. A product can be CPSIA-compliant on content but still trigger Prop 65 because the assessed exposure exceeds the MADL. Brands selling into California typically run both content testing and an exposure assessment per SKU.
How often does the REACH SVHC candidate list update?
Twice a year, typically in January and June. Each update adds substances (currently 240+ on the list as of mid-2026). The Article 33 duty to communicate down the supply chain and the SCIP database notification both kick in at 0.1% (w/w) per article. Brands without a recurring SVHC review against the new list miss the Article 33 trigger; retailer audits are picking this up routinely.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.
Related reading
Spot something off? .