EU-27 · Market Access PlatformTalk to us →

Ecommerce compliance readiness: the per-SKU, per-regime readiness framework for EU-shipping catalogues in 2026

EU compliance is not a single 'are we compliant?' verdict — it is a per-SKU, per-regime readiness state across GPSR, EU RP, EPR, PPWR, EmpCo and DPP. Here is the five-layer framework, the per-SKU score that drives prioritisation, and the catalogue-audit pattern that turns a regulatory backlog into a shippable engineering ticket list.

9 MIN READ · UPDATED 7 JUNE 2026

Ask any EU-shipping ecommerce operator "are you compliant?" and the honest answer is "with what?". EU product-compliance obligations land per regime and per SKU. A 10,000-SKU catalogue selling into 27 Member States is simultaneously in six regulatory regimes — GPSR, EU Responsible Person, EPR, PPWR, EmpCo, and (from 2027) DPP — each with different scope, different enforcement, and different timelines.

"Compliance" as a single binary verdict is not a meaningful unit of analysis. Readiness as a per-SKU, per-regime score is.

This guide describes the readiness framework Regonance uses across hundreds of catalogues: the five-layer model, the per-SKU scoring, the prioritisation pattern, and how to turn a regulatory backlog into a shippable engineering ticket list.

Why readiness, not compliance

Three structural facts make "are we compliant" the wrong question:

1. Per-SKU, not per-company. GPSR Article 9 / 19 attaches to every product sold. Two SKUs in the same shop can have different compliance states. The unit is the SKU, not the company.

2. Per-regime, not per-binary. A catalogue can be GPSR-clean and EPR-broken (or vice versa) at the same moment. Each regime needs its own score.

3. Per-deadline, not point-in-time. PPWR data capture is needed by 12 August 2026; PPWR recyclability thresholds bind in 2030. Both are "PPWR readiness" but the work is different and the prioritisation is different.

A readiness framework that ignores any of these three produces either a false-sense-of-security score (catalogue-level "we are compliant") or a false-alarm score (everything is red because the 2030 obligations are not yet met).

The five-layer readiness model

Readiness across an ecommerce catalogue lives in five layers, top-down:

Layer 1 — Listing layer. What the consumer sees before purchase. GPSR Article 19 (manufacturer, EU RP, warnings, model). EmpCo claims (green-claim language audit). Marketplace-specific attribute fields (Amazon Manufacturer Contact, Etsy Responsible Person). Highest signal-to-noise: verifiable from outside the supply chain by opening the listing.

Layer 2 — Product layer. What is physically on the product or its packaging. GPSR Article 9 (manufacturer + EU RP marking). CE marking and category-specific pictograms. Batch/serial identifier. PPWR packaging mark. Requires fulfilment-side change, not just listing-side change.

Layer 3 — Documentation layer. The technical file behind the SKU. Bill of materials, supplier-per-component, substance declarations, test reports, EC declaration of conformity, risk assessment under GPSR Article 9(7). This is what an authority asks for when they write in.

Layer 4 — Operational layer. The processes around the SKU. Incident-response plan (GPSR Article 9(8) — duty to notify Safety Gate). Recall and corrective-action procedures. Customer-complaint intake (GPSR Article 9(9)). EPR per-country reporting calendar. EU RP escalation path.

Layer 5 — Catalogue layer. Coverage across the SKU base and across the marketplaces. Per-country EPR registration status. Per-marketplace seller-account health. Onboarding workflow for new SKUs (do they enter the catalogue with the readiness already in place, or as a backlog item to fix later?).

Each layer is where a different failure mode bites: Layer 1 failures get you delisted by marketplaces; Layer 3 failures get you fined by authorities; Layer 5 failures compound silently into the next product launch.

Per-SKU scoring

For each SKU, score each applicable regime 0–100:

  • 0 — no evidence captured, regime obligation unmet.
  • 25 — partial data captured, gaps in critical fields.
  • 50 — primary fields captured, secondary fields and substantiation missing.
  • 75 — complete dataset captured, dated provenance present, output not yet generated.
  • 100 — complete, dated, evidenced, output rendered (technical file, Article 19 block, EPR report, EmpCo claim ledger, DPP passport).

Weight by regime severity at the current date:

  • GPSR / EU RP — enforcement active since 13 Dec 2024. Highest weight.
  • EPR — per-country, enforcement varies (Germany / France high, others moderate). High weight.
  • EmpCo — enforcement from 27 Sep 2026. Rising weight through 2026.
  • PPWR — main application 12 Aug 2026 (data capture and minimisation); 2030+ thresholds (recyclability). Rising weight.
  • DPP — batteries 18 Feb 2027; textiles 2027–2029. Forward-looking weight.

Aggregate per-SKU, then per-collection and per-marketplace. The headline is the aggregate; the drill-down is the per-SKU per-regime grid that operations actually fixes against.

The prioritisation pattern

Three rules in order:

Rule 1 — Fix the listing layer first. Article 19 is enforced by marketplaces, visible from outside, and uses data needed for every other regime. Closing it across the catalogue is the highest-leverage move.

Rule 2 — Fix the per-country EPR registrations before scaling the geography. EPR is the most fragmented regime — 27 different national registers and reporting calendars. Adding a new destination country without the EPR registration in place is creating compliance debt.

Rule 3 — Capture the data ahead of the deadlines, render the output at the deadlines. PPWR data is capturable in 2026 even if the recyclability thresholds bind in 2030. EmpCo substantiation is capturable now even if enforcement starts 27 Sep 2026. DPP per-SKU datasets are capturable now even though the textiles delegated act is 2027–2029.

The pattern: one captured dataset, multiple rendered outputs, against escalating deadlines.

Turning a regulatory backlog into a ticket list

A readiness audit that produces a 300-page PDF is a worse outcome than no audit. The deliverable that actually ships is a per-SKU ticket list:

  • SKU. GTIN or internal identifier.
  • Regime. GPSR | EU RP | EPR-DE | EPR-FR | PPWR | EmpCo | DPP.
  • Gap. Specific missing field or output (e.g. "EU RP address not populated in Shopify metafield", "FR EPR identifier missing for textile stream").
  • Owner. Engineering | operations | legal | supplier-facing.
  • Effort. S / M / L (single-SKU fix vs cross-cutting catalogue change vs supplier engagement).
  • Deadline. Specific date (regulatory deadline or marketplace-enforcement deadline).
  • Evidence. Where the substantiation will be stored once captured.

This is a ticket list, not a report. Operations imports it into Linear, Jira, Notion, or whatever the team runs. Compliance becomes a velocity metric, not a memo.

Reading the score

A few patterns from running this audit across hundreds of catalogues:

  • A score under 30 across the listing layer means the catalogue is at active delisting risk. Marketplace sweeps will catch it before authority enforcement does.
  • A score under 30 across the documentation layer with a high listing-layer score means the brand has the front-end right but the technical file is empty — the moment an authority writes in, the response cannot be produced.
  • A high catalogue score with low new-SKU readiness means compliance debt is being created with every product launch. The fix is at the SKU onboarding flow, not at the back end.
  • Per-marketplace divergence — high score on Shopify, low on Amazon — typically means the catalogue is managed in one system and the marketplace listings are out of sync. The fix is a single source of truth that pushes to every channel.

How Regonance helps

Regonance is the readiness operations platform: per-SKU, per-regime scoring across the five layers; the gap-to-ticket conversion automated; outputs rendered (Article 19 block, GPSR technical file, EU RP register, per-country EPR pack, EmpCo claims ledger, PPWR packaging inventory, DPP passport) from a single dataset; reassessment on every catalogue change so the score reflects today, not the audit date. The Growth plan sizes for under-500 SKU catalogues; Pro for 500–5,000; Agency for multi-brand operators.

Glossary

SKU. Stock-keeping unit — the per-product identifier on which obligations attach.

Readiness score. A 0–100 measure of how complete the evidence base is for a specific regime on a specific SKU.

Article 19 block. The listing-side disclosure required by GPSR Article 19: manufacturer, EU RP, warnings, sufficient product identification.

Five-layer model. Listing → product → documentation → operational → catalogue.

Compliance debt. Obligations created by adding SKUs or geographies without the corresponding readiness work, compounding into future remediation cost.


Educational information, not legal advice. The readiness framework is an operational pattern, not a substitute for qualified compliance counsel on contested questions.

Frequently asked questions

Why isn't 'compliance' a single yes/no answer?+

Because EU product-compliance obligations attach per regime and per SKU, not at the company level. A catalogue with 10,000 SKUs sold across 27 Member States faces six live regimes (GPSR, EU RP, EPR, PPWR, EmpCo, DPP) — each with different scope, different enforcement, and different timelines. Asking 'are we compliant?' produces no actionable answer. Asking 'for each SKU, which regimes apply and which evidence is missing?' produces a prioritised backlog an operations team can ship against.

What is the highest-leverage place to start?+

Article 19 of GPSR — the listing block (manufacturer, EU Responsible Person, warnings, sufficient product identification). It is verifiable from outside your supply chain in seconds, it is what marketplaces (Amazon, Etsy, eBay) are already enforcing, and the data needed to populate it is needed for every other regime. Fix Article 19 across the catalogue first, then move outward.

How do you score a catalogue's readiness?+

Score per-SKU on each applicable regime (0–100), weight by regime severity (active enforcement now scores higher than 2030 obligations), aggregate to a per-SKU readiness score, and roll up to a per-collection and per-marketplace score. The aggregate is the headline; the drill-down is what teams actually fix against.

Which regimes are 'live now' versus 'coming'?+

Live now (Q2 2026): GPSR Article 19 (since 13 Dec 2024), EU Responsible Person designation (same date), EPR per-country registrations (varies, mostly live). Landing in 2026: PPWR main application (12 Aug 2026), EmpCo enforcement (27 Sep 2026). On the 2027+ horizon: DPP battery passport (18 Feb 2027), DPP textiles (2027 delegated act, applicability 2028–2029).

How long does a readiness audit take?+

For a single-country catalogue with under 100 SKUs, a first-pass readiness audit is a 1–2 week effort. For a multi-country catalogue with 1,000+ SKUs, it is a 4–8 week structured project. The fixed cost is the data model and the per-regime ruleset; once those exist, scoring is automatable and repeatable.

Is this the same as an ISO 14001 or an SA8000 audit?+

No. ISO 14001 (environmental management) and SA8000 (social accountability) are voluntary management-system certifications. Ecommerce compliance readiness is an assessment against binding EU regulations — GPSR, EmpCo, PPWR, EPR, DPP — with the explicit goal of producing the evidence those regulations require, not a certificate.

Run a free compliance readiness scan

Upload product files or a listing URL and see exactly which fields are missing.

Start free scan

AI-assisted informational guidance. Not legal advice. Consult qualified counsel for your specific situation.