1. New pre-contractual information requirements

The ECGT Directive will require traders to provide consumers with additional, new information before a consumer enters into the contract. These new information requirements will apply for both bricks-and-mortar and online sales. There are also new requirements for both physical goods and digital content.

Physical goods

For physical goods (including those with digital elements), the following new information must be provided:

• A notice with a reminder about the legal guarantee of conformity and its main elements, including the minimum duration of two years. This notice must follow the template in Commission Implementing Regulation 2025/1960. There are different formats available for online and bricks-and-mortar sales. For example, for online sales, the notice must look like the one pictured below. For in-store sales, the notice can be in black and white, but must be at least A4 in size:

• If a free commercial warranty is offered lasting more than two years, then a label with information on the commercial warranty must also be provided. This label must also follow the template set by the EU. Again, there are different formats available for online and bricks-and-mortar sales. For example, for online sales, the notice will typically look like the one pictured below, though there is also a version that can be used as a nested display. For in-store sales, the notice can be in black and white. Where it is printed on packaging, it must meet specified dimensions and minimum font sizes.

• The repairability score, where applicable (e.g., this may be imposed by EU ecodesign rules, currently the only product group subject to this requirement being smartphones and tablets).
• Information about the availability and estimated cost of, and how to order, spare parts that are necessary to keep the goods in conformity; the availability of repair and maintenance instructions; and about repair restrictions. This does not create an obligation to offer repairs, spare parts or repair or maintenance instructions. However, if they are offered, and producers make this information available to traders, then it must be provided to consumers. The European Commission Q&A clarifies that this does ‘not mean that the producer-trader is obliged to inform the consumer proactively if a product cannot be repaired’.
• For goods with digital elements, information on the period of time during which software updates will be provided, where that information is available to traders.
• For online sales, information on environmentally friendly delivery options, where these are available.

Digital Goods

For digital goods (including digital content and services, such as apps) the following new information must be provided:

• A reminder of the existence of the legal guarantee of conformity for digital content and digital services. This is the legal guarantee established under the regime in Directive 2019/770. Unlike the requirement for physical goods, there is no harmonized template notice for this “reminder”.

• The minimum period of time during which software updates will be offered.

2. New prohibitions on certain types of claims

The ECGT Directive will ban certain types of claims, including:

• Generic environmental claims like ‘sustainable’, ‘green’ and ‘energy efficient’,unless traders can demonstrate ‘excellent environmental performance’ (e.g., EU Ecolabel, national schemes such as Germany’s Blue Angel, or top energy efficiency Class A under the EU Energy Labelling Regulation) relevant to the claim.

• Environmental claims about an entire product or a trader’s entire business when it only concerns a certain aspect of a product or a specific part of a trader’s business.

• Claiming that a product has a neutral, reduced or positive impact on the environment based on the offsetting of greenhouse gas emissions, such as saying a product is ‘carbon neutral’ or ‘net zero’.

• Presenting minimum legal requirements as a distinctive feature of a trader’s offer. This means that if a trader is required to achieve a certain environmental target by law, e.g., minimum recycled content in plastic packaging, this cannot be presented as if it is a feature of a trader’s offer.

• Misleading claims about the longevity of a product. This includes presenting a software update as necessary when it only enhances functionality; falsely claiming that under normal conditions of use a good has a certain durability in terms of usage time or intensity; presenting a good as allowing repair when it does not; inducing consumers to replace or replenish consumables of a good earlier than necessary; and withholding information concerning functional impairment when consumables, spare parts or accessories from a third party are used, or falsely claiming that such impairment will happen.

3. New rules on sustainability labels – including third-party verification

The ECGT Directive introduces new requirements that impact traders using sustainability labels.Sustainability label is defined to include any trust mark, quality mark or equivalent distinguishing a product or business by virtue of its environmental or social characteristics, e.g., B Corp, Global Organic Textile Standard (GOTS), Fairtrade and the Forest Stewardship Council (FSC).

From 27 September 2026 onwards, all sustainability labels used in the EU must either be established by a public authority or based on a certification scheme that complies with the ECGT Directive’s requirements. If this is not the case, the sustainability labels can no longer be used by traders in the EU.

Certification schemes underpinning sustainability labels need to meet requirements on transparency, openness and credibility and the trader’s compliance with the certification scheme’s standards must be verified by a third party that is independent from both the scheme owner and the trader.

While in practice compliance requires sustainability certification providers to take action, traders who display the sustainability label or certification remain legally responsible for only displaying sustainability labels based on a compliant certification scheme.

4. New requirements for claims relating to future environmental performance – also including third-party verification

The ECGT Directive bans claims related to future environmental performance, such as claims that a business ‘will become carbon neutral’ or that a product ‘will be made of fully recycled materials in the future’, unless these claims comply with the following:

• The claims are based on clear, objective, publicly available and verifiable commitments;

• The commitments are set out in a detailed and realistic implementation plan that includes measurable and time-bound targets and other relevant elements necessary to support its implementation, such as resource allocation;

• The implementation plan is regularly verified by an independent third-party expert; and

• The findings of the independent third-party expert are made available to consumers.

5. Enforcement and implementation

EU Member States are required to adopt national legislation to implement the new rules. There may be differences between different EU Member States in how they implement the ECGT Directive. Germany, for example, applies certain rules on misleading commercial practices to certain B2B transactions. However, the legislative amendment adopted to implement the ECGT Directive into German law expressly limits the requirements for claims about future environmental performance, for example, to B2C contexts.

The ECGT Directive will be enforced by the regulatory authorities of each EU Member State.

Fines for noncompliance can be up to 4% of a trader’s annual turnover in the relevant EU Member State (or more if the relevant EU Member State sets a higher maximum under national law). The relevant consumer laws are also in scope of the EU’s Representative Actions Directive, which allows claimants to bring class-action-style claims in the EU based on noncompliance with these obligations.

With just over six months until the new requirements start to apply, traders operating in the EU are advised to review their websites, product packaging and any other marketing claims for compliance. They should also check their websites and sales flows to make sure that they are compliant with the new consumer information requirements, in particular that they are showing customers the EU harmonised notice and label where required.

Key takeaways:

• Effective 27 September 2026, the EU’s Empowering Consumers for the Green Transition Directive introduces new requirements for traders offering goods and services to consumers in the EU.
• New pre-contractual information requirements will be introduced impacting every retailer in the EU, including an obligation to show customers a harmonised notice as a reminder of the minimum two-year guarantee.
• Certain types of claims will be banned in the EU, including generic claims like ‘sustainable’ and ‘carbon neutral’ claims based on offsets.
• Sustainability labels can only be used if compliance is monitored by an independent third party.
• Claims about future environmental performance trigger obligations to have an underlying implementation plan and commitments that are verified by an independent third party.

If you have any questions, please contact the Cooley EU Products Team.

Global regulator updates

Regulators from around the world shared updates on their current priorities and upcoming initiatives.

Health Canada gave a pre-recorded address reporting on its red tape review, spending reductions and upcoming regulatory changes. These include fragrance allergen disclosure requirements for cosmetics, proposed toy regulation amendments, consultations on furniture tip-overs and button batteries, and a notice of intent on proposed new requirements for lithium-ion batteries and consumer products that contain them.

A speaker from the Wisconsin Department of Agriculture, Trade and Consumer Protection provided an overview of US state-level activity, covering PFAS regulations, battery regulations and emerging bills to watch across multiple states.

Regulators from Brazil (INMETRO), Peru (INDECOPI), Chile (SERNAC) and El Salvador – all part of the Organisation of American States’ Consumer Safety and Health Network that comprises 21 active members – shared regional updates. Common themes included challenges with recall effectiveness (e.g., companies failing to sustain follow-up actions over time), manufacturers applying lower safety standards in Latin America than in other regions and the proliferation of unsafe products sold through ecommerce.

Brazil highlighted its use of mobile labs (including X-ray capabilities) and digital approval labels, as well as a dedicated office overseeing ecommerce platforms. Peru reported on recent regulatory changes requiring recalls to be published through mass media channels such as television, along with its cooperation with customs authorities to identify local suppliers and importers of internationally recalled products. Chile is developing a new interpretative circular on recalls to provide suppliers with greater certainty regarding the steps required following a recall notification. El Salvador presented its 2024 product safety reforms, including a 48-hour recall notification requirement and fines of up to $200,000 for violations.

The European Commission reported on plans to reinforce the European Union’s product compliance and market surveillance framework with proposals to revise the New Legislative Framework and Market Surveillance Regulation as part of the upcoming European Product Act (draft legislation expected in Q3 2026). The European Commission is also coordinating surveillance activities, including product testing across EU member states, and undertaking capacity-building initiatives to help national authorities better understand mental health risks. Studies on safety and circularity and on e-vulnerabilities are expected this year. The European Commission is also supporting United Nations Trade and Development (UNCTAD) in developing a handbook and training materials to implement the recent UN resolution on consumer product safety.

The UK Office for Product Safety and Standards (OPSS) outlined its evolving priorities, focusing on new product technologies, new types of harm (including psychological harm or harm caused by digital security breaches) and a new sectoral approach as a regulator. It is developing a support offering for new and innovative businesses, including an innovative product advice center and regulatory sandboxes. A consultation on reforms under the Product Regulation and Metrology Act will be published soon – including ideas to clarify digital distribution responsibilities, explore new approaches to general product safety and introduce enhanced enforcement tools.

Industry keynotes: Trust and collaboration

Three industry leaders delivered keynotes. The first argued that competitors should never compete on safety, calling for safety IP to be open and for companies to share learnings. The second drew on past crisis experience to outline a response framework – plan, communicate, cooperate, fix, exit and feed learnings back – emphasizing that trust is ultimately what is at stake. The third shared her path from quality compliance to company president, encouraging curiosity, a willingness to work outside comfort zones and remembering that quality is everybody’s job.

Looking back and forward: The ‘Eras Tour’ of product safety

A plenary session traced the arc of US product safety from 1972 to the present, highlighting the creation of the Consumer Product Safety Commission, the shift toward voluntary standards and the landmark 2008 Consumer Product Safety Improvement Act. The overarching message: Return to basics – collaboration, data, testing and certification – while embracing new tools.

Recalls: Practical frameworks

Two sessions focused on recalls. Key reminders included: Revisit prior risk assessments based on new information, consistently follow your processes, partner with cross-functional teams, don’t await final risk assessments, consider when to engage outside experts and periodically test your process. A separate session debunked five common recall myths, underscoring the value of upfront manufacturer-retailer discussions.

Extended producer responsibility (EPR)

A session unpacked the evolving US EPR landscape, covering requirements across seven states, baseline data collection and managing supplier data gaps, practical implementation steps, design impacts, enforcement risk and where EPR is heading.

AI in product safety

Artificial intelligence is already transforming how manufacturers, retailers and regulators work. Applications include computer vision on assembly lines, device telemetry analysis, multimodal analysis of warranty claims, customer support data and social media, as well as bespoke compliance-checking tools. The UK’s OPSS is focused on leveraging AI to drive efficiency gains – improving data gathering and analysis. The panel emphasized the importance of maintaining a human in the loop, with AI augmenting – not replacing – expert judgment.

Older adults: An overlooked group

A session highlighted older adults as an increasingly vulnerable and under-recognized group in product safety – not a niche concern, but a global-scale issue. Australia is undertaking a major project to close existing data gaps.

Consumer education and catalyzing change

Several sessions emphasized the importance of plain language, simple and consistent messaging, and the power of personal stories to educate consumers. Speakers also highlighted that cross-stakeholder collaboration enables the best possible education, engineering and evidence to drive systemic change.

Breakout sessions

More than 20 breakout sessions covered topics ranging from risk assessment harmonization and Internet of Things cybersecurity to right to repair and digital accessibility, plus an “Ask Us Anything” session moderated by Cooley’s Matt Howsare, where attendees drove the conversation.

What’s next?

Mark your calendars: The ICPHSO 2026 North America Product Safety Training Workshop is taking place June 18, 2026, and will be hosted by Lowe’s Corporation in Mooresville, North Carolina. The ICPHSO 2026 International Symposium is taking place September 9 and 10, 2026, in Brussels, held in conjunction with the European Commission’s International Product Safety Week, from September 7 – 10, 2026. Visit the ICPHSO website for further details.

ICPHSO is an international, neutral forum for product safety stakeholders to learn, network and share information. It typically hosts three types of events each year – an annual symposium in the US, an annual international symposium outside the US and regional training workshops based in North America. Cooley is a major sponsor of ICPHSO, and partner Rod Freeman serves as vice president on the ICPHSO executive board of directors.

Multinational companies should monitor cross-border implications, especially in light of other evolving regimes like the EU AI Act and the proposed Digital Omnibus on AI, which will impact businesses’ AI compliance roadmaps.

Read Cooley’s full article on the Executive Order.

It’s been a year since the European Union’s (EU) General Product Safety Regulation (GPSR) started to apply. While some aspects of the regulation have settled into practice, others remain open to interpretation, and the landscape continues to shift.

In the session, we’ll take stock of where things stand for businesses selling consumer products in or into the EU. We’ll focus on what’s clear, what’s less clear, and some implementation and enforcement trends.

Topics will include:

• What’s been clarified over the past year
• How regulators are approaching enforcement and where they’re focusing
• Key compliance challenges for manufacturers, importers, distributors and marketplaces
• Divergence between EU and UK regimes and what it means in practice
• What businesses should be preparing for in 2026

This is a practical, business-focused briefing designed to help legal, compliance and commercial teams stay ahead of developments and manage risk across their product portfolios.

Register your attendance here.

The targeted amendments have important implications for businesses that place, put into service and/or use AI systems in the EU, as well as for product manufacturers that integrate AI systems into their hardware products.

Read the full article on the Digital Omnibus on AI and explore key changes and simplification measures, including what they mean for businesses’ AI compliance roadmaps.

Scope: The GPSR applies in full to consumer products that are not already subject to EU harmonisation legislation (i.e. non-CE marked products) and covers gaps in product safety regulation for consumer products subject to certain EU harmonisation legislation (i.e. CE marked products). The new rules for product recalls and corrective actions under the GPSR apply to all consumer products in scope of the GPSR, including consumer products regulated by EU harmonisation legislation (to the extent that the sector-specific legislation does not provide for its own obligations related to product recalls and corrective actions).

What are the changes for product recalls and corrective actions?

Notifying authorities: Before the GPSR, companies could discharge their obligation to inform national authorities about dangerous products using the business-facing portal of the Safety Gate system (Business Gateway). While there was scope for companies to inform national authorities via other means, in practice, many opted to use Safety Gate. Under the GPSR, however, it is now mandatory to use the business-facing portal of the Safety Gate system (renamed the Safety Business Gateway). Whilst many will be familiar with the Safety Gate system, care should be taken as the online form has changed and is also the same form used to report accidents under the GPSR.

New post-market risk assessment methodology: Commission Delegated Regulation (EU) 2024/3173 establishes a new risk assessment methodology for EU member states to use in support of notifications they make via Safety Gate. The new methodology combines the risk assessment guidelines from both:

• Commission Implementing Decision (EU) 2019/417, laying down guidelines for the management of the European Union Rapid Information System.
• The EU general risk assessment methodology for harmonised products (i.e. many CE-marked products) that covers broader categories of risks.

The new methodology also introduces several changes. One concern for companies has been that the new methodology expands the list of cases that can be deemed to present a serious risk without the need for national authorities to conduct a risk assessment. This builds on a handful of examples under the former risk assessment methodology, which mainly involved chemicals and certain risks associated with children’s products. However, the new list is much broader and includes the following scenarios (among others):

• There is well-documented evidence that certain features of the product consistently lead to a serious risk – with the addition of electrical products with defective components that can lead to electric shock or fire.
• The product has been subject to a recall, withdrawal or removal of online content based on voluntary measures of economic operators or providers of online marketplaces.

The European Commission has clarified in a Q&A document that the presumption of serious risk without the need for a risk assessment under the first bullet point above is a rebuttable presumption. There is scope for national authorities to consider information provided by a manufacturer or importer that a product presents a less-than-serious risk.

In relation to the presumption for products subject to a recall, withdrawal or removal of online content based on the voluntary measures of online marketplaces, the European Commission clarified in its Q&A document that this presumption is applicable where this action constitutes ‘corrective measures, taken in relation to dangerous products and products posing other public interests as regards products covered by the Union harmonisation legislation’. Where the product recall, withdrawal or removal of online content was decided by an economic operator or a provider of an online marketplace for any reason other than these risks, e.g. ‘such as mere commercial reasons’, the presumption of serious risk should not apply.

Communication and advertising: The GPSR introduces a new express obligation to directly notify all affected consumers that can be identified ‘without undue delay’, making use of personal data collected. If not all affected consumers can be contacted directly, companies will be required to disseminate the recall notice using alternative channels such as their website, social media, newsletters, retail outlets and media announcements. This information should be accessible to persons with disabilities.

Recall notices: The GPSR introduces a new obligation to use a recall notice when communicating with consumers in writing and lays down requirements for what the recall notice needs to contain. This includes certain information about the product, the hazard, the actions consumers should take and the recall remedies available. Certain terms that may decrease a consumer’s perception of risk are prohibited, such as ‘voluntary’, ‘precautionary’, ‘discretionary’, ‘in rare/specific situations’ or statements indicating that there have been no reported accidents.

The European Commission has provided a template recall notice in Implementing Regulation (EU) 2024/1435, with subsequent corrections published in July 2024. The Commission clarified in a Q&A document that, whilst use of this template is recommended, use of the template itself is not mandatory. Another format for the recall notice that satisfies the requirements listed in the GPSR can be used. 

Recall remedies: The GPSR introduces new requirements surrounding recall remedies. This includes offering consumers a choice of at least two remedies from repair, replacement or refund. However, there is some flexibility for only one remedy to be offered in certain cases where other remedies would be impossible or disproportionate. The GPSR also lays down rules surrounding asking consumers to repair products themselves, asking consumers to dispose of products, who is to bear the costs of returning a product and the collection of nonportable products.   

New obligations on online marketplaces: The GPSR introduces new obligations for online marketplaces, including reporting dangerous products via the business-facing portal of Safety Gate, directly notifying affected consumers who purchased a product through their interfaces about recalls and publishing recall information on their online interfaces.

What’s next?

The European Commission is yet to publish its formal guidance on the GPSR, with tentative indications that this may possibly be published on 19 November 2025.

Companies that supply products to the EU should ensure that they understand the new requirements and review and update their internal recall plans.

Like to know more?

Get in touch with any member of the Cooley products team to find out more about the new rules under the GPSR and how they may impact your products.

This is the fourth in a blog series where the Cooley products team explores the new rules under the GPSR. See the first post in the series, ‘What’s New?’, along with the second post, ‘An Expanded Concept of Safety’, and third post, ‘New Accident Reporting Obligations’.

These requirements were originally due to apply from 18 August 2025, but the European Commission extended this date by two years, to 18 August 2027.

If you are wondering whether the Batteries Regulation applies to your products, please see Part 1 of our series.

Who is in scope?

The battery due diligence obligations apply to manufacturers or importers placing batteries on the EU market, where their net turnover (or the net turnover of their group) is at least 40 million euros in the financial year preceding the last financial year. There is currently a European Commission proposal to increase this turnover threshold to 150 million euros. This proposal is part of a larger package of reforms and is currently still under negotiation.

The obligations apply to economic operators responsible for placing both stand-alone batteries and batteries that are incorporated into products on the EU market. This means that manufacturers and importers will be responsible for compliance with these requirements where they place batteries on the EU market, even where their batteries were originally sourced from a third party outside the EU.

What are the new requirements?

From 18 August 2027, companies in scope must implement a comprehensive battery due diligence system covering the following pillars:

1.     Battery due diligence policy (DDP)

Businesses must adopt a corporate battery DDP addressing the sourcing of cobalt, lithium, nickel, natural graphite and related compounds. The policy must identify social and environmental risks and align with international standards. The battery DDP must also be verified by a notified body, and compliance must be audited annually.

2.     Update supplier contracts

Supplier contracts must incorporate both the company’s battery DDP and its risk management measures. In practice, this means that most businesses will need to take steps to amend their existing contracts now, so the new measures are incorporated for the compliance deadline.

3.     Traceability system

Companies are also required to establish a system of controls and transparency over their supply chain, including a chain of custody or traceability system which identifies upstream actors in the battery supply chain. In practice, this can take some time to put in place, given many companies’ limited visibility over their supply chains beyond their direct suppliers.

The traceability system must be supported by documentation that provides at least the following information:

• A description of the raw material, including its trade name and type.
• The name and address of the supplier that supplied the raw material to the economic operator that places the batteries on the market.
• The country of origin of the raw material and the market transactions from the raw material’s extraction to the immediate supplier to the economic operator placing the battery on the market.
• The quantity of the raw material present in the battery, expressed in percentage or weight.
• Third-party verification reports issued by a notified body, or if these are not available and the raw material originates from a conflict-affected and high-risk area, additional information as set out in the Organisation for Economic Co-operation and Development (OECD) Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas.

For many businesses, this will require greater scrutiny over their supply chains, particularly for those purchasing batteries from third parties before incorporating them into products.

4.     Oversight responsibility with top management level

Businesses must establish a risk management system that assigns responsibility for overseeing the battery DDP to the company’s ‘top management level’. The company must also report the findings of its risk assessment to the top management level. Generally, we see companies setting this up by establishing a committee that includes senior management.

5.     Due diligence and risk management

Businesses must conduct a risk assessment to establish whether there are any adverse impacts in their battery supply chain associated with the risk categories listed in Annex X (which includes environmental impacts, human rights and community life, including that of Indigenous people).

Following this assessment, businesses are required to develop a risk management plan which includes a strategy to address the identified risks – including mitigation, supplier engagement and escalation – with the findings being reported to top level management. Companies are expected to keep this plan under review, and it should be adapted when any new risks are identified.

6.     Grievance mechanism

There is also a requirement for the company’s due diligence system to integrate grievance and remediation mechanisms aligned with the United Nations’ Guiding Principles on Business and Human Rights.

7.     Annual Closure

Annually, businesses must publish a report on a free-to-access website which must include data and information on steps taken to comply with the due diligence requirements, any significant adverse impacts in identified risk categories and how these have been addressed. The report must also include a summary of the third-party audit carried out regarding the business’ compliance with its battery DDP.

The first report will likely need to be published by 18 August 2028.

8.     Record-keeping and audits

Documentation, including audit and verification reports, must be retained for 10 years after the last battery covered by the battery DDP is placed on the market.

Compliance with all the requirements mentioned in this blog post must be audited periodicallyby a notified body.

How can companies get support with compliance?

Businesses can join a recognised scheme to support their compliance programs but will remain individually liable for compliance. This means that while schemes can support compliance, ultimately it will be up to each company to make sure they have a compliant policy and process, do the audit on time and keep the necessary documentation. At the time of writing this post, no due diligence schemes have been recognised by the European Commission. Once a scheme has been recognised, it will be recorded in a public register maintained by the European Commission. 

The European Commission is required to adopt guidelines to support the due diligence obligations by 27 July 2026.

What should my business do next?

The Batteries Regulation applies in addition to other EU due diligence laws, such as the Conflict Minerals Regulation, Critical Raw Materials Act and the upcoming Corporate Sustainability Due Diligence Directive (CSDDD). Businesses are advised to approach their EU supply chain diligence compliance holistically, since it may be possible to leverage compliance with other due diligence laws that also apply to them. 

Concretely, we recommend that companies:

• Review existing supply chain policies and update for EU Batteries Regulation compliance or create a new battery DDP.
• Review and update contracts with battery suppliers to integrate the battery DDP and risk management processes.
• Update governance processes and assign oversight responsibility to top management.
• Put in place a traceability system for the battery supply chain. 
• Start doing due diligence on the company’s battery supply chains to assess environmental and/or human rights risks, and document processes.
• Engage a notified body for the audit once they are designated by the European Commission.

Stay tuned for Part 5 of our ‘Battery Shorts’ series, which will cover the new removability and replaceability requirements in the Batteries Regulation.

The NLF (Decision No 768/2008/EC and Regulation (EC) No 765/2008) sets out the template for rules governing CE-marked products in the EU. There are 30 legal acts aligned to the NLF template – so a revision to the NLF would have a broad impact. The aim of the revision is to boost harmonisation, cut regulatory burdens and leverage digital tools to improve compliance and safety.

The call for evidence outlines the potential legislative options being explored by the European Commission. These range from targeted amendments, through to comprehensive revisions, including amendments to the NLF and product harmonisation legislation to:

• Introduce mandatory DPPs, which would be a digital record of a product’s compliance and supply chain information.
• Revise conformity assessment processes.
• Align definitions with other EU legislation, such as the Market Surveillance Regulation (EU) 2019/1020.
• Address certain practices of notified bodies and strengthen oversight of notified bodies.
• Ensure timely and consistent responses to noncompliant and dangerous products across Member States.

The European Commission previously outlined its ambitions to progressively roll out DPPs to become the main tool for disclosing and sharing product information across all new and revised EU product legislation using the proposed revision of the NLF in its Single Market Strategy in May 2025. This would build on the framework for DPPs currently being established under the Ecodesign for Sustainable Products Regulation (EU) 2024/1781 (ESPR), where requirements for DPPs will be laid down for specific product groups, such as textiles, by future delegated acts made under the ESPR. There are also requirements for DPPs for certain products included in recently revised rules – such as the provisional agreement for the new Toy Safety Regulation, the new Construction Products Regulation (EU) 2024/3110, and for certain large batteries under the Batteries Regulation (EU) 2023/1542.

We don’t know yet how quickly the European Commission plans to roll out the expansion of DPPs under the NLF revision. If future requirements for a DPP are progressively added to existing pieces of product harmonisation legislation as those rules come up for review, or when new product harmonisation rules are made, this would result in a much slower rollout. Alternatively, if proposed amendments introducing requirements for DPPs across a number of pieces of product harmonisation legislation are contained in an omnibus proposal presented at the same time as the amendments to the NLF template legislation, this process could be much faster – and we could see widespread adoption of DPPs in the next few years.  

The revision of the NLF builds on the shorter-term simplification measures proposed in the Omnibus IV package of draft legislation presented in May 2025 and currently working its way through the EU legislative process. The Omnibus IV proposals include amendments to 20 pieces of EU harmonised product legislation for CE-marked products and seek to introduce digital Declarations of Conformity (DoCs) and flexibility to provide digital instructions for use, and empower the European Commission to adopt common specifications to fill the gap where harmonised standards are not yet in place. The Omnibus IV proposals would require the DoC and instructions be provided on a DPP, where a product is required to have a DPP under EU law.

Whilst one of the focuses of the Omnibus IV proposals is to reduce administrative burdens, in practice, we consider that there is a real risk that they will have the opposite effect. For example, the proposals include new obligations that may mean changes will need to be made to hardcopy labelling, in-box materials, digital instructions and DoCs – potentially increasing burdens and costs in the short term. Similarly, whilst we are aware of widespread industry support for e-labelling, if the NLF revisions mandate much wider adoption of DPPs, this will increase burdens for businesses in the short term, which will need to digitalise product compliance documentation for existing products.

A public consultation for the proposed revision of the NLF is planned for Q4 2025. Draft legislation is expected to be presented around Q3 2026, as part of the proposed European Product Act announced in the European Commission’s 2026 work programme. We will continue to blog updates on this topic on Productwise.

This year’s international symposium was held in London with a record attendance of nearly 370 delegates from more than 30 countries – including representatives of regulators, manufacturers, retailers, online marketplaces, testing laboratories, consumer organisations, law firms, standards organisations and academia. Cooley’s Rod Freeman, vice president of ICPHSO, served as the planning chair for the program, working alongside the planning committee of volunteer ICPHSO members.

Sarah Smith, deputy chief executive at the OPSS, opened the conference, providing a snapshot of product safety opportunities, as well as the challenges OPSS is seeing. We heard about the recently passed Product Regulation and Metrology Act (PRAM Act), a framework piece of legislation that gives the UK government powers to reform UK product safety laws via secondary legislation and represents one of the biggest product safety legislative reforms in the UK in the last 40 years. A consultation on using these new powers is expected before the end of the year. We also heard about OPSS’s continued focus on online marketplaces, new technologies (in consumer products, those used for compliance, e.g. by online marketplaces, and how the civil service can use artificial intelligence), and the broader priority of the UK government to simplify and reduce administrative burdens for businesses.

The first keynote was a fireside chat with former US Attorney General Eric Holder. This discussion offered insights into how companies can strengthen trust and resilience while navigating fast-evolving global product safety and compliance obligations. Key takeaways included the importance of a truly effective compliance program, being aware of legal requirements and building relationships with regulators in other jurisdictions, and the importance of diversity, equity and inclusion.

Arnau Izaguerri Vila, legal officer at UN Trade and Development (UNCTAD), also delivered a keynote focusing on UNCTAD’s work, including the recently adopted UN Principles for Consumer Product Safety that will now go before the UN General Assembly in December 2025. This is the first globally agreed framework for product safety and an important step to improve product safety for consumers worldwide.

The “Global Regulator Update” featured speakers from the European Commission, OPSS, Health Canada and the Australian Competition and Consumer Commission (ACCC), who spoke about their priorities, what has been keeping them busy and what gives them hope for the future. Some common themes emerged, including a continued focus on online marketplaces, lithium-ion batteries (particularly for e-bikes), and button and coin cell batteries, as well as priorities to promote competitiveness and growth within their respective economies. We also heard that the guidance on the European Union General Product Safety Regulation (GPSR) has been translated and may be published in the next month.  

The first plenary, “AI-Improving Compliance from Differing Lenses”, featured perspectives from academia, testing and a regulator. We heard about the possibilities of using AI to assess potential product safety issues, and how the European Commission is using AI both to search on a greater scale than ever for the online sale of products already covered by safety alerts and to proactively identify new safety trends and issues at an early stage before they escalate.

“Product Safety in Latin America: Regional Challenges, a Call for Focused Attention, and the Urgency of Harmonizing Regulation and Market Surveillance” explored the product safety landscape in Latin America. Despite market challenges, including fragmented regulations, limited enforcement and the widespread presence of informal markets, the panel explored encouraging signs of progress. Regional cooperation is gaining momentum, aiming to raise safety standards while easing compliance for businesses. The panel highlighted that these efforts are increasingly international, with Latin American regulators drawing on product safety data from other jurisdictions and the EU’s harmonised approach noted as a potential model for future regional alignment in Latin America.

“Regulation Hokey Cokey!”, moderated by Cooley’s Claire Temple, explored the rapid pace of change in the product regulatory landscape, including new regulation, deregulation and simplification. The session noted how it is more challenging for companies than ever before to stay on top of developments. Steps that can be taken include horizon-spotting, educating internal stakeholders and creating contingency plans in anticipation of change.

In “Market-Driving Sustainability: Ensuring Product Safety in a Circular Economy”, we heard how industry continues to drive a shift to more sustainable products. However, improving sustainability without considering product safety can create risks for consumers. The panel shared how suppliers, standards bodies and testing organisations are adapting to new realities – including the rise of third-party remanufacturing and increased use of recycled materials. To manage these changes, they emphasised the importance of increased testing, closer collaboration across supply chains and product chains of custody.

“Navigating Obligations Under the New Packaging Regulation” explored new rules coming into application across the EU. We heard about the shift to a full life cycle approach, examples of steps companies can take to achieve compliance and the requirements that are most challenging for different actors.

 “Disruption: Maintaining Safety and Compliance When Geopolitics Disrupt Your Supply Chains” explored how disruptions to supply chains can affect businesses and ways to maintain product safety and compliance. One key takeaway was the importance of stress-testing continuity plans.

“Collaborative Solutions for Ensuring Product Safety in Third-Party Online Marketplaces”, led by Consumer Reports, brought together representatives from Which?, Amazon and OPSS. The panel discussed ways they have engaged in collaborative dialogue to develop innovative strategies for enhancing consumer protection in the evolving digital marketplace.

“Intersection of Consumer Product Safety and Mental Health” explored the topical issue of mental health following reforms made by the EU GPSR. One takeaway was the data gap that currently exists on the prevalence of mental health harms. A representative from the Organisation for Economic Co-operation and Development (OECD) took attendees through some of the findings from a study on products that incorporate digital aspects, including mental health considerations not yet published.

The conference also featured shorter, rapid-style sessions covering risk assessments under the EU’s new GPSR, the digital safety landscape, a guide to button battery standards worldwide, data-driven sustainability and apprehending product safety in the era of the new EU Product Liability Directive. One stand-out rapid session was “The Recall Loophole: How Fraudsters Game the System – and What It Costs Us”, which explored how fraud is reshaping recall dynamics, how this affects consumers, and some of the ways to tackle this issue without putting undue burdens on honest consumers.

One important role ICPHSO plays is to train and mentor the next generation of product safety professionals. At the end of the conference, we heard from the students who took part in the International Student Mentorship Program, who shared how they found the event.

This year’s event was also held in collaboration with the UK charity Electrical Safety First (ESF). Many attendees stayed on to attend ESF’s annualElectrical Product Safety Conference 2025, which followed on 16 October at the same venue.

ICPHSO is an international, neutral forum for product safety stakeholders to learn, network and share information. It typically hosts three types of events each year – an annual symposium in the US, an annual international symposium outside the US and regional training workshops based in North America. The next ICPHSO in-person event will be the 2026 Annual Meeting and Training Symposium taking place February 23 – 26, 2026, in Orlando, Florida. Visit the ICPHSO website for more information.

Online marketplaces and ecommerce now dominate the modern world of B2C transactions. But what does that mean in terms litigation risk – be that regulatory litigation or consumer / commercial litigation? And which areas present the highest risk for businesses operating in this industry?

In this webinar, we’ll take a look at what’s changing for online marketplaces and ecommerce in terms of regulatory obligations, consumer rights, and what it means for businesses and legal teams working in the digital space in terms of litigation risk. We’ll help unpack the latest legal developments across the EU and UK.

Tuesday, 15 July 2025 – 4:30-5:30pm BST

Register now.

CLE credit
Attendees may earn up to 1.0 CLE credit for participating in this live webinar.
Credit will not be granted for on-demand viewing.
Cooley LLP is an approved provider and will provide credit in CA, CO, IL, NY, PA and TX.
Cooley LLP is a sponsor and will apply for credit in FL, OH, VA and WA.
Credit in other jurisdictions may be available via reciprocity.
If you have specific CLE credit questions, please contact Cooley’s CLE team.

If you are wondering whether the Batteries Regulation applies to your products, please see Part 1 of our series. For information on conformity assessment and CE marking, please see Part 2 of our series.

Substance restrictions

The Batteries Regulation incorporates restrictions on mercury and cadmium which are included in the EU’s existing Batteries Directive. It also introduces a new restriction on lead.

The restrictions are as follows:

• All batteries must not contain more than 0.0005% of mercury by weight.
• Portable batteries must not contain more than 0.002% of cadmium by weight.
• Portable batteries must not contain more than 0.01% of lead by weight.

These requirements have applied since 18 August 2024, save for the lead restriction on portable zinc-air button cells, which does not apply until 18 August 2028.

Manufacturers of portable batteries and products containing batteries must ensure their batteries comply with these restrictions.

The European Commission has powers to add further substance restrictions in the future.

Labelling of restricted substances

The Batteries Regulation introduces several new labelling requirements, which will be summarised in a later instalment of our series. At this stage, we flag that all batteries containing more than 0.002% of cadmium or 0.004% of lead must be labelled with the chemical symbol for the relevant metal.

Where it is not possible to mark this information on the battery itself, it can be provided on packaging or accompanying documentation.

Stay tuned for Part 4 of our ‘Battery Shorts’ series, which will summarise the new supply chain diligence requirements applicable from 18 August 2025.

If you are wondering whether the Batteries Regulation applies to your products, please see Part 1 of our series.

Conformity assessment and CE marking

Many product manufacturers will be familiar with the EU conformity assessment process if they sell CE marked products. For the first time, the Batteries Regulation introduces a requirement to conduct a specific EU conformity assessment for the battery, in order to demonstrate compliance with the requirements of the Batteries Regulation.

Manufacturers need to:

• Draw up technical documentation and a Declaration of Conformity (DoC) for their batteries, which can be combined with the DoC for products containing batteries. When it comes to evidence of compliance, if manufacturers apply harmonised standards or common specifications laid down in an implementing act (where these exist), this gives rise to a presumption of conformity.
• Establish procedures to ensure conformity of products containing batteries as part of series production.
• Retain technical documentation and the DoC for 10 years after the last battery has been placed on the market.
• Apply the CE mark on batteries. The CE mark should be affixed visibly, legibly and indelibly to the battery itself. Where this is not possible or not warranted due to the nature of the battery, it should instead be affixed to packaging and accompanying documentation. Where notified body involvement is required, the notified body number should be affixed next to the CE mark.

Can I rely on my third-party battery supplier to comply with these requirements and draw up the necessary documentation?

Many product manufacturers will be purchasing batteries from third-party suppliers. However, the manufacturer of the finished product remains legally responsible for compliance of the product as a whole, including the battery.

Where manufacturers rely on documentation provided by a third-party battery supplier as part of their evidence of conformity, they should ensure that they have taken steps to verify the accuracy and completeness of the technical documentation and put in place appropriate contractual protections in the supplier agreement. A manufacturer of a product containing a battery will need to draw up and sign its own DoC, though it may be possible to rely on a third-party battery supplier’s compliance documentation in support of this.

If you have any questions about the conformity assessment procedure, or other requirements under the Batteries Regulation, please reach out to your usual Cooley contacts.

Stay tuned for Part 3 of our Productwise Battery Shorts series, which will summarise the new substance restrictions in the Batteries Regulation.

Plenary session 11 featured speakers from Whirlpool and Exponent.

The panel discussed the components of a successful product safety compliance program (PSCP) – compliance, communication, culture and continuity. They provided their insights on how a company can implement or strengthen its existing PSCP in an effort to maximise the safety of its products and better withstand government scrutiny.

Below are some key takeaways and insights from the panel on the four Cs of company PSCPs:

1. Compliance

Companies should not just ensure that they are compliant with applicable laws and regulations, but also consider and comply with internal company rules and practices.  

During the production phase, companies should take into account a number of considerations including in respect of the equipment that is selected for production, whether it is being maintained and calibrated, whether there is adequate quality control, and whether all the data from any testing being carried out is being captured and uploaded to systems and databases to allow for traceability.

2. Communication

The panel discussed effective methods of communicating product safety compliance issues both internally and to consumers. Ad hoc communications are important, but the panel emphasised the importance of having defined processes in place to ensure that reactive communications can take place when issues arise. For example, is there a mechanism for whistleblowers to report anonymously if they become aware of a product compliance issue?

3. Culture

The panel discussed how corporate culture is important as it informs the beliefs and practices concerning product compliance. They noted the importance of integrating safety into the culture of the company so that all stakeholders can take decisions effectively during a crisis. Examples on how this can achieved include mission statements, training on safety campaigns and opening meetings with safety-related discussions.

4. Continuity

Finally, the panel noted that internal procedures should be updated on a regular basis so that the PSCP can deal with new challenges, such as artificial intelligence, and ensure continuous improvement.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event. 

Key contacts:

• Anushi Amin
• Jamie Humphreys

This panel session featured a regulator, a retailer, a consumer advocate (the president and founder of Reese’s Purpose), and our very own Lissie Ng, a Cooley associate.

The panel gave us insight into what happens when a product safety hazard is addressed via a product safety requirement – a law that must be implemented and followed by industry. The relatively recent enactment of Reese’s Law (dealing with button cell/coin batteries) has done just that.

The ingestion of button cell batteries by children can lead to death or serious injury, and the panellist from Reese’s Purpose spoke movingly about the death of her daughter, Reese. Following her advocacy, Reese’s law was introduced, presenting the following requirements for consumer products containing or designed to use button cell or coin batteries:

• Battery compartments containing replaceable button cell or coin batteries must be secured such that they require the use of a tool or at least two independent and simultaneous hand movements to open.
• Button cell or coin battery compartments must not allow such batteries to be accessed or liberated as a result of use and abuse testing.
• The packaging for the overall product must bear a warning.
• The product itself must bear a warning, if practicable.
• Accompanying instructions and manuals must include all of the applicable warnings.

The panel focussed on issues faced by industry stakeholders when managing a fast-tracked implementation of product safety law. A key tension emerged – timing.

• The longer it takes to enact a new product safety law, the longer consumers (in this case, children, one of the most vulnerable consumer groups) are at risk.
• Manufacturers, retailers and testing labs, on the other hand, have to manage complex implementation procedures in a compressed time frame. Businesses want to ensure compliance, but high-quality procedures take time.

Industry stakeholders can help manage this process by:

• Keeping open lines of communication with regulators, experts and advisors, allowing companies to pivot easily as the requirements evolve through the drafting/implementation process.
• Acting early – Don’t wait until the last minute to determine whether implementation will impact your business, or you could end up facing a last-minute scramble to comply. Feedback from companies that complied with Reese’s Law noted that monitoring developments early and often led to a smoother compliance path.
• If you are uncertain on the requirements – ask for help. There is no ‘one size fits all’ in this process.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Jamie Humphreys
• Harriet Jones

Plenary session 8: ‘Women in Product Safety Leadership’ featured speakers from the Toy Association, Exponent, Safe Kids Worldwide, GE Appliances and the legal industry.

The panel gave attendees an opportunity to hear from five women who have been in the product safety space for a number of years and took leadership roles in their respective fields. The panel described both the challenges and opportunities facing women in product safety – across engineering, advocacy and policy.

For first-time attendees, particularly those just starting out in their careers, the panel offered a unique opportunity to hear more about different paths in product safety, from a diverse group of industry representatives.

Some particularly interesting discussions were had around:

• The importance of role models, particularly for individuals from less-represented backgrounds. Sponsoring someone else’s success is the best gift leaders can give to their teams, or anyone starting out in the product safety world.

• What makes a good leader, with the panel agreeing that authenticity, listening and trust are the key qualities people who want to become leaders should look to develop. Together, these assets empower teams to act, and to work together for the best outcomes.

• Building a ‘trusted advisor’ role, whether that is backed by science or by knowledge of other similar scenarios in the market. This inspires confidence with both internal and external teams and is the ‘gold standard’ of a leader.

• The child safety industry, particularly how it is adapting to new ways of information being shared on children’s products. This presents a great opportunity for advocacy groups to educate parents on child safety, particularly in areas like car seat safety.

The Cooley products team are posting highlights from other plenary panel sessions on our blog throughout the event, which concludes today.

Key contacts:

• Emma Bichet
• Julia Greaves

‘Health Canada Updates’ featured Nadira Rambritch, a representative from Health Canada, the Canadian consumer product and cosmetics regulator. Rambritch provided an overview of the Canadian consumer product regulatory regime, Health Canada’s enforcement approach and enforcement activities to date.  She emphasised the extensive resources Health Canada has made publicly available on its website to help industry take a proactive approach to compliance. Highlights included:

• An outline of Health Canada’s program priorities, which focused on three key areas covering lithium-ion batteries, consumer chemical products and toys.
  
  • For lithium-ion batteries, Health Canada is proposing to introduce risk management requirements under the Canadian Consumer Product Safety Act(CCPSA). To support this proposal, Health Canada plans to engage interested parties in 2025 on a ‘Notice of Intent’ to seek early comments on the proposal.
    
  • For consumer chemical products, it was noted that current regulatory requirements set out in the Consumer Chemicals and Containers Regulations, 2001, are focused on acute hazards. Health Canada is now exploring the adoption of guidelines on risk-based labelling for chronic hazards.
    
  • For toys, Health Canada is planning to update the Canadian Toys Regulation to enhance protections for children from chemical and toxicological hazards in toys, and to reduce or eliminate the need for animal testing. In terms of consumer outreach, Health Canada is currently finalising its next two-year plan, which is expected to focus on button batteries, safe sleep and incident reporting. 

• A focus on collaboration. Health Canada emphasised the importance of increased collaboration and harmonised efforts with other regulators – in particular, the US Consumer Product Safety Commission (CPSC) – on key common product safety issues to ensure consistent safety requirements, facilitate efficient enforcement and reduce compliance burdens for manufacturers. A key feature discussed was the success of the recently published binational standard for power banks developed in conjunction with the CPSC to address risks, such as overheating, fire and explosion of portable power banks. This collaborative process is anticipated to become a blueprint for future North American collaboration as regulators seek to address emerging product safety risks. 

• Priorities. Compliance monitoring by Health Canada remains risk-based, with product groups assigned a risk score each year based on trends in consumer complaints, international regulatory action, and new science related to consumer product and cosmetic safety. Although these risk scores and list of priority products are not publicised at the time, reports on the previous year’s enforcement priorities are published on Health Canada’s website, giving companies insight into the regulator’s historic areas of concern. The need to address ecommerce-related risks was noted as an area of growing concern for Health Canada. Certain measures have been implemented already, including new internet scouring tools used by Health Canada to facilitate the preliminary identification of unsafe products for sale online. The voluntary Canadian Product Safety Pledge, to which certain online marketplaces are signatory, also was shown to be successful, with signatories removing from their listings 78 products identified by Health Canada as noncompliant within two days of receiving the notice. Notwithstanding, ecommerce is likely to remain a focus area for Health Canada in the coming years.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Emma Bichet
• Jack Eastwood

Plenary session 6 featured Jim Joholske, director of the US Consumer Product Safety Commission (CSPC) Office of Import Surveillance, and speakers from SGS North America, Hasbro and The Step2 Company.

The panel provided an overview of the CPSC’s incoming eFiling system, which is set to revolutionise product compliance data reporting in the United States. Hasbro and The Step2 Company, both early adopters of the eFiling process, offered insights into their learnings. Key takeaways included:

• Don’t wait until July 2026, start preparing now. This was the overriding message from industry, who acknowledged difficulties in data collection and processing at scale, as well as the need to communicate to all relevant stakeholders (e.g., companies overseas, third-party testing labs, etc.). Although the legal requirements for eFiling take effect for most imported products on July 8, 2026, and January 8, 2027, for those products imported from a Foreign Trade Zone, there are options to engage with the eFiling process already. CPSC is expanding its eFiling Beta Pilot to 2,000 companies, presenting a good opportunity for companies to get accustomed to the new requirements voluntarily in advance of the enforcement date. Currently, prospective registrants still need to request access via the email address, but the CPSC Product Registry is expected to shift to an on-demand service in the coming months, allowing businesses to create accounts instantaneously. As there is no de minimis rule exempting importers of regulated consumer products from e-filing, businesses were encouraged to assess whether they are likely to be impacted by this new rule and act swiftly.

• Businesses should identify the eFiling model that works for them and communicate these decisions to their trade partners. The CPSC Product Registry, a secure online application where importers can store and manage their product certificate data to file, has been established by the CPSC to give registered importers greater flexibility when complying with incoming eFiling requirements. While use of the CPSC Product Registry is not mandatory, it gives businesses the option to file a Reference PGA Message Set rather than a Full PGA Message Set each time they import a product. While a Full PGA Message Set requires businesses to transmit all required certificate data elements into the US Customs and Border Protection (CBP) Automated Commercial Environment (ACE) system, the Reference PGA Message Set saves businesses from having to file seven product data points each time. The Full PGA Message Set is recommended for those who import a limited number of regulated consumer products or do not repeatedly import the same product. The Reference PGA Message Set is recommended for those who repeatedly import regulated consumer products covered by the same product certificates.

• Best practices for eFiling implementation. The CSPC already offers multiple resources (available online) to help importers and trade partners familiarize themselves with the eFiling process. Best practices raised to prepare for the incoming rule were:
  
  • Establish integrated communication channels, setting clearly defined roles and responsibilities among stakeholders at each step.
  • Develop technical solutions to enable data flow.
  • Assess readiness for compliance to ensure that you have sufficient staffing support and resources.
  • Identify the eFiling model that works best for you.
  • Start communication early, especially with those shipping direct to US retailers.

• Implications for enforcement. eFiling is expected to support more targeted enforcement efforts by the CPSC allowing current product risk scoring to move away from Harmonized Tariff Schedule (HTS) codes. New codes – possible once the eFiling regime is up and running – will be based on a broader set of data points, including manufacturer, test labs, etc. For reputable importers, this is anticipated to result in lower risk scores, reducing the risk of CPSC involvement. 

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Jack Eastwood
• Jamie Humphreys

Plenary session 7: ‘Americexit’ featured insight from a strategic advisor, a regulatory affairs leader and a global product compliance leader from a global company.

The panel explored how, while Europe largely consolidates its product safety requirements at the European Union level, there has been decentralisation of regulation in the US and a trend of individual states adopting their own regulations. The panel expects that states will increase legislation focused on the environment and consumer protection and noted that at least 32 states are considering policies to ban certain chemicals. They also explained that states are tending to focus on regulating chemicals by hazard rather than by risk, and expect a focus on the regulation of chemical classes in an attempt to avoid piecemeal legislation.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Emma Bichet
• Cristina Ferruolo

ICPHSO’s Global Regulator Update featured senior representatives from the US Consumer Product Safety Commission (CPSC), the UK’s Office for Product Safety and Standards (OPSS), the European Commission and the National Consumer Commission of South Africa.

The panel explored the most significant regulatory activities in their jurisdictions from the past year, the challenges they face on a day-to-day basis and how they engage with each other to find common solutions for common problems. Of particular note was the announcement from the UK representative that the UK government intends to legislate and hold online marketplaces accountable for the products sold on their platforms.

Other key highlights included:

Significant regulatory activities

• Introduction of new legislation: Representatives from the UK, European Union and US discussed a raft of legislative changes, including the UK’s Product Safety and Metrology Bill, which is anticipated to pass by Q3 2025, the EU’s General Product Safety Regulation (GPSR), specifically, the introduction of secondary legislation outlining recall templates and the Consumer Safety Gateway, and the finalisation of requirements in the US on button cell batteries and nursing pillows/infant support cushions.

• Revision of existing regulatory frameworks: The South African representative explained the ongoing intergovernmental drive to separate the regulation of foodstuffs from general consumer products.

• Focus on lithium-ion batteries and micromobility: The UK and US representatives explained that both regulators had a strong emphasis on lithium-ion batteries and micromobility products (e.g., e-bikes). Whilst both recognised the utility of these products, it was agreed that new initiatives were needed to better address risks, such as overheating, fire and explosions.

• Consumer protection and education: All jurisdictions explained that they are enhancing consumer protection through internal and external educational efforts, with the aim of empowering companies and consumers with the information and tools to ensure the products they produce, buy and use are safe.

Key challenges faced by regulators

• Understanding and implementing new legislation: The EU and US representatives both discussed the challenge of educating companies on new legislative requirements, especially those based in foreign jurisdictions. The EU representative explained that the European Commission was receiving a significant number of inquiries in respect of the GPSR and, alongside to responding to these, was hosting educational webinars and developing FAQs, guidance, and communication campaigns to help all stakeholders comply.

• Online marketplaces: The interconnected nature of modern commerce presents unique regulatory challenges. In particular, the UK representative announced that the UK government intends to legislate and hold online marketplaces accountable for the products sold on their platforms.

• Education and outreach in developing countries: The South Africa representative explained that a particular challenge in countries with more nascent product safety systems is to educate large numbers of small manufacturers to ensure they understand – and comply with – product safety regulations. This requires extensive outreach and collaboration with various governmental bodies to integrate these businesses into the regulatory framework.

In wrapping up the session, all representatives emphasised the importance of collaboration both with the regulators on the panel, other regulators worldwide and in other forums – e.g., the Organisation for Economic Co-operation and Development (OECD) or the United Nations (UN). Given the rapid nature of recent changes in product safety, it is clear that ongoing cooperation and collaboration is the only way in which common solutions can be found to common problems.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Emma Bichet
• Fergal Duggan

The panel considered how manufacturers manage an overwhelming number of different regulations and standards when selling products internationally. The consequence: Difficult choices have to be made as manufacturers may have to limit where they sell their products to mitigate the cost of compliance in multiple jurisdictions.

The panel took a deep dive into the advantages and disadvantages of regulatory harmonisation and cross-border recognition and how they can be used to manage international trade and regulation. A number of core issues were addressed:

Why is global harmonisation or mutual recognition so difficult to achieve?

• There are divergent legal and regulatory frameworks shaped by complex factors, such as history, politics and different appetites for enforcement and bolstering trade. 
• There are often resource constraints in relation to pushing standards forward.
• The availability of data can differ dramatically between different jurisdictions.
• Countries will naturally have divergent priorities, and the way communities think about safety and the issues central to their work will differ. Stakeholders need to identify the similarities instead of the differences, to help drive harmonisation forward.  

What are the potential downsides for consumers with global harmonisation or mutual recognition?

• There is a risk that consumer protections are in fact reduced in order to achieve alignment with another jurisdiction, leading to harmonisation acting as a floor as opposed to a ceiling.
• Without consistent enforcement, safety loopholes can be created, which is more likely to lead to noncompliant products.
• Trying to achieve alignment can mean there is a slower response to emerging risk. Keeping pace with changes is already challenging, and it will be important to ensure harmonisation efforts are agile enough to meet emerging risks.
• Consistency is key for consumers, and when the consumer voice is not part of the conversation, there can be downsides. 

What are the advantages for manufacturers with harmonisation or mutual recognition?

• Harmonisation leads to greater time and cost effectiveness.
• A higher volume of compliance requirements can increase the risk that an obligation will be missed. Harmonisation reduces this risk.
• Manufacturers prioritising safety will ultimately show they are taking a proactive approach to regulatory compliance and ensuring safety in their products.

So, what are the key takeaways?

• Regulatory harmonisation and mutual recognition can benefit international trade and consumer safety.
• A patchwork of standards introduces risks and can create challenges for compliance.
• Collaboration is key, and all stakeholders should be at the table. The right voices will drive positive change forward.
• There is no magical solution – this must continue to be a collaborative and constructive process, and it will take time. This is a challenging problem, but with challenge comes opportunity.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Jamie Humphreys
• Harriet Jones

Plenary session 4: ‘Leveraging AI for Transforming Product Safety Learnings’ featured Elliot Kaye, a partner at Cooley and the former chairman of the US Consumer Product Safety Commission (CPSC), along with speakers from Amazon and Google.

The panel explored how companies can use artificial intelligence (AI) to transform product safety evaluations and data into actionable insights. Key points discussed included:

1. Current uses of AI in the product safety world

The panel identified that companies hold a significant amount of product safety data, but these data remain largely untapped due to their volume and unstructured nature. The processing of these data by AI systems (e.g., for trend analysis) – though not without risks – was identified as a key current use which allowed companies to design safer products, and evaluate and respond to product safety incidents more quickly and efficiently.

2. Moving from reactive to proactive to predictive applications

The panel considered the current pre-market and post-market surveillance applications of AI, before exploring its potential uses in the next three to five years. This included a review of the use of AI models in product design, material selection and manufacturing, before considering post-market surveillance activities, including the use of AI for multimodal analysis of consumer feedback. They outlined how companies could streamline processes by using AI models to select appropriate materials within the product’s design constraints, catch potential defects during the manufacturing process and comprehensively review consumer feedback.

Looking forward, the panel emphasised the potential for predictive use of AI to assist with decision-making processes, allowing for personalized safety for individual devices, including self-correcting mechanisms.

3. Not just for companies

The panel also discussed the use of AI by regulators around the world, and, in particular, the CPSC. The CPSC is currently using AI systems to scrub large data pools, such as consumer complaints, with an increased level of sophistication. The panel emphasised the importance for companies to keep up with regulators to avoid being on the back foot – for example, if a regulator’s use of AI led to better information about incidents involving the company’s products.

4. Potential issues

The audience identified that the most significant potential concern with using AI tools currently was the reliability and accuracy of the provided insights.

The panel was clear that, while AI allows decisions to be made at scale, both in terms of speed and volume of data considered, poor input data and prompts can lead to incorrect and failed outcomes. The panel discussed steps to mitigate these risks, such as ensuring machine learning models are trained on high-quality data, retraining models for accuracy, and implementing continuous audit and feedback mechanisms. Additionally, the panel considered the steps which could be taken to mitigate the impact of potential issues, such as implementing second-level review by humans for high-impact decisions and establishing appeals processes, where relevant.

5. Opportunities for collaboration

The panel discussed opportunities for collaboration on the use of AI in the product safety world and called for the development of a set of baseline AI/product safety principles, involving industry, regulators, standards organizations, academic experts, and others as the first step to creating a collaborative culture where these new technologies can be tested to further customer safety.

Overall, there was a consensus amongst the panel that AI systems offered a huge opportunity in the product safety space. They emphasised that, to fully reap the benefits of the technology, stakeholder collaboration was critical to foster a collaborative culture where AI technologies can be tested and deployed effectively, with the ultimate goal of furthering product safety.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Fergal Duggan
• Ed Turtle

Plenary session 3: ‘Leadership in Compliance’ featured panellists from the University of Utah, Safe Kids Worldwide, Hasbro and the European Commission.

The panel explored what leadership means in product safety and compliance. It highlighted the importance of individual responsibility and building trust and partnerships with your internal and external networks. Key points included:

• Leadership in product safety goes beyond strictly following regulations: Compliance with the law should be the baseline. Leadership in the product safety space entails a commitment to a culture of quality and shared values, which ultimately results in better consumer products.

• Each person can be a leader: A culture of compliance and quality thrives if each person – whatever their role – takes responsibility for product safety and compliance.

• It is important to strive to do better and improve step by step: Good leadership does not necessarily strive to be the best. It is important to acknowledge that mistakes happen, and the key to handling them is to take them as a learning experience in order to minimise risk in the longer term. It is important not to get lost in striving for the ultimate ‘best’, but instead to take a step-by-step approach to improving product safety.

• Building trust through communication and transparency fosters a culture of compliance: Product safety needs to involve all stakeholders, from the manufacturer to consumers, and foster trust through continuous education and transparency. Educating stakeholders about why compliance efforts are made is important to ensure everyone is onboard, along with making continuous improvements.

• Communication and transparency needs to be met with an openness for continuous learning: Professionals who are leaders in product safety and compliance are those who are prepared to learn from others, including their peers and other stakeholders from across different product sectors.

• Leaders in product safety and compliance need to be compassionate to others, as well as to themselves: Leaders need to take care of themselves to be able to bring their best selves to work and lead by example. Leaders should learn from their own mistakes, support others when they make mistakes and also provide space for upcoming leaders to shine.

The panel acknowledged that, in practice, a balance needs to be struck between compliance and other factors, such as costs and different business priorities. At the same time, the panelists called for each person to have the courage to be a leader in product safety and compliance in their own way, for the mutual benefit of all.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Rebecca Halbach
• Ed Turtle

Plenary session 2: ‘Across the Recall Ecosystem: Leading Practices, Challenges & Lessons Learned’ featured speakers from Costco, Peloton and Health Canada, and was moderated by a representative from the Retail Industry Leaders Association.

The panel discussed best practices in product recalls, common challenges companies face when conducting a recall, and learnings from stakeholders who have been through recalls and come out the other side. Key points discussed included:

• Timing for consumer notifications: The panel identified that timing is a big concern for retailers, who can find themselves not receiving much information from suppliers until the recall is about to be announced. This can be addressed by working with retailers from an early stage and ensuring there is an open and honest channel of communication along the supply chain, cooperating to develop a plan together for the timing for consumer notifications.

• Human factors to consider when communicating recalls: The panellists talked about the importance of layering communication to ensure consumers understand the risk and take action, and how there are various technologies that can help with this. Given many consumers have email fatigue nowadays, one panellist suggested that companies should be considering other forms of communication, including in-app push notifications, text messages and website pop-ups. The right communication will necessarily reflect the user base of the product in question, and for some ‘email’s where it’s at’ – whereas for others, text or paper communications may be appropriate.

• The role of the media in product recalls: Recently, there has been an increase in media coverage of recalls, particularly in the food sector. This can be challenging if there is a delay between notifying consumers, and the media coverage, of a recall, as it can cause confusion in the market. This is a challenge companies need to be prepared to manage when putting out safety information.

• Cooperation with regulators: The representative from Health Canada emphasised the importance of cooperating with regulators to avoid a mandatory recall being ordered by a government agency. She noted that it is essential for companies to work with their suppliers and regulators in order to ensure consistent and clear messaging is given to consumers, and reminded the audience that Health Canada has template communications freely available on its website that can be used for these purposes.

• Reframing recalls: The panellists emphasised that recalls should be seen as a way of learning about, and improving on, their internal product safety processes and building better relationships with stakeholders in their supply chain. They emphasised that recalls were not a negative business activity, and that companies who carry out voluntary recalls are those that want to do the right thing to ensure a high level of consumer safety.

The panel was a timely reminder that, whilst a product recall is not a situation companies want to find themselves in, where the recall is handled carefully, the impact can be managed in the best interests of all stakeholders. To do that successfully, it is critical to proactively ensure that you have the right practices and processes in place, before the safety issue arises.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Julia Greaves
• Ed Turtle

Plenary session 1 featured speakers from Amazon, TIC Council Americas, UL Solutions and Anushi Amin of Cooley (UK) LLP.

The panel examined how the new European Union (EU) General Product Safety Regulation (GPSR) would affect the EU’s approach to market surveillance and recalls, particularly in relation to products sold online. The EU’s approach also was compared at a high level with the approach taken when it comes to product safety in the United States.

Below are some key takeaways from the discussion during the session:

• The panel explained that changes introduced by the EU’s GPSR are broadly designed to provide market surveillance authorities (MSAs) with more information about the products being placed on the EU market, as well as the ability to co-ordinate and communicate more effectively with consumers and entities in the supply chain if a corrective action is required. Changes include:
  
  • The appointment of a ‘responsible person’ for certain compliance tasks.New labelling requirements.
  • New accident reporting obligations.

• In addition, the panel identified that the EU’s GPSR specifically addresses online marketplaces, with new obligations including:
  • Minimum information on product listings.
  • Appointing a single contact point responsible for communicating with consumers and MSAs.
  • Registering on the EU Safety Gate Portal.
  • Giving effect to notices received from MSAs within two working days.
  • Observing a general obligation to co-operate with MSAs to address any risks posed by dangerous products sold on the marketplace.

• One panellist explained that, historically, one of the big obstacles to effective product recalls has been ineffective communication of recalls, which has meant that affected consumers lack awareness of the recall and/or do not take action once notified of the recall. To address this, the EU’s GPSR requires online marketplaces to directly notify affected customers that the products they purchased from the platform are subject to a recall (making use of personal data that they might hold for them to do so), along with publishing recall information on their platform and following the new language requirements prescribed by the GPSR on how recalls should be communicated.

• In terms of practical steps that can be taken to help meet the new obligations, one panellist explained that they recommended monitoring multiple recall portals – including Safety Gate and the Organization for Economic Cooperation and Development (OECD) portal. They also recommended hat online marketplaces could provide advice and education to their customers on how to use products safely.

• The panel also discussed some of the differences between the EU and US approaches to product safety in the online space. Aside from differences in their legislative frameworks, it was observed that:
  
  • The concept of a ‘responsible person’ designated as responsible for compliance tasks in relation to the product did not exist in the US – although unsuccessful legislative efforts had been made to introduce it, and that usually the manufacturer or importer would have these responsibilities as a matter of fact.
  • The starting point in the US is not for ‘only safe products’ to be placed on the market. Rather, triggers for dangerous incidents for unsafe products were relied on. This meant that, if a product is found to be unsafe by an economic operator, they must bring this to the attention of the Consumer Product Safety Commission (CPSC) and work with the CPSC to ensure that it is made safe, which ultimately in his view, achieves the same result of only safe products being placed on the market.

Overall, the panel highlighted potential product safety challenges in the case of online sales, identifying that regulatory responses to these challenges were now being rolled out – the impact of which would be seen in the short term, with an anticipated increase in enforcement with a view to ensuring greater product safety in online channels.

The Cooley products team will be posting highlights from other plenary panel sessions on our blog throughout the event.

Key contacts:

• Anushi Amin
• Ed Turtle

You also can catch Cooley team members speaking on panels for the following sessions:

• Monday, February 17, 12:30 pm EST | Sponsored Satellite Session 3 Cooley – Global Product Safety and Regulatory Compliance: US, UK, EU, and International Updates for 2025 and Beyond featuring Rod Freeman, Matt Howsare and Rebecca Halbach

• Monday, February 17, 3:00 pm EST | Plenary Session 1 – Market Surveillance and Product Recalls: Linking Policy to Action in Case of Online Sales, featuring Anushi Amin

• Monday, February 17, 5:10 pm EST | Breakout 4: Exploring the Intersections Between Consumer Rights and Recalls, featuring Claire Temple

• Tuesday, February 18, 9:10 am and 10:30 am EST | Breakouts 8 and 12 (repeating) – Have Your Say: How Can Stakeholders Make a Difference in Shaping Policy and Laws, featuring Ed Turtle

• Tuesday, February 18, 11:30 am EST | Breakout 15: Gamechangers, featuring Emma Bichet

• Tuesday, February 18, 2:10 pm EST | Breakout 20 – Navigating the Digital Landscape: Streamlining CPSC e-Filing for Compliance, featuring Matt Howsare

• Tuesday, February 18, 3:10 pm EST | Plenary Session 4: Leveraging AI for Transforming Product Safety Learnings, featuring Elliot F. Kaye

• Thursday, February 20, 9:30 am EST | Plenary Session 9 – Reese’s Purpose: When a Product Safety Concern Becomes a Product Safety Requirement, featuring Lissie Ng

Further information about the event can be found on the ICPHSO website.

We hope to see you there!

Background

The EU Batteries Regulation requires that products containing batteries be designed to ensure the batteries are removable and replaceable by the end user, unless an exemption applies. There are two very narrow exemptions for:

• Products designed to be operated in an environment that is regularly subject to splashing water, water streams or water immersion (known as the ‘wet environment exemption’).
• Certain limited categories of medical devices must be designed for removability.

These exemptions are “partial” because products that qualify for them must still be designed to allow for battery replacement by an independent professional. There also is a very narrow exemption for certain limited categories of products which require a continuous power supply for safety or data integrity reasons. This is a “full” exemption, meaning that products that qualify do not need to have batteries that can be removed and replaced by either end users or independent professionals.

In practice, the exemptions will only apply to a very small number of products – meaning for the overwhelming majority of products containing batteries placed on the EU market, the battery will need to be removeable and replaceable by the end user. This requirement poses significant technical challenges and potential safety concerns for manufacturers, particularly as the Batteries Regulation specifies that the use of heat or solvents to remove and replace batteries will not be permissible.

Key points

Given the challenging requirements of the Batteries Regulation, manufacturers have been eagerly awaiting guidance from the EC on the Article 11 removability and replaceability requirements. We have summarised our key takeaways from this guidance below.

No damage

The guidance specifies that, ‘The replaceability of portable … batteries means that the battery can be removed and replaced with another battery without damaging or destroying the battery or the device where it is incorporated’. This language goes beyond the requirements in the Batteries Regulation, which only specifies that removal should not damage the device. The additional requirement that removal should not damage the battery creates further design complexities, especially for products containing delicate batteries (such as pouch cells) or using one-time fixings.

Tools

The Batteries Regulation requires that removal be possible using ‘commonly available’ and not proprietary tools. To assist with interpreting this term, the guidance refers to standard EN 45554:2020e, which clarifies that ‘proprietary tools’ means tools not available for purchase by the general public, or which cannot be licensed under fair, reasonable and non-discriminatory terms.

Mobile phones and tablets

Mobile phones and tablets subject to disassembly and repair requirements under the Ecodesign Framework (Directive 2009/125/EC) should comply with those requirements, rather than the removability and replaceability requirements under the Batteries Regulation. However, these products must still comply with other requirements under the Batteries Regulation, such as the due diligence policy requirements, labelling obligations and conformity assessment procedures.

Independent professionals

‘Independent professionals’ are defined as independent operators ‘who have the technical competence and qualification to repair the product where the battery is integrated into, and conduct their business on commercial basis and/or in commercial premises’.

‘Parts-pairing’

‘Parts-pairing’ – a practice whereby software is used to identify if appropriate batteries are fitted to a product by use of a unique identifier – will not be permitted. The guidance suggests that this is because parts-pairing can impede repairs. It also suggests that this is a complete ban, which will be disappointing for many manufacturers that had sought recognition in the guidance that the use of software should be permitted to prevent the use of unsafe or incompatible replacement batteries. Software features can be used to notify consumers that a nonoriginal battery is being used, as long as the software features do not affect the device functionality or user experience.  

Wet environment exemption

It is clear that the EC is intending the available exemptions to be interpreted narrowly, giving examples of shavers, hair clippers, epilators and electric toothbrushes as types of products that will fall within the wet environment partial exemption. The guidance notes that manufacturers relying on this exemption will need to ensure that product technical documentation includes ‘evidence’ that designing for removability by an end user would compromise the safety of the user or the product, and that there is no way to redesign the product without ‘severely affecting the health and safety of the end user, or the performance and functionality of the product’. There is no guidance given on what level of detail would be required. The Ingress Protection (IP) rating is specified as not being sufficient in itself to justify the wet environment exemption.

Medical device exemption

Despite extensive lobbying from industry stakeholders, many medical devices will be subject to the removability and replaceability requirements. The situation for medical devices is complex, and companies designing medical devices containing batteries should read the guidance carefully to determine whether their products may be able to benefit from an exemption. Full or partial exemptions may apply to implantable medical devices, and certain medical imaging, radiotherapy and in vitro diagnostic devices.

Continuity of power supply exemption

The EC has again taken a narrow approach to the types of products which could benefit from this exemption, giving examples of smoke or gas alarms, carbon monoxide alarms designed for at least 10 years of uninterrupted operation, and ‘batteries whose main function is to power a volatile memory itself or deliver backup functions in the internal clock of a device, such as CMOS (Complementary Metal-Oxide Semiconductor) batteries found in digital cameras, processors, sensors, and medical devices’. Hardware used by the digital payments industry also is mentioned as potentially exempt.

Next steps

The removability and replaceability requirements apply from 18 February 2027, so manufacturers need to start making design decisions now in order to ensure their products will comply with these new requirements.

The EC has also launched a process to consider whether there should be any further derogations to the removability and replaceability requirements. Submissions are due by 30 April 2025. Based on our involvement in the legislative process to date, we expectthat any further derogations will be extremely limited in scope, and that evidential requirements will be very high. In practice, it is likely to be challenging for manufacturers to make the case for an exemption, especially if there are other similar products in the market that have been (re)designed for removability and replaceability of the battery. For this reason, we recommend that manufacturers fully consider potential routes to compliance, including the possibility of adopting new technical and design solutions.

The Cooley products team has extensive experience advising stakeholders on removability and replaceability solutions, so please reach out to us for more information and assistance.

Key contacts:

Julia Greaves

Edward Turtle

Emma Bichet

Notably, Jackson is the second-ever federal appellate ruling – and the very first since the US Supreme Court’s landmark opinion in Loper Bright Enterprises v. Raimondo[2] last year – to endorse the government’s expansive reading of Section 301(k).[3] That provision criminalizes “[t]he alteration, mutilation, destruction, obliteration, or [label] removal of … a food, drug, device, tobacco product, or cosmetic, if such act is done while such article is held for sale (whether or not the first sale) … and results in such article being adulterated or misbranded.”[4] In addition, Jackson newly interpreted the term “legally marketed device” to exclude adulterated devices, which may inadvertently and severely undermine the “practice of medicine” defense dictated by Section 1006 of the FDCA, 21 USC § 396 (Section 1006). 

Jackson squarely rejected common defenses asserted by the physician, Dr. Anita Jackson, who argued that her decision to reuse the medical devices at issue:

• Fell outside Section 301(k)’s criminal prohibition for holding adulterated medical devices for “resale,” since she had used the devices solely for bona fide surgeries and had never actually sold any devices to patients.[5]
• Fit squarely within her expert medical judgment, which Congress expressly placed outside the reach of the FDCA, including Section 301(k).[6]
  

During the first Trump administration, the US Department of Justice (DOJ) brought record-breaking criminal charges and recoveries for healthcare fraud.[7] Now, with newfound vigor in the wake of Jackson, we expect DOJ and the US Food and Drug Administration (FDA) under the second Trump administration to continue aggressively prosecuting fraud involving medical devices by supplementing long-standing enforcement mechanisms with additional charges under Section 301(k).

Key factual background

Jackson was an ear, nose and throat (ENT) surgeon specializing in balloon sinuplasty surgery to treat chronic sinus infections. Balloon sinuplasty surgery involves inserting a medical device –in Jackson’s case, the Entellus XprESS – into a patient’s nose and inflating a small balloon to widen the nasal cavity. Because it touches a patient’s hair and bodily fluid during surgery, FDA had approved marketing of the Entellus for one-time use only, with the expectation that each device would be discarded after a single patient’s surgery.

Jackson oversaw multiple offices that performed balloon sinuplasty with reused Entellus devices, and her staff aggressively solicited patients to receive the procedure.[8] She would then bill Medicare and falsely claim reimbursement for the surgery and the full cost of a new Entellus.  Through this fraud scheme, Jackson charged Medicare more than $46 million for balloon sinuplasty surgery; at one point, she was the nation’s leading Medicare biller for the procedure.[9]

Crucially, during these surgeries, Jackson and her staff would frequently reuse a single Entellus on multiple patients, cleaning the device each time between surgeries. However, the Entellus was approved by FDA only for one-time use, and so the medical industry had no established practices to adequately sanitize the device for reuse. Indeed, Jackson’s staff testified that reused Entellus devices could not be fully sterilized, and that the devices became rusty and difficult to operate over time.[10]

Following a federal grand jury indictment and trial, a jury in the US District Court for the Eastern District of North Carolina convicted Jackson on all 20 counts, including for holding adulterated Entellus devices for sale in violation of Section 301(k), and for making materially false statements in response to Medicare audits.[11] After the court sentenced her to 25 years in prison and more than $5.7 million in restitution, Jackson appealed the verdict.

The Fourth Circuit’s opinion in Jackson

Jackson focused her appeal on challenging her Section 301(k) conviction as beyond the scope of the FDCA, and further asserted that her conviction on that count prejudicially tainted the jury’s verdict on the remaining 19 counts. She raised two primary arguments against the government’s broad interpretation of its Section 301(k) prosecutorial authority. 

First, Jackson argued that, during her many balloon sinuplasty surgeries, no Entellus device was ever “held for sale (whether or not the first sale),” nor did she ever pass ownership or title of any devices to her patients. Under Jackson’s theory, the statute’s plain text requires an attempt to sell adulterated devices to sustain a Section 301(k) conviction. 

Despite Jackson’s failure to preserve this argument below, the Fourth Circuit largely reached the merits by holding that the trial court did not plainly err in determining that Jackson’s conduct –soliciting patients for, and profiting from, the procedure using the Entellus – equated to holding them for sale, such that her conduct fell within Section 301(k)’s prohibition. 

For support, the Fourth Circuit favorably cited the US Court of Appeals for the Ninth Circuit in United States v. Kaplan.[12] Kaplan, the first-ever circuit case interpreting Section 301(k)’s held-for-sale requirement, held that Section 301(k)’s held-for-sale requirement is met when the medical device is used in any “commercial relationship between the doctor and the patient.”[13]  Even as Jackson did not need to tackle Kaplan’s interpretation of Section 301(k) head on, the Fourth Circuit acknowledged Kaplan’s “common-sense persuasiveness,” representing the very first time that another circuit has endorsed the Ninth Circuit’s broad reading and suggesting it may adopt Kaplan’s reading as its own in a future case.[14]

Second, Jackson argued that another section of the FDCA, Section 1006, precludes the government from prosecuting her for reusing Entellus devices for surgeries. Section 1006 exempts from liability actions falling within “the authority of a health care practitioner to prescribe or administer any legally marketed device to a patient for any condition or disease within a legitimate health care practitioner-patient relationship.” In Jackson’s estimation, reusing a medical device labeled for one-time use in legitimate surgeries merely reflected off-label usage within her discretion as a learned medical practitioner. 

The Fourth Circuit disagreed. In its view, Jackson was conflating using a device off label, which may fall within the legitimate practice of medicine, with holding “adulterated” Entellus devices for sale, which is illegal for physicians and non-physicians alike.[15] The jury found that she had failed to adequately sanitize the same Entellus device between different patient surgeries so as to render those devices “adulterated.” Moreover, her reuse of “adulterated” Entellus devices could not qualify for Section 1006’s exemption because that provision protects physicians only to the extent they prescribe or administer a “legally marketed device” – and FDA had never authorized the marketing or sale of the Entellus for multiple uses. If adopted, the court observed that her reading of the FDCA would “thwart congressional intent and create a huge loophole” that reflexively exempts physicians from otherwise unlawful conduct.

In so doing, Jackson appears to have severely undermined, if not eliminated, the “practice of medicine” provision under Section 1006. Specifically, the court’s use of the term “adulterated” could be read to mean the Entellus lacked adequate sanitation due to multiple uses on different patients.[16] But “adulterated” also is a term of art under Section 501(f)(1)(B), which provides that a device is “adulterated” if it lacks FDA’s marketing authorization for a particular intended use (i.e., an “off-label use”), such as the multiple-use indication at issue in Jackson. If the second meaning were adopted, it would essentially gut Section 1006, and healthcare practitioners may not rely on that provision at all, as any “off-label use” would practically render the device “adulterated” and, therefore, prohibited under Section 301(k). 

Healthcare fraud enforcement post-Jackson

The Jackson court’s determination that the Entellus was not a “legally marketed device” may embolden the government to reject the “practice of medicine” defense any time a healthcare practitioner uses an approved or cleared device for “off-label uses,” under the reasoning that any device that violates the FDCA is not “legally marketed.”

So while the Fourth Circuit did not officially adopt the Ninth Circuit’s holding in Kaplan – namely, that medical providers may be prosecuted pursuant to Section 301(k)’s bar on holding an adulterated medical device for sale whenever it is used to treat patients – it clearly resonated with that expansive reading in rejecting Jackson’s arguments to the contrary, including its interpretation of the Section 1006 “practice of medicine” defense.

With DOJ and FDA now armed with two circuit opinions (Kaplan and Jackson) that have taken an expansive approach to Section 301(k), we anticipate that the government will, alongside its existing arsenal of healthcare fraud enforcement tools, wield criminal penalties under the FDCA against hospitals, private practices and medical providers. As such, industry participants can expect close scrutiny by federal and state enforcers over the use of allegedly adulterated medical devices to perpetuate healthcare fraud.

The prospect of robust healthcare fraud enforcement is particularly salient given the new administration’s desire to draw attention to – and curb – alleged waste and abuse by recipients of federal funds. During President Donald Trump’s first term, DOJ eagerly pursued healthcare fraud prosecutions, including a nationwide takedown of 345 medical professionals for $6 billion in alleged fraud involving opioids,[17] and the largest individual healthcare fraud scheme in DOJ history.[18] 

Jackson presages renewed statutory authority for DOJ and FDA to situate Section 301(k) into future healthcare fraud enforcement efforts, and to test the outer boundaries of the FDCA’s criminal prohibitions, including Section 301(k), in the months and years ahead.

[1] No. 23–4467, No. 23-4587, 2025 WL 249109, at *7–8 (4th Cir., January 21, 2025).

[2] 603 US 369 (2024); see US Supreme Court’s October 2023 Term Administrative Law Trilogy – Holdings, Analyses and Implications of Jarkesy, Loper Bright and Corner Post, Cooley client alert, July 26, 2024.

[3] FDCA § 301(k), 21 USC § 331(k). The first and only other circuit opinion interpreting Section 301(k) is United States v. Kaplan, 836 F.3d 1199, 1208 (9th Cir., 2016), as discussed below.

[4] 21 USC § 331(k). 

[5] Id.at *7.

[6] Id. at *7–8. 

[7] See, e.g., DOJ press release, National Health Care Fraud Takedown Results in Charges Against 601 Individuals Responsible for Over $2 Billion in Fraud Losses, June 28, 2018.

[8] The Fourth Circuit explained that Jackson implemented quotas, incentives and other unorthodox methods to prescribe and administer the surgery. Her former employees testified that she instructed them to recruit patients in Walmart parking lots, churches, barbershops and doctors’ offices (Jackson, 2025 WL 249109, at *2). To increase the number of sinuplasty surgeries performed, she often skipped routine diagnostics to determine whether it was medically appropriate, and she misled patients into believing that the surgery was simply a “sinus spa” or “sinus rinse” (Id.). Then, to cover up her conduct, she submitted false, incomplete and altered records to the government, including some bearing fake notarizations and forged patient signatures (Id.at *3).

[9] DOJ press release, Raleigh ENT Doctor Sentenced to 25 Years in Prison for Adulterating Surgical Devices, for Defrauding Medicare, and for Stealing Patient Identities, June 16, 2023.

[10] Id.

[11] See21 USC § 331(k); 18 USC §§(a)(2); and DOJ press release, Raleigh ENT Doctor Sentenced to 25 Years in Prison for Adulterating Surgical Devices, for Defrauding Medicare, and for Stealing Patient Identities, June 16, 2023.

[12] 836 F.3d 1199, 1208 (9th Cir., 2016).

[13] Id.

[14] 2025 WL 249109 at *6–*7.

[15] 2025 WL 249109 at *18.

[16] 2025 WL 249109 at *13 (discussing the term “adulterated” in the context of “unsanitary conditions”).

[17] DOJ press release, National Health Care Fraud Takedown Results in Charges Against 601 Individuals Responsible for Over $2 Billion in Fraud Losses, June 28, 2018.

[18] DOJ press release, South Florida Health Care Facility Owner Sentenced to 20 Years in Prison for Role in Largest Health Care Fraud Scheme Ever Charged by The Department of Justice, September 12, 2019.

2024 was another huge year for products law. In the European Union, a number of significant laws entered into application, and we saw an unprecedented number of new laws complete the law-making process, as the 2019 – 2024 mandate of the European Commission came to an end. The UK also took its first legislative steps to reform the UK product safety framework. In this blog, the Cooley products team brings you a roundup of our highlights from 2024 and what to look out for in 2025.

2024 year in review

We saw a number of game-changing laws start to apply in the EU, including the:

• General Product Safety Regulation
• RED Common Charger Directive
• Ecodesign for Sustainable Products Regulation (ESPR)
• Batteries Regulation

An unprecedented number of new laws completed the final stages of the law-making process and will start to apply after various transition periods, including the:

• Artificial Intelligence (AI) Act
• Cyber Resilience Act
• Revised Product Liability Directive
• Directive on common rules promoting the repair of goods (Right to Repair Directive)
• Directive on empowering consumers for the green transition
• Regulation on Prohibiting Products Made with Forced Labour on the Union Market (FLR)
• Revised Environmental Crime Directive
• Revised Construction Products Regulation
• Packaging and Packaging Waste Regulation
• Critical Raw Materials Act
• Revised regulation on the classification, labelling and packaging of substances and mixtures (CLP Regulation)
• Revised Waste Shipments Regulation

The European Commission has started work on secondary legislation and other measures to implement these new rules, alongside continuing to progress existing work programs – e.g., in the areas of eco-design and chemicals.

The European Commission also published its fitness check of EU consumer law on digital fairness, expected to lead to an upcoming legislative proposal.

In the UK, we saw the:

• Product Regulation and Metrology Bill introduced into the UK Parliament, followed by the government response to the consultation on the UK Product Safety Review and publication of two calls for evidence on potential areas of reform using new powers under the bill.
• Product Safety and Metrology, etc. (Amendment) Regulations 2024 passed and entered into application – extending recognition of certain products that meet EU requirements “indefinitely” beyond the December 31, 2024, deadline for the GB market.
• Digital Markets, Competition and Consumers Act completed the law-making process.

• Producer Responsibility Obligations (Packaging and Packaging Waste) Regulations 2024 introduced into the UK Parliament and completed the law-making process.
• Government response to the consultation on proposed reforms to the UK Waste Electrical and Electronic Equipment (WEEE) Regulations published.

We also saw proposed UK legislation to introduce digital labelling and extend easements for importer labelling notified by the previous government to the World Trade Organization in May, but not carried forward by the new government in that form following the election.

What to expect in 2025

There are a number of significant proposals presented during the previous mandate of the European Commission that carried over with work continuing in the European Parliament and Council. These include the:  

• Proposed Toy Safety Regulation
• Proposed Green Claims Directive
• Proposed Customs Reform package
• Proposed AI Liability Directive
• Proposed revision of the Waste Framework Directive

The new European Commission commenced on 1 December 2024 and is expected to continue work on several long-awaited initiatives, alongside new proposals, which are expected to include the:

• Proposed ‘universal’ PFAS (per- and polyfluoroalkyl substances) restriction
• Proposed revision of REACH (Registration, Evaluation, Authorisation and Restriction of Chemicals)
• Proposed Delegated Act under the Radio Equipment Directive on software that alters the safety or compliance of a device (reconfigurable radio systems)
• Proposed revision of the Textiles Regulation
• Proposed new Circular Economy Act
• Proposed new Digital Fairness Act

However, draft legislation for some of these is not expected until 2026 at the earliest.

A lot of the European Commission’s work also is expected to focus on the rollout of recently passed laws – e.g., working on secondary legislation, guidance and other actions. We’re closely following this in a number of areas – including for the ESPR, with publication of the working plan (setting out product priorities) and various pieces of secondary legislation (e.g., setting out details and format for the disclosure of unsold consumer goods discarded and derogations to the ban on the destruction of unsold clothing, accessories and footwear), alongside preparation of the first Delegated Acts on textiles and steel (laying down new performance and information requirements) and work to roll out the new Digital Product Passport system.  

In the UK, the government is expected to:

• Start using new powers to make secondary legislation under the Product Regulation and Metrology Bill as soon as that legislation is passed by the UK Parliament.
• Present legislation making targeted reforms to the UK WEEE Regulations and publish plans for more wider-ranging reforms as part of a drive towards a circular economy.

We’ll also be monitoring any progress on the long-overdue consultation on the UK Battery Regulations.  

Alongside these changes, the increased focus on enforcement and international co-operation we’ve seen over recent years looks set to continue.

Want to know more?

Sign up to receive updates from our Productwise blog, and follow your regular contacts from the Cooley products team on LinkedIn for ongoing news.

Key contacts:

• Rod Freeman
• Claire Temple
• Tracey Bischofberger
• Emma Bichet

New rules under the General Product Safety Regulation (EU) 2023/988 (GPSR) apply from 13 December 2024 across the European Economic Area (EEA) – made up of European Union Member States, plus Iceland, Liechtenstein and Norway – and Northern Ireland. The GPSR is a significant piece of legislation that introduces a number of reforms. In the third in a series of blogs, the Cooley products team takes a look at the introduction of accident reporting obligations under the new rules.

Scope: The GPSR applies in full to consumer products that are not already subject to EU harmonisation legislation (i.e., non-CE marked products) and covers gaps in product safety regulation for consumer products subject to certain EU harmonisation legislation (i.e., CE marked products). The accident reporting obligations under the GPSR will apply to all consumer products in scope of the GPSR – including consumer products regulated by EU harmonisation legislation – to the extent that the sector-specific legislation does not provide for its own accident reporting obligations.

Who needs to do what?

Manufacturers: Have an obligation to report accidents meeting a certain threshold of seriousness to the relevant authority. We’ll cover this threshold in the next section.

“Responsible person”: Where the manufacturer is not established in the EU, the “responsible person” in the EU who has knowledge of an accident meeting the required threshold must ensure a report to the relevant authority is made – i.e., either ensuring that the manufacturer has reported or by reporting itself. The “responsible person” is a legal concept from the Market Surveillance Regulation (EU) 2019/1020 (MSR). The “responsible person” can differ depending on the supply chain, and there are guidelines in the MSR to assist in understanding the requirements and determining which entity in a supply chain this will be. Unfortunately, recently published FAQs on the GPSR are inconsistent with the guidelines on the MSR on when an authorised representative can be appointed as the “responsible person”. We hope the upcoming guidelines on the GPSR will provide some clarity.  

Importers and distributors: Will be required to inform the manufacturer of reports of accidents they become aware of involving products supplied by them. It appears that there is no threshold of seriousness tied to this obligation, meaning information about any accident may be required to be passed on. If the threshold to report accidents to the relevant authority is triggered, the manufacturer may then make the report or instruct the importer or distributor to report.

In addition, where the importer also is the “responsible person”, the importer will need to ensure that an accident meeting the required threshold of seriousness is reported to the relevant authority in line with the obligation on the “responsible person” discussed above.

Providers of online marketplaces: There is a separate obligation on providers of online marketplaces to report accidents that they have been informed about, over a certain threshold of seriousness, caused by a product made available on their online marketplace. Providers of online marketplaces also will need to let manufacturers know. 

In addition, there also is a wider obligation on providers of online marketplaces to pass information onto traders and “economic operators” (this includes manufacturers, authorised representatives, importers and distributors) that they have received about “accidents or safety issues” – where they have knowledge that the product was offered by those traders through their online marketplace. Again, it appears that there is no threshold for this wider obligation to pass on information.

Thresholds for reporting to the authorities: Not all accidents will trigger the requirements to report to the authorities.

The threshold under the GPSR for the manufacturer’s (or the responsible person’s) obligation to report to the authorities is described as “[o]ccurrences associated with the use of a product that resulted in an individual’s death or in serious adverse effects on that individual’s health and safety, permanent or temporary, including injuries, other damage to the body, illnesses and chronic health effects”.

The threshold for the obligation on providers of online marketplaces to report is described as “any accident … resulting in a serious risk or actual damage to the health or safety of a consumer”.

The two thresholds appear to be different, with the obligation on online marketplaces being broader in scope – it covers incidents resulting in a “serious risk”, even if no injury actually occurred. This will give rise to challenges for manufacturers to navigate, especially where a provider of an online marketplace reports an accident to the authorities that the manufacturer considers does not meet the required threshold for reporting under the manufacturer’s obligation.

How: Reports under the manufacturer’s (or responsible person’s) obligation, and by providers of online marketplaces, are to be made using the European Commission’s Safety Business Gateway – part of the Safety Gate portal. Currently, it looks like the only way to do this is by using the form ‘Notify a dangerous product to the authorities’. However, we do not think that form properly correlates with the accident reporting criteria under the GPSR, and this presents challenges for those looking to report accidents. We hope that there will be clarifications made around this point very soon.

Where: The manufacturer’s (or responsible person’s) report is to be directed to the competent authorities of the EEA country (or Northern Ireland) where the accident occurred. This is not expressly mentioned in the provisions laying down the obligation on providers of online marketplaces – their obligation is simply to report via the Safety Business Gateway.  

Timing: Reports to authorities will need to be made “without undue delay” from the moment the relevant entity knows about the accident. 

Content: The GPSR sets out the information thata report made under the manufacturer’s (or responsible person’s) obligation will need to include – the type and identification number of the product, along with the circumstances of the accident, if known. The competent authorities may request further information.

The GPSR does not go into detail as to what will be required for reports made by providers of online marketplaces.

What’s next: Upcoming guidelines on the GPSR and the updated Safety Business Gateway are expected.

What are the implications?

• Manufacturers and providers of online marketplaces will need to ensure that they have the appropriate procedures in place to promptly identify accidents reported by consumers, as well as ensuring they are escalated effectively and in a timely manner internally to determine if the accident is reportable and for the necessary report to be made. Where the manufacturer is established outside of the EU, it should co-ordinate with the “responsible person” appointed in the EU regarding who will make the report and ensure it has oversight of the content.
  
• Importers and distributors will need to ensure they also have processes in place to promptly pass on information about accidents to the manufacturer. An importer also should ascertain whether it will be deemed to be the “responsible person” or not – and, if so, put in place procedures to ensure reports for accidents that trigger the reporting obligation are made.
  
• Providers of online marketplaces also will need procedures in place to comply with requirements to promptly pass on information to traders and “economic operators” about accidents or safety issues.

The new accident reporting obligations are part of broader reforms made by the GPSR to gather more information about potentially dangerous products. This information may be used by the European Commission in a number of ways – e.g., to determine if specific traceability requirements should be laid down for certain types of products.

Like to know more?

Get in touch with any member of the Cooley products team to find out more about the new rules under the GPSR and how they may impact your products.

This is the third in a blog series where the Cooley products team explores the new rules under the GPSR. See the first post in the series, “What’s New?”, along with the second post, “An Expanded Concept of Safety”.

Key Contacts:

• Rod Freeman
• Claire Temple
• Jamie Humphries
• Tracey Bischofberger
• Emma Bichet

The aim behind the delay is to give businesses time to fully implement their EUDR due diligence obligations, and to ensure that the in-scope commodities and products are ‘deforestation-free’ and can be accompanied by the required due diligence statement before they are placed or made available on the EU market or exported from the EU. Given the huge lift involved for EUDR compliance, this is still not a lot of time for companies with in-scope products.

The targeted amendment will not affect the substance of the existing legislation as it was originally agreed. The EUDR only allows in-scope products and commodities that are ‘deforestation-free’ to be placed or made available on the EU market and/or exported from the EU. This includes certain products made from cattle, wood, cocoa, soy, palm oil, coffee and rubber.

For more on the delay and resources to support EUDR compliance, see our previous alert.

The proposed delay still needs to be endorsed and formally adopted by both the European Parliament and the Member States in the Council to pass into law. This is fully expected to pass, meaning that companies will have until 30 December 2025 to comply with the EUDR. In the unlikely event that the delay is not approved, the EUDR could still come into force by default on 30 December 2024.

The aim behind the delay is to give businesses time to fully implement their EUDR due diligence obligations, and to ensure that the in-scope commodities and products are ‘deforestation-free’ and can be accompanied by the required due diligence statement before they are placed or made available on the EU market or exported from the EU. Given the huge lift involved for EUDR compliance, this is still not a lot of time for companies with in-scope products.

The EUDR rollercoaster: Getting up to speed

The EUDR entered into force 29 June 2023 and was supposed to apply from 30 December 2024 (with a longer transition period for certain small and medium-sized enterprises).

However, significant concerns were raised by industry, EU Member States and non-EU countries – including the US – that they would not be able to comply on time. At the time, certain key technical aspects of the EUDR, e.g., the information system through which businesses would need to register their due diligence statements, were not yet up and running. In response, the European Commission presented a proposal on 2 October 2024 to delay the application date of the EUDR by 12 months. The Council agreed to the one-year delay on 22 October 2024.

However, when the file went to the new European Parliament for approval, politicking put the delay in jeopardy. The EPP (European People’s Party) group in Parliament pushed for further changes – including a two-year delay, the removal of traders from the scope of the EUDR and the creation of a new risk category for countries posing ‘no risk’ of deforestation. While only the additional amendment creating a new ‘no risk’ category was adopted by Parliament alongside agreement to the 12-month delay, this change meant that the delay was not approved, and the European Commission’s proposal had to go back to trilogue negotiations.

While the first round of negotiations failed, following provisional agreement on 3 December, Parliament dropped the call for additional amendments to the EUDR, and the one-year delay – which all three EU institutions agreed to – is now likely to become law.

The provisional agreement will now need to be voted on again by the Council and Parliament, and once formally adopted, it will need to be published in the Official Journal of the European Union. Following publication, the postponement will enter into force three days later – an expedited process that is faster than usual. As a regulation, the EUDR is directly applicable throughout the EU without the need for Member States to adopt national implementing legislation.

EUDR refresher

The EUDR applies to the raw commodities (cattle, cocoa, coffee, oil palm, rubber, soy and wood) and products that fall within the customs codes specifically listed in Annex I to the EUDR. 

It includes requirements that in-scope products and commodities may not be placed or made available on the EU market or exported from the EU unless they are ‘deforestation-free’, have been produced in accordance with the relevant legislation of the country of production and are covered by a due diligence statement. The due diligence statement must be filed before the product can be placed or made available on the EU market and must contain, among other things, information identifying the country of production and the geolocation of all plots of land where the relevant in-scope products were produced. The EUDR also contains record-keeping obligations and a requirement for companies to report publicly – including online – on their due diligence system and the steps they’ve taken to fulfil their EUDR due diligence obligations. Companies can satisfy their annual reporting obligation by including the information required by the EUDR in other reports they file publicly – e.g., a sustainability report under the Corporate Sustainability Reporting Directive (CSRD).

For more detail on the EUDR, see our earlier publication.

EUDR resources

While the European Commission has faced criticism for a lack of resources to support companies, some materials have already been published.

• EUDR guidance and the latest version (October 2024) of the EUDR FAQs, covering details on the functionalities of the information system, updates on penalties, and clarifications on critical definitions, such as ‘forest degradation’, ‘operator’ in the scope of the law and ‘placing on the market’.

• As of December 2023, the EU Observatory on deforestation and forest degradation has been available to businesses. The Observatory is a library of existing monitoring tools offering publicly available maps and datasets providing scientific evidence on global deforestation and forest degradation – e.g., near-real-time analysis of time series of satellite data. While the European Commission is clear that use of these maps will not automatically ensure that the conditions of the EUDR are complied with (companies will still be required to carry out due diligence), they are promoted as tools to help companies ensure compliance with the EUDR (e.g., to assess the deforestation risk).

• If the proposed delay is adopted, companies can expect the list of countries or regions that present a low or high risk to be published by means of implementing acts no later than 30 June 2025 (delayed from 30 December 2024). The European Commission’s benchmarking framework (upon which the country-by-country risk assessment will be based) indicates that a large majority of countries worldwide are expected to be classified as ‘low risk’. Products originating from ‘low- risk’ regions will benefit from a simplified due diligence process which will not require an in-depth risk assessment or the adoption of risk mitigation measures.

• The Deforestation Due Diligence Registry opened for the submission of due diligence statements on 4 December 2024. This is the online registry for making and submitting electronic due diligence statements that will ultimately be required to comply with the EUDR. These due diligence statements will need to show that a product is deforestation-free before it can be placed or made available on the EU market or exported from the EU.

• Operators, traders and/or their authorised representatives who will be required to submit EUDR due diligence statements will be required to register. As of 6 November 2024, companies have been able to register preemptively on the EUDR Information System. On 6 December 2024, the Implementing Regulation on the functioning of the information system was published in the OJEU coming into force on the 9 December 2024.

• The regulators who will ultimately be responsible for enforcing the EUDR can be found in the list of Designated Competent Authorities as updated from time to time.

Traditionally, the concept of “product safety” has focused on physical risks posed by consumer products – such as lacerations, burns, choking and other physical injuries. As consumer products have evolved, so too have the risks associated with their use.

The new General Product Safety Regulation (EU) 2023/988 (GPSR), applying in the European Union from 13 December 2024, contains a number of updates designed to specifically target new technologies – including the concept of “safety”.

As we consider the new rules under the GPSR, it’s important to keep in mind that these updates are not happening in a vacuum – they sit alongside a number of other key reforms in EU law that together will change the landscape of product safety and compliance and increase liability risks for products placed on the market in the EU.

An expanded concept of safety

The GPSR will broaden the concept of product safety, with a number of updates:

1. Covering risks to mental health: The GPSR refers to the World Health Organisation definition of “health” as a “state of complete physical, mental and social well-being and not merely the absence of disease or infirmity” in its recitals. It will be expected that risks to mental health, where applicable, will form part of any pre-market risk assessment, and that companies will take appropriate action (report to the authorities, initiate corrective actions) if warranted by the discovery of a risk to mental health associated with a product. It is noteworthy in this regard that current guidance from the European Commission makes it clear that it considers software to be within scope of the GPSR. This reform sits alongside recent updates to the EU’s Product Liability Directive (PLD) that enable consumers to claim damages under the PLD for medically recognised damage to psychological health caused by defective products.  
2. Adding new factors targeted at new technologies to the nonexhaustive list of aspects to consider when assessing safety, such as:
   • Cybersecurity: To the extent it has an impact on the safety of a product. This update in the GPSR sits alongside a number of other EU reforms targeted at cybersecurity – such as the Delegated Act made under the Radio Equipment Directive, requirements surrounding cybersecurity in the new Artificial Intelligence Act and Machinery Regulation, and new horizontal rules under the new Cyber Resilience Act. Reforms to the PLD  add safety-relevant cybersecurity requirements as a factor in assessing “defect”. In terms of how the EU reforms sit together, the recitals to the GPSR explain that the GPSR is aiming to fill the gap where sectoral legislation dealing with cybersecurity does not apply. 
   • Software updates/software downloaded: The impact of software updates and software subsequently downloaded – where it is meant to determine, change or complete the way the product to be assessed works – also will need to be taken into consideration when assessing the safety of that product. Other updates have been made under the GPSR to capture where the impact of the software update or download amounts to a substantial modification of a product – in which case additional regulatory requirements will be triggered.    
   • Artificial intelligence (AI) and machine learning functionalities: A product’s evolving, learning and predictive functionalities also would be relevant to consider, where required by the nature of the product. The addition of this factor to the list sits alongside the new EU AI Act and sector-specific adjustments in the new Machinery Regulation. The recitals to the AI Act explain that the GPSR is intended to act as a safety net – e.g., to ensure the safety of AI systems in consumer products that are not regulated as high-risk under the AI Act.
   • Connectivity: The effects on other products, where it is reasonably foreseeable that a product will be used with other products, including the interconnection of those products.

What does this mean in practice?

These additional factors will need to be considered in a pre-market assessment of safety. They also will need to be considered as part of post-market monitoring and determining whether there is a product safety issue that needs further action. This will impact not only nonharmonised products (non-CE marked) where the GPSR will apply in full, but also harmonised products (CE marked) where the GPSR will act as a safety net, covering gaps in other sector-specific legislation. 

Like to know more?

Get in touch with any member of the Cooley products team to find out more about the new rules under the GPSR and how they may impact your products.

This is the second in a blog series where the Cooley products team explores the new rules under the GPSR. See the first post in the series, What’s New?

Key Contacts:

• Tracey Bischofberger
• Emma Bichet
• Rod Freeman
• Jamie Humphries

The new PLD represents a landmark reform of the EU’s existing product liability regime, which has been in place for nearly 40 years. Given the remit for reform focussed on concerns that existing laws were no longer ‘fit for purpose’ with the emergence of new technologies, including connected products and artificial intelligence (AI), online sales, and the circular economy, there is no doubt that the new PLD will have a major impact on tech companies and marketplaces. However, whilst the remit for reform was fairly narrow, the changes agreed are broad, expand the scope of claims that can be brought and the range of damages that can be recovered, and make it easier for consumers to prove their claims in all product sectors.

The reforms also have implications for product safety and cybersecurity, including how long software updates should be provided to avoid potential liability.

Background

The EU’s existing PLD established a strict liability regime for product liability claims in the EU. It was adopted in the 1980s, in the wake of high-profile cases like those concerning the drug thalidomide, with the intention of making it easier for consumers to recover for damage caused by defective products.

Because liability is strict, producers are responsible for defects in tangible products, regardless of whether the defect is their fault. As there is no need to establish fault, proving ‘defect’ is usually the biggest hurdle to bringing a claim under the PLD – and in a number of recent cases, claimants have failed to overcome this hurdle. The revisions to the PLD are likely to alter this trend and make it much easier for claimants to establish defect in future cases.

Reforms under the new PLD

Key reforms include steps to:

• Expand the scope of claims – for example, to cover not only hardware but also stand-alone software and AI systems for the first time.
• Expand the damages that can be recovered – for example, to include destruction or corruption of data and medically recognised harm to psychological health.
• Ease the burden of proof for claimants, by introducing presumptions of defect in certain circumstances and a creating a new disclosure mechanism (similar to US discovery), which will be completely new in some EU jurisdictions (e.g., Germany) which have no existing mechanism.

1. Expanded scope of application

The term ‘product’ under the new PLD will comprise software, digital manufacturing files and certain related services. Software includes operating systems, firmware, computer programs, applications or AI systems, irrespective of whether the software is stand-alone or embedded in other products, with very limited exceptions for certain free and open source software developed or supplied outside of commercial activity.

The term ‘defect’ will be expanded to cover issues arising from software updates, AI functionality and cybersecurity vulnerabilities, including where a manufacturer failed to issue software updates necessary to address vulnerabilities. Crucially, the test also will change. Under existing rules, a product is considered defective if it does not provide the level of safety that a person is entitled to expect, taking all the circumstances into account. The new PLD adds an alternative basis for a product to be considered defective – where the product does not provide the safety required under EU or national law. In other words, if a product does not comply with regulatory requirements, it could automatically be considered defective for the purposes of a product liability claim.

As well as manufacturers and importers, new actors – including authorised representatives, fulfilment service providers and online platforms – can be held liable for defects in certain circumstances. In addition, the new PLD extends the claims period (the ‘long stop’) in circumstances where symptoms are slow to emerge, from 10 years following placement of the product on the market, to 25 years. For producers of medicinal products and medical devices, in particular, this very long exposure period will significantly increase liability risks.

2. Expanded scope of recoverable damages

The definition of ‘damage’ under the new PLD will be extended to include medically recognised damage to psychological health as well as destruction or corruption of data, meaning it will be possible to bring certain data claims under either the General Data Protection Regulation (GDPR) or the new PLD going forward. At the same time, the reforms remove minimum thresholds and maximum limits for compensation claims. The impact of this change, particularly when combined with the introduction of the EU’s new class actions regime (see below), is likely to be an uptick in mass claims for relatively trivial data destruction or corruption issues.

3. Easier burden of proof for claimants seeking compensation in complex cases

To make it easier for claimants to succeed in their claims, the new PLD reverses the burden of proof in certain circumstances, so claimants no longer need to prove elements of their case. Two of these circumstances are:

• To make it easier for claimants to succeed in their claims, the new PLD reverses the burden of proof in certain circumstances, so claimants no longer need to prove elements of their case. Two of these circumstances are:
• Where there is noncompliance with relevant EU product safety regulations.
• If it is excessively difficult on account of the ‘technical or scientific complexity’ of a product for a claimant to prove either that a product is defective or the causal connection between the defect and the damage. (The recitals suggest that examples of products to which this could apply include medical devices and products that use AI technologies.)

In addition, the new PLD provides for disclosure of ‘necessary and proportionate’ evidence to claimants and defendants during proceedings to correct any asymmetry of information between the parties. As many EU countries have limited or no disclosure mechanisms under national laws, this will be an important tool for claimant law firms seeking to make their case. It also will increase the importance of stakeholders ensuring they are fully compliant from a regulatory perspective, with appropriate document and internal communications procedures in place.

Looking to the future: A fundamental shift in European risk landscape

The new PLD’s more claimant-friendly regime represents a fundamental shift in the European risk landscape. Moreover, the reforms sit alongside parallel EU policy initiatives – such as the EU’s new class actions mechanism (Representative Actions Directive), AI Act and proposed liability rules, new General Product Safety Regulation (GPSR) and regimes addressing the circular economy (Ecodesign for Sustainable Products Regulation and Empowering Consumers in the Green Transition Directive), and cybersecurity (Cyber Resilience Act).

Taken together, these reforms have the objective of bringing existing EU regimes in line with challenges presented by new digital technologies and ecommerce, and the growing focus on sustainability through the product life cycle. At the same time, they create a raft of new obligations for stakeholders – and have the potential to significantly increase the costs and risk of doing business in the EU.

Key Cooley contacts:

• Anushi Amin
• Emma Bichet
• Rod Freeman
• Edward Turtle

The PSR was aimed at updating the UK’s product safety regime after Brexit and in light of evolving technologies, increased levels of online shopping and growing concerns around consumer safety. As part of the PSR, the UK government launched a consultation in 2023 on a range of proposals for reform (see our related August 2023 Productwise blog). We already had relatively strong indications of what would be next in terms of regulatory priorities – chiefly, a focus on greater regulation of online marketplaces, ensuring that regulation keeps pace with technology and effective enforcement. The government’s response has confirmed those priorities, but has it provided any further insight on some of the other 2023 proposals? Read on to find out what we now know – and what we don’t.

What do we know now?

There are no big surprises in the response. The government remains focused on further regulating online marketplaces and ensuring that legislation is fit for purpose in the digital age.  However, helpfully, the response has clarified a few key areas and provided a further indication of timings.

Here is a summary of the main points outlined in the response.

Online marketplaces

The sale of unsafe products online has been deemed a ‘significant problem’, and we have seen the introduction of legislation in the form of the PRM Bill to allow the government to quickly introduce new requirements on online marketplaces through secondary legislation. The response emphasises the government’s intention to introduce these requirements ‘at the earliest opportunity’. They will be developed in the next 12 months and introduced as secondary legislation ‘as soon as possible’ (our best bet is in the next 18 months). These requirements will seek to clarify the responsibilities of online marketplaces to:

• Take steps to prevent noncompliant and unsafe products from being made available.
• Provide consumers with appropriate information, instructions and warnings about products prior to purchasing.
• Cooperate with regulators and provide ongoing assurance – including devising appropriate systems to quickly take action to stop the availability of unsafe products.

Cross-cutting hazards

The government is considering a move from sector-specific risks to cross-cutting hazards, such as the choking hazard presented by button batteries. It intends to develop options for consultation in the coming months, in the hopes that it can bring forward legislation across the whole UK internal market ‘as soon as possible’. Given the continued recognition of the European Union’s CE mark for products placed on the market in Great Britain, and the fact that Northern Ireland must follow the European Union’s rules on product safety as a result of the Northern Ireland Protocol and Windsor Framework, it really does remain to be seen what is envisaged here. Early indications suggest that it will be more targeted than when this area of change was first mooted. For now, we know that the following are areas of focus: 

• Button batteries in children’s toys
• Lithium batteries in e-cycles/conversion kits
• Automated machinery
• 3D printing
• Augmented reality

Stronger enforcement framework

There will be a focus on the coordination and alignment of product safety approaches. The government is seeking to enhance the leadership and coordination role of the OPSS, as the national regulator, to address enforcement gaps and reinforce better ways of working between market surveillance authorities.

Voluntary digital labelling

During the consultation, there was support for the introduction of voluntary digital labelling to enable businesses to provide certain product safety compliance information, such as the UK Conformity Assessed (UKCA) mark, digitally rather than on a box or label. The government states that it also is moving towards allowing for provision of market surveillance-based information via digital labelling. The next few months will see the government pondering on how best to progress this. Of course, there is tension here, given that whilst the European Union’s CE mark continues to be recognised for products placed on the market in Great Britain, the European Union does not recognise digital labelling, so businesses also may still need to label in the traditional manner for European Union-facing sales.

Legal data gateway

A majority of respondents to the consultation (mostly market surveillance authorities) were in favour of a new single and legal data gateway. The integration of existing systems would enable the sharing of intelligence between market surveillance authorities to aid in compliance and enforcement. The government also noted the need to consider confidentiality obligations when developing this gateway.

What do we still not know following this response?

There are several questions which remain unanswered, including:

European Union alignment

It is still not clear how the government intends on approaching the ongoing question of alignment with European Union rules. This is particularly pertinent due to the wave of regulatory reforms currently sweeping through Europe – such as the European Union General Product Safety Regulation (GPSR), the new Product Liability Directive and the AI Act. The response does acknowledge that this is a pertinent question, and it states the government’s aim to align with international standards; however, there also is emphasis placed on adopting regulations that better suit the UK’s specific needs.

Specific implementation timelines

Whilst the response outlines various intentions and proposals, specific implementation timelines remain vague. We see references to the government ‘currently considering’ various approaches – with no specific timings. The government has said it intends to create rules for online marketplaces in the next 12 months; however, it is unclear if this time estimate includes the passing of secondary legislation.

Impact on businesses

The response provides limited information on how the proposed changes will impact businesses. We hope to see further guidance concerning compliance costs or support measures to help businesses adapt to the new regulations.

Specifics of digital labelling

We are told that, in the coming months, the government will ‘consider the most effective ways to progress this’, but no further specifics are provided. The government will work with businesses and consumer groups when considering next steps.

Status of some of the 2023 proposals

Whilst some of the 2023 proposals have followed through to the PRM Bill or the government’s response – e.g., a defined role of ‘online marketplace’, introduction of e-labelling and indication of greater enforcement powers – the status of some of the other 2023 proposals remains unknown – e.g., mandatory incident reporting and a review of the UK product liability regime.

What are the next steps?

Short term

In the next 12 months, the government intends to focus on creating new rules for online marketplaces and addressing cross-cutting hazards. It also has launched two calls for action regarding changes to the European Union product and metrology legislation related to measuring noise from outdoor equipment and common chargersolutions.

Medium term

Over the next 12 to 18 months, the government will continue to review feedback from the PSR consultation to consider how best to utilise digital technology. This will be done alongside sector reviews to determine what changes are needed to meet modern challenges.

Long term

In the coming years, the government will evaluate how technological advancements are incorporated into the current framework, ensuring its efforts align with the Industrial Strategy which is scheduled for release in spring 2025.

These aims will be achieved through a variety of ways, such as:

• Specific consultations – There will be continued engagement with industry and other key stakeholders before any regulatory changes are brought forward to ensure they are fit for purpose.  
• Legislative reform – The government aims to push through secondary legislation ‘as soon as possible’.
• Strengthening the regulatory framework – Although the methods of funding are unclear, the government will be enhancing the regulatory capacities of the OPSS to enable it to play a greater role in the coordination and alignment of product safety approaches.
• Improving consumer awareness – As alluded to with the proposed new requirements for online marketplaces, we also may see an increased emphasis on consumer awareness and education.

The government has made clear that legislative changes are on the immediate horizon, so it is critical that businesses prepare for compliance by keeping their current product safety practices under review and considering how they might need to adapt.

We will be keeping a close eye on these developments in our upcoming blogs, so stay tuned. In the meantime, if you want to think about how you can start meaningfully engaging with this important area of legislative change, please get in touch.

The guide’s ‘practical advice’ specifically focuses on how businesses which make environmental claims about clothing, footwear, fashion accessories and related services (e.g., packaging and delivery) can ensure these claims are clear and accurate.

Enforcement action for failure to do so is front and centre for the CMA. Indeed, on the very same day the guidance was published, the CMA confirmed that it had issued further warnings to 17 fashion brands for possible greenwashing. Together with the pending consumer enforcement provisions under the Digital Markets, Competition and Consumers Act 2024 carrying possible fines of up to 10% of worldwide turnover and a global trend towards more stringent green claims legislation, the stakes for noncompliance are increasingly high for brands that make green claims. 

Time is short for fashion retail businesses to review their environmental claims and take steps to shore up the accuracy and transparency of consumer communications, so read on for our key takeaways and get in touch if you have any questions.

Background

The new guidance draws on the CMA’s conclusions from its recent investigation into three fashion retailers that – without any admission of wrongdoing or liability – entered into undertakings with the CMA committing to making only accurate and clear green claims (see Cooley’s May 2024 summary). The CMA’s annual plan for 2024 – 2025 made clear that environmental sustainability remains a policy and enforcement priority, and the recent warnings issued to fashion brands indicates that these early investigations may lead to wider enforcement action in the near future.

Key takeaways from the guidance

Companies are responsible for any claims made relating to their own products and/or third-party products they sell and must satisfy themselves that such claims are clear, accurate and not misleading, regardless of whether the claim is made on a product (including a label), in advertising, in store or online. This includes content communicated by a business on a company website or app, or even on a third-party platform, for example, via social media.

• Don’t hide important information. This includes ensuring claims and explanatory information – including any qualifications – use plain, accurate language which is clearly visible. Accompanying information must be presented close to the environmental claim made and generally cannot require further action (e.g., following a hyperlink or scanning a QR code).
• Avoid unclear terms. Broad or absolute claims, such as ‘green’, ‘sustainable’ or ‘eco-friendly’ are only suitable if the product as a whole has a positive environmental impact, or at least no adverse impact, which can be substantiated. In general, unless supported by evidence, companies should avoid such terms for individual products and product ranges.
• Avoid misleading imagery and icons. Logos, icons and imagery alone may give the impression of, or reinforce, misleading impressions of a product’s impact on the environment. Companies should pay particular attention to the overall impression of their marketing campaigns and communications and consider whether more information is needed to explain the logo, icon or imagery used.
• Only make clear comparisons. Comparisons must be like-for-like, clear, fair and provide consumers with sufficient information so that they can make an informed choice about competing products or businesses.
• Be clear what actions a consumer must take. Any claim that requires consumer action (e.g., specific disposal instructions) to realise the positive environmental attribute must be clearly stated.
• Be clear when using filters and other navigational tools. Navigational tools (e.g., filters based on environmental credentials) must be used in a way which does not mislead consumers. The tools themselves are required to clearly indicate the environmental criteria which apply, and the products they identify must meet said criteria.
• Be clear which claims relate to which fabrics and what these claims are. Companies should avoid subjective terms like ‘responsible cotton’ and instead refer to the objective properties of the fabric, e.g., ‘organic cotton’. Where claims relate to the use of a specific fabric, the specific, or minimum percentage of relevant fibres, must be set out clearly. Where a product is not made entirely of a single fabric or entirely ‘recycled’, that also must be clear. Certain components (e.g., buttons, zippers and threads) can be excluded from this assessment.  
• Be clear about affiliations and accreditations. Companies should be careful not to mislead consumers when referring to affiliations or accreditations that do not specifically relate to the product. When substantiating environmental claims based on such affiliations/accreditations, companies should – among other things – be clear which claims are covered, whether they relate to a specific part of the product’s life cycle, and reference where further information can be found. Similar requirements also have been recently introduced in the European Union via the Empowering Consumers for the Green Transition Directive.

Above all, companies must establish internal processes to ensure that all environmental claims made are accurate and not misleading, including through the implementation of appropriate policies, regular staff training, and systems to verify product listings are correct and marketing materials compliant. When relying on supplier claims, these should be backed up with evidence (e.g., final scope or final transaction certificates), with spot-checks along the supply chain deemed good practice.

New rules under the General Product Safety Regulation (EU) 2023/988 (GPSR) apply in the European Union from 13 December 2024. The GPSR replaces the General Product Safety Directive 2001/95/EC (GPSD). It applies in full to products that are not already subject to EU harmonisation legislation (i.e., non-CE marked products) and covers gaps in product safety regulation for products subject to certain EU harmonisation legislation (i.e., CE marked products).

The GPSR represents a substantial update from the current rules. It will introduce new requirements for consumer products marketed in the EU and create new obligations for companies supplying those products to the EU. Many of the changes are world-first regulatory innovations. Companies impacted need to ensure they understand the upcoming new requirements and review existing products, systems, policies and procedures to determine what changes (if any) will be needed to comply.

So, what’s new?

1. New requirements for non-harmonised products – including new stricter labelling obligations and new requirements to prepare a technical file, conduct a pre-market risk assessment and appoint a responsible person in the EU to undertake certain tasks.

2. Additional requirements to consider when assessing the safety of products – including mental health, cybersecurity (to the extent it has an impact on safety), impact of software updates/software subsequently downloaded, artificial intelligence (AI) and machine learning (ML) functionalities, connectivity, different impacts on health and safety for different genders, and risks for vulnerable consumers (e.g., children, older people and people with disabilities).

3. New requirements for online sales – including that the online offer will need to display mandatory information, such as the details of the manufacturer, details of the responsible person in the EU where the manufacturer is not established in the EU, information to identify the product (picture, its type and any other product identifier), and any warnings and safety information required to be affixed to the product, or on its packaging or included in its accompanying documents under EU laws.

4. New mandatory requirements for complaints – Manufacturers, and in certain cases importers, will be required to have communication channels for consumers to submit complaints and report accidents/issues. There is an obligation to investigate complaints that concern the safety of products or allege products are dangerous, and keep an internal register of those complaints and product recalls/corrective actions, along with specific requirements regarding personal data stored on that register. For many harmonised products, sector-specific rules cover the requirements for an internal register.

5. New mandatory accident reporting obligations – Manufacturers will be required to report accidents over a certain threshold without undue delay from the moment they know about it. Where the manufacturer is not established in the EU, the responsible person who has knowledge of an accident will need to ensure the report is made. There also is a separate accident reporting obligation on online marketplaces.

6. New obligations on providers of online marketplaces – including to establish a single point of contact for market surveillance authorities and also consumers, to cooperate with authorities, to respond to notices from authorities within two working days and process notices related to product safety issued under the notice and action mechanism in the Digital Services Act within three working days, to design interfaces to enable traders to display the information required for online offers, to report dangerous products via Safety Gate, to report accidents via Safety Gate, and to directly notify affected consumers about recalls and publish information about recalls, plus more.

7. New requirements for how product recalls and corrective actions are carried out – including to notify all affected consumers directly, along with mandatory requirements for recall notices (including a template recall notice and a prohibition on using terms such as ‘voluntary’, ‘in rare/specific situations’) and new rules for the recall remedy (including offering a choice of at least two options of repair, replacement or refund).

8. Enhanced role for Safety Gate – It will become mandatory to use the European Commission portal, Safety Gate, to notify product recalls, and it will be the portal for the new accident reporting obligation. Consumers and ‘other interested parties’ will be able to use Safety Gate to report products that may present a risk.

9. Increased enforcement – including requiring the European Commission to organise, on a regular basis, joint activities between market surveillance authorities to inspect products purchased covertly, obligations on authorities to carry out coordinated sweeps of particular products/product categories, along with provisions on international cooperation between the European Commission and international regulators.

10. Increased class action risk by amending the new EU Representative Actions Directive to allow representative actions for any breaches of the GPSR – such as for recalls.

We’ll be taking a deeper dive exploring these changes in our upcoming blogs, so stay tuned.

New rules under the General Product Safety Regulation (EU) 2023/988 (GPSR) apply in the European Union from 13 December 2024. The GPSR replaces the General Product Safety Directive 2001/95/EC (GPSD). It applies in full to consumer products that are not already subject to EU harmonisation legislation (i.e., non-CE marked products) and covers gaps in product safety regulation for products subject to certain EU harmonisation legislation (i.e., CE marked products).

The GPSR represents a substantial update and will introduce new requirements for consumer products marketed in the EU and create new obligations for companies supplying those products to the EU. These reforms are the culmination of a long period of consideration and debate in Europe. The existing GPSD is around 20 years old, and reform has been under consideration for some 10 years after a failed attempt in 2013. Many of the changes are world-first initiatives.

Companies that supply products to the EU need to ensure they understand the upcoming new requirements and review existing products, systems, policies and procedures to determine what changes (if any) will be needed to comply.

The Cooley products team will explore the new rules under the GPSR in a series of upcoming blogs, addressing topics including:

• What’s new
• Expanded concept of safety
• New accident reporting obligation
• Focus on online marketplaces
• New requirements for recalls and corrective actions
• Enhancements to Safety Gate 
• Increased enforcement and international co-operation
• Liability and collective redress

Stay tuned for more.

The EU Batteries Regulation establishes a raft of new obligations, including for the design, conformity assessment and labelling of products, as well as in respect of supply chain due diligence, audit and online disclosures. With new requirements phased in from 18 August 2024, most product stakeholders need to take immediate action to ensure they comply with the requirements.

In this new Productwise miniseries, we’ll be summarising the requirements of the EU Batteries Regulation and breaking down the new compliance obligations into the following topic areas:

• Scope and timeline for compliance.
• Conformity assessment, CE marking and substance restrictions.
• Labelling.
• Designing for repair – removability and replaceability.
• Supply chain due diligence requirements.
• Producer responsibility obligations.
• Penalties and risks of noncompliance.

This post is Part 1 in the series, and it sets out the scope of the new legislation and the timeline for compliance. Watch this space for more on the rest of these topics, and if you have questions in the meantime, please reach out to the Cooley products team.

Which batteries are in scope?

All batteries are in scope, save for a few very narrow exemptions for batteries connected with the protection of security interests, military purposes or intended to be sent into space.

Importantly, this includes both stand-alone batteries and batteries incorporated into products. The Batteries Regulation establishes certain requirements for the battery itself (e.g., conformity assessment, CE marking and labelling) and other requirements for products that incorporate batteries (e.g., a requirement to design for easy removal and replacement of the battery by an end user).

There are varying requirements under the Batteries Regulation, depending on the type of battery. For product manufacturers, the key types of battery to be aware of will be:

• Portable batteries, which is the category of batteries in most consumer electronic devices
• Portable batteries of general use, which is a subset of portable batteries in common formats (e.g., AA, button cell).
• Light means of transport (LMT) batteries, which are commonly used in electric bicycles and other forms of light transportation.
• Starting, lighting and ignition (SLI) batteries, which are commonly used in (non-electric) vehicles to start the engine and power certain vehicle systems.
• Electric vehicle (EV) batteries that provide electric power for traction in hybrid or electric vehicles of categories M, N, or O.
• Industrial batteries, which are specifically designed for industrial uses or batteries of more than 5 kilograms that are not an EV, LMT, or SLI battery.
• Stationary battery energy storage systems, which store and deliver energy to the grid or end users.

Who has obligations under the Batteries Regulation?

Manufacturers, importers, and distributors who supply batteries or products containing batteries in the EU are subject to obligations, which apply to online and in-store business-to-consumer and business-to-business sales.

Can I rely on my battery supplier to ensure compliance?

Manufacturers of final products will be legally responsible for the compliance of the batteries they contain. This means that product manufacturers will need to work closely with their battery suppliers to ensure that batteries comply with the new requirements set out in the law, or risk facing penalties that could include fines and restrictions on the sale of products.

What do I have to comply with if I am in scope?

Manufacturers of products containing batteries will need to comply with the following requirements:

• Design portable batteries to be readily removable and replaceable by end users using commonly available (or provided) tools during the lifetime of the product. (There are very limited exemptions to this requirement.)
• Ensure a conformity assessment has been carried out, batteries have been marked with the CE mark and technical documentation, and a declaration of conformity has been drawn up.
• Batteries must be labelled with a range of new information and a QR code which links to certain information on a webpage.
• Ensure that batteries comply with substance restrictions (for all batteries) and performance and durability requirements for portable batteries of general use.

Importers and distributors will have their own obligations to ensure that the manufacturer has complied with these obligations and act with due care in relation to these requirements, respectively.

In addition, manufacturers and importers of batteries and products containing batteries must comply with new supply chain due diligence obligations. These include developing a due diligence policy and having this policy verified by a third-party notified body. Compliance must be audited annually, due diligence policies incorporated into contacts with suppliers, and annual reports on compliance published on the manufacturer or importer’s website. Manufacturers, importers and distributors also must comply with new producer responsibility requirements.

When do the new requirements apply?

As shown in the graphic below, there will be phased implementation of the requirements under the Batteries Regulation.

1. An obligation on manufacturers to repair broken or defective goods.
2. An obligation on sellers to incentivise consumers to choose repair ahead of the other remedies available for a breach of the legal guarantees offered under the Sale of Goods Directive.

The trend towards repair and a more circular economy is not isolated to the EU, with several states in the US contemplating or already having adopted right to repair laws.

Below, we have provided an overview of the products in scope, what the R2R Directive means for manufacturers and sellers going forward, and how long companies have to prepare.

New right to repair obligation for manufacturers

The R2R Directive will require manufacturers (including those marketing products under their name or trademark) or their authorised representative in the EU to carry out repairs outside of the legal guarantee for products covered by repairability obligations under EU law unless repair is impossible.

Scope

This obligation applies to consumer goods subject to repairability obligations detailed in Annex II to the R2R Directive. Currently, this means that only certain consumer goods are in scope, including electronic displays, mobile phones and slate tablets, as well as certain household goods (e.g., white goods such as washing machines and fridges). However, companies should anticipate the scope of this obligation to broaden significantly as new repair requirements are introduced for a broader range of products (e.g., textiles and footwear). Under the R2R Directive, the European Commission is required to update Annex II as new products become subject to repairability requirements. A large number of new repair obligations, such as those improving ease of disassembly and access to spare parts or repair-related information, are expected as part of the rollout of the EU’s Ecodesign for Sustainable Products Regulation (ESPR) framework, which we discussed in a December 2023 blog post.

Key features

Repair requirements

The repair must be free of charge or for a reasonable price and must be carried out in a reasonable time. While a repair can be refused where it is impossible, it cannot be refused for the sole reason that a previous repair was performed by a third party or for purely economic reasons. For these purposes, ‘repair’ means ‘one or more actions carried out to return a defective product or waste to a condition where it fulfils its intended purpose’. Further, the manufacturer must make information on repair services and costs available free of charge in an easily accessible, clear and comprehensible manner.

Spare parts availability

Where manufacturers make spare parts and tools available for in-scope products, they also are required to offer these at a reasonable price that does not deter repair. The R2R Directive includes a number of obligations surrounding spare parts, such as requiring information on certain spare parts to appear online and preventing certain practices that can hinder repair including contractual clauses or certain software-related and hardware-related barriers. In particular, manufacturers will not be permitted to impede the use of original or second-hand spare parts, compatible spare parts, and spare parts issued from 3D printing, by independent repairers when those spare parts are in conformity with product safety and intellectual property requirements under EU or national law.

Further measures to incentivise repair

Under the R2R Directive, additional measures to incentivise repair include:

1. The establishment of an online platform to help consumers find repairers and sellers of refurbished goods.
2. A standardised European Repair Information Form which repairers can use voluntarily to provide key information to consumers about the repair and its cost.

Member states also will be required to implement at least one policy measure to promote repair over replacement. Examples include repair vouchers and funds, information campaigns or a reduction of the value-added tax rate on repair services.

Amendments to the existing legal guarantee

Under the existing Sale of Goods Directive, sellers are liable to the consumer for any lack of conformity which exists at the time the goods were delivered and which becomes apparent within two years of delivery (or longer, depending on the national law). Currently, consumers can choose between a refund, free repair or a replacement (with certain exceptions). The R2R Directive amends the Sale of Goods Directive to better incentivise repair.

Scope

This obligation is not limited to goods subject to ecodesign rules and applies to all goods (including goods with digital elements) sold to consumers under the Sale of Goods Directive.

Key features

Hierarchy of remedies remains unchanged

Consumers still will be able to choose between a repair and a replacement for nonconforming goods contrary to the initial legislative proposal which sought to make repair the default option. Sellers will, however, be required to inform consumers before the remedy is provided about their right to choose between repair and replacement as well as about the possible extension of the consumer’s legal guarantee if repair is requested. Sellers still will be able to refuse repair if it would impose disproportionate costs on them. Companies should nevertheless expect greater scrutiny of the use of this exemption by consumers and the consumer protection authorities.

Replacement and refurbished goods

Sellers also may voluntarily make a replacement product available to the consumer during the period of repair. Further, if the consumer requests a refurbished product as a replacement (instead of a repair), the seller can discharge its obligations by providing the refurbished product. These provisions also apply to manufacturers which offer consumers a commercial guarantee.

Extended legal guarantee

The seller’s liability under the Sale of Goods Directive will be extended by a further 12 months where a consumer chooses repair in order to have the good(s) brought into conformity. Member states have discretion to further extend this period under national laws if they so wish.

Insufficient repairability may equate to nonconformity

As amended by the R2R Directive, the Sales of Goods Directive now includes an assumed level of ‘repairability’ as an additional characteristic alongside durability, functionality and compatibility of goods of the same type. A nonconformity may be established if, given the nature of the goods and taking into account any public statement made by or on behalf of the seller or related actor (e.g., on a label or in an advertisement), a consumer may reasonably expect a greater level of repairability than is possible.

Commercial guarantees

Given the significant changes introduced by the R2R Directive, including the new repair obligations and rules around loan and refurbished products, manufacturers should review their existing commercial guarantees to ensure they are compliant with the new rules.

Enforcement

The R2R Directive is brought in scope of the Representative Action Directive, meaning consumers will be able to enforce the R2R Directive by means of the EU’s new class actions mechanism. It also amends the Consumer Protection Cooperation Regulation, which permits consumer protection authorities to cooperate and coordinate enforcement actions against non-compliant businesses. Any penalties a business might face will be set by member states under their own implementing legislation, on the proviso they must be ‘effective, proportionate and dissuasive’.

Timeline

As the R2R Directive has been published in the Official Journal of the EU, it will enter into force 20 days later. Member states then have two years, until 30 July 2026, to transpose the requirements into national law.

Broader context

The R2R Directive forms part of the EU’s Circular Economy Action Plan and targets obstacles that discourage repair, including ‘inconvenience, lack of transparency or difficult access to repair services’. It complements several other initiatives, all of which have the overarching aim of incentivizing consumers to use products for longer and prioritise sustainable consumption throughout the entire product life cycle, including:

• The new Batteries Regulation, which we posted about in July 2023.
• The Ecodesign for Sustainable Products Regulation.
• The Directive on Empowering Consumers for the Green Transition, which we posted about in January 2024

Alternatively, a patient may establish liability through evidence that the physician, even while still recommending the treatment, would have relayed a stronger warning to their patient and that an objectively prudent patient hearing such warnings would have refused treatment altogether.

The court’s newly articulated causation standard for medical product manufacturer liability redraws the boundaries between patient informed consent and the learned intermediary doctrine as a legal defense.  As explained below, the court’s ruling may have resounding impacts on manufacturers and other key stakeholders in the healthcare industry in the years ahead.

Underlying Facts and Procedural History

In 2017, Michelle Himes and other patients filed a putative class action in the U.S. District Court for the Central District of California asserting state law diversity claims from injuries they allegedly suffered from electroconvulsive therapy, or ECT, that their physicians had prescribed them.[2] ECT is a medical procedure where a device sends electric currents into a patient’s brain to induce seizures that improve certain mental health conditions.[3] 

The defendant, Somatics LCC, manufactures the ECT devices that allegedly caused their injuries, including brain injury, permanent retrograde amnesia, cognitive impairment and death.

But according to the plaintiffs, Somatics never conducted any clinical trials of its ECT device to evaluate its safety and efficiency.[4] In addition to their own alleged injuries, the plaintiffs further claimed that Somatics knew of, but failed to investigate, hundreds of patient reports of injury and death from ECT.[5]

And as the plaintiffs alleged, Somatics failed to report any adverse events to the U.S. Food and Drug Administration, never provided any warnings at all to physicians about the material risks of ECT and misbranded their ECT device to avoid FDA regulation.[6] 

Somatics moved for summary judgment in 2021, asserting the learned intermediary doctrine as a complete defense against the plaintiffs’ claims of strict liability, negligence and loss of consortium.[7]

As a historical matter, under the learned intermediary doctrine, medical product makers could defeat liability for failure-to-warn claims if the manufacturer could show that it (1) advised a learned intermediary, i.e., the prescribing physician, of the material risks associated with the medical product, and (2) the intermediary still prescribed that product to the patient.

The principle behind the doctrine is that “patients often rely on their physician’s expertise and judgment in making medical treatment decisions” and providing informed consent, and not on warnings, if any, provided directly by the medical product manufacturer.[8]

Applying that doctrine, the district court initially assumed for purposes of the summary judgment motion that Somatics failed to provide any warnings of ECT’s risks to physicians.[9]

Still, the district court granted summary judgment for Somatics because it concluded that the plaintiffs could not demonstrate causation — i.e., that the nondisclosed risks associated with ECT would have altered their physicians’ choice to prescribe ECT — regardless of the potential inadequacy of Somatics’ disclosures, how physicians may relay stronger warnings to their patients or how patients may react to those stronger warnings.[10]

The plaintiffs appealed to the Ninth Circuit, arguing that the district court had applied an unduly demanding causation standard that turned solely on the physician’s choice to prescribe ECT while disregarding the physician’s warning practice and patients’ informed consent.[11]

The Ninth Circuit affirmed summary judgment for one plaintiff because his physician testified that even stronger risk warnings by Somatics would not have altered his decision to prescribe ECT or to even disclose additional risks to his patients.[12] 

However, the Ninth Circuit revived Himes’ claims, citing factual evidence that, while Himes’ treating physician would still have recommended ECT to Himes, he also would have passed on a stronger warning had Somatics provided one.[13]

Thus, the operative question remained whether patients can overcome the learned intermediary defense by showing either they personally or a reasonable person in their shoes would have declined a particular medical product after hearing a hypothetical stronger warning from their physician.[14] Finding an absence of controlling state precedent on the issue of causation, the Ninth Circuit certified the case to the California Supreme Court.

The California Supreme Court’s Opinion in Himes v. Somatics

The Ninth Circuit certified the following question of state law to the California Supreme Court:

Under California law, in a claim against a manufacturer of a medical product for a failure to warn of a risk, is the plaintiff required to show that a stronger risk warning would have altered the physician’s decision to prescribe the product?  Or may the plaintiff establish causation by showing that the physician would have communicated the stronger risk warnings to the plaintiff, either in their patient consent disclosures or otherwise, and a prudent person in the patient’s position would have declined the treatment after receiving the stronger risk warning?[15]

Underscoring the high stakes of the California Supreme Court’s decision, a wide array of industry stakeholders filed amicus briefs supporting the medical product manufacturer.

Writing for a unanimous court, Justice Joshua Groban responded to the Ninth Circuit’s question by rejecting the manufacturer’s argument that the learned intermediary doctrine operates as a complete defense to causation and liability unless the patient can prove that the treating physician would have refused to prescribe the product given the stronger warning.

Siding partly with the patients and partly with amici, the court held that causation for a medical product manufacturer’s failure to warn of adverse risks may be proven by evidence that either (1) “a stronger risk warning would have altered the physician’s decision to prescribe”; or (2) “the physician would have communicated the stronger warning to the patient and an objectively prudent person in the patient’s position would have thereafter declined the treatment notwithstanding the physician’s continued recommendation of the treatment.”[16] 

Although the court’s decision widens the door for medical product maker liability, the court did not hand the plaintiffs a full win. 

For one, the court reinforced the continued viability of the learned intermediary doctrine by shutting down the patients’ contention that, if a manufacturer fails to properly warn physicians, then it bears the burden of warning the patients directly to avoid failure-to-warn liability.[17]

The court reasoned that direct manufacturer-to-patient warnings would undermine informed consent and the learned intermediary doctrine by removing physicians from the equation altogether.[18]

Second, according to the court, the patients incorrectly argued that causation can be met by patient testimony that they would have personally declined the treatment had they had received a stronger risk warning.

As the manufacturer argued, the patients’ proposed subjective rule for crediting retrospective patient testimony would upend the learned intermediary doctrine and put manufacturers in an impossible position of speculating how idiosyncratic patients may react to their physicians’ hypothetical risk disclosures.[19]

In their amicus briefs, industry stakeholders echoed these concerns, warning that a rule that turns on patients’ hindsight testimony would “operate as a virtually automatic bar to summary judgment” in medical failure-to-warn cases.[20] 

The court, seeking to avoid the bias of hindsight while respecting patient decision making, struck a different balance altogether. Under its newly articulated causation test, patients “must prove that an objectively prudent person in the patient’s position would have declined treatment despite the physician’s assessment that the benefits of the treatment for the patient would still outweigh any risks disclosed by a stronger warning.”[21]

Its new test therefore applies an objective test that still accounts for “personal characteristics … or circumstances unique to the patient.”[22]

Potential Implications of the Himes Decision

Stronger medical product risk disclosures may be necessary to defeat causation and liability in California and potentially nationwide.

Himes effectively adds a new pathway for plaintiffs to establish causation and liability against manufacturers. In a post-Himes world, manufacturers must now also defend against claims that their warnings were inadequate and that in the face of a counterfactual stronger warning by their physician, objectively prudent patients would have refused treatment. 

Given this, Himes may contribute to an uptick in patient-initiated litigation against manufacturers and more failure-to-warn cases surviving motions to dismiss and summary judgment. To avoid this, manufacturers may respond to Himes by modifying their warnings to encompass all potential risks, so as to avoid heightened judicial scrutiny into how counterfactual stronger warnings by physicians may affect patient choices.

Although the Himes decision solely concerned the standard for causation in California courts, the size of California’s patient base means that medical product manufacturers nationwide may be incentivized to warn of all potential risks of treatment using their product.

While this may deter claims against manufacturers, amici also insisted that this outcome perversely incentivizes manufacturers to over-warn about all possible medical risks, no matter how remote, thereby obscuring the most salient risks to the detriment of physicians and patients alike.[23] 

Himes may place medical product manufacturers at odds with physicians, hospitals, insurers and patients.

As a general matter, under the learned intermediary doctrine, a medical product manufacturer’s duty to warn runs primarily to physicians, and not to patients. Thus, in cases where the medical product warning is adequate, medical providers and malpractice insurance bear any liability since the learned intermediary defense establishes the medical provider prescribing the product as the intervening cause of the patients’ injuries.

Through the Medical Injury Compensation Reform Act, California law limits all noneconomic damages for meritorious claims against physicians and other medical providers — e.g., for pain and suffering, discomfort, loss of consortium, and death.[24]

After enacting MICRA in 1975 to constrain the ballooning cost of malpractice insurance for medical providers,[25] the California Legislature recently amended MICRA’s damages cap to up to $500,000 in 2023, with annual increases for an upper limit of $1 million by 2033.[26]

Crucially, MICRA “applies only to actions alleging injury suffered as a result of negligence in rendering the professional services that hospitals and others provide by virtue of being health care professionals.”[27] 

By contrast, California law imposes no damages limit for meritorious injury claims against manufacturers. So, while the learned intermediary doctrine may have historically discouraged patients from bringing injury-related suits against medical product manufacturers, the Himes ruling may encourage more plaintiffs to assert, and prevail in, actions against manufacturers seeking monetary relief far above MICRA’s damages cap.

And in future failure-to-warn actions asserting comparative liability against both the physician and manufacturer, physicians — potentially seeking to shift liability away from themselves — may be inclined to testify that the manufacturer’s disclosures inadequately warned of risks, and that they would have reviewed and conveyed a stronger warning to patients had one been provided.

Thus, Himes raises important implications for the entire medical industry going forward.

For instance, to the extent Himes substantially raises legal costs for medical product manufacturers — including for makers of surgical machines, heart-lung machines, ventilators, incubators, dialysis machines and many others — amici warned that such ballooning costs may negatively affect the research, development and availability of medical breakthroughs to treat serious conditions, echoing the California Legislature’s concerns motivating MICRA nearly a half-century earlier.[28]

The state high court ruling leaves unanswered questions and potential defenses on the table under the Federal Food, Drug and Cosmetic Act.

One question that was not before the California Supreme Court is what role, if any, federal preemption may have on a plaintiff’s claims.

Specifically, the Federal Food, Drug and Cosmetic Act expressly preempts state law in regulating medical instrumentation, with few exceptions.[29] The FDCA provides:

[N]o State or political subdivision of a State may establish or continue in effect with respect to a device intended for human use any requirement (1) which is different from, or in addition to, any requirement applicable under this chapter to the device, and (2) which relates to the safety or effectiveness of the device or to any other matter included in a requirement applicable to the device under this chapter.[30]

Whether Section 360k(a) intended to preempt causation in the context of state tort actions remains an open question. The U.S. Supreme Court has visited the issue twice, once for Section 510(k)-cleared devices, like the ECTs at issue in Himes, and again for higher-risk premarket-approval devices.

In Reigel v. Medtronic Inc. in 2008, the high court found that Section 360k(a) expressly preempts state law tort claims alleging negligence and strict liability for PMA-approved devices, if such claims are based on state requirements “different from, or in addition to,” federal requirements relating to safety and effectiveness.[31]  

For 510(k)-cleared devices, however, the U.S. Supreme Court has taken a different approach, holding that state law claims were not preempted by Section 360k(a) because the 510(k) process does not impose requirements regarding the safety and effectiveness of the device.[32]

Since the 510(k) process merely establishes that the device is substantially equivalent to a predicate device, the U.S. Supreme Court ruled in Medtronic Inc. v. Lohr in 1996 that the federal government had not established requirements in the same manner that it does for premarket-approval devices.[33]

In addition to express preemption provided for in § 360k(a), there are also implied preemption theories that have applied in FDCA cases.[34]  

Indeed, this case will be interesting to watch on remand to see whether and how Somatics raises preemption defenses moving forward, for example, by noting that the patient’s claims would have required the defendants to include warnings for their device that was “different from, or in addition to” the federal requirements relating to safety and effectiveness.[35]

The defense is made further complex because the ECTs at issue in Himes were initially required to proceed to market via the premarket-approval pathway, but were down-classified to Class 2 devices eligible for the 510(k) pathway, thus making the express preemption arguments under U.S. Supreme Court precedent murky, yet plausible.[36]  

What’s Next

The case now returns to the Ninth Circuit to reconsider the district court’s grant of summary judgment with the California Supreme Court’s latest guidance on causation and potential liability. 

The Ninth Circuit had previously found a genuine dispute of material fact about whether the Himes’ physician, in the face of a hypothetical stronger warning, would have passed the warning on to her, and so the Ninth Circuit will likely reverse the grant of summary judgment and remand to the district court to decide whether an “objectively prudent person in the plaintiff’s position” would have declined the treatment if given a stronger warning. 

As the case progresses, it remains to be seen what evidence the plaintiffs will adduce and what additional defenses, such as those potentially available under the express preemption provision in the FDCA, that the manufacturer will assert. 

What is clear, however, is that Himes has the potential to significantly change nationwide medical product warnings as well as the litigation landscape for medical product manufacturers, physicians, patients and other healthcare industry participants in the years ahead.

[1] No. S273887, 2024 WL 3059637 (Cal. June 20, 2024).

[2] Pls.’ Class Action Compl. ¶ 2, Riera v. Mecta Corp., 2021 WL 2024688 (C.D. Cal. May 14, 2021), ECF No. 1.

[3] While Plaintiffs’ briefs centered on allegedly harmful consequences of ECT, the American Psychiatric Association (“APA”) filed an amicus brief seeking to correct alleged misstatements by Himes regarding the efficacy of ECT, which it insisted effectively treats certain mental health conditions.  APA Br. at 9; see Electroconvulsive Therapy (ECT), Mayo Clinic (Oct. 12, 2018).

[4] Riera, 2021 WL 2024688, at *1.

[5] Id. 

[6] Id.

[7] Somatics Mot. for Summ. J., supra note 3, at 16-18, ECF No. 80.

[8] Himes, 2024 WL 3059637, at *8.

[9] Riera, 2021 WL 2024688, at *5.

[10] Id. at *5-6.

[11] Himes v. Somatics LLC, 29 F.4th 1125, 1126 (9th Cir. 2022).

[12] Id.

[13] Himes v. Somatics, LLC, 2022 WL 989469, at *2 (9th Cir. Apr. 1, 2022).

[14] Himes, 29 F.4th at 1126.

[15] Id. at 1127.

[16] Himes, 2024 WL 3059637, at *5.

[17] Id. at *6; see Opening Br. on the Merits, supra note 2, at 3.

[18] Himes, 2024 WL 3059637, at *6-7.

[19] See id. at *9-10; see also CMA, CDA, and CHA Br. at 34.

[20] PLAC Br. at 4-5, 23-24.

[21] Himes, 2024 WL 3059637, at *1 (emphasis added); see Opening Br. on the Merits, see supra note 2, at 46.

[22] Himes, 2024 WL 3059637, at *9.

[23] PLAC Br. at 10-11.

[24] See Cal. Civ. Code § 3333.2. 

[25] See Lopez v. Ledesma, 12 Cal. 5th 848, 855–56 (2022).

[26] See Cal. Civ. Code § 3333.2(g). 

[27] Flores v. Presbyterian Intercommunity Hosp., 63 Cal. 4th 75, 88 (2016). 

[28] CLS Br. at 22-24; PLAC Br. at 5; CJAC Br. at 11.

[29] 21 U.S.C. § 360k(a).

[30] Id.

[31] See Reigel v. Medtronic, Inc., 552 U.S 312, 328–30 (2008).

[32] See Medtronic, Inc. v. Lohr, 518 U.S. 470, 493 (1996).

[33] See id., at 492-94.

[34] See e.g., Buckman Co. v. Plaintiffs Legal Comm., 531 U.S. 341, 347–48 (2001).

[35] Defs.’ Answer to Pls.’ First Am. Compl., supra note 3, at 15, ECF No. 23.

[36] 21 C.F.R § 882.5940.

The UK’s Online Safety Act (OSA) imposes extensive obligations on certain types of online service providers to protect users from illegal and harmful content. A key focus of the OSA is the protection of children online, and special obligations are conferred on service providers whose platforms are “likely to be accessed by children”.

Under the OSA, Ofcom, the UK’s online safety regulator, is required to issue guidance and Codes of Practice setting out the practical steps relevant services should take to comply with these duties (Children’s Codes) to help protect children online. Related to this, Ofcom launched a consultation on that guidance and the Children’s Codes.

Interested parties have until 17 July 2024 to submit responses. Businesses which could be impacted by these measures – e.g., those that operate or are involved with regulated user-to-user (U2U) services and regulated search services which children can access – should consider whether to file a response. This may be the only opportunity to make your voice heard in relation to these important changes.

In order to better help you understand the proposals in the consultation and determine whether to respond, this blog summarises:

• The background to the child safety duties imposed by the OSA.
• How a provider can determine if its services are “likely to be accessed by children”.
• The risks of enforcement for breaching those duties.
• Ofcom’s key proposals in the Children’s Codes.
• Next steps for the consultation.

For more background on the OSA, please see this November 2023 Cooley alert, Decoding the UK Online Safety Act 2023: Latest Draft Guidance, Key Features and Insights, which describes the types of services that are in scope of the legislation, the wide-reaching obligations the legislation imposes, compliance tips and enforcement risks. Also see our April 2024 update, Online Safety Act Update: Ofcom Proposes Categorisation Thresholds, summarising some of the latest key developments.

What child safety duties are imposed under the OSA?

While many OSA obligations apply to all in-scope providers, there are additional obligations which apply to services that are “likely to be accessed by children”. These duties relate only to the parts of a service possible for children to access. 

How can a provider determine if its services are ‘likely to be accessed by children’?

All regulated U2U services and regulated search services must conduct a children’s access assessment to determine whether their service (or a part of it) is likely to be accessed by children. This assessment must be kept under review and conducted annually. Most providers must complete their first assessment within three months of Ofcom publishing its final children’s access assessment guidance (which may be in early 2025).

Additional considerations here include that:

• Providers must use age verification or age assurance (e.g., photo ID matching) to conclude that it is not possible for children to access their service. Certain age assurance methods are considered unacceptable for these purposes – including payment methods which do not require the user to be over 18 and self-declaration of age.
• If a children’s access assessment determines that the service (or part of it) is likely to be accessed by children, it must then carry out a children’s risk assessment and take appropriate steps to keep it up to date.
• If a service fails to complete a children’s access assessment, it will be considered likely to be accessed by children from the date by which the access assessment should have been completed and will be subject to the relevant duties.

What are Ofcom’s enforcement powers, and what is the risk to buinsess of noncompliance?

The stakes are high when it comes to noncompliance (summarised below), which is why ensuring that the guidance and Children’s Codes are helpful and practical for businesses is important. With strong enforcement powers like these, businesses do not want confusion over how they are meant to comply.

The enforcement powers and risks of noncompliance include:

• Investigations:Children’s access assessments are an “enforceable requirement” under the OSA. This means that in-scope companies must co-operate with investigations by Ofcom into whether a service has failed to comply with the requirements. Ofcom has stated that it will engage with the largest and riskiest services via continuous regulatory supervision, including – where necessary – by making formal and enforceable requests for information.
• Fines:Following an investigation, if Ofcom finds a service has contravened its obligations, it has the power to impose a penalty of up to 10% of qualifying worldwide revenue or 18 million pounds (whichever is greater) and require remedial action to be taken. Ofcom has been vocal about its willingness to use its enforcement powers where necessary, with its Chief Executive Dame Melanie Dawes reportedly stating that Ofcom will drive change “with every possible tool that we’ve got”.

• Business disruption:In the most serious cases of noncompliance, Ofcom can seek a court order imposing business disruption measures – effectively shutting down access to services in the UK.
• Data protection risk: As set out in a recent joint statement, services subject to both the online safety and data protection regimes may be considered “companies of mutual interest” by Ofcom and the Information Commissioner’s Office (ICO). If so, Ofcom and the ICO may decide to collaborate on regulation of that company, such as by routinely sharing information with each other. For the ICO, the protection of children online has long been a key priority, signified by its Children’s Code, updated Opinion on Age Assurance and 2024 – 2025 Priorities for Protecting Children’s Personal Information Online. “Companies of mutual interest” should therefore take particular care to address the requirements of both regulators in respect of children’s safety.
• Reputational risk: Interestingly, there have been several reports indicating that Ofcom may publicly name service providers that fail to implement appropriate measures to protect children. Ofcom also has wide-ranging powers to require services to be more transparent, and certain providers have a duty to include measures taken to protect children in their terms and conditions.

What is Ofcom’s focus under the draft Children’s Codes?

The draft Children’s Codes build on the child protection measures in Ofcom’s consultation on protecting people from illegal harms online published in November 2023. Ofcom’s approach is risk-based, and many of the proposed measures will not be relevant to all services.

The Children’s Codes are extensive, with more than 40 recommended safety measures that fall into a number of broad categories. In particular, Ofcom spotlights three key areas:

1. Strong governance and accountability.

• Service providers should have appropriate internal oversight and accountability for children’s online safety.
• Ofcom recommends that U2U services and search services likely to be accessed by children should have a person accountable for the child safety, reporting and complaints duties.

2. Safer algorithms and foundational design choices.

• Services should know which of their users are children to ensure they are protected. Ofcom’s draft Children’s Codes therefore expect much greater use of highly effective age assurance.
• If a service operates a recommender system and is at higher risk of harmful content, it should identify who the child users are and configure algorithms and content moderation systems to filter out the most harmful content from children’s feeds and reduce the visibility of other harmful content. Children also should be able to provide negative feedback directly to the recommender feed, so it can better learn what content they do not want to see.

3. Providing children with information, tools and support.

• Should ensure clear and accessible information is provided to children in terms and conditions and publicly available statements.
• Should ensure children can easily report content and make complaints.  

What happens next?

The consultation closes on 17 July 2024, and responses will be published both during and after. If you think that part or all of your response should be treated as confidential, you can let Ofcom know, and it will consider that request.

Ofcom will then assess the responses received and prepare its final guidance and codes. Below, we have set out the anticipated timeline thereafter:

• Early 2025 – Final guidance on children’s access assessments is expected to be published. Most services will then have three months from publication to carry out these assessments.
• Spring 2025 – Ofcom’s main statement on children’s safety duties is expected to be published along with its finalised proposals, including its final guidance on children’s risk assessments. In parallel, Ofcom will submit its Children’s Codes to the Secretary of State.
• Summer 2025 – Subject to government approvals, the Children’s Codes are expected to come into force. Relevant services must then comply with the protection of children’s safety duties, and Ofcom can enforce against noncompliance.

Ofcom is planning an additional consultation later this year on how automated detection tools can be used to mitigate the risk of illegal harms and content harmful to children.

The consultation is an opportunity for in-scope companies to help shape the practical application of the OSA. Respondents can opt for responses (or parts of responses) to be kept confidential. If you would like to talk about responding, or about the application of the OSA more generally, please contact any of the lawyers below.

These developments are not limited to companies operating in the EU. Indeed, over the past few years, we also have seen the introduction of the US’s Uyghur Forced Labor Prevention Act, Canada’s Fighting Against Forced Labour and Child Labour in Supply Chains Act and Japan’s Guidelines on Respecting Human Rights in Responsible Supply Chains, with other countries expected to follow suit with the introduction of supply chain transparency legislation. Companies also are increasingly making affirmative statements in their voluntary sustainability reports and policies that they are OECD-aligned. As scrutiny in this space grows, it will be critical that such assertions are substantiated.

Whilst the guidelines themselves are voluntary, OECD member states will need to establish a national grievance mechanism to receive complaints for violations of the guidelines. Companies should be mindful of the reputational and financial risks attached to being reported, as well as the risk of a potential finding of noncompliance being used in parallel proceedings or investigations brought under new sustainability laws. For example, noncompliance with the CSDDD could see businesses facing fines of up to 5% of global turnover, or restricted access to finance where a company can no longer satisfy the ‘do no significant harm’ principles and minimum safeguards under the EU’s Sustainable Finance Disclosure Regulation (SFDR) and Taxonomy Regulation.

We review the recently updated guidelines below and set out practical steps businesses can take to ensure they are compliant.

Background

The OECD is an international organisation focused on establishing international standards and policies to address social, economic and environmental challenges. It first released its Guidelines for Multinational Enterprises on Responsible Business Conduct in 1976, setting standards for responsible business conduct across a range of issues, such as human rights, labour rights and the environment. The guidelines also encouraged sustainable development and set expectations that businesses address the adverse impacts that they may have or have had on people, societies and the environment. Since their introduction, the guidelines have been revised a number of times. On 8 June 2023, the OECD released its latest revised update.

Additionally, on 3 May 2024, the OECD revised its AI Principles, initially adopted in 2019. As one of the first intergovernmental standards on artificial intelligence, these principles now explicitly emphasise responsible business conduct and environmental sustainability throughout the AI system life cycle, consistent with the updated guidelines. This includes co-operation with the suppliers of AI systems, as well as AI system users and other stakeholders in the supply chain.

Key updates

The 2023 updates to the guidelines do not change the nine broad topic areas covered by the original guidelines,[1] but rather seek to update these in alignment with evolving expectations for businesses concerning responsible business conduct. The key updates are:

Risk-based due diligence

The updated guidelines draw on the United Nations’ Guiding Principles on Business and Human Rights in setting out due diligence principles companies are expected to follow when conducting human rights – as well as environmental – due diligence (see the OECD Due Diligence Guidance for Responsible Business Conduct). Businesses are expected to avoid and address adverse impacts that they cause, or contribute to, and must seek to prevent or mitigate adverse impacts directly linked to their products, operations or services through a business relationship. Businesses’ due diligence responsibilities are therefore not limited to a company’s own operations, but are expected to cover the entire upstream and downstream value chain, including the impacts of a business’s product or service on consumers and users.

Climate change and environmental impacts

The updated guidelines reinforce the need to conduct business in an environmentally sensitive way. Companies are now expected to align with internationally agreed goals on climate change (such as the Paris Agreement) and biodiversity. The updated guidelines clarify the expectation that companies must identify, assess, mitigate and – where necessary – remediate potential and actual adverse environmental impacts in their upstream and downstream value chain. Environmental considerations are not limited to climate change and also include animal welfare, biodiversity, deforestation and pollution.

Stakeholder engagement

The updated guidelines expect businesses to ‘meaningfully’ engage with stakeholders throughout the due diligence process, with particular attention given to those negatively affected. Particular sensitivity should be shown to stakeholders who are more vulnerable, and businesses are advised to take steps to remove barriers to engagement.

Disclosure

The updated guidelines now provide for requirements which recommend businesses disclose information on how they comply with their environmental and human rights obligations. 

Updated enforcement mechanisms

National Contact Points for Responsible Business Conduct (NCPs) were originally introduced in 2001 with a twofold mandate of promoting the guidelines and handling complaints. The updated guidelines now give more power to NCPs and their complaint procedures to ensure their visibility, effectiveness and functional equivalence.

Science and technology

The guidelines now include due diligence expectations on the development, financing, sale, licensing, trade and use of technology – including the gathering and using of data – thereby extending due diligence requirements to the digital sphere. The OECD’s AI Principles are aligned with this recommendation and provide further guidance on what this should look like in practice.

What steps can companies take to implement the guidelines and avoid complaints?

To ensure compliance with the guidelines and minimise the risk of complaints or litigation, businesses should consider implementing the following measures:

• Embed responsible business practices into policies and management systems and include expectations in engagement with suppliers and other business relationships.
• Identify and assess actual and potential adverse impacts and consider the importance of environmental and human rights impact assessments.
• Cease, prevent and mitigate adverse impacts.
• Track implementation and results.
• Communicate how impacts are addressed.
• Provide for and cooperate in remediation when appropriate.

Above all, businesses should ensure that they properly represent whether they are complying with the OECD guidelines or any other human rights instrument, such as the United Nations’ Guiding Principles on Business and Human Rights.

Enforcement: Why should businesses take action?

While new supply chain due diligence legislation is introducing new enforcement mechanisms worldwide, such as the national penalties which EU member states can impose for failure to comply with the CSDDD, compliance with the guidelines’ recommendations ultimately remains voluntary for businesses.

However, companies which do not comply are at risk of being reported to a country’s NCP, bringing with it reputational damage and occasionally introducing barriers to public procurement and investment.

When receiving a complaint against a company headquartered in a particular OECD member state, in the first instance, the relevant NCP will review specific complaints brought before them and facilitate ‘good offices’ by encouraging dialogue or providing for conciliation and/or mediation. Following this stage, if agreement was reached, the NCP will issue a final report, which can contain further recommendations to be implemented by the business against which a complaint has been raised. If no agreement is reached, the NCP will issue a statement on the case and provide recommendations on how to proceed.

NCPs also have the power to set out their views on whether companies have complied with the guidelines, as well as the power to inform government agencies of good faith engagement – or absence thereof. This may have major impacts on a company’s access to public procurement and may give rise to governmental investigations against a denounced company. For those companies that are seeking to position themselves as ‘sustainable’ under the EU’s SFDR and Taxonomy Regulation, it also may restrict their access to capital, irrespective of their environmental credentials.

Companies that claim alignment with the OECD guidelines in their voluntary sustainability reports and policies also are at increased risk of enforcement action where such claims are unsubstantiated. Companies wishing to make such affirmative statements should ensure that human rights impact assessments have been conducted in order to ensure that such claims are not misleading, failing which they may be at risk of litigation.

Effectiveness

According to the OECD, 650+ cases relating to company operations in more than 105 countries and territories have been resolved. Over one-third of all cases which were accepted for further examination resulted in agreement, and half of those led to internal policy changes in the companies. Even in instances where cases are not accepted, a complaint to the OECD and the resulting reputational damage can result in corporate policy changes.

For example, in 2019, ClientEarth raised a complaint against BP before the UK’s NCP alleging that BP’s advertising campaign gave a false impression of the relative scale of renewable and low-carbon energy in BP’s business, and that it made misleading claims about the environmental impact of gas. It was reported that as a consequence of this complaint, and before the UK NCP could issue an initial assessment, BP withdrew the advertising campaign and announced it would redirect resources towards promoting climate policies.

As an additional point, the various environmental, social and governance (ESG) legislative provisions that are being adopted in jurisdictions across the world may ultimately seek to rely on the information and complaints found in the NCP mechanism to assess compliance with their respective sustainability frameworks. At a time when large corporations are facing more public scrutiny from civilians and activist organisations, the power of the OECD guidelines and NCPs should not be underestimated.

Primary insight

The updated guidelines provide companies with a useful benchmark on the expected scope of their ESG due diligence policies. Companies should note that the guidelines are not a stand-alone soft-law instrument, as they sit alongside a multitude of sustainability and supply chain legislation that is being enacted and implemented globally. Therefore, while voluntary, the updated guidelines provide useful clarity and guidance for companies looking to navigate the ever-growing global legislative framework for ESG compliance. If you would like to understand the potential implications of these developments on your business, you can contact our Cooley lawyers listed below.

[1] These are: (1) disclosure; (2) human rights; (3) employment and industrial relations; (4) the environment; (5) bribery and other forms of corruption; (6) consumer interests; (7) science, technology and innovation; (8) competition; and (9) taxation.

These developments are not limited to companies operating in the EU. Indeed, over the past few years, we also have seen the introduction of the US’s Uyghur Forced Labor Prevention Act, Canada’s Fighting Against Forced Labour and Child Labour in Supply Chains Act and Japan’s Guidelines on Respecting Human Rights in Responsible Supply Chains, with other countries expected to follow suit with the introduction of supply chain transparency legislation. Companies also are increasingly making affirmative statements in their voluntary sustainability reports and policies that they are OECD-aligned. As scrutiny in this space grows, it will be critical that such assertions are substantiated.

Whilst the guidelines themselves are voluntary, OECD member states will need to establish a national grievance mechanism to receive complaints for violations of the guidelines. Companies should be mindful of the reputational and financial risks attached to being reported, as well as the risk of a potential finding of noncompliance being used in parallel proceedings or investigations brought under new sustainability laws. For example, noncompliance with the CSDDD could see businesses facing fines of up to 5% of global turnover, or restricted access to finance where a company can no longer satisfy the ‘do no significant harm’ principles and minimum safeguards under the EU’s Sustainable Finance Disclosure Regulation (SFDR) and Taxonomy Regulation.

We review the recently updated guidelines below and set out practical steps businesses can take to ensure they are compliant.

Background

The OECD is an international organisation focused on establishing international standards and policies to address social, economic and environmental challenges. It first released its Guidelines for Multinational Enterprises on Responsible Business Conduct in 1976, setting standards for responsible business conduct across a range of issues, such as human rights, labour rights and the environment. The guidelines also encouraged sustainable development and set expectations that businesses address the adverse impacts that they may have or have had on people, societies and the environment. Since their introduction, the guidelines have been revised a number of times. On 8 June 2023, the OECD released its latest revised update.

Additionally, on 3 May 2024, the OECD revised its AI Principles, initially adopted in 2019. As one of the first intergovernmental standards on artificial intelligence, these principles now explicitly emphasise responsible business conduct and environmental sustainability throughout the AI system life cycle, consistent with the updated guidelines. This includes co-operation with the suppliers of AI systems, as well as AI system users and other stakeholders in the supply chain.

Key updates

The 2023 updates to the guidelines do not change the nine broad topic areas covered by the original guidelines,[1] but rather seek to update these in alignment with evolving expectations for businesses concerning responsible business conduct. The key updates are:

Risk-based due diligence

The updated guidelines draw on the United Nations’ Guiding Principles on Business and Human Rights in setting out due diligence principles companies are expected to follow when conducting human rights – as well as environmental – due diligence (see the OECD Due Diligence Guidance for Responsible Business Conduct). Businesses are expected to avoid and address adverse impacts that they cause, or contribute to, and must seek to prevent or mitigate adverse impacts directly linked to their products, operations or services through a business relationship. Businesses’ due diligence responsibilities are therefore not limited to a company’s own operations, but are expected to cover the entire upstream and downstream value chain, including the impacts of a business’s product or service on consumers and users.

Climate change and environmental impacts

The updated guidelines reinforce the need to conduct business in an environmentally sensitive way. Companies are now expected to align with internationally agreed goals on climate change (such as the Paris Agreement) and biodiversity. The updated guidelines clarify the expectation that companies must identify, assess, mitigate and – where necessary – remediate potential and actual adverse environmental impacts in their upstream and downstream value chain. Environmental considerations are not limited to climate change and also include animal welfare, biodiversity, deforestation and pollution.

Stakeholder engagement

The updated guidelines expect businesses to ‘meaningfully’ engage with stakeholders throughout the due diligence process, with particular attention given to those negatively affected. Particular sensitivity should be shown to stakeholders who are more vulnerable, and businesses are advised to take steps to remove barriers to engagement.

Disclosure

The updated guidelines now provide for requirements which recommend businesses disclose information on how they comply with their environmental and human rights obligations. 

Updated enforcement mechanisms

National Contact Points for Responsible Business Conduct (NCPs) were originally introduced in 2001 with a twofold mandate of promoting the guidelines and handling complaints. The updated guidelines now give more power to NCPs and their complaint procedures to ensure their visibility, effectiveness and functional equivalence.

Science and technology

The guidelines now include due diligence expectations on the development, financing, sale, licensing, trade and use of technology – including the gathering and using of data – thereby extending due diligence requirements to the digital sphere. The OECD’s AI Principles are aligned with this recommendation and provide further guidance on what this should look like in practice.

What steps can companies take to implement the guidelines and avoid complaints?

To ensure compliance with the guidelines and minimise the risk of complaints or litigation, businesses should consider implementing the following measures:

• Embed responsible business practices into policies and management systems and include expectations in engagement with suppliers and other business relationships.
• Identify and assess actual and potential adverse impacts and consider the importance of environmental and human rights impact assessments.
• Cease, prevent and mitigate adverse impacts.
• Track implementation and results.
• Communicate how impacts are addressed.
• Provide for and cooperate in remediation when appropriate.

Above all, businesses should ensure that they properly represent whether they are complying with the OECD guidelines or any other human rights instrument, such as the United Nations’ Guiding Principles on Business and Human Rights.

Enforcement: Why should businesses take action?

While new supply chain due diligence legislation is introducing new enforcement mechanisms worldwide, such as the national penalties which EU member states can impose for failure to comply with the CSDDD, compliance with the guidelines’ recommendations ultimately remains voluntary for businesses.

However, companies which do not comply are at risk of being reported to a country’s NCP, bringing with it reputational damage and occasionally introducing barriers to public procurement and investment.

When receiving a complaint against a company headquartered in a particular OECD member state, in the first instance, the relevant NCP will review specific complaints brought before them and facilitate ‘good offices’ by encouraging dialogue or providing for conciliation and/or mediation. Following this stage, if agreement was reached, the NCP will issue a final report, which can contain further recommendations to be implemented by the business against which a complaint has been raised. If no agreement is reached, the NCP will issue a statement on the case and provide recommendations on how to proceed.

NCPs also have the power to set out their views on whether companies have complied with the guidelines, as well as the power to inform government agencies of good faith engagement – or absence thereof. This may have major impacts on a company’s access to public procurement and may give rise to governmental investigations against a denounced company. For those companies that are seeking to position themselves as ‘sustainable’ under the EU’s SFDR and Taxonomy Regulation, it also may restrict their access to capital, irrespective of their environmental credentials.

Companies that claim alignment with the OECD guidelines in their voluntary sustainability reports and policies also are at increased risk of enforcement action where such claims are unsubstantiated. Companies wishing to make such affirmative statements should ensure that human rights impact assessments have been conducted in order to ensure that such claims are not misleading, failing which they may be at risk of litigation.

Effectiveness

According to the OECD, 650+ cases relating to company operations in more than 105 countries and territories have been resolved. Over one-third of all cases which were accepted for further examination resulted in agreement, and half of those led to internal policy changes in the companies. Even in instances where cases are not accepted, a complaint to the OECD and the resulting reputational damage can result in corporate policy changes.

For example, in 2019, ClientEarth raised a complaint against BP before the UK’s NCP alleging that BP’s advertising campaign gave a false impression of the relative scale of renewable and low-carbon energy in BP’s business, and that it made misleading claims about the environmental impact of gas. It was reported that as a consequence of this complaint, and before the UK NCP could issue an initial assessment, BP withdrew the advertising campaign and announced it would redirect resources towards promoting climate policies.

As an additional point, the various environmental, social and governance (ESG) legislative provisions that are being adopted in jurisdictions across the world may ultimately seek to rely on the information and complaints found in the NCP mechanism to assess compliance with their respective sustainability frameworks. At a time when large corporations are facing more public scrutiny from civilians and activist organisations, the power of the OECD guidelines and NCPs should not be underestimated.

Primary insight

The updated guidelines provide companies with a useful benchmark on the expected scope of their ESG due diligence policies. Companies should note that the guidelines are not a stand-alone soft-law instrument, as they sit alongside a multitude of sustainability and supply chain legislation that is being enacted and implemented globally. Therefore, while voluntary, the updated guidelines provide useful clarity and guidance for companies looking to navigate the ever-growing global legislative framework for ESG compliance. If you would like to understand the potential implications of these developments on your business, you can contact our Cooley lawyers listed below.

[1] These are: (1) disclosure; (2) human rights; (3) employment and industrial relations; (4) the environment; (5) bribery and other forms of corruption; (6) consumer interests; (7) science, technology and innovation; (8) competition; and (9) taxation.

The OSA imposes obligations in relation to ‘illegal content’. This may be relevant to online marketplaces that facilitate the online sale of products. Notwithstanding that offences under the Consumer Protection from Unfair Trading Regulations (e.g., misleading information or omissions in listings) and offences that relate to the safety or quality of goodsare specifically excluded from the scope of ‘illegal content’, there is the possibility of online product listings being considered in scope – for example, if offering the products for sale would be considered a ‘priority offence’ due to them being specific product types (such as firearms, weapons like knives, or drugs) or, more broadly, if the goods are counterfeit.  

The extent of the applicable obligations under the OSA will be determined by reference to which category a service falls into. Carolina Ljungwaldh and Mo Swart have set out a helpful summary of the latest news in relation to this categorisation of services.

Online Safety Act Update: Ofcom Proposes Categorisation Thresholds – On the Record (cooley.com)

On April 19, 2024, the US Environmental Protection Agency (EPA) issued a final rule that designates two PFAS chemicals – PFOA and PFOS – as ‘hazardous substances’ subject to the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA, also known as Superfund). The rule will take effect under CERCLA, giving the EPA increased authority to investigate and respond to PFAS contamination and seek recovery of costs associated with cleanup efforts. The EPA sees the new rule as a significant step in its regulation of PFAS.

What are PFAS chemicals?

Per- and polyfluoroalkyl substances (PFAS) are a class of human-made substances that typically break down slowly over time, earning them the nickname ‘forever chemicals’. A variety of industrial and consumer products have utilized perfluorooctanoic acid (PFOA) and perfluorooctane sulfonic acid (PFOS) – the two newly designated hazardous substances under CERCLA – since the 1940s, including fire retardants, nonstick cookware, water-resistant clothing, stain-resistant fabrics, food packaging and cleaning products, among others.

What is CERCLA (Superfund) and what has changed?

CERCLA, also known as Superfund, was established in 1980. The law allows the EPA to initiate the investigation and cleanup of contaminated sites. To fund those activities, CERCLA requires parties responsible for the contamination to either perform the cleanup or reimburse the government for EPA-led cleanup work.

PFOA and PFOS are the first and only PFAS to be designated as hazardous substances under CERCLA. Prior to this designation, the EPA could only respond to a release of these substances on a finding that PFOA and PFOS ‘present[ed] an imminent and substantial danger’. Now, the EPA will have authority to investigate and/or respond to PFOA and PFOS releases with broad discretion.

The EPA also will be able to seek cost recovery for cleanup efforts from the parties responsible for the presence of PFOA and PFOS, as well as use enforcement measures. Overall, the EPA believes that this designation will enable it (and other agencies with CERCLA authority) to ‘address more sites, take earlier action, and expedite eventual cleanup’.

Additionally, companies releasing PFOA and PFOS will be required to immediately report any releases of PFOA and PFOS greater than one pound within a 24-hour period to the EPA National Response Center (NRC) and state, tribal and local emergency responders.

Alongside the rule, the EPA released a PFAS Enforcement Discretion and Settlement Policy Under CERCLA, which clarifies that enforcement will be focused on entities that significantly contribute to the release of PFAS into the environment – such as PFAS manufacturers, manufacturers that use PFAS in their processes, federal facilities and other industrial parties. The policy also clarifies that operations for the public interest are not generally an enforcement target – i.e., water utilities, airports, fire departments, landfills and farms.

What comes next?

The PFAS Superfund rule issuance is another piece of the EPA’s PFAS Strategic Roadmap, which it first announced in October 2021. It follows the agency’s October 2023 final rule under the Toxic Substances Control Act (TSCA), Section 8(a)(7), which requires any company that has manufactured or imported PFAS or articles containing PFAS since 2011 to submit a report regarding its PFAS uses, production volumes, disposal, exposures and hazards by May 2025.

Please reach out to the Cooley team listed below with any questions regarding PFAS in consumer products.

1. European Union AI Act approved by European Parliament

What has happened?

On 13 March 2024, the European Parliament provisionally approved the Artificial Intelligence Act (AI Act), after it was negotiated and agreed amongst member states at the end of 2023. The AI Act will govern the development, placing on the market and use of AI systems in the EU, and we expect the general-purpose rules to apply from May 2025 (with longer implementation periods for other provisions).

Why does it matter?

The AI Act is a completely new, bespoke AI regulatory regime. It’s the first law in the world to specifically regulate AI on a horizontal basis and adopts a risk-based approach, where AI systems which pose higher risk will be subject to stricter rules than systems which are deemed to be lower risk. It establishes three categories:

• Unacceptable risk. This category bans AI systems which pose a threat to the fundamental rights of citizens – such as biometric categorization systems that use sensitive characteristics, emotion recognition in the workplace and schools, social scoring, predictive policing and AI which can manipulate human behaviour.
• High risk. AI systems which may cause significant harm to health, safety, fundamental rights, the environment, democracy and the rule of law must follow stricter rules before they can be placed on the market. Such systems might include critical infrastructures, certain law enforcement systems, border control or democratic processes, and the administration of justice. Importantly, they also can include AI systems performing a safety function in certain products.
• Minimal risk. Most AI systems are expected to fall into this category with no threat caused to fundamental rights of citizens. These will not be subject to regulatory obligations under the AI Act.

The AI Act also introduces requirements on all companies to be transparent about the use of AI systems and guardrails for general-purpose AI.

There are strong sanctions available for noncompliance, with fines up to 35 million euros, or 7% of global turnover. The EU also will set up an AI Office within the European Commission to oversee EU-wide enforcement.

The AI Act will now go to the European Council for approval before it is expected to be adopted ahead of the next parliamentary elections in June 2024. It then will be published in the Official Journal of the European Union and enter into force 20 days later. It will generally apply 24 months after it has entered into force (with general-purpose rules applying after 12 months and some provisions applying after a longer transition period of 36 months).

2. EU AI Liability Directive moves forward

What has happened?

The European Council has recently confirmed that discussions on the proposed AI Liability Directive (AILD) ‘will be resumed now that agreement has been reached in negotiations on the closely linked AI Act’. These discussions are in their early stages, with neither the European Council nor European Parliament having commenced their negotiating mandates. We therefore expect any further decisions to roll over until the next term of Parliament.

Why does it matter?

The AILD will sit alongside the AI Act as part of EU policymakers’ overall strategy to protect consumers from the perceived risks of AI technologies. The AILD will supplement national rules on fault-based liability – for example, by empowering national courts to order companies to disclose information about high-risk AI systems and by introducing a rebuttable presumption that an AI system gave rise to damage where there is noncompliance with applicable AI regulations.

Taken together with the amended Product Liability Directive (PLD), which includes new provisions designed to cover AI systems, and the EU’s new class action regime (which the AILD and PLD are in scope of), the changes will increase litigation risk for companies that design and/or deploy AI.

3. UK AI private members’ bill reaches second reading

What has happened?

In the UK, a private members’ bill for an AI regulation had its second reading in the House of Lords at the end of March 2024, having been introduced in late November 2023. A private members’ bill is a legislative instrument that can be proposed by individual members of the House of Commons or Lords outside of official government policy.

Why does it matter?

The private members’ bill proposes a more interventionist approach to regulating AI than that taken by the UK government, which has deliberately taken a ‘light-touch’ approach to regulating AI.

The UK government has argued that specific new legislation is not required, and that it’s sufficient to issue guidance and principles together with a series of tests that need to be met before new laws can be passed. This strategy is designed to be pro-innovation and to help foster the development of AI.

The private members’ bill, by contrast, proposes the following:

• Establishing a UK ‘AI authority’ to ensure UK regulators work together for more effective AI regulation and enforcement.
• Requiring a ‘designated AI officer’ in businesses that develop, deploy or use AI.
• Enacting regulations to lay down various requirements, including:
  • For any person supplying a product or service involving AI to give customers clear and unambiguous health warnings, labelling, and opportunities to give or withhold informed consent in advance.
  • For any business which develops, deploys or uses AI to allow independent third parties accredited by the AI authority to audit its processes and systems.
  • For any person involved in training AI to supply certain information to the AI authority.

The private members’ bill has received considerable support and suggests there is concern amongst some policymakers about the current ‘light-touch’ approach to regulating AI. With an upcoming election, there is a very real chance that the UK strategy for regulating AI could change before the end of the year – with a much more strictly regulated approach likely to be on the horizon if there is a change in government, as is expected.

ICPHSO is an international, neutral forum for product safety stakeholders to learn, network and share information. It typically hosts three types of events each year – an annual Symposium in the US, an annual International Symposium outside of the US and regional training workshops based in North America.

This year’s Annual Meeting and Training Symposium had over 760 delegates – including regulators, manufacturers, retailers, testing laboratories, consumer organisations, law firms, standards organisations and academia. Kim Mason from Five Below was the Planning Chair for the program, working alongside the Planning Committee of volunteer ICPHSO members.

Alexander Hoehn-Saric, Chair of the US CPSC gave a keynote. He reflected on changes under the new leadership of the agency. Unilateral warnings, that were once rare, are now an important part of the tool box with 26 issued in the last year – more than issued in the previous five years combined. The CPSC has assessed nearly $110 million in civil penalties during his time as Chair – a massive increase. Mandatory safety regulations have been finalized, including for button cell batteries, powerful magnets, furniture tip-overs and adult portable bed rails. Consumer education efforts are being expanded to reach communities often overlooked – including Native American communities, and outreach to small and large businesses domestically and around the world is being expanded. Despite uncertainty regarding budget, the CPSC will be pursuing an ambitious agenda that includes finalizing “long-delayed rulemakings”, continuing small business outreach and information sharing (in-person and through the Regulatory Robot), enforcing the safety standards put into place over the last few years, educating consumers about potential product safety hazards, and strengthening the ability to prevent hazardous products reaching consumers – particularly through monitoring imports. Expanding on remarks made during the ICPHSO International Symposium in Sweden in October 2023, sales of products on online marketplaces remain a key focus. A copy of his remarks is available on the CPSC’s webpage at bit.ly/3UXUOjq.

Austin Schlick, Executive Director from the US CPSC gave an update on CPSC FY23 accomplishments and FY24 priorities. Planned proposed rules for 2024 include aerosol dusters, bassinets, button batteries in toys, infant carriers, Li-Ion batteries in micromobility products, water beads, water floats and e-bikes (advance notice of proposed rulemaking), to expand NEISS hospital enrollments and accelerate delivery of death certificate data. Enforcement priorities include adult portable bedrails, ATVs, clothing storage units (tip-overs), high powered magnet products, infant sleep products, packaging including button and coin cell batteries and retailers in underserved communities.

Jen Sultan, Deputy Director, Office of Compliance and Field Operations at CPSC provided an update on compliance and field operations. This covered the increasing use of unilateral notifications as a tool, recent letters and guidance issued (including letters on micromobility devices, letters encouraging compliance with new regulatory authorities – infant sleep rule, crib bumper ban, magnet safety rule and adult portable bed rails, as well as guidance for categorizing youth ATVs), recall monitoring and civil penalties.

Speakers from Health Canada provided a regulatory update covering annual compliance verification reporting, as well as incident reports and surveillance data. Health Canada issued a notice of intent on proposals to amend the Toy Regulations seeking feedback. We also heard about work on compliance promotion, inspection and outreach efforts – including to remote areas that would not normally have in-person contact with inspectors, joint international efforts with the European Commission, US CPSC and Mexico’s PROFECO agency and about an important project deconstructing unconscious bias (DUB).

Graham Russell, Chief Executive and Sarah Smith, Deputy Chief Executive from the UK Office for Product Safety & Standards (OPSS) spoke about three practices – outcomes, risk and intervention choices. Regulators need to prioritize issues – thinking about what matters and where they can make a difference. The OPSS has been working on a new tool to look at the broader picture for emerging priorities and help make decisions around interventions. Areas of focus for the OPSS include batteries for e-bikes and products sold on online platforms. The UK Government’s response to the consultation on fire safety of domestic upholstered furniture is expected to be published in the coming weeks.

Pinuccia Contino, Deputy to the Director for Consumers & Head of the Product Safety and Rapid Alert System Unit, Directorate-General for Justice and Consumers (DG JUST) at the European Commission gave an update from the EU with a focus on the upcoming new obligations under the General Product Safety Regulation that will apply from December 13, 2024. To implement the new rules, the Commission is working on 46 actions, including 10 implementing measures such an upcoming Delegated Act to lay down new operating rules for Safety Gate and align the risk assessment guidelines for non-harmonized and harmonized products (i.e. generally CE marked products).

Pinuccia Contino and Richard O’Brien, Director, Office of International Programs at the CPSC presented a plenary session “International Organizations as Product Safety Hothouses: What’s in there for Consumers? How regulators and other stakeholders work together to make sure all consumers are safer worldwide”, with a guest appearance by Brigitte Acoca, Head of Consumer Policy Unit at the OECD. We heard about collaboration between different jurisdictions, work by the UNCTAD working group on consumer product safety, as well as organizations such as the OCED. Policy work at this level can be the first seed that lays the path for further regulatory developments. The European Commission funded a study of the OECD on the impact of products using new technology like AI and consumer health – including mental health. Interim results are expected to be presented later this year and what comes out of the study may influence regulators all around the world.

Pinuccia Contino also received the Ross Koeser Achievement Award for her contribution to product safety. The secret to her success? Leading with compassion.

There were a number of thought provoking keynotes. Andrew Frank, Founder and President of KARV stressed the importance of having a plan in place ahead of a potential recall scenario. Kelly Mariotti President and CEO of the Association of Home Appliance Manufacturers (AHAM) left attendees with a quote from Maya Angelou “[d]o the best you can until you know better. Then when you know better, do better”. Rohan Oommen Vice President, Worldwide Trustworthy Shopping Experience at Amazon noted that success and scale brings broad responsibility and explained how Amazon applies that mindset in practice.

The plenary session “Inside the Room(s) Where It Happens – Fostering Organizational Understanding for the New Landscape of CPSC Enforcement” moderated by Matt Howsare from Cooley featured Jana Fong-Swamidoss, Chief of Staff at the CPSC on the panel. We heard about the importance of understanding the current CPSC enforcement landscape and effectively communicating the associated risks within an organization.

“Protecting Consumers in an Expanding Secondhand Market” was moderated by Tracey Kelly from Ikea and featured Jen Sultan, Deputy Director, Office of Compliance and Field Operations at the CPSC on the panel. This issue is broader than the sale of secondhand products online – we also need to think about the safety of secondhand products sold in thrift stores, yard sales or passed on between family members. Digital Product Passports could be a helpful tool to communicate information about products that have been recalled.

The hot topic of PFAS was covered in the plenary session “Say Goodbye to PFAS: What product manufacturers can expect from regulatory initiatives on PFAS” and the breakout session “Toxicology, chemical, and human factors/risk communication perspectives on the rapidly evolving PFAS landscape”. Regulation of PFAS is largely uncoordinated globally, creating confusion for manufacturers working to modify the material composition of their products, or in some cases completely redesign products to comply with requirements across various jurisdictions. Panelists discussed challenges and ways to mitigate risks of non-compliance.

The plenary session “Developing Safe and Sustainable Consumer Products: Materials and Product Considerations” was moderated by Xiao Chen from Intertek and featured Pinuccia Contino on the panel. This session considered how safety and sustainability can and should work together. Sustainable raw materials can bring opportunities and innovations, but integrating them into product design at a late stage can be costly. An interdisciplinary and collaborative approach is key – it’s critical that ESG teams are multidisciplinary and do not work in silos.

Cybersecurity was tackled during the session “The Intersection of Cybersecurity and Safety for Consumer IoT Products” moderated by Michael Fagan of the National Institute of Standards and Technology (NIST). Technology gives consumers greater autonomy, but creates greater vulnerabilities. It’s important to think about unexpected hazards coming out of the proliferation of IoT consumer products, if the compromise of certain features can create safety issues and how to deal with products that customers may continue to use beyond the support period.

The plenary session “Going Above and Beyond: the role of voluntary safety pledges for the future of online safety” was moderated by Ed Turtle from Cooley and featured Brigitte Acoca from the OECD, Geoff Barrett, Director, Risk Management Bureau, Consumer Product Safety Program at Health Canada and Clay Marquez from Amazon. This topic was also discussed by the panel in the breakout session “EU GPSR – Product Safety for Providers of Online Marketplaces” where Pinuccia Contino from the European Commission noted that pledges can be a laboratory for future policy.

Over 20 different breakout sessions covered a wide-range of hot topics including Digital Product Passports, impacts of the EU’s new General Product Safety Regulation, use of AI and other digital innovations in product safety, CPSC’s eFiling, Disagreeing Without Being Disagreeable presented by two former CPSC Commissioners, balancing regulatory obligations and stakeholders expectations for sustainability, lithium-ion battery fires, plus more.

This year’s event also featured accredited CLE sessions as well as poster presentations. Another highlight was the chance to speak with other product safety professionals from around the world during the networking breaks.

The ICPHSO 2024 North America Product Safety Training Workshop is taking place June 26, 2024 hosted by Walmart in Bentonville, Arkansas. The ICPHSO 2024 International Symposium is taking place October 16-17, 2024 in conjunction with the European Commission’s International Product Safety Week in Brussels. Visit the ICPHSO website (ichphso.org) for more information.

This article was first published in Product Safety Letter and has been reproduced with the permission of Product Safety Letter.

The EU’s ban on products made with forced labour regulation (FLR) will apply to products which in whole or in part benefited from forced labour. Supplementing the existing EU rules combatting human trafficking, the FLR now will be subject to formal approval and is likely to apply across all EU member states from mid-2027. The full text of the provisional agreement has not been published and is expected to become publicly available in the next few weeks. In the meantime, based on what we know at this stage, our alert here contains some highlights of the agreement.

The text of the provisional agreement has not yet been published and is expected to become publicly available in the next few weeks. In the meantime, we have listed some highlights of the agreement on the text based on what we know at this stage.

A new right to repair obligation on producers
The Directive will require producers to carry out repairs outside of the legal guarantee for products covered by repairability obligations under certain EU ecodesign regulations listed in an Annex.

• Products in scope: We are waiting to see the text of the provisional agreement for the final list of ecodesign regulations in scope; however, we expect this to be largely unchanged from the European Commission’s proposal that contained ecodesign regulations applying to certain white goods (including household washing machines, dishwashers and refrigerators), vacuum cleaners, electronic displays, and mobile phones and tablets (among others). The Directive also allows for the Commission to add more products to this list over time.

• Repair requirements: The Commission’s original proposal tied the scope of repairs required to be offered by the producer to the repairability requirements under the relevant ecodesign regulations (e.g., the components covered and the periods of time that spare parts need to be available etc.). Producers can charge for the repair; however, indications are that a “reasonableness” requirement has been introduced. We will be checking the text of the final agreement to see whether the exemption where repair would be impossible proposed by the Commission has been retained.
• Spare parts obligations: A number of obligations surrounding spare parts also have been agreed – such as requiring information on certain spare parts to appear on a website, making them available to all parties in the repair sector and preventing certain practices that can hinder repair – including contractual clauses or certain software- and hardware-related barriers (among other things).
• Loan devices: The European Parliament’s press release (see below) refers to measures that could require loan devices to be provided to consumers while they wait for repair in certain cases and to enable a consumer to opt for a refurbished unit as an alternative. We will be checking the provisional agreement to understand the detail of these measures.

Amendments to the existing legal guarantee
Under the existing Sale of Goods Directive, the seller is liable to the consumer for any lack of conformity which exists at the time when the goods were delivered and which becomes apparent within two years of that time. In the event of non-conformity, the Sale of Goods Directive sets out a hierarchy of remedies, allowing consumers to initially choose between repair and replacement (with certain exceptions).

• Hierarchy of remedies stays the same: The Commission’s legislative proposal sought to change the existing hierarchy of remedies under the legal guarantee established by the Sale of Goods Directive to make repair the default option (see our April 2023 blog here). However, it’s understood that the provisional agreement has kept the existing hierarchy intact – such that consumers will continue to be able to choose between a repair or a replacement (allowing for certain exceptions).
• But repair still incentivised: Instead, to encourage consumers to choose repair over replacement, the legal guarantee under the Sale of Goods Directive would be extended by 12 months following a repair, with Member States having discretion to further extend this period under national laws if they so wish. We are waiting to see the text of the provisional agreement to understand the exact mechanics around this and to see if other changes will be made to the legal guarantee.

Any other changes?

• European Repair Information Form: Under the Commission’s proposal, it would be mandatory for repairers to provide a standardised European Repair Information Form to consumers when they request a repair. This form would include certain information on repair conditions, such as timing and price. The provisional agreement makes this form optional to cut red tape for repairers. However, if repairers provide this form, the conditions set out on the form will be binding on them for a set period. We understand a template form is included in an Annex to the Directive.
• Online matchmaking repair platform: To encourage the utilisation of repair services, an online platform will be created to allow consumers to find local repair shops and other related services. The provisional agreement would require this to be designed and operated at a European level, with national sections.
• Other measures to encourage repair: Member states would be required to support at least one measure to promote repair – such as repair vouchers and funds, information campaigns or a reduction of the value-added tax rate on repair services, among other options.

What’s next?
The text of the provisional agreement now needs to be formally approved by the full European Parliament at plenary, and then by the European Council. It will then be signed and published in the Official Journal of the European Union and enter into force 20 days later. We expect this process to be completed before the European Parliament elections in June 2024. Member States will then have 24 months to transpose the requirements into their national laws.

Where can I find out more?
Press releases following the provisional agreement:

• European Commission
• European Parliament 
• European Council

We will be posting more information about these reforms on our ProductWise blog when more information is available, so continue following to learn more.

This new directive forms part of a much larger EU package of measures, which includes the Ecodesign for Sustainable Products Regulation, the proposed Green Claims Directive and the Right to Repair Directive. The new directive will take effect by amending the current text of the EU Unfair Commercial Practices Directive and Consumer Rights Directive.

Key reforms of the directive include:

1. A ban on the use of unsubstantiated generic environmental claims such as ‘environmentally friendly’, ‘natural’, ‘biodegradable’ and ‘eco’.
2. A ban on the use of claims such as ‘climate neutral’ that suggest that a product has a neutral, reduced or positive impact on the environment because of emissions offsetting schemes.
3. Regulated use of sustainability labels, given the confusion caused by their proliferation and lack of suitable comparator data – under the new rules, only sustainability labels based on official certification schemes or established by public authorities will be allowed in the EU.
4. A new harmonised label will be created for producers that wish to highlight that they are offering – free of charge – an extended guarantee that goes beyond the two-year EU minimum.
5. A ban on practices associated with early obsolescence of goods, such as:
   • Making unfounded durability claims (for example, claims that a product will last longer than it will, if this is not true under normal conditions).
   • Presenting software updates as necessary when they only enhance functionality.
   • Presenting goods as repairable when they are not.
   • Inducing consumers to replace consumables earlier than necessary for technical reasons.
   • Withholding information on the impairment of the functionality of a good when consumables, spare parts or accessories not supplied by the original producer are used, or falsely claiming that such impairment will happen.

Next steps

The new directive now needs to receive final approval from the EU Council, after which it will be published in the Official Journal of the EU. After the directive’s entry into force, EU member states will have two years to transpose it into their national laws, during which time businesses can adapt their environmental claims.

2023 was a year of reform – the most active year of regulatory change we’ve seen in the products law space, with impacts that will be felt by product stakeholders for years to come. New requirements will need to be understood, and any required changes to products and processes will need to be planned and implemented. Below is our roundup of some of the highlights.

For the European Union, a number of really significant pieces of legislation completed the legislative process in 2023 and are now firmly on the books. These will start to apply after various transition periods:

• The General Product Safety Regulation
• The Batteries Regulation
• The Machinery Regulation
• The Deforestation Regulation
• The Data Act

Provisional (political) agreement was reached by the co-legislators on the text of a large number of legislative proposals in 2023 – with agreement on many of these happening at trilogue negotiations in December.  These pieces of legislation still have a few hurdles to clear before they complete the lawmaking process, which we expect to happen early this year ahead of the European Parliament elections in June 2024:

• The proposed AI Act
• The proposed revision of the Product Liability Directive
• The proposed Ecodesign for Sustainable Products Regulation
• The proposed Cyber Resilience Act
• The proposed Directive amending Directives 2005/29/EC and 2011/83/EU as regards empowering consumers for the green transition
• The proposed Critical Raw Materials Act
• The proposed targeted amendments to the Waste from Electrical and Electronic Equipment (WEEE) Directive
• The proposed revision of the Construction Products Regulation
• The proposed revision of the Classification, Labelling and Packaging of Chemical Substances and Mixtures Regulation
• The proposed revision of the Environmental Crime Directive
• The proposed new Corporate Sustainability Due Diligence Directive

There are a number of significant proposals still in the pipeline, and the race is on to see if provisional agreement can be reached and approved by the full European Parliament ahead of the European Parliament elections. These include:

• The proposed Right to Repair Directive
• The proposed Directive on Green Claims
• The proposed revision of the Toy Safety Directive
• The proposed revision of the Packaging and Packaging Waste Directive
• The proposed EU ban on forced labour
• The proposed package of Customs Reform measures
• The proposed targeted amendment of the Restriction of Hazardous Substances (RoHS) Directive
• The proposed Artificial Intelligence Liability Directive – where work was put on hold in the European Parliament and Council in 2023 pending progress on the AI Act
• The proposed regulation on circularity requirements for vehicle design and management of end-of-life vehicles

It’s already starting to look likely that several of these files will not complete the process in time.

Outside of the EU, the UK has been navigating its way through the new post-Brexit world with a number of significant developments, including:

• Publication of the long-awaited consultation on the UK Product Safety Review
• An announcement for plans to extend recognition of certain products that meet EU requirements “indefinitely” beyond the upcoming December 2024 deadline for the GB market 
• Regulations made laying down new cybersecurity requirements for consumer connected products under the Product Security and Telecommunications Infrastructure Act
• Introduction of the proposed Digital Markets, Competition and Consumers Bill into the UK Parliament
• Publication of the AI White Paper, detailing the UK’s proposed approach to regulating artificial intelligence
• Completion of the lawmaking process for the Online Safety Act, with the Office of Communications (Ofcom), the UK’s communications regulator, now working on draft codes and guidance
• Consultations on various proposals – including on draft regulations to revise the Producer Responsibility Obligations (Packaging Waste) Regulations 2007

The above is just the tip of the iceberg – with much more happening than we can list here.

What to expect in 2024

Whilst 2024 is an election year for the EU and the UK (although a date for the UK General Election is yet to be announced), it still looks set to be another big year.

In the EU, the legislative proposals where provisional agreement was reached in 2023 are expected to complete the lawmaking process – with the countdown starting on the transition periods.

The European Commission will be working on various pieces of secondary legislation and guidance to implement these and other new laws. This includes a number of proposed implementing acts and implementing decisions, plus guidance for the General Product Safety Regulation.

We’ll be closely following the preparation of delegated acts under the proposed Ecodesign for Sustainable Products Regulation – with proposals in the pipeline expected to be presented in 2024 (one in particular to look out for is the proposed revision of the ecodesign rules for external power supplies), along with work starting for new product groups.

Whilst preparatory work to roll out the Digital Product Passport system has already started, this also will ramp up following entry into force of the proposed Ecodesign for Sustainable Products Regulation that lays down the framework.

We also expect PFAS to remain a big focus – with work preparing a proposed restriction in the EU continuing.

The European Commission also is working on various non-legislative initiatives to complement upcoming laws, such as the proposed AI Pact and the proposed EU code of conduct on age – appropriate design.

The evaluation of EU consumer laws is scheduled to be published by the European Commission, with the addictive use of digital products  one of the issues being explored. This issue also is firmly on the radar in the European Parliament.

Once the dust has settled following the European Parliament elections and appointment of commissioners, the newly elected Parliament will need to decide how it wants to proceed with any legislative files that did not complete the legislative process before the elections. The European Commission also will set out its new work programme. We’ll be following this closely to see what is decided for the files that didn’t make it through the process, along with what is included in the European Commission’s new work programme – such as the proposed revision of the Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH) Regulation which was originally planned for 2023 but was not presented.

In the UK, work looks set to continue on a number of fronts. There are too many to list here – but some of the ones to look out for include:

• The government’s response to the UK Product Safety Review detailing the policies it plans to take forwards, expected in the first half of 2024, along with a legislative proposal to introduce e-labelling 
• Legislation to formalise the announcement to indefinitely extend recognition of certain goods that meet EU requirements beyond the 31 December 2024 deadline
• The government’s response to the consultation on the AI White Paper
• The long-awaited consultation on a review of the UK battery legislation

Alongside these changes, we also expect the focus on enforcement and international co-operation to continue.

It all makes for challenging times ahead for stakeholders.

Want to know more?

Sign up to receive updates from our Productwise blog, and follow your regular contacts from the Cooley Productwise team on LinkedIn for ongoing news.

If you want to know more about our tailored regulatory monitoring and horizon-scanning services, contact any member of the Cooley team.

The PLD establishes a strict liability (i.e., no fault) regime to enable claimants to seek compensation for defective products across the EU, meaning claimants do not need to establish fault to claim successfully. As a result, it is the preferred way of making product liability claims in the EU. The revision is a significant development, as the PLD dates back to 1985 and has been virtually unchanged for nearly 40 years – with only very minor amendments in 1999.

The reforms will expand the scope of claims that can be brought and the range of damages that can be recovered under the PLD, as well as making it easier for consumers to prove their claims. There also are implications for product safety and cybersecurity issues, such as considerations around how long software updates should be provided to avoid potential liability.

Whilst negotiators from the European Commission, European Council and European Parliament have now reached agreement on the text of the provisional agreement, the final text has not yet been published. It is expected to become publicly available in the next few weeks, and once it is, we will follow up with some more detailed analysis of the implications for stakeholders.

In the meantime, we have listed below some highlights of the agreement on the text, based on what we know at this stage:

• Expanded definition of a product to cover software and digital manufacturing files. The agreed text takes a broad approach, with both embedded and stand-alone software in scope – with only limited exceptions for certain free and open-source software developed or supplied outside of a commercial activity.

• Expanded concept of defect to introduce strict liability for defects from software updates, artificial intelligence (AI) and machine learning, among others.

• Expanded range of damages to include medically recognised damage to psychological health and destruction or irreversible corruption of data (not used exclusively for professional purposes) – e.g., deletion of files from a hard drive.

• Expanded range of defendants, with new liability for online marketplaces and fulfilment service providers in certain cases, as well as for those who ‘substantially modify’ a product outside of the original manufacturer’s control.

• New requirements for discovery by harmonising rules on when a court can order discovery of documents at an early stage (currently not available in all EU Member States under existing rules).

• Easing the burden of proof in certain circumstances, such as in scientific or technically complex cases where it would be difficult for the victim to prove liability. The European Commission has previously suggested this could include vaccines, medical devices and products that make use of AI technologies.

• Significantly extending the long-stop period where symptoms are slow to emerge, from 10 years under the existing rules to 25 years.

The indications are that proposed changes which will increase the importance of regulatory compliance as a means of mitigating product liability risks also have been agreed. These include adding compliance with EU product safety rules and the existence of any product recalls as relevant factors for assessing defect, along with creating a presumption of defect where there is a noncompliance with relevant product safety laws. We are waiting to see the final text to understand the impact of any final tweaks made to these provisions and will follow up with more detail in the new year.

The text of the provisional agreement now needs to be formally approved by the full European Parliament at plenary, and then by the European Council. It will then be signed and published in the Official Journal of the European Union and enter into force 20 days later. A 24-month transition period has been agreed – meaning the laws look set to enter into force in the first half of 2024 and will start applying from 2026.

These reforms sit alongside parallel policy initiatives – such as the EU’s new class actions mechanism that has applied to cases across the EU since June 2023, proposals on AI, circular economy activities and cybersecurity. Together, these reforms are set to significantly change the liability risks for product manufacturers and suppliers.

See more from these press releases following the provisional agreement – European Commission, European Parliament and European Council.

We will be posting more information about these reforms on our Productwise blog in the coming weeks, so continue following to learn more.

Key takeaways

• Political agreement on the new Corporate Sustainability Due Diligence Directive (CSDDD) was announced on 14 December 2023; it will be applicable to certain European Union (EU) and non-EU companies with activities in the EU
• The CSDDD will impose new mandatory human rights and environmental due diligence obligations – in particular, companies in scope will be required to identify and prevent, bring to an end, or mitigate the adverse impacts of their activities on human rights, such as child labour and exploitation of workers, and on the environment, such as pollution and biodiversity loss
• The CSDDD will apply to companies’ own operations, their subsidiaries, and their upstream and downstream business partners
• The legislation includes obligations for large companies to adopt and put into effect a climate transition plan to ensure their business strategy is compatible with limiting global warming to 1.5 °C
• Failure to comply risks fines of up to 5% of global turnover, claims under a new civil liability regime and potential disqualification from participating in public tenders

For more information see here

Background

The UK’s new cybersecurity regime for consumer connectable products – the Product Security and Telecommunications Infrastructure (Product Security) regime – comprises:

• The Product Security and Telecommunications Infrastructure Act 2022 (PSTIA), which is in two parts. Part 1 sets out product security requirements for in-scope connected products to help secure against cyberattacks. Part 2 focuses on supporting deployment and expansion of mobile, full-fibre and gigabit-capable networks.
• The PSTI Regulations which specify requirements for manufacturers for compliance with the PSTIA (together, the PSTIA Regulations).

The PSTIA Regulations will come into full effect on 29 April 2024. The PSTI Regulations were only signed into law in September 2023, so many stakeholders are still trying to prepare and navigate the impact of these changes.

Scope

The requirements under the PSTIA Regulations will apply to connectable products intended by the manufacturer to be used by consumers (or, where the manufacturer is aware/ought to be aware that consumers will use the product). The aim is to ensure that all products that can reasonably be expected to be used by consumers will have the same security requirements. In addition, certain products used by business customers could qualify as ‘consumer connectable products’ if those same products also are made available to consumers, which represents a broad approach. Moreover, the explanatory notes suggest that this applies if those products are made available to consumers by any supplier – so many business-to-business products will also end up in scope of the regime.  

The PSTIA Regulations apply to a range of smart products and Internet of Things (IoT) devices that are either products capable of connecting to the internet (internet-connectable products), or products that can connect directly or indirectly to an internet connectable product (network- connectable products). In addition, certain software falls in scope (as set out in the PSTIA Regulations in the schedule for each of the security requirements). The PSTIA Regulations set out a small number of exempt products, including:

• Products made available in Northern Ireland.
• Charging points for electric vehicles.
• Medical devices.
• Smart meter products.
• Certain computers and tablets.

Requirements

The PSTIA Regulations establish obligations for manufacturers, as well as other entities in the supply chain – including importers and distributors.

Manufacturers must comply with mandatory minimum safety measures relating to minimum default password requirements, providing information to the public on how to report security issues and publishing how long security updates will be provided. There is a requirement to report incidents or noncompliance, along with a requirement to retain documents. Compliance with parts of the standards ETSI EN 303 645 and ISO/IEC29147 will provide deemed compliance with the security requirements.

For all in-scope products, manufacturers will need to provide a statement of compliance which should accompany the product. The minimum information required for the statement of compliance is:

• Product (type and batch).
• Name and address of each manufacturer of the product and, where applicable, each authorised representative.
• A declaration that the statement of compliance is prepared by or on behalf of the manufacturer of the product.
• A declaration that, in the opinion of the manufacturer, they have complied with either:
  • The applicable security requirements (in Schedule 1 of the PSTI Regulations).
  • The deemed compliance conditions (in Schedule 2 of the PSTI Regulations).
• The defined support period for the product that was correct when the manufacturer first supplied the product.
• The signature, name and function of the signatory.
• The place and date of issue of the statement of compliance.

Importers and distributors are under corresponding obligations to not make in-scope products available without an accompanying statement of compliance. Both importers and distributors also are under duties to not make available products that are not compliant with the PSTIA Regulations, and to take action in relation to any noncompliance that they are aware of.

Penalties

There is a ban on supplying products that do not comply. Penalties for noncompliance include fines of up to £10 million, or 4% of a company’s worldwide revenue, along with daily fines of up to £20,000 where a breach continues.There also are powers to recall noncompliant products from the market and for information about compliance failures to be made publicly available.

Getting ready for compliance

By 29 April 2024, manufacturers, importers and distributors will need to have adjusted their practices to meet the applicable requirements, depending on their role in the supply chain. In general, stakeholders should be thinking about:

• Determining whether their activities and devices fall within the scope of the PSTIA Regulations.
• Considering any changes that are required to software or hardware to comply with the new cybersecurity requirements.
• Drawing up statements of compliance and ensuring in-scope products are accompanied by these if made available after 29 April 2024.
• Reviewing procedures, including:
  • Processes for records management and retention.
  • Processes for the monitoring, investigation and notification of incidents and noncompliance.
  • Policies on periodic security updates and security and firmware support periods for products.
  • Vulnerability management and disclosure policies.
  • Password management processes.
  • Verification of statements of compliance.
• Establishing a monitoring program for additional future requirements. The PSTIA Regulations make provision for additional requirements to be specified through secondary legislation. It is important that manufacturers, importers and distributors monitor for future changes to cybersecurity requirements.

Please contact the Cooley international products team if you have questions about the PSTIA Regulations – or how to ensure your products are compliant. We have experience with the issues that are being seen by stakeholders, and we can assist with practical steps to address the new requirements.

The Cooley team will continue to blog on this topic, so keep an eye out for further updates on Productwise.

Background
The Ecodesign for Sustainable Products Regulation (ESPR) was originally proposed by the European Commission in March 2022 to repeal and replace the existing Ecodesign Directive. The EU institutions reached a provisional agreement on the new law on 4 December 2023. We anticipate that this new law will have a significant impact on many of our clients’ businesses. We have summarized the key highlights below.

Key highlights
Broader scope and stricter sustainability requirements

The ESPR will give a broad mandate for the Commission to introduce product-specific sustainability requirements for a wide variety of products via delegated acts. It significantly expands both the scope of products covered and the requirements which could apply to said products.

Scope: The ESPR will apply to all products on the EU market, including intermediate products, such as steel and aluminium, with only a few sectors exempt – including food, feed, living organisms, certain motor vehicles and medical products.

Requirements: The ESPR will empower the Commission to adopt a broad spectrum of sustainability requirements for specific product groups. These requirements generally fall into two buckets:

• Performance requirements: These are very broad and cover elements like durability, reliability, reusability, repairability, energy and resource efficiency, recycled content, and the presence of ‘substances of concern’ – a new concept that includes substances that can negatively affect the reuse and recycling of materials in the product.
• Information requirements: These include the introduction of a ‘digital product passport’ (see below) and the publication or labelling of certain other sustainability information.

Once the Commission adopts requirements for a specific product group, products within that group will only be able to be placed on the EU market if they comply with the requirements.

Priority product groups

Although the scope of the ESPR is very broad, the Commission has already stated that it intends to prioritise the introduction of requirements for certain product groups which it deems highly impactful. These include textiles, iron, steel, aluminium, furniture, tires, paints and chemicals, as well as certain energy-related products and electronics.

Digital product passports

As part of the EU’s drive towards greater transparency on sustainability issues, the ESPR also introduces a ‘digital product passport’ which will require the provision of information on the sustainability credentials of products via QR code to consumers, regulators and other businesses in the supply chain. The idea is that increased transparency will drive consumers towards making more sustainable choices, and that it also will provide market intelligence for refining the rules in the future.

Unsold consumer goods

The ESPR introduces various requirements aimed at minimising the number of unsold consumer goods, which will apply without the need for further delegated acts.

In particular, the ESPR introduces a first-of-its-kind ban on the destruction of unsold clothing and footwear. This will apply two years after the legislation enters into force, with various exemptions for small or medium-sized companies. The Commission also has been given the power to prohibit the destruction of other categories of products in the future (e.g., unsold small electronics).

The ESPR also introduces a requirement for certain large companies to publish the quantities of unsold consumer products they discard each year, alongside their reasons for doing so.

Next steps

The provisional agreement will now need to be formally approved by the European Parliament and Council. Although it is possible there could be changes along the way, these tend to be legal linguistic amendments, rather than substantial amendments to the text. The legislation will then be signed, published in the Official Journal of the European Union and enter into force 20 days later to complete the lawmaking process.

Following the ESPR’s adoption, the Commission is expected to adopt its first working plan within nine months of entry into force of the ESPR, which will include an indicative list of product groups that it intends to regulate in the coming years. Product-specific requirements will apply via delegated acts which will be adopted separately by the Commission and will each have their own transition period.

Under the CPSA, manufacturers, importers and distributors of consumer products are required to “immediately” report information that “reasonably supports the conclusion that the product contains a defect which could create a substantial product hazard” or “creates an unreasonable risk of serious injury or death.” At the time of Gree’s reporting to the Consumer Product Safety Commission (CPSC), the Gree companies were alleged to be aware of hundreds of incidents, more than 100 fires and millions of dollars in property damage – information that the government alleged should have given rise to a reporting obligation far sooner.

Following a recall, in 2016, the Gree companies agreed to pay a $15.45 million civil penalty to settle CPSC staff charges of knowingly violating the CPSA’s reporting requirement, using a false UL product certification mark, and making material misrepresentations to the federal government. But that did not end the saga for the Gree companies. In 2021, one Gree company agreed to plead guilty to a felony – knowingly and willfully failing to report to the CPSC – and the other companies entered into a deferred prosecution agreement related to the same charge. The companies’ criminal resolution included a $91 million penalty and represented the first corporate criminal enforcement actions ever brought for failure to report a product safety issue as required by the CPSA.

At the same time the corporate prosecution was pending, the Department of Justice (DOJ) also individually indicted Simon Chu and Charley Loh, the former Chief Administrative Officer and Chief Executive Officer, respectively, of one of the companies. The March 2019 indictment, which was sought and filed during the Trump administration, alleged the two executives had received “multiple reports” that the dehumidifiers were “defective, dangerous and could catch fire,” but failed to disclose these hazards to the CPSC for at least six months while they continued to sell the defective products – all while allegedly knowing that they were required to report this information. Following a six-day trial in November 2023, a Los Angeles jury found both executives guilty of conspiracy and failure to immediately report required information under the CPSA. 

This first-of-its-kind prosecution (and guilty verdict) against corporate officers reflects the CPSC’s and DOJ’s increasingly aggressive approach to enforcing the CPSA and holding corporate executives accountable for misconduct.  Companies making or selling products subject to the CPSA should be mindful of the increased enforcement focus and potential for corporate and individual criminal exposure that, regardless of administration, appears poised to continue.

Read on for more about criminal enforcement under the CPSA.

Reporting requirement under the Consumer Product Safety Act

The CPSA was enacted in 1972 to protect the public from unreasonable risks of injury from consumer products. It imposes an affirmative reporting requirement on manufacturers, importers and distributors of consumer products, which also applies to the directors, officers and agents of those companies. Information must be reported when it “reasonably supports the conclusion that the product contains a defect which could create a substantial product hazard” or “creates an unreasonable risk of serious injury or death.” In practice, the CPSC advises, “when in doubt, report.” Given the interplay with consumer product safety, Congress purposefully set a tight deadline for this reporting obligation in the CPSA: Such information must be reported “immediately” – meaning “within 24 hours of obtaining reportable information,” though CPSC’s implementing regulations also allow companies time to conduct a reasonable investigation, not to exceed 10 working days.

Failure to timely report the information required under the CPSA can result in civil penalties, which are currently capped at $120,000 per violation and $17,150,000 for any “related series of violations.” With respect to civil penalties, companies may be subject to monetary penalties if they knowingly violate the law, which is not a particularly high bar because “knowledge” includes information that a reasonable company should have had while exercising due care.

The CPSA also provides for criminal penalties – and imprisonment of up to five years – for not only knowing, but also willful, violations (i.e., where a company knew of its legal obligation to report but voluntarily and intentionally chose not to do so). For individual officers or directors of a company, the CPSA provides for criminal penalties for knowing and willful authorization of the violation of law. This provision of the CPSA had never been utilized by the DOJ for the CPSA’s Section 15(b) reporting violations before – until now.

The road ahead: increased focus on criminal enforcement

While the CPSC has not historically pursued criminal enforcement for violations of the CPSA, signs point to this being the leading edge of a potential sea change at the Commission. For example, the CPSC’s fiscal year 2023 operating plan reflected an intention to review “all” civil penalty cases “for potential criminal referral to the Department of Justice” – a sentiment repeated within the fiscal year 2024 operating plan. And a unanimous and bipartisan contingent of current CPSC commissioners have strongly voiced their intention to place more emphasis on the role of criminal penalties.

Chair Alex Hoehn-Saric, for example, noted that “[f]ailure to report in a timely fashion will result in an investigation and CPSC will pursue significant civil and potentially criminal penalties.” Commissioner Richard Trumka also made clear that “this Commission is serious about deterring corporate misconduct using every tool at our disposal, including the appropriate use of civil penalties and, where warranted, criminal referrals.” Commissioner Peter Feldman similarly noted in the wake of Chu’s and Loh’s convictions that “CPSC and its federal partners will use all available tools to keep consumers safe.” And finally, Commissioner Mary Boyle stated that “[c]ivil – and potentially criminal – penalties are essential to ensure that the interests of consumers are given their due.”

While Gree is the first case involving corporate and individual criminal exposure for a violation of the CPSA, it assuredly will not be the last. The DOJ Consumer Protection Branch, working alongside the U.S. Attorneys’ Offices, appears to have the appetite to pursue additional criminal investigations and prosecutions under the CPSA. In fact, Generac Power Systems recently disclosed that in July 2023 it received a grand jury subpoena related to its failure to timely submit a report about defective portable generators. This criminal investigation follows Generac’s May 2023 settlement with the CPSC, under which it agreed to pay a civil fine of $15.8 million and implement and maintain a compliance program and certain internal controls to ensure compliance with the CPSA.

As Chair Hoehn-Saric cautioned last year, “companies should be on notice that the agency will be even more aggressive in the future.” And, in the words of DOJ’s Arun Rao (Deputy Assistant Attorney General for the Consumer Protection Branch), “holding corporations and those who act on their behalf (such as managers who attempt to conceal potentially dangerous problems from customers … ) responsible for criminal wrongdoing has been, and remains, an important priority of the department.” The writing appears to be on the wall that, where there are indications of a willful violation, CPSC already is and will continue closely scrutinizing a company’s behavior through both a lens of civil penalty enforcement and referral to the DOJ for criminal prosecution. Given the CPSC’s increased focus on criminal referrals, companies should assess criminal exposure risk as part of regulatory investigations related to potential violations of the CPSA and corporate executives should have it in the back of their mind when acting on recommendations of whether a product safety issue warrants a Section 15(b) report to the CPSC. 

Key highlights

While we are waiting for the full text of the provisional agreement to become available, we have listed some key highlights below.

New essential requirements and conformity assessment

We understand that the main elements of the European Commission’s proposal have been retained, such as requirements that ‘products with digital elements’ comply with new essential cybersecurity requirements. Compliance will need to be demonstrated as part of the applicable conformity assessment process, a declaration of conformity will need to be drawn up, and the CE mark will need to be applied.

Post-market requirements

The new rules also will impose post-market obligations, such as those to handle vulnerabilities, and a market surveillance framework will be established.

Scope and lists of ‘critical’ products

Under the Commission’s draft legislative proposal, the scope would include ‘products with digital elements’ – defined as any ‘software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately’ – that are connected directly or indirectly to another device or network. The Commission also proposed a number of exceptions. We understand that amendments have been made to the scope that include adjustments to the application for certain open-source software. There also have been changes to the lists of ‘critical’ products – which can impact the type of conformity assessment process required for a particular product.

Software updates

There will be a requirement for manufacturers of ‘products with digital elements’ to continue to provide security updates. One of the issues we’ve been following in the negotiations is the period for which security updates would need to be provided. While we are keen to see the agreed text to get into the detail for this one, indications are that the agreed text will require security updates be provided for at least five years, except for products that are expected to be in use for a shorter period of time, in which case that shorter period would apply. In addition, there would be requirements surrounding how security updates are supplied – around automatic installation and unbundling of security and functionality updates.

Reporting obligations

This was another hot issue in the negotiations. Under the Commission’s proposal, reports of actively exploited vulnerabilities and incidents would need to be made to the European Union Agency for Cybersecurity (ENISA) within 24 hours of the manufacturer becoming aware of any such incident. Under the provisional agreement, it looks like reports would be made to the national computer security incident response teams (CSIRTs) of EU member states. ENISA still will have a role in the process, but with potential restrictions on the information it receives in certain cases.

Transition period

A 36-month transition period has been agreed. However, obligations to report certain incidents and vulnerabilities will apply sooner, after 21 months following the entry into force of the CRA.

A lot of issues will need to be unpacked when the text of the provisional agreement becomes publicly available, which is expected in the coming weeks or early in 2024.

What’s next?

The provisional agreement still needs to be formally approved by the European Parliament and Council, and it’s possible there could be changes along the way (usually legal linguistic amendments, but theoretically other changes also could pass). The text of the legislation will then be signed, be published in the Official Journal of the European Union and enter into force 20 days later to complete the lawmaking process.

In terms of timing, we’d expect this lawmaking process to be completed between the first and second quarters of 2024, with the new requirements starting to apply beginning in Q1 or Q2 2027, and obligations to report incidents and vulnerabilities applying between Q4 2025 and Q1 2026.

Where can I find out more?

The European Commission, Parliament and Council issued press releases after the trilogue agreement was reached. We’ll publish more analysis on our blog when the text of the provisional agreement is available.

What are the adjusted thresholds?

A company’s reporting obligations under the CSRD are determined by the size of the company or group. Most large EU companies and groups will need to comply for financial years beginning on or after 1 January 2025, and certain small and medium-sized enterprises (SMEs) will need to comply for financial years beginning on or after 1 January 2026.

A comparison of the current and new thresholds is set out in the table below.

Threshold test for non-EU parent companies

The threshold for non-EU parent companies to prepare a group report under the CSRD from financial year beginning on or after 1 January 2028 has not been adjusted. The CSRD remains applicable to any non-EU company which satisfies both of the following criteria:

• Generates a net turnover of more than 150 million euros in the EU for each of the last two consecutive financial years at the consolidated level (or, if not applicable, at the individual level).

AND

• Has at least one EU subsidiary in scope of the CSRD, or has at leastone branch which generated a net turnover of more than 40 million eurosin the preceding financial year.

When will these adjusted thresholds apply?

Member states are required to apply these new thresholds for financial years beginning on or after 1 January 2024. Member states may, however, allow entities to apply these adjusted thresholds for financial years starting on or after 1 January 2023. This will be determined at the individual member state level.

Why have the thresholds been changed?

The stated reason for raising the thresholds is to accommodate for inflation over the past 10 years and reduce the reporting burden for smaller companies.

Next steps

The amendments adopted by the European Commission are now subject to a scrutiny period (usually two months, although this can be extended) during which the European Parliament or European Council might veto the changes. If the changes are not vetoed, the amendments will be formally published in the Official Journal of the European Union and will enter into force three days after.

Are there any other changes on the horizon?

No changes to the first set of European Sustainability Reporting Standards (ESRS): The ESRS which will start to apply to certain large EU companies reporting on FY 2024 also are nearing the end of their cooling off period. Adopted in July 2023, the ESRS are subject to a two-month scrutiny period in the European Parliament and European Council before they formally enter into force at the end of this year. A motion tabled last week to reject the ESRS and requesting a less onerous set of reporting standards was itself rejected on 18 October 2023.

Delays to drafts of the sector-specific and non-EU-specific ESRS: The European Commission’s 2024 Commission Work Programme indicates that it plans to postpone the adoption of sector-specific ESRS and the ESRS to be used by non-EU companies in scope of the CSRD. Adoption of these standards was initially scheduled for June 2024. The proposed two-year delay is not, however, currently expected to impact the reporting deadlines for either EU or non-EU companies in scope of the CSRD.

For further details on the CSRD, see Cooley’s related August 2023 client alert.

If you have any questions or would like support adjusting to this new reporting regime, please contact a member of Cooley’s international ESG & sustainability advisory team.

Restrictions are, of course, one lever available to governments to change behaviour. In recent years, however, governments also have begun using the tax system to incentivise consumers and businesses away from the use of nonrecycled plastic material.

The UK is an early adopter of this tax-driven approach and has already brought its own plastic packaging tax (PPT) into law. We set out its key features below, together with some points to bear in mind. The EU, likewise, is keen to lead the way, but rather than introducing an EU-wide PPT, it has chosen to introduce a “plastics contribution” – owed directly by member states to the EU, with member states given flexibility as to how to fund their contributions.

As will be seen, PPTs are not without complexity, and the divergence of approaches taken by different governments (including within the EU) makes it all the more challenging for businesses to keep on top of their obligations. Being prepared – and taking timely advice – are essential.

UK PPT

The UK PPT came into force on 1 April 2022. At first glance, the tax may seem straightforward –a per-tonne charge on plastic packaging that does not contain at least 30% recycled material –but its scope can be complex.

It also is important to be aware that the UK PPT legislation contains a stringent compliance regime, with criminal sanctions in the case of fraudulent activity and the potential for secondary or joint and several liability where an unconnected business within a supply chain fails to pay its own UK PPT.

What is the UK PPT charged on, and who pays it?

The UK PPT is payable on chargeable plastic packaging components, either manufactured in or imported into the UK, at a rate of £210.82 per metric tonne. It is payable by manufacturers and importers.

A plastic packaging component is defined as any product that is designed to be suitable for use in the containment, protection, handling, delivery or presentation of goods at any stage in the supply chain. This broad definition, which can catch items that ought not to be within the scope of the UK PPT, is supplemented by extensive UK tax authority guidance. Businesses should consider taking specialist advice in order to assess whether particular items are in or out of scope.

A plastic packaging component will be chargeable if it is finished (that is, broadly, not subject to further modification) and if the proportion of recycled plastic in the component is less than 30%.

Registration requirements

A business within the scope of the UK PPT is required to register with the UK tax authority, but only if it manufactures or imports more than 10 tonnes of finished plastic packaging components in a 12-month period. Businesses generally have 30 days from the end of such 12-month period to register.

Exemptions, credits and reliefs

There are a number of exemptions, credits and reliefs. Certain products are not subject to the tax but count toward the 10-tonne threshold (such as plastic packaging for human medical products), whilst others are exempted entirely (such as “tertiary” packaging used to transport multiple sales units).

If a business intends to export a finished plastic packaging component, the liability to the UK PPT may be deferred and ultimately cancelled provided certain requirements are met.

Supply chain – secondary or joint and several liability

A business may be liable (on a secondary basis or jointly and severally liable) for the UK PPT where another party in the supply chain is liable and has failed to pay.

Accordingly, it is crucial that businesses understand the UK PPT status of their suppliers and customers and obtain appropriate verification that any PPT due from those parties has been paid in full.

Sanctions – including criminal liability

Criminal sanctions can be imposed in various circumstances, including cases of fraudulent evasion of the UK PPT or falsification of documents.

The EU plastics contribution

As mentioned above, the EU plastics contribution operates differently to the UK PPT.

Instead of there being an EU-wide PPT charge, each EU member state is required to make a payment (or “contribution”) to the EU, at a rate of 0.80 euros per kilogram of nonrecycled plastic packaging waste produced in that member state. It is then up to each member state whether to fund its plastics contribution by introducing its own PPT (or similar measure) or out of existing resources.

To date, only a handful of the largest member states have introduced taxes equivalent to the UK PPT. Spain is one example, which, as of 1 January 2023, imposes a tax on nonreusable plastic packaging at a rate of 0.45 euros per kilogram. Italy and Poland also have announced their intention to introduce a PPT in 2024. Elsewhere, there are several approaches, including no measures or plans at all and relatively limited charges on a narrow set of items.

Therefore, whilst there is a consistent policy intention across the EU to disincentivise the use of unrecycled plastic material, businesses have to grapple with a patchwork of different tax regimes within the EU – each with different scopes, rates and compliance burdens.

What should manufacturers and importers be doing now?

Businesses that manufacture or import plastic packaging should review whether their operations give rise to:

• Obligations to register and/or account for PPT.
• Potential exposures to PPT owing to defaults by other parties in supply chains.

This review should be ongoing and forward-looking, as jurisdictions continue to introduce PPTs or make amendments to existing rules.

If you have any queries in relation to the UK PPT, or have general enquiries regarding the direction of travel of plastic packaging taxation globally, please do not hesitate to reach out to any member of the Cooley UK tax team – the authors of this post.

If the Court of Justice endorses the AG’s reasoning, this might have groundbreaking effects, as it could open the way to requiring HTS to be made freely available.

HTS are adopted, typically in the context of EU product legislation, by European Standardisation Organisations (ESOs), further to a mandate issued by the European Commission. They establish technical specifications that can be voluntarily used by manufacturers to comply with the technical and safety requirements set in EU legislation. They provide a presumption of conformity with the applicable rules and, therefore, are typically relied on by manufacturers.

Standardisation organisations charge a fee for the purchase of a standard.

Background to the dispute

Two nonprofit organisations made a request to the European Commission under Regulation (EC) 1049/2001 and Regulation (EC) 1367/2006 for access to four HTS adopted by the European Committee for Standardisation (CEN) under the Toy Safety Directive 2009/48/EC. The European Commission refused to grant the nonprofit organisations access to the four standards.

Consequently, the nonprofit organisations challenged the European Commission before the EU General Court, which dismissed the case (see the judgment in Case T-185/19).

The nonprofit organisations appealed the judgment of the General Court before the Court of Justice to seek the annulment of the General Court’s judgment and the European Commission’s decision to refuse access to the four standards.

Summary of the AG opinion

Here we summarise the main arguments presented by the AG in favour of free access to the HTS:

1. HTS are an act of EU law.

The AG concluded that HTS are adopted by the European Commission and, therefore, are part of EU law and should be made freely available based on the following considerations:

• HTS are not implementing measures originating from ESOs, ‘but are – under the EU standardisation system set out by the EU Legislature – to be considered as having been adopted by the [European] Commission or, in any event, that that institution is responsible for the adoption of HTS in conjunction with ESOs’.
• The procedure to adopt HTS starts with a request from the European Commission and ends with the European Commission, which verifies the conformity of the HTS with its original request and publishes the references of the standards in the Official Journal of the European Union. Furthermore, the work of ESOs is partially financed by the European Commission. 
• The conformity with a given HTS is relied on by manufacturers of harmonized products to prove compliance with the essential requirements of the corresponding EU secondary legislation. HTS are – de facto – mandatory.

2. HTS impact rule of law requirements.

The AG further concluded that HTS, as acts that are part of EU law, implement EU legislation and produce legal effects. Therefore, the AG took the view that they should be made freely available without charge and also entirely published in the Official Journal of the European Union to ensure enforceability and accessibility by the public at large.

3. HTS are not capable of being protected by copyright.

The AG also held that, being acts of EU law and being indispensable for the implementation of EU legislation, HTS cannot benefit from copyright protection.

4. There is an overriding public interest justifying the disclosure.

Even if HTS could benefit from copyright protection (quod non), the AG concluded that free access to the law should take precedence over commercial interests which, in the present case, have not even been demonstrated and assessed.

Conclusions

In the opinion adopted on 22 June 2023, the AG argued that the judgment under appeal must be set aside, the contested decision must be annulled, and the European Commission must be ordered to grant the appellants access to the four requested standards for the reasons outlined above.

Next steps

The AG opinion is not binding on the judges of the Court of Justice, who are now considering the case, which will be settled with a judgment that may be issued in the course of 2024. If the Court of Justice endorses the AG opinion, it may not only annul the General Court’s decision but also order the European Commission to grant access to the four requested HTS to the two nonprofit organisations.

The findings of the Court of Justice also may result in the need to revise Regulation 1025/2012, so as to require the content of the HTS to be published in the Official Journal of the European Union or made available without any charge not only to manufacturers but also, more generally, to the public. 

Links

• AG opinion
• Court of Justice press release

The restriction applies to microplastics on their own and in certain consumer products, such as cosmetics and detergents.

We provide a quick overview of the adopted restriction below.

What is a microplastic?

The restriction adopts a broad definition of microplastics to cover ‘synthetic polymer particles below five millimetres that are organic, insoluble and resist degradation’ (see the European Commission’s press release). Certain types of polymers have been excluded from the definition of microplastics, so we recommend checking this list if you think a polymer that you use may qualify as a microplastic.

What products are covered by the restriction?

The restriction applies to microplastics placed on the market as substances on their own or where ‘intentionally added’. This means that they are ‘present to confer a sought-after characteristic’, in mixtures in concentration equal to or greater than 0.01% weight/weight. An example of intentionally added microplastics would be microbeads. Certain exclusions apply, which we’ve set out below.

What products are excluded from the scope of the restriction?

Certain products are excluded from the scope of the microplastic restriction, meaning that they can continue to use microplastics, including where these are ‘intentionally added’. 

These exclusions include:

1. Microplastics used at industrial sites.
2. Medicinal products and veterinary medicinal products.
3. EU fertilising products.
4. Food additives.
5. In vitro diagnostic devices.
6. Food and feed.

Although these products can continue to be sold, suppliers of medicinal products and veterinary medicinal products, food additives and in vitro diagnostic devices containing microplastics will have to report specific information to the European Chemicals Agency (ECHA) every year. In addition, suppliers of microplastics used at industrial sites, as well as suppliers of food additives and in vitro diagnostic devices containing microplastics, will have to provide, among other things, instructions on how to use and dispose of the product to prevent microplastics emissions.

Certain microplastics also are excluded from the restriction – on their own or in mixtures:

1. Microplastics that do not release microplastics, or where releases are minimized.
2. Microplastics that are permanently modified during use such that they no longer fall under the definition of microplastics.
3. Microplastics permanently incorporated into a matrix.

When will the restriction start to apply?

The microplastics restriction will apply as follows:

• On 17 October 2023 for microplastics on their own and when intentionally added (e.g., loose glitter).
• From 17 October 2027 for the use of microplastics in rinse-off cosmetic products.
• From 17 October 2028 for the use of microplastics in detergents/waxes/polishes and air care products, fertilising products outside the scope of application of Regulation (EU) 2019/1009, and products for agricultural and horticultural uses.
• From 17 October 2029 for the use of microplastics in the encapsulation of fragrances, leave-on cosmetic products and medical devices within the scope of Regulation (EU) 2017/745.
• From 17 October 2031 for the use of microplastics in plant protection products, biocidal products and granular infill for use on synthetic sports surfaces.
• From 17 October 2035 for the use of microplastics in lip products, nail products and makeup. Note that, from eight years from the entry into force of the restriction and until the end of the transition period, suppliers of these products will have to include on the label, packaging or package leaflet, the following statement: ‘This product contains microplastics’.

Next steps

The restriction was published in the Official Journal of the European Union on 25 September 2023 and will formally enter into force on 17 October 2023. The timings set out above for different product groups apply.

Links

• The adopted restriction
• European Commission press release
• European Commission Q&A

The Carbon Border Adjustment Mechanism (CBAM) is a European Union regulation which has been introduced to reduce carbon emissions produced by manufactured goods imported from jurisdictions with less stringent carbon emissions regulations.

The regulation will affect Cooley clients importing fertilisers, energy products, hydrogen, cement, iron and steel, as well as carbon dioxide equivalent (CO₂e) emissions connected to them. CO₂e refers to ‘the number of metric tons of CO₂ emissions with the same global warming potential as one metric ton of another greenhouse gas’, as defined in the upcoming legislation.

This blog post will cover the scope of the CBAM, its key provisions, timeline and next steps.

Scope of the CBAM

The CBAM applies to all imports of high-emission goods from non-EU countries and to companies which rely on imports of high-emission goods for their business. The CBAM specifically applies to cement, iron, steel, aluminium, some chemical industries (fertilisers and hydrogen) and electricity, which are imported into the EU.

The CBAM applies to all companies that import any of the included goods for any part of their business, not just to those who supply or deal exclusively with those goods.

The requirements which will come into force

Affected companies will be required to accurately report on their CO₂e emissions, and after the transitional period, they also will be required to account financially for those emissions.

1.Reporting requirements

In the interim phase of implementation of the CBAM, from 1 October 2023 to 31 December 2025, affected companies will need to report on their carbon emissions. During this time frame, importers should determine and assess direct and indirect reporting. Direct reporting includes the greenhouse gas (GHG) emissions which the imports produce during production, and indirect reporting includes the emissions associated with the electricity used during production of the goods.

Affected EU importers are obliged to prepare a quarterly CBAM report that provides the information on the imported quantity of CBAM goods.

From 1 October 2023, companies will need to report on:

• The direct emissions within each CBAM imported good, including the annual embedded GHG emissions.
• The indirect embedded emissions contained therein (reporting on indirect embedded emissions is initially only for cement, electric power and fertiliser).
• The consistency throughout the value chain cycle – meaning that the number of CBAM certificates in the company’s CBAM registry account at the end of each quarter should correspond to at least 80% of the embedded emissions in imported products since the beginning of the calendar year.
• Any carbon taxes effectively paid in the country of production.

The first report should be submitted by 31 January 2024. Penalties may be put in place if an entity’s reporting is deemed insufficient by the European Commission.

2. Mandatory registration

As of 1 January 2026, it is mandatory for affected companies to register as declarants. Only registered declarants will be permitted to import any CBAM goods. This will be monitored by the customs authorities of each EU member state. They will be obliged to deny the import of CBAM goods by nonregistered declarants. The period to register begins on 1 January 2025.

3. Import charges and certificate trading

After January 2026, import charges will be imposed on companies importing CBAM goods. This will require importers to purchase CBAM certificates equal to the carbon content of the imports. These certificates serve as proof that the carbon emissions have been accounted for and offset.

When the company pays the relevant charges for its imported CBAM goods, any carbon offsetting price that the importer paid in the jurisdiction where the goods were manufactured will be allowed to be offset from the CBAM import charge.

Exemptions

The CBAM will not apply to:

• Imports from the European Economic Area (EEA) – Norway, Iceland, Liechtenstein and Switzerland.
• Small quantities of imported goods – i.e., under 150 euros per consignment.
• Downstream emissions.
• Emissions created by transporting materials between sites and from processes further upstream.

Next steps
As an immediate step, companies need to think about the reporting requirements that are kicking in on 1 October 2023. This will require them to determine, assess and document all direct and indirect emissions from imported CBAM goods. Additionally, in looking forward to the 2025 and 2026 requirements, companies should start assessing their production, supply chain and import practices to be CBAM-compliant.

Cooley lawyers will continue to monitor this space. Please reach out to the authors of this note or your regular Cooley contact if you would like to discuss further.

Join the Cooley international products and business litigation teams for a 45-minute, rapid-fire webinar to discuss the latest EU proposal to restrict PFAS, ongoing initiatives to regulate PFAS in the UK and US, and associated liability risks for product stakeholders.

PFAS are under increased scrutiny in the European Union, UK and US. The EU proposal to restrict around 10,000 PFAS is just one of the latest initiatives to regulate a group of chemicals that are used not only in industrial settings but also in consumer products – such as electronics, textiles, food contact material, packaging, cosmetics, etc. In parallel, the UK has concluded its evaluation of PFAS and announced that it will be considering measures to regulate them, including restrictions of PFAS in consumer products – in the near future – together with other measures to address environmental and human health risks that PFAS are deemed to pose. The US Environmental Protection Agency also has announced a new framework for evaluation of PFAS, and regulators are increasingly showing concern regarding their use in consumer products.

Speakers

• James Maton – Partner
• Edward Turtle – Associate
• Selma Abdel-Qader – Associate
• Shawn Skolky – Associate

Ban on unsubstantiated generic environmental claims, such as ‘climate neutral’

The new directive will update the current list of commercial practices that are banned in the EU to include generic environmental claims – such as ‘environmentally friendly’, ‘natural’, ‘biodegradable’, ‘climate neutral’ or ‘eco’ – unless they can be properly evidenced.

Ban on unverified claims based on emissions offsetting schemes

Unverified claims that suggest a product has a neutral, reduced or positive impact on the environment also will be banned.

Planned obsolescence of goods

The provisional agreement also will ban practices associated with early obsolescence, such as presenting software updates as necessary when they only enhance functionality features, presenting goods as repairable when they are not, and unjustified obligations to buy spare parts from the original producer. It also will clarify the position on traders’ liability for information (or lack of information) on early obsolescence.

New EU label for information on the guarantee

A new harmonised label to highlight products with an extended guarantee will be designed by the European Commission. This label will be for producers that wish to highlight that they are offering – free of charge – an extended guarantee that goes beyond the two-year EU minimum.

The directive to empower consumers for the green transition forms part of a larger EU package of measures, which includes the proposed Ecodesign for Sustainable Products Regulation, the Green Claims Directive and the Right to Repair Directive. The new directive will take effect by amending the current text of the EU Unfair Commercial Practices Directive and Consumer Rights Directive.

Timing

The provisional agreement will now need to be agreed and formally adopted by both the European Council and Parliament, which is expected to happen in November 2023. The directive will enter into force shortly thereafter. Following the directive entering into force, there will be a 24-month period for businesses to adapt. 

Why does this matter?

This agreement is another step in a general crackdown at the EU level of perceived greenwashing practices. As its name suggests, the directive to ‘empower consumers for the green transition’ is aimed at increasing consumer protection and giving consumers greater tools to challenge businesses that do not comply.

The requirements of the new directive will be in scope of the EU Representative Actions Directive that enables class action-style claims where obligations have not been complied with. In our view, it’s very likely we’ll see class actions in relation to greenwashing and early obsolescence, as there are some very active consumer organisations in the EU that will likely look to bring test cases.

As always, if you would like to discuss further or have any questions, please reach out to the Cooley team.

Read more

• European Council press release
• European Parliament press release
• European Commission’s original proposal from March 2022

Are you selling consumer products to the European Union market?

Would you like to learn about the new obligations introduced by the upcoming EU General Product Safety Regulation (GPSR)?

If so, please join ICPHSO and the European Commission’s Product Safety Unit for an ICPHSO power hour on the EU GPSR, moderated by Cooley partner Rod Freeman.

Thursday, September 21, 2023

8:00 – 9:00 am EDT
1:00 – 2:00 pm BST
2:00 – 3:00 pm CET

Register on the ICPHSO website.

Although the European Union lacks harmonised requirements related to the shipping of IMPs directly to study participants, trial sponsors have been experimenting with different approaches. DtP supply of IMPs and DCT models were important to on-going activities related to clinical trials conducted during the COVID-19 pandemic.

Previous research already suggested that EU law would not prohibit home shipping or administration of medicinal products for use in conducting a clinical trial. It also established that related national provisions in EU Member States can be limited, resulting in case-by-case decisions by regulatory bodies and ethics committees. The study published in July, conducted on behalf of Trials@Home consortium , investigated the different approaches used for DtP supply of IMPs during DCTs within the European Economic Area (EEA).

Study methodology

Research was based on interviews with staff at investigative sites, representatives from pharmaceutical companies, and courier services between the months of May and November 2021. Interviewees were questioned regarding their experiences or plans related to DtP supply of IMPs in the EEA.

Comparison of different models

The study identified three main DtP IMPs supply models used in the EEA – and considered the positive and negative elements of each. These models are investigative site-to-participant supply, central pharmacy or pharmacy depot-to-participant supply, and local pharmacy-to-participant supply. All these models involve supply of IMPs through courier post, a healthcare professional or collection at a local pharmacy. The study could not identify a sponsor-to-participant supply model in the EEA, however, which involves the shipping of IMPs from a private company sponsor or distributor depot to study participants. According to the researchers, a sponsor-to-participant model in the EEA raises concerns related to privacy and the need for pharmacy controls in the dispensing of IMPs.

Basis for discussion

The researchers suggest that it is feasible to employ DtP IMPs supply models in the EEA, and that their findings can be used by trial sponsors to discuss supply models with regulatory bodies and ethics committees – or identity best practices regarding DtP supply of IMPs. The findings of this study are consistent with an EU recommendation paper on DCTs published on 13 December 2022, which includes an annex on the acceptability of various decentralized elements such as DtP delivery of IMPs in EU Member States.

Directive 2011/65/EU on the restriction of the use of certain hazardous substances in electrical and electronic equipment (RoHS) controls the use of hazardous substances in electrical and electronic equipment in the European Union. The hazardous substances falling in scope are listed in Annex II of the directive.

As a consequence of RoHS, EU Member States must ensure that electrical and electronic equipment placed on the market do not contain the substances listed in Annex II – including lead. There are, however, a number of exemptions from this prohibition provided in Annex IV to RoHS. Examples of exemptions provided in Annex IV include lead in solders in portable emergency defibrillators, lead in X-ray test objects and cadmium in X-ray measurement filters. 

The new directive amplifies the exemption related to lead that is included in Annex IV to include lead as a thermal stabilizer in PVC sensors for IVDs used for the analysis of creatinine and blood urea nitrogen.

The preamble to the directive explains that the amendment is to take account of the fact that available lead substitutes for related devices are not reliable for creatinine and blood urea nitrogen measurements. Consequently, substitution of lead for IVD sensors is not yet guaranteed. Furthermore, restriction on the use of lead sensors would negatively affect the health service. The European Commission has, therefore, provided a related exemption that will expire on 31 December 2023. 

• The standards cover various environmental, social and corporate governance (ESG) topics including climate change, pollution, water, treatment of workers in the value chain and business conduct. The reporting standards clarify which areas of reporting are mandatory for all companies reporting and which are subject to materiality assessments.
• Companies should start preparing for their CSRD reporting now. Some companies will be required to report extensively on sustainability matters from 2024.

For full insight into the mandatory ESG reporting Standards the full article can be found here. Please reach out to our team if you have any questions. 

Join Cooley’s International Products Team for a 30 minute overview and discussion of the key proposals contained in the UK’s long awaited Product Safety Review and their potential impact on those doing business in the UK.  

On 2 August 2023, the UK government published its long-awaited proposals for reform of the UK product safety regime. There are 13 wide-ranging proposals, some of which could radically change the UK product safety landscape and/or have a significant impact for stakeholders.   

The UK government has launched a public consultation on the proposed reforms, which is open until 24 October 2023. This may be the only chance to comment on some of these proposals. So please join Rod Freeman, Claire Temple and Ed Turtle in conversation where,  in 30 minutes, they will provide a fast paced overview of the key proposals and views on their potential impact together with the ways that we might see this play out, moving forward.

The guidance provides that:

• Transition to the CTR is an administrative process following which assessment by EU Member States will be reduced to the minimum required to ensure compliance.
• Sponsors are encouraged to register clinical trials under the new Clinical Trials Information System (CTIS) at their earliest convenience to avoid delays.
• Documentation that was previously assessed will not be reassessed. This means that additional part I and II documents in Annex I to the CTR which were already approved under the CTD will not be reassessed.
• Templates that were developed and endorsed by the EU Clinical Trials Expert Group as part of EudraLex Volume 10 to provide compliance with the CTR do not need to be updated.
• There is no need to retrospectively create a site suitability form. These forms are only necessary for new trial sites added through substantial modification to part II documents after initial trial approval.

Transition to the CTR includes an obligation to submit a transition application to the CTIS. The guidance document includes direction concerning transition to the CTR and the CTIS regarding:

• When clinical trials must be transitioned from the directive to the regulation.
• Conditions for transition of single and multinational trials.
• Obligations which trial sponsors must fulfil.
• Consequences of the transition for clinical trial-related obligations under the CTR, such as obligations for notification through the CTIS, safety reporting rules and archiving requirements.
• The permitted uses of data generated during a clinical trial authorized on the basis of the CTD.
• Other issues, including steps related to updating trial documents and labels, the addition to the trial of sites in new EU Member States, urgent substantial modifications to a clinical trial and transparency requirements.

Key proposals

We’ve outlined below the key proposals included in the European Commission’s draft Toy Safety Regulation.

Regulation change

The European Commission’s draft would convert the existing Toy Safety Directive into a new Toy Safety Regulation. The different legal instrument means it would be directly applicable across the EU without the need for national legislation to implement the requirements. One of the aims behind this change is to ensure uniform implementation across the EU.

Expanded concept of ‘safety’ to add mental health risks

The general safety requirement would be expanded beyond protecting the physical health and safety of users, to include foreseeable risks to ‘psychological and mental health, well-being and cognitive development of children’. This reform is a response to the increased use of digital technologies in toys. As currently drafted, however, there is a risk that it could create uncertainties. In particular, there are no relevant definitions, meaning the scope of the obligation is unclear. For example, are manufacturers only required to consider the risks of medically recognised conditions? Or, if a toy causes emotional upset or anxiety to a child, would that kind of risk be in scope? In our view, if mental health risks are to be included in toy safety assessments, it is important that the boundaries of the new obligation are more clearly delineated.

More stringent rules on harmful substances

A central part of the reforms is the introduction of much stricter rules on chemicals. As toys are already subject to stricter chemicals rules than many other products (including those used by children), there have been concerns raised by industry about the proportionality of these measures, with a number of industry bodies suggesting that the increased burden will put many toy manufacturers out of business. Some have even suggested that the reforms may have the inverse effect of that intended by EU policymakers – meaning the only entities that will be able to bring products to market at a cost-effective price point under the new regime will be those entities based in third countries willing to bring noncompliant products to market. So, there remain considerable issues to resolve here.   Specific proposals in relation to harmful substances include:

• Expanding the current generic ban on substances which are carcinogenic, mutagenic or toxic for reproduction (CMRs) to additional harmful chemicals classified as endocrine disrupters, respiratory sensitisers or substances toxic to a specific organ, with limited derogations proposed.
• Extending the current limit values that apply for certain chemicals in toys intended for children under 36 months or intended to be placed in the mouth to apply to all toys.
• Lowering the limit values for nitrosamines and nitrosatable substances for certain toys intended for use by children under 36 months or in other toys intended to be placed in the mouth.
• Requiring possible risks of the combined or cumulative presence of chemicals in the toy to be considered when assessing safety.

Batteries in toys

Under the proposal, batteries in toys would need to comply with other applicable EU rules, such as the Regulation on registration, evaluation, authorisation and restriction of chemicals (REACH) and the Batteries Directive, which will be replaced by the upcoming Batteries Regulation. In addition, the proposed recitals include wording that ‘toys that include batteries should be designed in such a way that the batteries are difficult for children to access’.

New requirement for Digital Product Passport

All toys, including those sold online, would need to be accompanied by a Digital Product Passport containing prescribed compliance information, replacing the existing Declaration of Conformity. This is building on proposals under the proposed Ecodesign for Sustainable Products Regulation that would lay down a framework for Digital Product Passports. Unlike in that context, the focus here is on compliance and enforcement – and the European Commission has announced a complementary initiative to create a new IT system that will screen all Digital Product Passports at EU borders to identify and prevent entry for noncompliant products at customs. The draft Toy Safety Regulation is the first measure we’ve seen proposing to extend the use of the Digital Product Passport beyond ecodesign to cover product safety and compliance information. We expect to see this rolled out more widely to other sectors.

Changes to labelling

Proposals include requiring manufacturers and importers to indicate an ‘electronic address’ in addition to their postal address (as seen in the recently passed General Product Safety Regulation), a requirement to label a data carrier for the Digital Product Passport and allowing the word ‘Warning’ to be replaced by a specified generic pictogram.

Enabling consumers to file complaints or report accidents

In addition to upcoming accident reporting requirements under the recently passed General Product Safety Regulation, the proposals include requirements for manufacturers or importers to make publicly available a telephone number, electronic address, dedicated section of their website, or another communication channel to allow consumers to file complaints concerning the safety of toys and to inform manufacturers/importers of accidents or safety issues they have experienced. There also are proposed restrictions on the personal data that can be kept in a register of complaints and for how long.

Transition period

A 30-month transition period is proposed for most provisions, after which all toys placed on the market will need to comply with the new requirements. Unusually, under the proposals, toys placed on the market before the end of the transition period would only be allowed to be continued to be made available through the supply chain for a further year after the 30-month transition period ends. At that stage, the consequence of the provision is that such products would need to be removed from the supply chain if they have not been sold to consumers. In our view, this risks creating considerable burden and cost for industry, with negligible benefit.

Next steps

The draft legislation is undergoing an eight-week feedback period open to industry and the public. Currently, this closes on 6 October 2023, but we expect the deadline to be extended slightly whilst translations are prepared – you can check the proposal’s current status on the European Commission’s website. Feedback received during this process is usually summarised by the European Commission and presented to the European Council and European Parliament to consider as they review the proposal. Feedback also will be made public on the European Commission’s webpage for this proposal.   The legislative proposal then will make its way through the ordinary legislative process involving the European Council and European Parliament separately reviewing the proposal before meeting in trilogue negotiations with the European Commission. This process potentially could be delayed, given the upcoming European elections next year.   Please reach out to our team if you have any questions about the Toy Safety Regulation or would like assistance preparing feedback.

Where to find out more

• Proposal for a Regulation of the European Parliament and of the Council on the safety of toys and repealing Directive 2009/48/EC
• Commission steps up protection of children from unsafe toys (European Commission press release)
• Questions and answers: Commission proposal on Toy Safety

Medical devices CE marked on basis of directives

During the transition period, devices which were CE marked on the basis of the MDD, the Active Implantable Medical Devices Directive (AIMDD) and the In Vitro Diagnostic Devices Directive (IVDD) still may be placed on the market in the EEA beyond the official date of application for the MDR (26 May 2021) and the IVDR (26 May 2022). This means that devices CE marked on the basis of the directives may continue to be available on the territory of third countries.

Implications of revised MDR

In the factsheet, the European Commission notes that:

• Medical devices that do not, on the basis of the MDR, require involvement of a notified body in their conformity assessment, such as Class I medical devices and most custom-made devices, must have been demonstrated to comply with the MDR from 26 May 2021, as the revised transition provisions do not apply to these devices.
• New medical devices not previously covered by a CE certificate of conformity or declaration of conformity issued under the MDD/AIMDD must be demonstrated to comply with the MDR since 26 May 2021, as the revised transition provisions do not apply to these devices.
• Medical devices that did not require the involvement of a notified body on the basis of the MDD/AIMDD – but do so on the basis of the MDR and for which the manufacturer prepared a declaration of conformity before 26 May 2021 – may continue to be placed on the EEA market until 31 December 2028.
• Medical devices covered by CE certificates of conformity issued by a notified body on the basis of the MDD/AIMDD between 25 May 2017 and 26 May 2021 that remain valid on 26 May 2021 may be placed on the EEA market until 31 December 2027 or 31 December 2028 at the latest, depending on the risk class of the device.
• CE certificates of conformity issued by notified bodies remain valid until either 31 December 2027 or 31 December 2028, unless the certificate is withdrawn sooner by the notified body.

To benefit from the extended deadlines for which the revisions to the MDR and IVDR provide, manufacturers must apply to a notified body for a conformity assessment before 26 May 2024. In addition, manufacturers must sign an agreement with the notified body in relation to conduct of the conformity assessment by 26 September 2024. Manufacturers may use a self-declaration as evidence of the application and agreement related to the conformity assessment process, and this may be supported by a confirmation letter from the notified body. However, manufacturers also may provide such evidence through other means. There must be no significant changes in the design or intended purpose of medical devices benefitting from the extended deadlines.

Implications of revised IVDR

In the factsheet, the European Commission notes that:

• For IVDs that do not require the involvement of a notified body for a conformity assessment on the basis of the IVDR, such as Class A non-sterile IVDs, compliance with the IVDR has been required since 26 May 2022, and the revised transition provisions do not apply to these devices.
• New IVDs not previously covered by a CE certificate of conformity issued by a notified body on the basis of the IVDD or a declaration of conformity prepared on the basis of the IVDD also must already be demonstrated to comply with the IVDR since 26 May 2022, so the revised transition provisions do not apply to these devices.
• CE certificates of conformity issued by a notified body on the basis of the IVDD after 25 May 2017 or in accordance with Annex VI to the IVDD before 25 May 2017, and IVDs covered by such CE certificates of conformity, remain valid until the sooner of the end of the period on the certificate or 27 May 2025.
• IVDs in relation to which the involvement of a notified body in a conformity assessment based on the IVDD was unnecessary – but in relation to which notified body intervention will be required on the basis of the IVDR, and for which the manufacturer has drawn up a declaration of conformity before 26 May 2022 – may continue to be placed on the EEA market until the end of a specified transition period, based on the risk class of the IVD.

To benefit from the extended deadlines, there must be no significant changes in the design or intended purpose of the IVD.

However, medical devices are not among the categories of products concerned by the indefinite recognition of CE marking. Instead, the UK government has been working to introduce regulations to substantially reform the current regulatory framework governing medical devices in the UK. The future UK regime for medical devices is expected to apply from 1 July 2025.

In the meantime, the UK government has amended the Medical Device Regulations 2002, SI 2002 No 618, as amended, (UK MDR) to extend the recognition of CE marked medical devices in Great Britain for a limited period. The amendments provide transitional arrangements to minimize disruption to the supply of medical devices in Great Britain. The amendments also provide that CE marks will cease to be recognized in Great Britain on 30 June 2030, at the latest. Shorter deadlines may apply depending on the regulatory framework on the basis of which the CE mark is affixed and the classification of the medical devices. In addition, CE marks may cease to have effect before the deadlines established in the amended UK MDR – if CE Certificates of Conformity expire, or if related application of European Union law renders the CE Certificates of Conformity invalid at an earlier date. Accordingly, CE marked medical devices can be placed on the Great Britain market until the following deadlines.  

The UK government has launched a public consultation on the reforms, which is open until 24 October 2023. This may be the only chance to comment on some of these proposals, so we encourage stakeholders to provide feedback. Read on for our analysis on the key emerging issues and likely next steps.

Headlines

Key proposals include:

• Mandatory incident reporting.
• A new defined role of ‘online marketplace’ with its own set of specific duties.
• An increase in the level of consumer-facing information to be provided for online listings.
• The introduction of voluntary e-labelling.
• Direct penalty powers for enforcement authorities without needing to bring a prosecution.
• A review of the UK product liability regime.
• Radically, a move away from the existing product safety framework (derived from European Union rules) to a new cross-cutting, hazard-based approach.

Expected aspects

Some aspects of these proposals were very much expected. Wide-ranging reforms are already underway in the EU to bring existing rules up to date with new technologies and new market conditions.   UK product safety rules are largely derived from EU laws, and the UK is facing many of the same issues. However, since Brexit, the UK was at risk of falling behind. So, it is not surprising that some of the proposals have a familiar ring to them, when we consider what is already underway in Europe, such as around the themes of enhanced consumer protection and increased regulation of new technologies and sales models, including ecommerce.   It remains to be seen to what extent the UK government will end up choosing to align with the EU approaches that companies generally would welcome, or whether divergence will be the ultimate theme. As we explained in a previous blog post, the announcement on 1 August 2023 regarding indefinite recognition of the CE mark indicates that this is still very much a live discussion, the outcome of which is hard to predict.

Stricter regulation of online sales

The targeting of ecommerce for greater regulation was especially anticipated. It is a general global theme that those enforcing legislation recognise that the law has not kept pace with technology and, therefore, may not adequately (to their minds) reflect the role ecommerce now plays in supplying products to consumers. The UK government has been particularly vocal about that, so it is not surprising to see proposals for new duties for online marketplaces. The proposed duties include:

• Cooperating with enforcement authorities to provide information and take appropriate actions if products are unsafe or noncompliant.
• Establishing a compliance function in the UK.
• Collecting – and taking reasonable steps to verify – information about third-party sellers of high-risk products.
• Keeping track of the UK government’s Product Recalls and Alerts page, monitoring their marketplaces for products which reasonably look to be an identical or ‘very similar’ product, and taking ‘appropriate action’.
• Gathering information about products and sellers which could indicate a product is unsafe – together with information from enforcement authorities to regularly assess which products warrant greater due diligence – and taking targeted action accordingly.

The consultation seeks to justify the new proposals by explaining that they are designed to ensure consumers are protected whilst minimising the burden on businesses. However, the reality is, if all of these proposals make it into finalised legislation, online marketplaces will be subject to additional burdens, and the risk is that the cost will be passed back to sellers and consumers.

Greater enforcement powers and more data-sharing

Another unsurprising theme is that of enhanced enforcement powers for the Office for Product Safety and Standards (OPSS) and data-sharing with proposals that would enhance its leadership and coordination role. This would see OPSS receiving notices of recalls and other corrective actions, as opposed to Trading Standards, and consolidate existing enforcement legislation. OPSS also would receive new serious incident reports (see ‘The surprises’ section below). Whilst OPSS has been in place for five years, the majority of enforcement of product safety laws has remained at the local level with Trading Standards.   What we see proposed now marks a potential shift away from the local level to more national enforcement for certain matters. In addition, there are proposals for new enforcement powers generally including improvement notices, civil monetary penalties without the need for prosecution through the courts and enforcement undertakings.

E-labelling

Finally, we already knew that e-labelling would very likely be contained in the proposals – the government previously indicated it was looking to implement digital labelling sooner as a ‘quick win’. The reality of this proposal is that it is limited in scope – applying only to manufacturer details and UK Conformity Assessed (UKCA) marking, not importer details and other marks –and therefore, arguably, of limited impact.

Surprises

Restructuring the whole framework

What is especially interesting, and perhaps more concerning, is the proposal that some of the fundamental structures of the existing regime be abandoned and replaced. The UK government has said, in addition to ‘streamlining’ the existing framework, ‘we also propose to carefully consider a move away from the current multiplicity of regulation towards a cost-cutting hazard-based framework underpinned by risk assessment, using standards and effective guidance to ensure agility and flexibility in an ever-changing market’.   The consultation explains that any new framework could include:

• Categorisation of products by their hazards, rather than, for example, by sector – falling into one of several defined risk levels.
• A cross-cutting approach for pre-market requirements across all product types of a similar risk level – with differing levels of requirements (marking, conformity assessment, etc.) applying according to risk level.
• Guidance to provide additional detail on the application of the essential safety requirements and more detailed product-specific rules, and to support businesses to undertake proportionate pre-market risk assessments.
• The role of standards and the presumption of conformity also may be examined.

It is not entirely clear exactly what this proposal means, but we can predict that a fundamental departure from the well-established structure of product regulation in Europe will not prove to reduce costs for most product manufacturers, given that they will be producing products for multiple markets, but will rather add cost and confusion.

Mandatory incident reporting

The UK government has proposed introducing mandatory incident reporting for product-related incidents. Whilst similar requirements are being introduced in the EU under the new General Product Safety Regulation, this obligation is not consistent with the UK’s stated intention to reduce the regulatory burden for businesses. In that regard, the threshold for reporting will be key, and it is positive that the consultation is proposing to target only incidents resulting in deaths, injuries requiring an overnight stay in hospital or fires. However, there remain many issues to iron out, including verification of reports, as well as establishing the deadlines and triggers for reporting. In any event, it would be a significant change to the current risk-based model.

Short summary of the proposals

The 13 proposals are summarised below.

Proposal 1

This suggests a new approach centred around potential hazards, cross-cutting, risk-based safety requirements and transparency. It is a rethinking of the current product safety legislative landscape to, at a minimum, streamline the current framework to reduce duplication and inconsistences – and potentially move more radically towards a different cross-cutting framework categorising products by hazards and risk levels, with requirements applying according to risk level.

Proposal 2

This establishes a derogation process, enabling businesses to apply for temporary regulatory easements to seep up supply of essential products in emergencies. It appears to be a relatively narrow innovation, prompted by specific difficulties encountered during the COVID-19 pandemic.

Proposal 3

This introduces digital labelling – allowing e-labelling for the UKCA mark and manufacturer details – but for the reasons set out above, it would have limited scope.

Proposal 4

This proposes new duties for online business models, particularly online marketplaces (cooperation duties). It defines a new role for ‘online marketplace’, with specific duties distinct from the manufacturer, importer and distributor. Duties could include a requirement to cooperate with enforcement authorities to provide information and to take appropriate actions if products are unsafe or noncompliant, as well as a duty to have a compliance function established in the UK.

Proposal 5

This proposes duties for online marketplaces to take certain due care requirements in relation to unsafe product listings. It includes a range of duties that online marketplaces would be expected to take to help prevent listing and relisting of unsafe or noncompliant products – including collecting information about third parties for high-risk products, monitoring the UK government’s Product Recalls and Alerts page, and taking action in relation to any identical or similar products on their marketplaces, gathering information about products and sellers which could indicate a product is unsafe, and taking action accordingly in relation to listings which ‘reasonably look like’ they could be advertising noncompliant or unsafe products.

Proposal 6

This increases consumer-facing information on online product listings to support informed purchasing decisions for higher-risk products. It comprises information that ordinarily would be on product packaging – or provided on or with the product – within the online offer, including traceability information.

Proposals 5 (part of), 7, 8, 9 (part of), 10, 11 and 12

These proposals enhance (collectively) enforcement powers and data-sharing. They include a broad range of suggestions around enhancing the leadership and coordination role of OPSS, facilitating data-sharing, notification of recalls and incidents to OPSS (as opposed to local authorities), consolidating enforcement legislation, granting new powers to directly sanction without prosecution through the courts, and giving inspection powers extended to home working.

Proposal 9

This introduces mandatory incident reporting in the UK for product-related incidents. The potential threshold flagged for discussion in the consultation is incidents resulting in deaths, injuries requiring an overnight stay in hospital or fires.

Proposal 13

This proposes reviewing the product liability regime in light of technological developments. It covers the UK’s strict liability framework under the Consumer Protection Act 1987, and the focus includes whether changes are required to deal with perceived risks arising from software updates, artificial intelligence and online sales.

Next steps and timing

The consultation is open until 24 October 2023 and is a really important opportunity for industry to have its say on these potential reforms. It may be the only opportunity to provide feedback on some of the issues.   Please reach out to our team if you have any questions or would like assistance preparing feedback.

Where to find out more

• UK government press release
• UK government webpage with a link to a PDF of the consultation document
• Online consultation questionnaire

The press release does not contain full details about how this will apply. For example, it is unclear whether businesses will be required to choose either the CE or UKCA mark or whether both can be used. Moreover, it is not yet clear what approach the UK government is proposing where UK product safety requirements do not align with European Union requirements. Where there is divergence, a CE mark will not be equivalent to a UKCA mark, so it is unclear how a CE mark could be accepted by UK authorities. In practice, the continued recognition of CE marking will only work effectively if there also is a broader intention to not depart from EU product safety rules – which would effectively mean the UK is giving up its ability to set its own safety rules post-Brexit.  

The next step is for the UK government to table draft legislation to enact these changes and update guidance, which should provide further clarification on the ongoing requirements. We will continue to monitor the position and will blog about any updates  

The announcement applies to the following 18 product categories under the remit of the Department for Business and Trade:

• Toys
• Pyrotechnics
• Recreational craft and personal watercraft
• Simple pressure vessels
• Electromagnetic compatibility
• Non-automatic weighing instruments
• Measuring instruments
• Measuring container bottles
• Lifts
• Equipment for potentially explosive atmospheres (ATEX)
• Radio equipment
• Pressure equipment
• Personal protective equipment (PPE)
• Gas appliances
• Machinery
• Equipment for use outdoors
• Aerosols
• Low-voltage electrical equipment
  

According to updates made to guidance, there are separate plans to be communicated for certain other products – such as medical devices, construction products, unmanned aircraft systems, marine equipment and ecodesign (among others). We also will monitor these changes and blog about updates in due course.  

Please get in touch with any member of the Cooley products team if you have any questions regarding the announcement or about how this development may impact your business.      

What is the European Parliament’s position?

The European Parliament states that its negotiating mandate ‘strengthens the measures proposed by the Commission to ensure longer product lifespans and better-informed consumers’. Amongst other things, the European Parliament’s proposal:

• Identifies certain high-impact product groups to be prioritised when setting new ecodesign requirements – including textiles, iron, steel, aluminium, furniture, tyres, paints and chemicals.
• Introduces a specific ban on destroying unsold textiles, footwear and EEE. This ban would be applicable for one year after the ESPR enters into force. This goes further than the European Commission’s proposal which only required information on the destruction of unsold consumer products to be published and stated that any bans on the destruction of unsold consumer goods could be introduced later via secondary legislation. It also goes further than the European Council’s position which, although it proposed a ban, would only apply to apparel or clothing accessories (not to footwear and EEE) and included a three-year transition period, rather than the one-year period proposed by the European Parliament.
• Introduces a ban on premature obsolescence, prohibiting manufacturers from limiting a product’s lifetime via design features.

Although many green organisations were happy with the European Parliament’s position, some environmental campaigners and policy organisations were disappointed that it failed to address the risks of noncompliant products sold via online marketplaces. Given the focus on products sold via online marketplaces in other pieces of legislation (e.g., the recently adopted General Product Safety Regulation), we would not be surprised if this is raised again during the negotiations.

What are next steps?

As the European Parliament and Council have now defined their respective negotiating positions, the ‘trilogue’ negotiations will begin shortly, during which the European Parliament and Council will seek to finalise and adopt the law. Although the length of time it takes for trilogue negotiations to conclude can vary, we estimate that the ESPR will be adopted at some point before the end of 2023, with the rules applied to specific product groups via delegated acts starting to apply in 2025 or 2026.

Key documents

• European Commission’s proposal
• European Parliament’s negotiating mandate
• European Council’s negotiating mandate
• European Parliament’s press release

As a reminder, key new measures introduced by the Batteries Regulation include:

• Products containing portable batteries must be designed so the batteries can be readily removed and replaced by end users during the lifetime of the product. This requirement will apply to the batteries in most consumer electronic products, subject to a few, very narrow, exemptions. It will mean, for example:
  • End users must be able to remove batteries with commercially available tools (e.g., standard screwdrivers) or tools provided with the product.
  • The use of heat or solvents to remove and replace batteries will not be allowed, which means many existing battery designs that rely on adhesives will not be permitted.
• Batteries will need to be CE marked and comply with new labelling requirements, including a QR code linked to information online.
• Spare batteries must be available for purchase at a ‘reasonable and non-discriminatory price’ for five years after the last unit of a battery is placed on the market.
• The use of certain substances is banned, and portable batteries of general use (e.g., AA, AAA, etc.) will need to comply with electrochemical performance requirements.
• Businesses will need to implement new requirements for supply chain diligence, including having supply chain diligence policies audited by a notified body and making information available to consumers about their supply chains.

For more information, please refer to our previous blog post summarising the regulation text. If you would like to discuss the possible effects of these changes on your products, feel free to reach out to the Cooley team.

Sponsor role in contracting service providers for trial-related tasks

In clinical trials, the investigator carries the responsibility of protecting the rights and welfare of trial subjects. However, in DCTs, trial activities are conducted remotely, implying a leading role for sponsors in related contracting services. The update acknowledges this reality, but stresses that the separation of the respective responsibilities of sponsors and investigators must be safeguarded. Their division of roles is elaborated in the Head of Medicines Agencies’ Recommendation Paper on Decentralized Elements in Clinical Trials. Accordingly, the update provides that the following conditions must be respected where sponsors identify or contract with service providers for trial-related tasks that are the responsibility of the investigator:

• There must be compliance with the applicable EU laws and the requirements of the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use E6 guideline.
• The investigator retains the final decision on whether the service provider is appropriate, their supervision and ultimate responsibility for tasks involving trial-related medical decisions.
• A written agreement should be concluded between the sponsor and the service provider.
• The written agreement between the sponsor and service provider, as well as that between the sponsor and investigator, should clearly state that the investigator maintains adequate control and oversight over the tasks contracted by the sponsor.
• As a general principle, whenever agreements are concluded with service providers, a clear division should be maintained between tasks that are mutually exclusive or that lead to potential conflicts of interest (e.g., issues may arise when the service provider performs both the quality control function and the related task, or when the service provider performs tasks for the investigator and the sponsor even though independence in the tasks is required).

Productivity software

Productivity software is used in clinical trials to support the conduct of clinical trial processes and to record, track, and evaluate events that occur as part of a trial. However, the data generated often lacks traceability, as well as the means to attribute entries and changes. The updated Q&A proposes risk evaluation and, where appropriate, mitigation measures to offset these common shortcomings in areas where data integrity principles apply and prevent negative impacts to the risk-benefit balance of the clinical trial. Mitigation measures to ensure attributability and traceability may include, for example, additional programs or customizations that compensate for application deficiencies, restrictions on the use of the software itself or additional controls in the application environment.

When identifying clinical trial sites, sponsors should assess the impact of the sites’ use of productivity on the safety and integrity of data, as well as the safety and rights of potential clinical trial participants. If the sponsor identifies deficiencies, the site should only be selected if the shortcomings are appropriately justified, and the related risks are mitigated.

The updated Q&A specifies that productivity applications permitting specific configurations and customization of software functions should be subject to validation before use. The appropriate level of validation will depend on the use case and the corresponding risk that may be associated with the process. In addition, any modification of a productivity application should be performed only by qualified and trained personnel. Specific configurations and customizations of productivity application also should be taken into account in the clinical trial archiving strategy.

As a result, the suitability of the use of a productivity application should be assessed and determined on a case-by-case basis in light of the specificities of a clinical trial. To allow competent authorities to assess the appropriateness of mitigation measures, the use of productivity applications requiring mitigation measures, and the adopted mitigation measures, should be detailed and justified in the clinical study report.

Direct remote access

Direct remote access concerns access to data from an access point that is not under the control and supervision of the clinical trial investigator or site. This provides sponsor-appointed trial monitors or regulatory inspectors with remote access to identifiable personal and health data of clinical trial participants. The updated Q&A provides important considerations concerning direct remote access, in addition to national provisions on direct remote access. The considerations include:

1. Informed consent of patients relating to any direct remote access to their confidential health records.
2. The requirements provided in Annex 1 to the Clinical Trials Regulation regarding the content of the clinical trial protocol.
3. Other technical considerations to identify and manage risks associated with accessing or viewing documents remotely.

Authors

Elizabeth Anne Wright

Jessica Lauren Koffel

Alix Vermulst

The General Product Safety Regulation was published in the Official Journal on 23rd May 2023, setting the clock running on the implementation of the widespread reforms these laws will bring.  The Regulation enters into force 20 days from today, with a transition period that will see its provisions applying in full as of 13 December 2024.  For most product manufacturers and distributors, there will be adjustments to be made to ensure compliance, and the end of next year could come around quickly for some.  It’s time to start getting ready.

These laws have been a long time in the making, and represent a significant achievement for the team at the European Commission responsible for getting this over the line. Its measures will change many aspects of consumer product regulation in Europe, and some of the more novel provisions will surely be influential for reforms in other sectors, and in other parts of the world.

Link to the new text can be found here:

Regulation (EU) 2023/988 of the European Parliament and of the Council

More analysis to follow. Get in touch with any member of the Cooley Products Law team if you have any questions.

Background

After significant delays, the UK government has introduced draft legislation representing a major shift in digital, competition and consumer protection regulation. The wide-ranging reforms contained in the bill will significantly strengthen the powers and remit of the UK’s antitrust regulator, the Competition and Markets Authority (CMA).

The bill reflects the intention of the UK government for the CMA to have a much broader and more robust toolkit of competition, digital regulatory and consumer protection powers from which it can take forward enforcement action in digital markets and intervene to protect consumers. The legislation would see consumer rights infringement afforded a much higher platform in terms of enforcement, more akin to how we see competition infringement dealt with.

Key competition and digital markets elements of the bill

Large digital companies with UK activities will be subject to new digital markets regulatory framework

The CMA will have the power to designate companies engaging in the provision of internet services and digital content in the UK as having strategic market status (SMS). Only those companies designated as having SMS will be subject to the digital markets regime.

SMS designations will be determined by the CMA according to whether a company has substantial and entrenched market power, a position of strategic significance in the market and a turnover exceeding £25 billion globally or £1 billion in the UK.

The approach is similar to that adopted by the EU in the Digital Markets Act (DMA). That is, the focus of the new regulatory regime is on large digital companies with strong market positions. As such, many firms in the digital sector will face no new compliance obligations

The regime will require the CMA to conduct a formal evaluation process to determine who should be designated as having SMS. However, the tests and approach used to determine those companies with SMS differ from those of the EU. Whilst there will be commonality between the two regimes, it is possible that there may be some differences between the companies subject to regulation in the UK and EU.

Each designated SMS firm will be subject to its own bespoke set of obligations focused on three core principles of fair dealing, open choice, and trust and transparency

There is no one-size-fits-all approach taken in the bill in respect of the obligations each designated SMS firm will be subject to (as is the case under the EU’s DMA). Rather, each company will be subject to requirements that are appropriate to its activities, position in the market and potential CMA concerns. The UK government considers this provides more flexibility and will enhance the effectiveness of the regime.

For SMS firms, the CMA will have the power to select appropriate “conduct requirements” to achieve one or more of the following objectives:

• Fair dealing to ensure fair treatment of users and potential users.
• Open choice to enable free and easy choices for users and potential users between the services and content offered by designated undertakings and those offered by other companies.
• Trust and transparency to ensure those using or seeking to use services or content provided by designated companies have the information they need to inform their decision-making.

Conduct requirements, which will be of relevance to all third parties who deal with SMS firms, will either oblige the SMS firm to take certain actions (for example, requirements to provide clear and accessible information to users) or to avoid certain actions and behaviours (for example, the prevention of discriminatory terms, conditions or policies).

SMS firms will be required to provide the CMA with compliance reports explaining how they are complying with the requirements. There also will be obligations on each SMS firm to appoint compliance officers to take responsibility for complying with the conduct requirements.

Proposed reforms will give CMA significantly expanded toolkit to use in digital markets

The CMA will also have the power to make “pro-competitive interventions” in relation to SMS firms, designed to address any factors that the CMA identifies, after an investigation, as having an adverse effect on competition. These powers are potentially wide-ranging and intrusive, including the power to order structural remedies and divestments against SMS firms.

The bill provides for the use of a final offer mechanism that will act as a backstop tool to enforce conduct requirements to offer fair and reasonable payment terms. This will enable the CMA to require the SMS firm and an invited third party to submit what they consider to be fair payment terms for a proposed transaction, and the CMA will make a determination.

In addition, the CMA will have robust enforcement powers. The CMA will be able to impose fines of up to 10% of global turnover for breaches of the conduct requirements, along with daily fines of up to 5% of global turnover for continued breaches.

But, more generally, the draft legislation will provide the CMA with a choice – whether to use its normal competition law powers or its digital regulatory powers when taking forward enforcement action in the digital space. As such, we can expect to see greater regulatory activity.

CMA is widening net of reviewable mergers, including in tech sector

The bill proposes an additional merger control threshold allowing the CMA to review mergers where either party has at least a 33% share of supply or purchases of goods/services in the UK (or a substantial part of it), that party has more than £350 million of turnover in the UK, and a UK nexus test is met with respect to the other party.

The test is designed to close a gap in the current UK merger control regime and more easily enable the CMA to intervene in mergers where there may not be any clear competitive overlap between the parties, and/or where the target is particularly small but is being acquired by a purchaser with a sizeable market position. The UK nexus requirement, however, suggests that the CMA’s jurisdiction will not automatically extend to acquisitions of targets that have not yet commercialised any products – to the extent that the target’s activities are fully conducted outside of the UK.

Whilst this change will apply to all sectors, a more sector-targeted proposal is the requirement for all SMS firms and their groups to report to the CMA all acquisitions worth at least £25 million, where such acquisitions involve passing an equity or voting gateway of 15%, 25% or 50% (including joint ventures), and the transaction has a UK nexus. The SMS firm will not be able to close the transaction until the expiry of a five-day waiting period, which starts once the CMA has confirmed that the report provided is complete. This change will give the CMA better knowledge of the investment activities of SMS firms, as well as providing it the opportunity to “call-in” and review investments and acquisitions using its existing powers, if desired. The requirement is similar to one included in the EU’s DMA, pursuant to which gatekeepers must report all planned acquisitions to the European Commission before completion.

Key consumer rights elements of the bill

UK consumers have an existing set of statutory rights to enforce consumer law, but research carried out by the Department of Business, Energy and Industrial Strategy (replaced now by the Department for Business and Trade) identified various weaknesses that needed to be remedied (see the Consumer Protection Study 2022).

The research suggested that consumers are losing out on £54.2 billion a year from unresolved disputes with traders, and that enforcement action is slow, lengthening the time it takes for consumers to receive redress. There also is little to deter traders from breaching consumer protection law. Unlike the other countries in the G7, the UK is the only country not to have civil penalties for common consumer protection breaches.

Bill introduces extensive new enforcement powers for breaches of consumer protection law, including aggressive fining powers

The bill proposes to significantly strengthen the enforcement of consumer protection law by introducing new penalty powers for the civil courts, along with out-of-court powers for the CMA to determine and sanction breaches of certain consumer laws.

• Bolstering the powers of civil courts: The bill will provide civil courts with new powers to impose civil monetary penalties for breaches of consumer protection law. Authorities, such as the CMA and local authority trading standards, will be able to apply to the courts to impose penalties of up to £300,000, or 10% of the total value of a business’ global turnover, whichever is higher.
• New administrative powers for the CMA: The bill introduces an administrative model for consumer protection law enforcement, allowing the CMA to determine if certain consumer laws have been breached and impose monetary penalties (up to 10% of the total value of a business’ global turnover), without having to go through the courts. This will mirror the CMA’s existing competition enforcement powers.
• The CMA also will have additional investigative powers to gather evidence, impose higher penalties for failure to comply with investigative requirements (e.g. failing to comply with information notices or providing false or misleading information), and levy penalties based on business turnover for noncompliance with CMA orders, undertakings and accepted commitments.
• The intention for these powers is to enable the CMA to act faster and take on more cases to safeguard the interests of consumers and create a level playing field for compliant businesses.  

Bill introduces enhanced and expanded consumer rights

The bill revokes the Consumer Protection from Unfair Trading (CPUT) Regulations 2008 (which is the UK’s implementation of the EU’s Unfair Commercial Practices Directive). That said, these regulations are not going anywhere, as the bill largely recreates the prohibitions of unfair commercial practices (e.g., misleading actions, omissions and aggressive practices) set out in the CPUT Regulations, with the same objective of preventing harm to the collective interests of consumers.

New measures are proposed to regulate consumer saving schemes and to protect consumers from inertia selling (the sending of unsolicited goods to potential customers in the hope of making a sale) and entering into subscription traps.

Consumer-related proposals will lead to increased enforcement and shift in compliance focus

The CMA’s broader investigative powers and ability to impose higher, turnover-based penalties for failure to comply with its information notices, orders, undertakings and commitments means that businesses should examine their processes to ensure they are robust enough to allow for a prompt response to CMA requests for information – and for the business to remain compliant with any undertakings, orders or commitments.

Further, the CMA’s administrative powers to determine breaches of consumer law and impose significant turnover-based fines without having to go to court will likely result in a significant increase in CMA consumer law enforcement. Whilst the bill does provide for a merits-based appeal of the CMA’s enforcement decisions, the explanatory notes to the bill suggest that a court should interfere only if it concludes that the decision is wrong ‘in a material respect’. As a result, businesses should carefully review their consumer-facing communications and practices to ensure they are found compliant under the new regime.

Recently, the CMA has focused on online choice architecture, with the aim of tackling potentially harmful online selling practices to UK consumers. On 29 March 2023, the CMA wrote an open letter to online businesses in the UK, setting out its compliance advice in relation to urgency and price reduction claims in digital retail spaces. In view of the significant expansion of the CMA’s enforcement powers, businesses should ensure that their online choice architecture and selling practices are compliant with the CMA’s advice in this area.

Next steps

The bill has begun the legislative process and, subject to the parliamentary timetable, is expected to come into force in spring 2024.

If you would like assistance in assessing the impact of the new bill on your business, please contact a member of the Cooley team.

This blog was authored by Caroline Hobson, Claire Temple, Christine Graham, Anna Caro, and Anushi Amin.

On 19 April 2023, the European Parliament formally approved a new European Union Deforestation Regulation on commodities and products associated with deforestation and forest degradation. The new Deforestation Regulation will impact companies selling products or packaging in or exporting them outside the EU if they contain certain commodities, including wood and rubber. The text that has been approved by the Parliament is unlikely to change before it becomes law.

Below, we’ve explained the main requirements of the Deforestation Regulation.

Background

The European Commission proposed the Deforestation Regulation in 2021 to address deforestation and forest degradation in Europe and globally. It has now been agreed upon by the Council of the EU and the Parliament, and formally approved by the Parliament. The Deforestation Regulation will replace the existing EU Timber Regulation 995/2010.

To whom and what does it apply?

The Deforestation Regulation will apply to any person or company marketing specific products in the EU or exporting them from the EU if the products contain, have been fed with or have been made using any of the following commodities:

1. Cattle
2. Cocoa
3. Coffee
4. Palm oil
5. Rubber
6. Soya
7. Wood

Examples of such products include wood packaging (such as cases, boxes and crates), tableware, kitchenware and furniture; clothing and clothing accessories made with vulcanized rubber and articles of hard rubber; and printed books, newspapers, pictures and other printing industry products, such as leaflets and brochures.

What is it about?

The Deforestation Regulation will introduce, among others, the following requirements:

• Operators are banned from placing on the EU market and exporting from the EU products containing, fed with or made using the relevant commodities that:
• Are not deforestation-free.
• Have not been produced in accordance with the relevant legislation of the country of production.
• Are not covered by a due diligence statement.
• Operators must carry out due diligence for in-scope products and commodities to determine whether they are deforestation-free and have been produced in accordance with relevant legislation in the country of production.
• Operators must submit a due diligence statement to the competent national authorities before placing the products on the EU market or exporting them out of the EU.
• Competent authorities in Member States can ask operators to take corrective measures, including preventing the sale or distribution in the EU of relevant commodities and products; product withdrawal, recall and/or destruction; or measures requiring them to donate to charitable or public interest entities.
• Competent authorities also can impose sanctions, including fines, confiscation of products and revenues, and temporary prohibition from placing on the EU market or exporting from the EU in-scope products.
• Third parties (e.g., nongovernmental organisations, competitors and consumers) can submit substantiated concerns to the competent authorities when they believe that operators do not comply with the Regulation, and the competent authorities will be required to assess the concerns.

What is the anticipated timeline?

The Parliament approved the agreed text of the Deforestation Regulation at its plenary session on 19 April, 2023. The text now will pass to the EU Council for formal approval (usually a rubber-stamping exercise) and then will be published in the Official Journal of the European Union (OJEU).

The Deforestation Regulation will enter into force 20 days after it is published in the OJEU, and the obligations set out in the Regulation will be enforceable 18 months later. We anticipate that the requirements will become applicable by Q1 2025. Microenterprises and small enterprises will have a longer period of 24 months to comply with the new rules.

Why does it matter?

The Deforestation Regulation will have a significant impact on businesses marketing a broad variety of products in the EU or exporting those products outside the EU, and it will require them to undertake due diligence in order to comply with the new rules. Companies will need to ensure that they carry out the relevant due diligence and submit the statements to authorities before they market products impacted by the new Regulation. For product manufacturers, this likely will involve more in-depth quality control with their suppliers. This is part of a broader trend we are seeing of the EU adopting rules that push companies to do more due diligence and have a better handle on their supply chains. For example, similar requirements are included in the upcoming EU Batteries Regulation, the upcoming ban on products made with forced labour and the Corporate Sustainability Due Diligence Directive.

Where can I find it?

The EU Council posted the text of the provisional agreement it reached with the Parliament in December

What’s being proposed?

The proposed R2R Directive focusses on the post-sale stage of a product’s lifecycle and sits alongside other legislative proposals currently working their way through the EU legislative procedure, including: (1) the proposed Ecodesign for Sustainable Products Regulation focussed on the production phase; and (2) proposed Directive on Empowering Consumers in the Green Transition focussed on providing information at the pre-sale phase (see our blog here). Taken together, these are intended to establish the so-called right-to-repair in the EU.

The proposed R2R Directive takes a multi-pronged approach:

• Repair remedy against retailers within the SGD legal guarantee: a consumer can seek a remedy from the retailer where a product is not in conformity with the contract of sale under the legal guarantee established by the SGD. Under the current rules, the consumer can choose between a repair or a replacement. The proposed R2R Directive would amend the SGD to make repair the default option. There are a few important points to note:
  • Scope of products: the amendment would apply to all products subject to the legal guarantee under the SGD, which includes all tangible products, including those with digital elements (so that extends to digital content or digital services incorporated or interconnected with goods in a way that their absence would prevent the good from performing its function).
  • Responsibility for repair: the repair obligation would apply to the retailer, not the manufacturer. That has the potential to lead to practical difficulties where the retailer is a third party and is not in a position to carry out repairs: for example, because they do not have access to spare parts, proprietary tools or detailed product repair manuals. Given these barriers, retailers may seek to offer replacements in lieu of repairs, wherever possible, and reallocate repair obligations to manufacturers under supply contracts, where replacement is not possible.
  • Potential exemption: a repair does not need to be offered if it is more expensive than a replacement. This is a potentially useful exemption, which should guard against imposing repair obligations where costs are disproportionate. However, it is currently unclear how repair costs should be calculated. That’s important because the calculation could vary significantly depending on whether, for example, costs of repair just cover components and repair time, or if they extend to other costs – such as the administration of processing repairs, the cost of retrieving a product, or even the cost of establishing a repair program where one does not exist already. If a broad approach is taken to the calculation, then replacement may be a more proportionate remedy in many cases.

• Repair remedy against producers outside of the legal guarantee: in addition to the repair remedy against retailers, the R2R Directive would establish a new obligation on the producer to repair certain defects upon request by a consumer where the legal guarantee does not apply (for example, where it has expired or the damage is excluded (e.g. accidental damage)). Key aspects of this new obligation include:
  • Scope of products:  this new obligation would apply to products covered by repairability obligations under certain EU laws listed in a proposed Annex – which currently lists certain ecodesign regulations applying to white goods (including household washing machines, household dishwashers and fridges), electronic displays and mobile phones and tablets (among others). However, as the scope of products for ecodesign is broadened, we should expect that the scope of products should broaden here as well.
  • Scope of repairs: the types of repairs correspond to the repairability requirements under the relevant EU laws listed in the Annex (e.g. the components covered and the periods of time that spare parts need to be available etc.).
  • The producer can charge a cost to carry out the repair: as currently drafted, there is no “reasonableness” requirement. The explanatory memorandum notes that where the “producer repairs against a price, such repair services could become an additional source of revenue and the producer would have an interest to reach an agreement on the price with the consumer in order to conclude a contract. The competitive pressure from other repair actors are likely to keep the price acceptable for the consumer. The producer may also have an interest to perform the obligation for free as part of a commercial guarantee on durability of its products”.
  • Exemption where the repair would be impossible: the Recitals note this would apply where repair would be factually or legally impossible, and indicate that purely economic reasons (such as the costs of spare parts) may not be a sufficient reason. The Q&A document also gives the example of where products are damaged in a manner in which repair is technically impossible.
  • The producer can sub-contract the repair: the proposal expressly allows this.
  • New requirements to provide consumers with certain information: about the existence of the producer’s obligation to repair and on repair services.  
  • Where the producer is located outside of the EU, the obligation to repair is to be carried out by other entities in the EU: in order of priority, the authorised representative (if there is one), the importer (if there is no authorised representative), or the distributor (where there is no importer and no authorised representative in the EU).

• New obligations for repairers and Member States: to make it easier for consumers to access repair services. These include:
  • Standardised European Repair Information Form: required to be provided by repairers to consumers when they request a repair. The aim is to bring transparency to repair conditions and price, and make it easier for consumers to compare repair offers. The conditions offered for the repair in the form (e.g. the price) cannot be changed for 30 days (unless agreed otherwise).
  • Online matchmaking repair platform: to be set up by Member States to make it easier for consumers to find repairers, retailers of refurbished goods and purchasers of defective goods to be refurbished, and to request completed European Repair Information Forms (among other things).

Alongside the proposed new rules, the Commission will also facilitate development of a voluntary European quality standard for repair services. One of the aims is to help consumers identify repairers that have committed to meet certain repair standards.  

Why does this matter?

1. The proposal is designed to change market practice is Europe. The Commission wants to extend product lifecycles and end what it perceives to be a “throwaway” culture of consumer goods by ensuring that, when products go wrong, repair will be the norm. Whilst there are clear environmental benefits to such an approach, these need to be balanced against product safety and liability considerations, especially in circumstances where repairs are being carried out by third parties.
2. Businesses in scope of the new obligations need to plan how they will comply. This is likely to require considering how products are designed for repair, revisiting supply contracts to address provisions for repair, strategic planning to ensure spare parts are available and putting in place procedures for how repairs are carried out – for example, whether to offer repairs in-house or through a network of independent repairers.  
3. There is an increased class action risk. The legislation would be added into scope of the new Representative Actions Directive that would enable class action style claims where the new obligations have not been complied with. In our view, it’s very likely we’ll see class actions in relation to right to repair. We’ve already seen regulatory enforcement and claims in relation to early obsolescence, which raise similar issues, and there are some very active consumer organisations promoting right to repair who may look to bring test cases. So, we expect to see class actions against organisations who do not meet obligations under right to repair legislation – either following on from regulatory enforcement, or as a means to challenge the approach taken by businesses in the EU (for example, where they prioritise replacement over repair on the basis of cost). This kind of activism is part of the EU’s push to empower consumers to drive the green transition.
4. The new rules could have retrospective effect – applying to products placed on the market before the new-requirements kick-in. The trigger under the new rules is not when a product was placed on the EU market, but rather when the sales contract or the repair contract was concluded. Amendments to the legal guarantee to prioritise repair over replacement would apply to sales contracts concluded after the 24-month transition period ends. The new obligation on producers to repair certain products outside of the legal guarantee would apply to contracts for the provision of repair concluded after the end of the 24-month transition period.
5. Even if a product is not currently in the proposed scope of the new repairability obligation on producers (outside of the legal guarantee), it might be added into scope in the future. The Commission is planning to introduce repairability requirements for a far greater range of products under the proposed Ecodesign for Sustainable Products Regulation (beyond electrical products) and has also indicated that it is planning to add more products into scope of the R2R Directive over the coming years. In addition, amendments to broaden the scope of products could be proposed by the Parliament or Council as the proposed R2R Directive works through the EU legislative process and could be agreed in the final text.

What are the next steps?

The Commission’s legislative proposal is undergoing an 8-week feedback period open to industry, other stakeholders and the public. Feedback currently closes on 25 May 2023. Feedback received during this process is usually published on the Commission’s website and is also summarised by the Commission and presented to the European Council and Parliament to consider as they review the proposal. The proposal will then make its way through the ordinary legislative process involving the Council and Parliament each separately reviewing the proposal before meeting in trilogue negotiations with the Commission to attempt to reach agreement on the final text.

The timing on when the new rules could start to apply depends in part on whether agreement can be reached in trilogue negotiations before the European Parliament elections next year. If provisional agreement can be reached before the elections (which would be a very ambitious timetable), we’d estimate that the new rules could start to apply when the 24-month transition period ends around Q3 / Q4 2026.

Where can I find out more?

• The Commission’s draft legislative proposal is available here
• Q&A document issued by the Commission here
• Press release here
• Feedback can be submitted here

Topics included:

• The European Commission’s proposal for a new Green Claims Directive.
• The proposed Right to Repair Directive.
• The proposed Packaging and Packaging Waste Regulation and the policy framework on biobased, biodegradable and compostable plastics.
• A short update on some of the upcoming initiatives for textiles expected for 2023 as part of the EU’s strategy for sustainable textiles.

A recording of the webinar is accessible here.

The rules governing liability for legal costs in death and personal injury cases in UK courts, are being changed to increase the amount of costs that defendants can recover from unsuccessful claimants. New rules impacting cost recovery will apply for claims issued on or after today’s date, 6 April 2023.

What was the position on QOCS?

In the UK, legal costs associated with a claim are usually paid by the losing party. On 1 April 2013, the “Qualified One-Way Cost Shifting regime (“QOCS”) was introduced as a modification to this approach in death and personal injury claims in order to maintain access to justice. Subject to certain exceptions, if a claimant loses any aspect of the case, any cost awards that are made in favour of the defendant can only be enforced up to the level of any damages and interest awarded to the claimant. Therefore, if the claimant is entirely unsuccessful, the defendant cannot recover any costs.

The impact of the QOCS regime on settlements was subsequently refined via case law:

1. The Court of Appeal ruled that defendants could not recover costs from any settlement reached with the claimant under Part 36 (as a reminder, Part 36 of the English Civil Procedure Rules prescribes rules for making settlement offers with advantageous cost consequences) or a Tomlin Order (a type of Court Order often used to record settlements) (Cartwright v Venduct Engineering Ltd [2018] EWCA Civ 1654); and
   
2. The Supreme Court ruled that a defendant could not set off their costs against a claimant’s costs (Ho v Adelekun [2021] UKSC 43).

As a result, it was almost impossible for defendants to recover their costs if they settled with the claimant.

QOCS was intended to act as a shield against excessive defense costs for genuine, but unsuccessful claimants. However, the Supreme Court has recognized that the rules could be considered “counterintuitive and unfair” in certain circumstances. They were therefore reviewed.

What’s changing?

The new rules provide that defendants can offset their costs against the claimant’s damages, interest, and costs, increasing the pot of money available for applicable defense costs. It also allows all modes of settlement to be QOCS compliant, which will increase the ease of enforcing cost orders against unsuccessful claimants.

What does this mean in practice?

The changes are likely to lead to a significant reassessment of how personal injury claims are handled. We have flagged some key issues below:

1. The changes will affect settlement dynamics and will need to be considered by parties when making offers, accepting or rejecting them. The changes will give claimants more incentive to accept sensible Part 36 offers by the defendant given the increased risk of exposure on costs.
   
2. Interim applications are likely to become more important and could dictate the outcome of cases. In some cases a generous costs order at the interim stage could force the claimant to settle rather than go to court.
   
3. There will also be scope for defendants to recover their costs associated with disputes over costs once the case has settled. This should discourage claimants from taking an unreasonable position on costs.
   
4. After The Event insurance will be an attractive option for some claimants to protect against adverse costs. However, we may see a corresponding rise in insurance premiums. 

These changes may not be the end of the matter. There was a series of cases on the interpretation of the QOCS regime after it was introduced and it would be no surprise to see the new rules lead to a further round of litigation.

If you would like assistance with understanding how these changes could impact your business, please do not hesitate to contact a member of the Cooley team.

Register now

Wednesday, 5 April 2023

8:30 – 9:00 am PDT
10:30 – 11:00 am CDT
11:30 am – 12:00 pm EDT
4:30 – 5:00 pm GMT
5:30 – 6:00 pm CET

Panelists

• Selma Abdel-Qader – Associate
• Emma Bichet – Special counsel
• Corinne Robinson – Associate
• Claire Temple – Partner
• Edward Turtle – Associate

What is being proposed?

Key takeaways include:

1. Green claims would need to be based on an assessment, meeting new minimum ‘substantiation requirements’ that include:

• Relying on recognised scientific evidence and state of the art knowledge;
• Demonstrating the significance of impacts from a life-cycle perspective;
• Requiring greenhouse gas offsets to be reported in a transparent way;
• Providing information on whether the product performs environmentally significantly better than what is common practice; and
• Identifying whether a positive achievement leads to significant worsening of another impact.

2. Green claims can only cover environmental impacts that have been assessed in accordance with the substantiation requirements and identified as ‘significant’ for the product or business.

3. Green claims will need to be accompanied by information on their substantiation, either in physical form, or by way of a weblink, QR code, or equivalent.   This means that businesses making green claims may need to reconsider their product packaging.

4. Obtaining a ‘certificate of conformity’ for green claims.  Businesses making green claims are required to have their green claims verified and certified as compliant by an officially accredited body before they are communicated. Certification would provide companies with certainty that their claims would then not be challenged by any Member State competent authorities.

3. Stricter regulation of environmental labelling schemes, including third country labelling schemes.The Directive targets the perceived proliferation of environmental labels by banning the establishment of new national or regional public environmental labelling schemes in the EU Member States, unless these are established at EU level. New environmental labelling schemes established by public authorities in third countries (e.g. the US) need to be approved by the European Commission before they can enter the EU market.  Private schemes will need to be approved by the national authorities, and can only be approved if they can show added value compared to existing schemes.

4. Comparative green claims can only be used if they can be substantiated based on equivalent information and data.

5. Emphasis on enforcement. There are many provisions in the Directive devoted to enforcement of the new rules, which will take place at the Member State level. In short, Member States will need to designate competent authorities responsible for enforcement; establish a penalty regime and ensure access to a court or other independent body competent to review the procedural and substantive legality of the competent authority’s decisions.

What type of green claims are covered?

The Directive applies to explicit environmental claims made by businesses to consumers in the EU, unless these claims are not already governed by specific EU rules e.g., the EU Ecolabel.  An “environmental claim” includes any message or representation in any form that states or implies a positive environmental impact, lesser negative impact, no impact, or improvement over time for a product, service, or organisation e.g., “sustainable”, “eco-friendly”, “packaging made of 100% recycled plastic” and “climate neutral”.   The Directive also regulates environmental labels.

Why does this matter?

The Directive is part of a clear drive to create stricter rules on green claims and increase the enforcement of greenwashing in the EU, which has historically not been approached in a consistent way across the 27 EU Member States.  Companies that wish to use green claims on their products will now need to consider them very carefully and make sure they have carried out assessments to back them up and had them verified and certified by an independent certification body. 

This will involve time and resources, and will need to be taken into account when planning packaging and marketing strategies. 

We anticipate that, if adopted, these new rules may have a chilling effect on companies wishing to make green claims, given the regulatory hurdles they will need to pass to support their claims.  However, we think the companies with products that have products that are genuinely environmentally-friendly stand to benefit from these rules, since they will no longer be at a competitive disadvantage compared to companies that were applying less effort behind a similar claim or publishing misleading claims.  

With the EU Representative Actions Directive entering into force this year and creating a class-action style mechanism in Europe, we can also expect to see consumer organisations taking advantage of this new redress mechanism to bring actions against green claims that they consider not properly substantiated.

Next steps

The Commission’s proposal will now pass to the European Parliament and Council for consideration. We anticipate that this process will take around 18 months allowing time for businesses and other stakeholders to participate in a public consultation process and provide their comments. We will continue to follow how the proposed Directive develops during this period and its impact on current industry practices.

If you would like assistance assessing the impact on your business of these proposed rules or preparing feedback for the public consultation process, please contact a member of the Cooley team.

Where can I find it?

• The draft legislation is available here.
• The Q&A document issued by the Commission here.
• Factsheet issued by the Commission here.
• Press release here.

On 7 March 2023, the Council of the EU (“Council”) approved at first reading the European Commission’s proposal, supported by the European Parliament, to amend the transitional provisions in Regulation (EU) 2017/745 on medical devices (“MDR”) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (“IVDR”). All 27 members of the Council, representing the 27 EU Member States, voted in favor of the proposed legislative amendment during a session of the Education, Youth, Culture and Sports Council.

As discussed in our previous blog post, the related amendment was proposed by the European Commission in response to the imminent risk of medical device shortages on the EU market resulting from the limited capacity and availability of notified bodies and the insufficient preparedness of device manufacturers to bring their devices into conformity with the Regulations within the original transition timelines. The amendment will not introduce any substantive revisions to the requirements established in the Regulations. It will, however, postpone the timeline within which manufacturers of certain medical devices certified in accordance with Directive 93/42/EEC on medical devices (“MDD”) and Directive 90/385/EEC on active implantable devices (“AIMDD”) will be required to comply with the requirements established in the MDR.

The extension of the transitional periods in the MDR will follow a staggered approach based on the risk classification of each device and will be subject to cumulative conditions. These conditions are intended to ensure that only devices that are safe and for which the necessary actions have been taken to facilitate their transition to the requirements established in the MDR benefit from this extension.

Specifically, the legislative amendment will allow certain medical devices that are certified in accordance with the MDD and the AIMDD prior to 26 May 2021 – so called “legacy” devices – to be placed on the EU market or put into service until:

• 31 December 2027 for Class III and Class IIb implantable devices[1];
• 31 December 2028 for Class IIb, Class IIa and Class I devices placed on the market in sterile condition or having a measuring function; and
• 26 May 2026 for Class III custom-made implantable devices provided that an application for conformity assessment has been lodged before or on 26 May 2024 and a written agreement has been signed by the notified body and the manufacturer before or on 26 September 2024.

The validity of the CE Certificates of Conformity for legacy devices benefitting from one of the above transitional periods will also be prolonged based on the risk class of each device.

The legislative amendment will also allow medical devices and IVDs covered by a CE Certificate of Conformity issued in accordance with the MDD, AIMDD or Directive 98/73/EC on in vitro diagnostic medical devices (“IVDD”) before 26 May 2021 to continue to be sold on the EU market. Removing the “sell-off” deadline in the MDR and the IVDR will prevent safe medical devices that have already been placed on the EU market but have not yet reached the final user from being withdrawn.

The medical device industry has welcomed the adoption of the extended transitional periods by the European Parliament and Council and the removal of the “sell-off” deadline. Med Tech Europe, the trade association representing the EU medical device industry, has, however, called for “aligned and clear interpretation of the amendment”. This includes a streamlined submission process for conformity assessment by notified bodies and guidance on the type of evidence needed to demonstrate that the validity of CE Certificates of Conformity has been extended.

Formal adoption of the European Commission proposal by the European Parliament and the Council will take place on 15 March 2023 with the signature of the legislative act by the Presidents of the two bodies. The amended Regulation will then enter into force the day of its publication in the Official Journal of the European Union.

This blog was authored by Elizabeth Anne Wright and Anastasia Vernikou.

[1] The following devices do not benefit from the extended transitional period: sutures, staples, dental fillings, dental braces, tooth crowns, screws, wedges, plates, wires, pins, clips and connectors.

On 27 February 2023, the EMA launched a program that will allow 10 manufacturers of certain high-risk medical devices and in vitro diagnostic medical devices (“IVDs”) to receive advice on their clinical development strategies from expert panels established in accordance with the Medical Device Regulation (EU) No. 2017/745 (“MDR”) and the In Vitro Diagnostic Medical Device Regulation (EU) No. 2017/746 (“IVDR”). The aim of the program is to support developers of medical devices and IVDs in conformity assessment activities with notified bodies. The pilot phase of the program is intended to permit the EMA to gain the necessary experience to fully operationalize the ad hoc expert panel advice procedure foreseen in Article 61.2 MDR.

Articles 106 MDR and 48.6 IVDR require the European Commission to establish expert panels responsible for providing scientific, technical and clinical support in relation to the development of medical devices and IVDs to a range of stakeholders, including medical device and IVD manufacturers. Article 61.2 MDR allows manufactures of certain high-risk medical devices to seek advice from these expert panels regarding their intended clinical development strategy and proposed clinical investigations. Although this advice is subject to the payment of a fee[1], a related waiver will be provided to the 10 successful applicants participating in the pilot program. This is because the program is fully funded by the EU4Health budget.

Devices that are eligible for expert panel advice during the initial phase of the program are Class III and Class IIb devices that are intended to administer or remove medicinal products from the human body. However, only medical device manufacturers established in the European Economic Area (“EEA”) will be permitted to seek participation in the pilot phase of the program. Priority will be given to applications concerning:

• orphan devices;
• devices intended for paediatric use;
• devices addressing life-threatening medical conditions for which limited alternatives are available; or
• novel devices that have the potential for major clinical impact.

Special consideration will also be given to applications submitted by small and medium enterprises (“SMEs”).

An important factor in the selection process for participation in the pilot program will be the ability of medical device manufacturers to provide evidence in their letters of interest demonstrating that they meet the eligibility criteria. For example, manufacturers of devices intended for small patient population groups (e.g., orphan and pediatric devices) should provide a description and estimated size of their target patient population.

After the selection process has been completed, manufacturers will participate in a pre-submission meeting with the relevant expert panel to discuss their draft submission. A second meeting will follow to ensure that any remaining questions from the expert panel have been addressed by the applicants before the final request for advice is submitted. Successful applicants are expected to submit the final advice request within one month after the pre-submission meeting takes place. The expert panel will require 60 days, on average, to respond to the questions included in the advice request.

While manufacturers are not obliged to request expert panel advice, those that choose to do so must “give due consideration to the views expressed by the expert panel” by taking additional steps to align their clinical development strategies with the expert panel’s advice. Manufacturers must also ensure that the panel’s views are reflected in the clinical evaluation report allowing notified bodies to be aware of the expert panel’s advice and the manner in which manufacturers considered this advice in their clinical development strategies or clinical investigations.

The pilot program will run until the end of Q1 2024 and will include two phases of selection; one in April 2023, and one in September 2023. Medical device manufacturers can submit a letter of interest until the end of August 2023 based on the template published by the EMA.

This blog was authored by Elizabeth Anne Wright and Anastasia Vernikou.

[1] Article 106 MDR. The price of the fee is yet to be determined through an implementing act of the European Commission.

On 16 February 2023, the European Parliament voted at first reading to amend the transitional provisions in Regulation (EU) 2017/745 on medical devices (“MDR”) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (“IVDR”). The proposed text was adopted without any amendments. The approved amendment will not introduce substantive revisions to the quality, safety, and performance requirements established in the MDR and the IVDR. It will, however, give medical device manufacturers additional time to bring their devices into conformity with the requirements foreseen in the Regulations. It will also allow more time for notified bodies to conduct conformity assessment procedures in accordance with the Regulations.

Following pressure from the medical device industry and from the EU Member States, the European Parliament approved the European Commission’s proposal to:

1. extend the transitional periods foreseen in the MDR for certain devices certified in accordance with the Medical Devices Directive 93/42/EEC (“MDD”) and the Active Implantable Devices Directive 90/385/EEC (“AIMDD”) on the basis of the risk classification of each device;
2. prolong the validity of CE certificates of conformity issued in accordance with the MDD, AIMDD and the In Vitro Medical Devices Directive 98/79/EEC (“IVDD”) prior to 26 May 2021; and
3. allow medical devices and IVDs certified in accordance with the MDD, AIMDD and IVDD that are on the market to continue to be sold beyond the “sell-off” deadline of May 2025. (For more information on the European Commission’s proposal, please refer to Cooley’s related Cooley Alert)

The amendment to the transitional provisions in the MDR and the IVDR was adopted in accordance with the urgent procedure. A related request was approved by the European Parliament two days before the plenary vote on the substance of the legislative amendment. The European Commission’s proposal provides that the urgency of the measure is justified by the “imminent risk of shortages of medical devices and the associated risk of a public health crisis”. The urgency to adopt this amendment was also expressed by health ministers of the EU Member States in the meeting of the Employment, Social Policy, Health and Consumer Affairs Council (“EPSCO”) in December 2022 (for more information on the EPSCO meeting, please refer to Cooley’s related Productwise blog) and has been sustained throughout the legislative process, with the European Commission’s proposal being available for stakeholder feedback for only 8 days. 

Next steps

The text approved by the European Parliament will now be subject to an official adoption procedure by the Council of the European Union (“Council”). The text has already been reviewed and agreed by the Permanent Representatives Committee (“Coreper”), the body responsible for preparing and coordinating the Council’s work items. It will, however, require formal adoption by the Council. The European Parliament’s position was discussed by the Council on Friday 17 February 2023 and is expected to be formally approved early in the week of 20 February 2023. After formal adoption by the Council, the amended Regulation will be published in the Official Journal of the European Union.

In addition to the approved legislative amendments, the European Commission has announced its intention to carry out a comprehensive assessment of the MDR by May 2027. The purpose of the assessment will be to identify structural problems with the MDR and examine potential solutions to these issues. The European Commission also intends to fund actions to support the implementation of the MDR, including in relation to notified body capacity and orphan medical devices. These actions will be funded under the EU4Health programme starting in early 2023.

This blog was authored by Elizabeth Anne Wright and Anastasia Vernikou.

This is huge.  It is the biggest proposed chemical restriction in EU history and has been several years in the making.  If adopted – and we think it will be – the restriction will have a big impact on companies manufacturing electronics, textiles and clothing, cosmetics, food contact materials, packaging and medical devices, amongst others.  In many cases this would require a redesign of products destined for the EU market.  We also expect the EU’s decision on PFAS to have global consequences, given that other countries frequently follow the EU’s approach to chemicals regulation.

A public consultation will begin on 22 March 2023 and will run for 6 months. Don’t miss the opportunity to provide comments, as these will feed into the restriction process.

Read below for a short summary of the PFAS restriction, our take on why it matters and next steps.

What is it?

The restriction has been prepared within the framework of the EU’s “REACH Regulation” (blogged on here).  It was prepared together by the Netherlands, Germany, Sweden, Norway and Denmark.  It proposes to restrict a group of PFAS under the REACH Regulation.

Who will it apply to?

The restriction, if adopted into law, will apply to manufacturers, users and importers of PFAS on their own, as well as manufacturers and importers of mixtures and products that contain PFAS. 

With certain exceptions, the PFAS covered by the restriction are defined as: “any substance that contains at least one fully fluorinated methyl (CF3-) or methylene (-CF2-) carbon atom (without any H/Cl/Br/I attached to it)”.

These PFAS are currently widely used in electronics, textiles and clothing, cosmetics, food contact materials, packaging and medical devices, amongst others.  Companies operating in all of these sectors will likely be impacted.

Why does it matter?

Based on the restriction dossier, if approved, this would likely cover around 10,000 PFAS substances. This is groundbreaking, since it is the biggest REACH restriction ever proposed in the EU.  It will have a big impact on products manufacturers in multiple sectors.

The restriction proposes to ban:

• The manufacture, use and placing on the market of PFAS on their own; and
• The placing on the market of PFAS as constituents in other substances, in mixtures and in products

unless the specific concentration limits are complied with or if any of the (very narrow) proposed derogations apply.  Only PFAS used as active substances in pesticides, biocides and human and veterinary medicinal products are excluded from the restriction proposal.

We think that the Member States and the European Commission are likely to broadly support the proposed restriction, since it is in line with the Commission’s Chemicals Strategy for Sustainability, which encourages the restriction of substances used in consumer products as a group (rather than individually), and the REACH Restrictions Roadmap (blogged on here).

This restriction is the most recent (and biggest) of numerous initiatives to address PFAS. Internationally, PFAS such as PFOA, PFOS and PFHxS are already regulated under the Stockholm Convention on Persistent Organic Pollutants. In the EU, certain PFAS have already been restricted or are being restricted and have been identified as substances of very high concern (“SVHCs”) under the REACH Regulation. Releases of PFAS into the environment are also being addressed under sector-specific EU legislation regulating industrial emissions, water and drinking water.

On the other side of the Atlantic, State legislatures are increasingly introducing legislation regulating the use of intentionally added PFAS in consumer products, such as textiles and food packaging. For example, in September 2022, California adopted a law prohibiting the manufacture, distribution or sale of any new textile articles and cosmetic products containing PFAS above specific concentrations.

What’s next?

Before becoming law, the dossier needs to be approved by the European Chemicals Agency (“ECHA”) committees and endorsed by the Commission and EU Member States’ representatives.  We anticipate that the whole process is likely to take 3-4 years.

• Public consultation.  The restriction will now subject to a 6-month public consultation period, which will run from 22 March 2023 to 22 September 2023. All stakeholders are invited to submit comments, which will be taken into account by ECHA’s Committees.  Please contact a member of the Cooley team if you would like assistance with putting forward constructive input.

• ECHA committee opinions.  After the public consultation, ECHA’s Committees for Risk Assessment and for Socio-Economic Analysis will adopt their opinions (this takes 9-12 months from publication of the restriction, but is likely to take longer here given the size of the restriction).

• Commission proposal. Based on the ECHA committee opinions, the Commission will then present a legislative proposal to amend REACH to restrict PFAS (within 3 months from the receipt of the opinions). For the restriction to be adopted, the REACH Committee, composed of Member States’ REACH Competent Authorities, will have to approve the restriction.

• Non opposition from Council and Parliament.  If approved in the REACH Committee, the restriction proposal will then be sent to the European Parliament and Council for the 3-month scrutiny period. If they do not oppose, the restriction will be adopted and published in the Official Journal.

• 18-month transition period. The restriction provides for a relatively short lead in time as it would become enforceable 18 months after the entry into force of the restriction.

Where can I find out more?

The restriction and accompanying documents can be found here.

The EMA has announced the decision of its management board to resume its proactive clinical data publication policy after a four year-long pause. The application of the proactive publication policy will follow a staggered approach where priority will be given to data relating to new marketing authorization applications that involve new active substances.

A decision to suspend publication of clinical data was made in December 2018 to support EMA’s operational continuity during re-location of its headquarters from London to Amsterdam following the UK’s withdrawal from the European Union. Clinical data relating to treatments and vaccines for COVID-19, however, continued to be published during this time on an exceptional basis to meet public demand for publication of information, facilitate global research and enhance trust in related regulatory decisions across the EU.

The policy first came into effect on 1 January 2015 and applies to medicines submitted for evaluation in accordance with the centralized procedure established in Regulation (EC) No 726/2004 (“EMA Regulation”) after this date. It also covers clinical reports for applications submitted after 1 July 2015 to vary a marketing authorization for an extension of a therapeutic indication. The proactive publication policy requires EMA to provide public access to extensive information included in clinical trial reports and individual patient data submitted to the EMA by medicinal product manufacturers in support of their marketing authorization applications. The information is published following the European Commission’s decision on the grant of a marketing authorization or, in case an application for marketing authorization is withdrawn, before a related EMA opinion has been adopted.

The rationale underpinning this policy is to enable transparency in relation to information on medicinal products in accordance with Article 80 of the EMA Regulation. According to EMA, this policy aims to:

• facilitate the application of new knowledge to future research by the scientific community;
• avoid duplication of clinical trials, foster innovation and encourage development of new medicines;
• allow the scientific community to re-assess clinical data; and
• allow the public to scrutinize regulatory decision making, thus building public trust and confidence in EMA’s scientific and decision making processes.

This blog was authored by Elizabeth Anne Wright and Anastasia Vernikou.

Regulation (EC) 1907/2006 on the Registration, Evaluation, Authorisation, and Restriction of Chemicals (more commonly known as “REACH”).

What is it about?

REACH is the key EU Regulation regulating chemicals in the EU. It applies to the manufacture, placing on the market and use of chemical substances in the EU. REACH applies to chemical substances on their own (for example, lead), in mixtures (for example, paint) and in finished products (for example, a smartphone).

After Brexit, EU REACH is no longer directly applicable in the UK, where the EU regulation has been replaced by UK REACH, which largely follows the same approach embedded in EU REACH. Businesses that manufacture, place on the marker or use chemical substances in the EU and the UK must now comply with both regulatory regimes. In Northern Ireland, however, EU REACH will continue to operate under the Northern Ireland Protocol.

The key requirements of REACH and UK REACH are as follows:

• Registration: the overarching principle of REACH is “no data, no market”, meaning that no substance can be manufactured or placed on the market unless it is registered with the European Chemicals Agency (“ECHA”) for the EU or the Health and Safety Executive (“HSE”) for Great Britain. Registration is based on the principle “one substance, one registration”, meaning that manufacturers and importers of the same substance will have to submit their registration dossier jointly and, consequently, share both the data generated for the purposes of registration and the costs associated with the generation of data and the registration of the substance.

• Evaluation: ECHA and HSE evaluate whether registration dossiers are in compliance with the information requirements set out in REACH. If they find that the registration dossiers are not compliant, they can require the manufacturer or the importer to bring the dossier into compliance by generating the required information and update the registration dossier. Risks posed by registered substances are also screened by Member States in the EU and HSE in the UK on the basis of the information included in the registration dossier. If it is concluded that the substance may pose a risk to human health or the environment that needs to be clarified, they can request registrants to generate additional data.

• Authorisation: substances (on their own, in mixtures or in articles) that are identified as “substances of very high concern” (“SVHC”) and included in Annex XIV to REACH (“the Authorisation List”) cannot be placed on the market for a use or be used (including in finished products manufactured in the EU/UK), unless a specific authorisation is granted. The authorisation requirements do not apply to imported articles, meaning that articles manufactured outside the EU/the UK and incorporating a substance subject to authorisation in the EU/UK can be placed on the EU/UK market.

• Restrictions: When the manufacture, use or placing on the market of a substance, on its own, in a mixture or in an article, poses an unacceptable risk to human health or the environment, it can be restricted by the European Commission.  A restriction can be any measure necessary to address the “unacceptable risk”. Most REACH restrictions ban the manufacture, placing on the market and use of substances (above specific tolerance levels).  However, in some instances restrictions impose training or labelling/information requirements.

Who and what does it apply to?

REACH applies to all chemical substances that are manufactured, placed on the market or used in the EU, whether on their own, in mixtures (e.g. cosmetics) or finished products (e.g. a laptop, a bike or a piece of furniture).

Certain exemptions apply. For example:

• REACH does not apply to radioactive substances, substances under customs supervision, the transport of substances, non-isolated intermediates, waste and some naturally-occurring low hazard substances.
• Substances subject to more specific legislation, such as human and veterinary medicines, food and feed, plant protection products and biocides, have tailored provisions under REACH.

Why does it matter?

REACH is largely seen as one of the most comprehensive and protective chemicals legislation worldwide.  It is taken as a model by many other countries and has been retained by the UK post-Brexit.

However, 2023 will be a year of major changes in how chemicals are regulated on both sides of the Channel.

In the EU, the European Commission is currently drafting a proposal for the “targeted” revision of EU REACH and is expected to adopt the proposal at the end of 2023 (see Commission’s 2023 Work Programme). The proposal was originally scheduled for the end of 2022 and has been pushed back.  It is one of the fundamental pillars of the Chemicals Strategy for Sustainability (“CSS”), whose objective is to achieve a toxic-free environment, and its delay is attracting criticism from Member States, the European Parliament and certain voices in civil society.

In the UK, the Government has recently introduced to Parliament the so-called Freedom Bill. If adopted, all retained direct EU legislation will be revoked by the end of 2023. Retained direct EU legislation also includes UK REACH. So far, EU REACH has guided the UK’s post-Brexit approach to the regulation of chemicals. It is too early to anticipate whether UK REACH will be revoked, but it is possible that, in the near future, the UK and EU chemicals regulatory framework will grow further apart, with the consequence that companies wishing to do business both in the EU and the UK might be confronted with different regimes to comply with and, consequently, bear increased regulatory costs.

Where can I find it?

The EU REACH regulation can be found here.

The REACH etc. (Amendment) Regulations 2021 can be found here. The consolidated version of REACH incorporating the amendments made by the UK can be found here.

Is there any guidance?

Yes, guidance on different aspects of EU REACH can be found here, here and here.

Guidance on UK REACH can be found here.

The CTIS is the centralized EU portal and database established by the CTR as the single electronic entry point for sponsors to submit documentation and data relating to clinical trials. This includes applications for approval of clinical trials, clinical data records, safety reporting, corrective measures, modifications, additional information requested by the reporting Member State and notifications. The purpose of a common entry point for submission of documentation related to clinical trials was to streamline and facilitate the exchange of information among the competent authorities of EEA countries and between clinical trial sponsors and the competent authorities of EEA countries, harmonize application procedures and oversight and assessment processes and enhance transparency in relation to clinical trial data.

For practical information on the use of CTIS, the EMA has developed a CTIS Sponsor Handbook to support clinical trial sponsors in navigating the submission of information related to their clinical trials to CTIS.

What is it?

The proposed Batteries Regulation will replace the existing Batteries Directive 2006/66/EC. It represents a significant reform of the current rules and aims to make batteries used in the EU more environmentally friendly and increase the life of consumer electronic devices. The legislative proposal has been working its way through the European legislative procedure and is the culmination of a lengthy debate among the EU institutions.

Why does it matter?

More stringent removability and replaceability requirements

• Products incorporating portable batteries must be designed in a way that ensures the batteries are readily removable and replaceable by the end-user at any time during the lifetime of the product and must be accompanied by instructions and safety information on the use, removal and replacement of the batteries. This information must be made permanently available online. There are also new requirements to make batteries available as spare parts for a minimum of 5 years.
• There are very limited exceptions to these requirements – which have been narrowed compared to earlier leaked drafts:

1. a partial derogation to enable a product to be designed for the battery replacement to be undertaken by an independent professional (rather than end-users) for products designed to operate in an environment subject to splashing water, water streams or water immersion and intended to be washable and rinseable (where it is required to ensure safety), as well as for a limited category of medical devices and IVD medical devices.
2. a full exception where the continuity of power supply and a permanent connection between the product and the battery is required to ensure safety, or for products that collect and supply data as their main function, for data integrity reasons.

Ban on certain substances and electrochemical performance requirements

• In addition to restrictions under the REACH Regulation and the end-of-life vehicles Directive, batteries would need to comply with certain restrictions under the Batteries Regulation itself including on mercury and cadmium and a new restriction on lead.

• The new rules also give the Commission powers to restrict further substances in the future.

• In addition, ‘portable batteries of general use’ (e.g. AA batteries) must meet the electrochemical performance and durability parameters set out in the Batteries Regulation.

New marking, labelling and information requirements

• All batteries will need to be marked with a label containing information on the manufacturer’s identification, the battery category and certain traceability information, the manufacturing location, capacity, chemistry, certain critical raw materials plus more.
• There are also new requirements to CE mark batteries and include certain information about the importer.

• All batteries will have to be marked with a QR code linked to a website providing access to information about the battery.

• Additional information is also required for rechargeable portable batteries and non-rechargeable portable batteries. 

• As required under the current regime, batteries will have to be marked with the crossed wheelie bin symbol, and batteries containing cadmium and lead over certain levels need to be marked with the respective chemical symbol for the metal concerned.

New requirements for all batteries to undergo a conformity assessment

• All batteries will need to undergo a conformity assessment. There will be a presumption of conformity where harmonised standards are used.
  
  
• Batteries will also need to be accompanied by an EU declaration of conformity.

Supply chain due diligence

• All economic operators placing batteries on the EU market, except SMEs, will be required to develop and implement a so-called “due diligence policy” to address the social and environmental risks linked to sourcing, processing and trading raw materials and secondary raw materials.

Common charger extension

• The Commission will be required to assess how best to introduce harmonised standards for a common charger for rechargeable batteries incorporated into specific categories of electrical and electronic equipment, among other products, by 1 January 2025.  

What’s next?

The text still needs to be formally approved by the European Parliament and Council. The legislation will then be signed, published in the Official Journal of the European Union and enter into force 20 days later. We expect this process to finish around Q1 – Q2 2023.

It will apply 6 months after publication, but there are numerous transition periods applying to different provisions (e.g.  42 months for the removability and replaceability and QR code requirements). The current batteries regime will not be repealed until 24 months after publication, so it will remain possible to place batteries on the market under that regime until then.

Where can I find out more?

The text of the provisional agreement can be found here.

Press releases from the Commission, Parliament and Council following the trilogue agreement reached.

What is it called?

The Cosmetic Products Regulation (EC) 1223/2009 governs the placing on the market of cosmetic products and replaced the Cosmetics Directive (Directive 76/768/EEC).

What is it about?

The Cosmetic Products Regulation lays down the rules for the placing and making available on the market of finished cosmetic products in the EU.  

The Cosmetic Products Regulation is complemented by the Common Criteria Regulation 655/2013 that sets out criteria for the justification of claims used for cosmetic products and Commission Implementing Decision of 25 November 2013 on the safety assessment for cosmetics.

Key requirements of the Cosmetic Products Regulation include:

• All cosmetic products must undergo a safety assessment and be accompanied by a safety report before they can be placed on the EU market;
• All cosmetic products need to be registered in the EU Cosmetic Products Notification Portal;
• The manufacture of cosmetic products must comply with good manufacturing practices;
• Cosmetics packaging must include a range of information, including, for example, the name and address of the responsible person, precautions of use and list of ingredients;
• Labelling information must include, among other things, the name and address of the responsible person, a list of ingredients, to be expressed using the common ingredient names, precautions of use, the validity period of the cosmetic products, and the function of the cosmetic product (unless this is already clear from its presentation).

The Cosmetic Products Regulation also contains a list of the substances that are prohibited, restricted or authorised for use in cosmetic products and sets out rules on the use of nanomaterials.

Who and what does it apply to?

The Cosmetic Products Regulation applies to EU manufacturers, importers and distributors of cosmetic products.

Importantly, the Cosmetic Products Regulation creates the role of the ‘responsible person’ and provides that:

• Only cosmetic products for which a responsible person is appointed can be placed on the market; and
• For each cosmetic product placed on the market, the responsible person must ensure compliance with the relevant obligations.

The Cosmetic Products Regulation applies to “cosmetic products”.  Cosmetic product is defined as “any substance or mixture intended to be placed in contact with the external parts of the human body (epidermis, hair system, nails, lips and external genital organs) or with the teeth and the mucous membranes of the oral cavity with a view exclusively or mainly to cleaning them, perfuming them, changing their appearance, protecting them, keeping them in good condition or correcting body odours”.

Typical examples of cosmetic products include perfumes, make-up, shampoos, soaps, skin care products and toothpastes. There is sometimes a fine line between what qualifies as a “cosmetic product” or another type of product, such as medicinal products, biocidal products, toys or medical devices. In such cases, the assessment as to whether a product qualifies as a cosmetic product or a product subject to a different regulatory regime will need to be evaluated on a case-by-case basis, taking into account all the circumstances, including the claims that are made about the product.

Why does it matter?

The Cosmetic Products Regulation is the main piece of legislation applying to cosmetic products in the EU. Failure to comply with the provisions of the Cosmetic Products Regulation exposes economic operators to possible enforcement action by the Member States’ regulators, including corrective actions, withdrawals and recalls, as well as penalties.

As part of the Chemicals Strategy for Sustainability (“the CSS”), the Commission is now working on a targeted revision of the Cosmetic Products Regulation, alongside with the targeted revision of the EU chemicals framework. The Commission is expected to publish the legislative proposal for the revision of the Cosmetic Products Regulation in the course of 2023. It is worth noting that the regulatory framework for cosmetics has been recently amended in the US (for more insights visit Cooley’s blog here).

Where can I find it?

The Cosmetic Products Regulation can be found here.

Is there any guidance?

Yes, the Commission published guidance documents on:

• Cosmetic claims
• Serious undesirable effects reporting
• Borderline products
• Cosmetic products notification portal.

In addition, the Scientific Committee on Consumer Safety has published notes of guidance for the testing of cosmetic ingredients and their safety.

There are only few days left until the feedback period closes on the European Commission’s proposal for a Cyber Resilience Act (“CRA”) – it isn’t too late to provide a response.  Here we explain what this proposal is, why it is so important to the world of connected products and how you can share your thoughts with the Commission.

Background

On 15 September 2022, the Commission published its proposal for the CRA, laying down cybersecurity requirements for connected products, software and certain types of data processing.

The CRA is the first regulation of its kind. It seeks to impose horizontal cybersecurity requirements and more traditional product safety style concepts, such as conformity assessment and CE marking, together with recall and reporting obligations, to cyber risks posed by “products with digital elements“. Products with digital elements is defined in the proposal as “any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately”.  

This is all to address the new risks and challenges that the Commission perceives are created by connected products and their software. We expect it to have a big impact on many businesses who will have to rethink the way they conceive, design, and manufacture connected products and software to ensure an adequate level of cybersecurity and a system to address possible vulnerabilities.

Feedback on the proposed CRA is open until 23 January 2023 – helpful links can be found at the end of this post.

Who and what will it apply to?

The CRA would establish obligations for manufacturers, importers, authorised representatives and distributors of products with digital elements, as well as persons that “substantially modify” products already placed on the market.

The CRA would apply to products with digital elements, which would include:

• Any device or group of inter-connected or related devices, one or more of which, pursuant to a program, perform automatic processing of digital data (e.g. smartphones, laptops, tablets, routers).
• Embedded software, (e.g. firmware, basic operating systems, network systems, storage and security management).
• Non-embedded software (standalone software), i.e. software that is additional to the primary function of the device on which it is downloaded, e.g. mobile apps. 

The CRA would not apply to software provided as a service, except for the remote data processing solutions related to a product with digital elements.

What is being proposed?

There are several new requirements being suggested. We think the most notable of these are:

• Application of the CE marking model to deal with cyber risks. The draft proposal contains essential requirements for the design, development and production of in scope products. Compliance with the essential requirements would need to be demonstrated as part of the applicable conformity assessment process and the CE mark applied.
• Mandatory third-party conformity assessment for “critical” class products. The default conformity assessment procedure is the self-assessment process. However, products with digital elements classified as “critical” may need to undergo a mandatory third-party conformity assessment.  

Specific rules on the conformity assessment of highly critical products with digital elements and high-risk AI systems also apply. On the one hand, to demonstrate conformity, highly critical products with digital elements will need to obtain a cybersecurity certificate. On the other hand, the conformity of high-risk AI systems can be demonstrated either through a self-assessment process or a third-party conformity assessment, depending on whether harmonised standards and technical specifications established under the EU AI Act are available and applied by the manufacturer.

• New post-market obligations continuing during the lifetime of the product. Manufacturers would have to handle vulnerabilities in line with the requirements set out in the CRA.  This would include, for example, an obligation to provide security updates during the product’s lifetime or 5 years after the placement on the market, whichever is shorter.
• Report vulnerabilities and incidents to ENISA (the European Agency for Cybersecurity) within 24 hours from becoming aware of an actively exploited vulnerability or incident affecting the security of the product with digital element.  Manufacturers would also have to inform end-users about incidents and indicate the measures they can take to mitigate the effects of the incident.  In line with other product legislation, manufacturers would also have to take corrective measures to bring non-compliant products into conformity, recall or withdraw them as appropriate.
• There are also strong proposals for enforcement. Market surveillance authorities would have the power to take corrective actions and order the recall or withdrawal of non-compliant products with digital elements.  In exceptional circumstances, the Commission can also request ENISA to carry out an evaluation of the compliance and, on the basis of ENISA’s evaluation, take corrective or restrictive measures (including requiring a product recall).  This is a rather significant and important development in the context of product safety law as, typically, corrective actions against non-compliant products are taken by Member States’ competent authorities and not by the Commission.

• There is a significant focus on penalties.  Under the proposed CRA, Member States would be able to impose administrative fines up to EUR 15 million or 2.5% of the worldwide annual turnover in case of non-compliance with the essential cybersecurity requirements.  Such administrative fines are similar to those set out in the GDPR and the NIS2 Directive, but are a new and significant development in the area of product safety legislation, which typically does not provide for such thresholds.  We believe this signals the importance the Commission is attaching to cybersecurity matters and that there will be high expectations from Member States in terms of enforcement.

How will it interact with other legislation and initiatives?

As the proposed CRA would introduce new requirements on products that are also subject to other EU legislation or will be covered by upcoming legislation, this proposal should be considered alongside other legislation and proposals aimed at dealing with risks and challenges posed by connected products. This includes:

• The upcoming ecodesign measures for mobile phones and tablets (see our blog here);
• the Act adopted under the Radio Equipment Directive on cybersecurity requirements;
• the proposed EU AI Act;
• the proposed EU Data Act; and
• the upcoming General Product Safety Regulation (see our blog here). 

In addition, the proposed CRA should also be considered in the context of:

• The proposal to revise the Product Liability Directive; and
• The proposal for a new AI Liability Directive

as non-compliance with the CRA requirements may lead to liability claims under these two initiatives.  

You can find helpful insights on the proposed revision of the Product Liability Directive and the new AI Liability Directive here and here.

What is the anticipated timeline?

The CRA proposal will be passed to the European Parliament and the Member States in the Council for negotiation, a process which normally takes 1.5-2 years.  Depending on how this goes, if the law passes, it could enter into force in 2024/2025. There is currently a 2-year transition period proposed for the majority of the rules, but there is a shorter transition period proposed of 12 months for the new reporting obligations to ENISA. These time periods are relatively short given the extensive obligations that this will create.

Next steps

Given the breadth of the cybersecurity requirements the CRA is seeking to introduce and the products that would be in scope (smartphones, laptops, smart wearables, software, etc.), we recommend that, if this proposal impacts your business, there are two steps that you should consider taking:

1. The first, which is most immediate, is if you have not already, putting your views in. The proposal is now nearing the end of its feedback period (closing on 23 January 2023).  The feedback will be published on the proposal’s webpage and will be summarised by the Commission before being presented to the European Parliament and the Council, who will analyse the proposal separately in their respective preparatory bodies, before issuing negotiating mandates.  
2. The second is that, as the proposal progresses, you should evaluate the impact on your business. If it passes, the transition periods (unless extended) are short, so businesses should pre-emptively consider how they might comply with the new rules.

If you would like assistance preparing feedback or assessing the impact on your business of these proposed rules, please contact a member of the Cooley team.

Where can I find it?

• The draft legislation is available here.
• Q&A document issued by the Commission here.
• Factsheet issued by the Commission here.
• Press release here.
• The link to provide feedback or see the feedback already submitted is here.

The guideline on sponsor management of investigational medicinal products (“IMPs”) for use in clinical trials that was published by the European Medicines Agency (“EMA”) on 14 September 2022 (the “Guideline”) came into effect on January 1, 2023. The Guideline addresses the responsibilities of sponsors for the release and shipping of IMPs in line with Good Clinical Practice (“GCP”) and Good Manufacturing Practice (“GMP”). The Guideline should be read in conjunction with the Delegated Regulation (EU) 2017/1569 on GMP and arrangements for inspections and the detailed Commission guidelines C(2017) 8179 on GMP for IMPs.

Article 63.1 of the Clinical Trials Regulation (EU) 536/2014 (“CTR”) requires that IMPs be manufactured in accordance with GMP. The Regulation also authorises the European Commission to establish GMP principles through the adoption of delegated acts and related guidelines.

The Guideline divides the release procedure for IMPs to clinical trial sites into two phases: the preparation of a batch certification by the Qualified Person (“QP”) and the regulatory release of IMPs by the clinical trial sponsor. Pursuant to Article 62.1 of the CTR, the QP verifies that each production batch of IMPs manufactured or imported in the EEA meets the quality standards that are established by the European Commission and certifies that these requirements are fulfilled. The sponsor must ensure that the required clinical trial authorisation has been granted before IMPs are released for delivery to clinical trial sites and pharmacies.

Although sponsors are responsible for the clinical trial up until the point IMPs have been delivered to the relevant trial sites, the Guideline provides that sponsors may delegate the regulatory release of IMPs to manufacturers. Where this task is delegated to manufacturers, the sponsor and the manufacturer must conclude a related written agreement. The sponsor must provide the manufacturer with all the information required to perform the regulatory release of IMPs to the clinical trial sites, including inspection reports and information on quality issues of IMPs.

Other issues related to GMP of IMPs, including sourcing, transport, storage, and re-labelling, may also be subject to a written agreement between the manufacturer and the sponsor. The purpose of the agreement is to ensure that the division of responsibilities among the parties is clearly defined.

In relation to the shipping of IMPs to trial sites, the Guideline states that measures should be taken that minimise “any risk of exposure to conditions that could impact quality and integrity of the product”. These measures should include steps to ensure the security of the product against adulteration, tampering and theft. Compliance with Good Distribution Practice (“GDP”), should also be ensured, including measures concerning shipment documentation that ensure traceability, transportation specifications and storage conditions of IMPs as listed in the product specification file. The Guideline also provides that any derogation from the transportation instructions provided by the sponsor or on their behalf in relation to the shipment of IMPs should be documented and communicated to the sponsor or their representative. Derogations from the shipment conditions outlined in the product specification file must also be recorded and investigated by the sponsor in cooperation with the manufacturer. The impact of such derogation on the quality of the IMPs must be assessed and related corrective measures taken where necessary.

This blog was authored by Elizabeth Anne Wright and Anastasia Vernikou.

Article 71 of Regulation (EU) 536/2014 on clinical trials (“CTR”) provides that clinical trial sponsors can authorise third parties to perform clinical trial-related duties on their behalf. The sponsors must ensure that such delegation does not undermine the safety and well-being of clinical trial subjects. Clinical trial data must also remain robust and reliable. This means that, although trial-related tasks can be performed by third parties, clinical trial sponsors remain responsible for compliance of the clinical trials with the applicable regulatory requirements. Therefore, clinical trial sponsors must establish processes and measures to evaluate whether or not:

1. the third parties to whom clinical trial-related duties are delegated possess the necessary skills, experience and organisational competence to perform these duties;
2. the delegated activities are appropriately supervised by the clinical trial sponsor; and
3. the quality of the clinical trial is ensured.

The updated guidance provides a non-exhaustive set of measures for use by sponsors in assessing the suitability of third parties to perform activities on the sponsor’s behalf. These include suitability assessment questionnaires, review of CVs of third-party personnel, and review of approvals or licenses necessary for the third parties to conduct the delegated duties.

Clinical trial sponsors may demonstrate appropriate supervision of the delegated clinical trial activities through documentation. According to the updated guidance, the measures that can be used to demonstrate sponsor oversight of the delegated tasks include those that:

1. guarantee direct access to essential documents such as SOPs, training documents, etc.;
2. ensure that significant decisions and actions are recorded, for example in the form of meeting minutes;
3. archive relevant written and verbal communication;
4. keep records of access to documentation;
5. record acknowledgment of quality assurance reports;
6. document and assess divergence from contractual arrangements, GCPs and regulatory requirements; and
7. assess and adapt documentation and training requirements as necessary.

Where third parties decide to further sub-contract certain tasks to a different entity, clinical trial sponsors should demonstrate compliance with the oversight requirement on the basis of two additional documents:

1. a contract that explicitly allows third parties to further delegate tasks to different entities; and
2. a recorded assessment of the measures used by third parties to evaluate and supervise the subcontracted activities.

It is important if this approach is adopted that the respective liability of the individual parties for any breach of related obligations is clearly documented in a binding manner.

Furthermore, the guidance recommends that clinical trial sponsors establish processes and measures to assess and manage the quality of the clinical trial. The type of quality issues to be taken into account should include incomplete data, high incidences of errors in data entries, defective computerized systems and deceptive practices. If a quality issue results in regulatory non-compliance, the clinical trial sponsor must notify the relevant national competent authorities through the Clinical Trials Information System (“CTIS”) or in accordance with national requirements.

This blog was authored by Elizabeth Anne Wright and Anastasia Vernikou.

The most important amendment to the Q&A is the inclusion of a new Annex III.

The application dossier for the approval of a clinical trial in accordance with the CTR is composed of two parts. Part I of the application dossier relates to scientific aspects of clinical trials that are considered to be scientifically harmonized among EEA countries. Part II relates to country-specific, patient-level requirements, which may vary from one EEA country to another. The European Commission has developed standardized templates for documentation required for Part II of the application dossier. However, certain EEA countries have also developed their own national templates.

As a result, when operating in the EEA, sponsors may be confronted with divergent national requirements of individual EEA countries. The updated Q&A aims to provide sponsors with a consolidated list of national sources where sponsors can identify national requirements and any applicable templates in individual EEA countries. This information should assist sponsors in navigating the specific requirements of individual EEA countries and submitting high quality and appropriate documents as part of their application dossiers for the approval of clinical trials.

Annex III provides an overview table containing links to the websites of all EEA countries where sponsors can find information regarding national requirements of individual EEA countries. Annex III also includes the e-mail addresses of the national competent authorities of EEA countries to which enquiries may be submitted.