TL;DR: Compliance documentation doesn’t expire on a fixed schedule — it expires when the underlying condition it certifies changes, and missing that trigger is the most common cause of audit failure.
TL;DR: In our experience, roughly 40% of non-conformances flagged during customer audits trace back to documents that were technically current but no longer matched the actual material or process in production.
When a Compliance Document Becomes Invalid — The Trigger-Based Model #
The standard industry assumption is that compliance documents have a fixed shelf life: renew annually, re-test every two years, done. That model works until a supplier quietly substitutes a plasticizer, your converter changes ink formulation, or a regulation gets amended without a grace-period announcement. At that point, your document package looks complete on paper while the physical product no longer meets what it certifies.
Our internal document control system, which we track under what we call the CR-11 Change Trigger Register, classifies every compliance document by three risk tiers based on what would invalidate it. Tier 1 documents (FDA 21 CFR 176.170 food-contact declarations, EU 10/2011 migration test reports, FSC chain-of-custody certificates) are sensitive to any raw material substitution or supplier change. Tier 2 documents (REACH SVoC declarations, RoHS conformity statements) require re-evaluation when a substance on the SVHC candidate list is updated — which the European Chemicals Agency updates twice per year. Tier 3 documents (general ISO 9001:2015 conformity records, internal QC inspection reports) follow calendar-based renewal, typically 12 months.
The table below summarizes the trigger logic we apply across our most common document types:
| Document Type | Renewal Trigger | Minimum Retest Interval | Governing Standard |
|---|---|---|---|
| Food-contact migration report | Raw material or supplier change | 24 months if no change | EU 10/2011 / FDA 21 CFR 176–179 |
| REACH SVHC declaration | ECHA candidate list update | 6 months (ECHA update cycle) | REACH Regulation (EC) No 1907/2006 |
| FSC chain-of-custody certificate | Scope change or annual surveillance | 12-month surveillance audit | FSC STD-40-004 v3-1 |
| Ink/coating food-safety declaration | Formulation or substrate change | 12 months minimum | GB/T 10004, EuPIA GMP |
| Heavy metals test report (RoHS) | Component supplier or colorant change | 24 months if no change | EU RoHS 2011/65/EU |
The practical implication: a brand partner who approved a paperboard food box in 2022 and hasn’t re-briefed us on any changes is probably fine on the FSC certificate (surveillance keeps it current) but may be exposed on the migration report if the greyboard supplier updated their wet-strength additive — something that would not appear in any change notification we’d receive automatically.
What Goes Wrong When Document Maintenance Is Reactive #
This is where we see the most preventable failures, and the failure modes follow a consistent pattern.
The first scenario is supplier-side silent substitution. A board mill changes their internal sizing agent — same grade name, same GSM, slightly different chemistry. The change doesn’t cross any regulatory threshold that requires them to notify customers under their own quality system. Our incoming goods inspection under ASTM D3103 moisture barrier testing would catch a performance shift, but it wouldn’t flag a chemistry change unless we’d specifically added extractables screening to the incoming test plan for that grade. If the existing migration test report was issued against the old formulation, it’s now unsupported — even though nobody knowingly changed anything. This type of gap has resulted in re-testing costs and two to three weeks of shipment hold while updated documentation is generated, based on incidents we’ve tracked over the past three years across our food-packaging lines.
The second scenario is regulatory creep. The ECHA SVHC candidate list has grown from 15 substances in 2008 to over 240 substances as of 2024. A packaging component that was fully clean under REACH when originally qualified may now contain a newly listed substance above the 0.1% w/w threshold, with no process change on our side. Without an active watch process tied to ECHA update cycles, a REACH declaration issued 18 months ago may no longer be accurate. Our practice is to run an SVHC substance mapping review against each semi-annual ECHA update for all Tier 1 and Tier 2 components, cross-checked against our Bill of Substances records.
The third scenario is document-to-production drift. This one is procedural. A sample was approved, compliance documents were issued against that sample, and then during production scale-up a minor process adjustment was made — curing temperature shifted by 8°C, coating weight reduced from 12 gsm to 10 gsm to hit a cost target, or a release liner was substituted mid-run. None of these individually seem significant. Cumulatively, the production unit no longer matches the certified sample. We catch this through our closed-loop sample-to-production reconciliation check, logged against each job’s CR-11 record before final document release, but it requires the production team to flag changes proactively rather than assume they’re below reporting threshold.
Does Document Maintenance Apply the Same Way for All Packaging Types? #
No — and the distinctions matter.
Primary food or pharma packaging carries the strictest re-validation obligations because the certified properties (migration limits, barrier performance, sterility) directly affect consumer safety. For secondary and tertiary packaging, the compliance burden is lower, but supply chain transparency regulations like the EU PPWR 2023 are expanding documentation requirements into structural and recyclability claims that previously had no formal certification path. We’d treat those under a Tier 2 watch structure now, anticipating that enforcement teeth will follow within 24 to 36 months.
For purely aesthetic packaging — rigid gift boxes, decorative folding cartons — the primary compliance exposures are restricted substance declarations and any applicable regional labeling regulations. Renewal cycles here can be extended to 18–24 months if the supply chain is stable and no substrate changes have occurred.
Specification Notes for Brand Partners #
When you brief us on a compliance documentation package, the single most useful thing you can provide is your current list of active documents by type, issue date, and the specific product SKU each covers. A surprising number of briefs come in with “we need full compliance docs” — which is a starting point, not a specification.
The common gap that adds sample iterations: not telling us which market the product ships to. EU food-contact and FDA food-contact have different test protocols and different migration limits. A migration report issued under EN 1186 or EU 10/2011 conditions does not automatically satisfy FDA 21 CFR requirements for the US market, and vice versa. If you’re shipping to both markets, we need to know upfront so we can scope the correct test plan rather than issue one report and retest later.
Our standard turnaround for a full compliance document package on a new material combination is 15–20 working days from sample approval, assuming no third-party lab queue delays. Complex food-contact applications requiring full migration testing under EN 1186 can extend to 30–35 working days. Providing us with any existing test data from previous suppliers shortens that window measurably — even if the data doesn’t transfer directly, it guides the test scope.
Frequently Asked Questions #
How often should we request updated compliance documents from our packaging supplier?
It depends on what changed, not on the calendar — but as a baseline, request a full document review any time your packaging formula, substrate, or primary supplier changes, and conduct a calendar-triggered review at 12 months for food-contact or pharma applications, 18–24 months for secondary packaging.
Our current supplier provided an EU 10/2011 migration report — does that cover FDA requirements too?
No. EU 10/2011 and FDA 21 CFR 176–179 use different simulants, test conditions, and threshold limits. A report issued against EU 10/2011 protocols cannot be used as standalone FDA evidence. If you’re selling into the US market, a separate evaluation against FDA 21 CFR conditions is required, and the test plan scope should be confirmed with a qualified food-contact specialist before testing begins.
What happens if a substance gets added to the ECHA SVHC list after our compliance documents were issued?
Your existing REACH declaration may no longer be accurate if the newly listed substance is present above 0.1% w/w in any article. The ECHA candidate list updates twice per year, so a declaration issued 12 months ago could be stale against two update cycles. The correct response is to run a substance mapping check against the updated SVHC list — not to simply re-date the existing document.
Can we reuse compliance documentation from a previous packaging project if the new project uses the same materials?
Only if the material source, grade, formulation, and supplier are genuinely identical — and even then, only within the document’s validity window. We require a formal material equivalence check logged against the new project before we allow document carryover. Skipping this step is one of the fastest ways to fail a customer audit.
How long does it take to rebuild a full compliance document package from scratch if our documentation has lapsed?
For a standard folding carton or rigid box with non-food contact requirements, 10–15 working days is realistic. For primary food-contact packaging requiring migration testing, budget 30–35 working days and factor in third-party lab scheduling, which can add 5–10 working days during peak periods (Q4 and Q1 tend to be busiest in our experience).
Planning a packaging project? Contact our team to request a complimentary specification review and sample quote.
