Regulatory & Compliance Documentation — Industry Case Study

What Failed and Why — A Compliance Documentation Breakdown in Practice #

A US-based wellness brand approached us in early 2023 with a specific problem: their existing China-sourced packaging supplier had been dropped by their largest retail buyer (a regional chain with roughly 380 stores) after a routine vendor audit. The packaging itself passed all physical and safety tests. The failure was entirely documentary.

The root documentation gaps, as we found them during our initial brief review (logged under Category D in our supplier onboarding checklist, what we call the CVA-03 Compliance Verification Assessment):

Five gaps. Each one independently sufficient to block a retail shelf placement. Together, they had cost the brand roughly eight months of delayed market entry.

The previous supplier had produced technically acceptable packaging. They simply had no documentation infrastructure.

The Root Cause Most Teams Misdiagnose #

The assumption in most post-mortem conversations like this one is that the supplier was cutting corners — deliberately withholding documentation, using non-compliant materials and hoping nobody checked.

That is rarely what happens, and it wasn’t what happened here.

The actual mechanism is more mundane and harder to fix: the supplier’s documentation was generated reactively, project by project, with no version control, no expiry tracking, and no centralised repository. The FDA Letter of Guarantee existed — it was dated 2019 and buried in a folder nobody had opened since. The FSC certificate had lapsed seven months earlier because the certificate holder had changed and nobody updated the records. The SVoC test reports were genuine, commissioned from a third-party lab, but referenced a substrate formulation that had been quietly changed by the material mill in 2021.

This is a documentation lifecycle problem, not a compliance intent problem. And it is far more common than the industry acknowledges.

The diagnostic signal we look for is the “report-to-production lag”: the gap between when a compliance test was conducted and when the production run it supposedly covers was manufactured. Any lag exceeding 24 months on substrate formulations, or 36 months on structural parameters, should trigger re-verification. For ink systems specifically, we require re-testing after any reformulation event regardless of elapsed time — UV and water-based ink formulations change more frequently than suppliers typically disclose.

Confirming this failure mode requires two things: a document date audit and a material change log cross-check. If your supplier cannot produce a material change log for the past three years, the test reports they hold are unverifiable regardless of their content.

Corrective Actions We Implemented — Ranked by Impact #

The project ran 34 working days from brief to first verified shipment. The corrective actions, in the order we prioritised them:

1. Compliance Master File (CMF) construction. We consolidated all 14 required documents into a single versioned file with issue dates, expiry dates, and responsible party tagged to each entry. This is the structural foundation. Without it, every other action is ad-hoc. Time investment: approximately 5 working days for an established supplier. Cost delta: small but measurable as a one-time internal resource cost.

2. Substrate re-testing against current formulation. We commissioned fresh SVoC testing per REACH Annex XVII and EN 71-3 migration limits on the actual production lot material, not the archived specification sheet. Results turnaround from our appointed third-party lab: 12 working days. This single action resolved two of the five retailer audit failures simultaneously.

3. UV ink cure energy documentation. We introduced inline cure energy logging (measured in mJ/cm² per pass) across our offset UV lines. For this project, specified cure energy was 140 mJ/cm² at 80 m/min line speed — logged per batch and attached to the CMF. This resolves EU Regulation 10/2011 migration risk documentation requirements. Expensive to retrofit if you’re not already doing it; our lines have had this capability since 2021.

4. FSC certificate reinstatement and audit trail. The brand re-engaged their FSC-certified board mill, updated the Chain of Custody linkage under FSC-STD-40-004 v3.1, and we issued a corrected Transaction Certificate. Elapsed time: 8 working days assuming the mill’s FSC status is current.

5. ISTA 2A transit validation. Conducted on 18 units of the secondary carton format. Pass/fail threshold per protocol: no structural failure, no compression set exceeding 10mm on stacked units. Results archived in the CMF with the test lab’s signed report.

Actions 1 through 3 resolved the retail buyer’s hold. Actions 4 and 5 addressed longer-term scalability for the brand’s EU market entry, which was the next phase.

Prevention — What to Specify Before Production Starts #

The CMF approach only works if the document scope is defined before sampling begins, not after the first compliance query arrives.

On the purchase order or supplier brief, specify: the destination markets (US, EU, AU each trigger different documentation sets), the retail channel (mass retail chains typically carry stricter audit requirements than DTC), and the end-product food-contact status. These three variables determine which of the roughly 9–12 standard compliance documents are mandatory versus optional for your programme.

Request a Document Readiness Declaration from any supplier before approving samples. This is a one-page form listing all applicable compliance documents with current validity dates. If the supplier cannot produce this within 5 working days, that is diagnostic information.

Specification Notes for Brand Partners #

When you brief us on a packaging project requiring compliance documentation, the three things that most directly affect our ability to quote accurately and sample efficiently are: destination market, retail channel, and whether the packaging contacts food, cosmetic product, or pharmaceutical content directly.

The most common brief gap we encounter is undefined market scope. A brand will request “export compliant” packaging without specifying whether that means FDA 21 CFR, EU Regulation 10/2011, Australian APHA guidelines, or all three. Each has different documentation requirements, and the substrate and ink selections can differ as a result. Catching this at brief stage saves one to two full sample iterations.

Our standard timeline from confirmed brief to a complete Compliance Master File with first sample set is 20–25 working days, assuming substrate and ink selections are within our qualified material library. New material introduction adds 10–15 working days for third-party testing. Rush processing against existing qualified materials is possible in 14 working days; we assess this case by case based on line scheduling.

What documentation does a brand typically need for US retail packaging?

At minimum: FDA Letter of Guarantee (if paperboard or food-adjacent substrate is involved), a current SVoC/REACH substance declaration, an ISTA transit test report for the secondary packaging format, and an ink/coating safety data sheet. If you’re making sustainability claims, you’ll also need a verified certification like FSC or SFI. That’s five documents before a major retailer will typically clear a new vendor.

Can we use test reports from our previous supplier?

It depends on the elapsed time and whether the substrate formulation has changed. Reports older than 24 months on food-contact or chemical migration testing are generally not accepted by EU-market retailers or US chain buyers. If the mill changed its formulation — which happens more often than suppliers communicate — the original report is void regardless of age. We always verify against the current material lot before relying on archived documents.

Our product isn’t food. Do we still need FDA documentation?

If the packaging uses paperboard that could come into incidental contact with food (outer gift boxes near food gifts, retail shelf proximity in certain categories), some buyers will still request an FDA 21 CFR 176.170 letter as a precaution. For purely non-food applications like apparel, electronics, or cosmetics, FDA food-contact documentation is not required — but EU Regulation 10/2011 may still apply if inks or coatings could migrate to the product surface.

How long does a full compliance document set take to prepare?

For packaging within our existing qualified material library, 20–25 working days is our standard. The timeline compresses if the brand has pre-existing test data we can incorporate; it extends if new substrates or ink systems need third-party verification. The ISTA transit test alone takes 8–10 working days from sample submission to signed report, which sits on the critical path for retailer onboarding.

Is a Compliance Master File a legal requirement?

No. There is no regulation that mandates this specific format. The CMF is an internal organisational tool that ensures all required documents are version-controlled, expiry-tracked, and retrievable during a buyer audit. What the regulations require are the underlying documents themselves — the CMF just prevents them from getting lost, outdated, or decoupled from the production lot they reference. Brands that skip this structure typically rediscover its value after their first retailer audit.

---

Planning a packaging project? Contact our team to request a complimentary specification review and sample quote.