Which rules actually apply?
Three inputs decide the obligation set. Change any one of them and it changes completely — which is why a generic compliance checklist is worth very little.
Product type
9505Festive décor → REACH, GPSR6204Apparel → + PFAS, azo dyes9405Electrical lighting → + CE, RoHS9503Toys → + EN 71, tighter phthalates
Destination market
- EU only → REACH + GPSR + PPWR
- US only → CPSC + Prop 65 + UFLPA
- Both → dual stack; one submission has to satisfy EN and ASTM
Trigger conditions
- China origin → UFLPA presumption
- Non-EU factory → EU representative required
- Electrical parts → CE + RoHS
- Children's use → tighter thresholds
From three inputs to an addressed ruleset
L1 Scope router
Reads product, market and triggers. Holds no rules itself.
L1-compliance-scope.mdRule addresses
Returns the exact L2 sections to open — nothing more.
L2 Rule book
Opens only those sections: thresholds, dates, exemptions, enforcement precedent.
Assessment
CN·JS-01 — festive décor, CN → EU + US.
Why the two layers stay separate
L1 is the index; L2 is the rule book. Updating a threshold cannot break the routing, and adding a route cannot corrupt a rule — which is also what makes expansion cheap (05).
How a rule gets read without being misread
Four checks, in this order. Getting any one of them wrong changes the answer — not just the wording.
-
1
Classify the product first
A decorative item with LED lights is not
HS 9505— it isHS 9405. That one reclassification swaps general product safety for electrical safety: different testing, different marking. Everything downstream inherits it. -
2
Separate process use from presence in the article
"The factory used n-hexane" is not "the article contains n-hexane" — most of it evaporates during coating. The obligation attaches to residual content in the finished article, which only a residual test settles.
-
3
Use the right denominator, then check exemptions
The 0.1% SVHC threshold is measured on total finished-article weight, not per coating or component. Read against the wrong denominator, a compliant article looks like a violation — or the reverse.
-
4
Name the entity that carries the obligation
Under REACH the EU importer owes the SCIP notification, not the factory. But if the factory withholds the data, that liability returns as a cost claim under the supply contract.
Four misreadings we correct on sight
What we hold, and what has to be asked for
Knowing the rule is not the same as being able to prove it. Naming that boundary turns a blanket document request into four specific asks with a named holder and a deadline.
In our own records
Only the factory has it
What the map is for
Every ✕ becomes one line in the data request: which document, who issues it, which framework it closes, by when. Until it arrives the assessment runs on a worst case and says so — a stated confidence, never a silent guess.
How it stays current
Three tiers of signal: what the law says, what is actually being stopped, and what is coming. Most teams run only the first.
Law — primary sources Weekly sweep
Enforcement — where the judgment is On every alert
Early warning — 6 to 12 months out Continuous watch
From signal to client action
Source, date, tier, raw text kept verbatim.
Sets urgency and who needs to hear it.
Threshold, date or exemption edited, version stamped.
L1 runs in reverse across the book.
Named client, named document, named deadline.
The distinction that causes most of the damage
Enters into force is not shall apply from. GPSR entered into force June 2023 and applied from December 2024 — an eighteen-month gap. In the worked example CN·JS-01 has shipped without an EU representative for over a year and a half, because the two dates were read as one. L2 records both; the router keys off the second.
How coverage keeps expanding
Three axes, one intake path. Because the index and the rule book are separate, new coverage never re-opens settled rules.
New product category
A category we already finance but cannot yet scope — footwear, small appliances, furniture. Entry point is always the HS code.
New destination market
UK, Japan, Canada, Gulf states — each with its own authority, local-representative rule and accepted proof format.
New buyer requirement set
Large retailers run restricted-substance lists stricter than law. Passing the regulation and failing the buyer's list still costs the order.
What triggers a build
- Portfolio exposure first. A category or market we already finance outranks one that is merely interesting.
- An enforcement case we could not classify. Tier 2 surfaced it; the KB had no answer.
- A question the agent declined. Logged every time, then read as a build queue.
- A tier 3 signal firming up. We build before it applies, not after.
What a build must satisfy to publish
- A primary source cited — regulator or official journal, never a secondary summary alone.
- Both dates recorded separately — in force, and applies from.
- Thresholds with their denominator — the number means nothing without it.
- Evidence type named — which document proves it, and who issues it.
- Back-filled and versioned — past assessments the rule would have changed are re-scored, and any assessment can be replayed against the rule text as it stood that day.
How we audit our own blind spots
A knowledge base that never reports a gap is unaudited, not complete. Two kinds exist, detected differently, each with its own closing discipline.
Knowledge gap
Data gap
Both appeared in the worked example
Knowledge: PFAS confirmed as scoped to clothing, not decorative hardgoods — two hours' work that removed a testing requirement from the supplier.
Data: no BOM on file for CN·JS-01, so SVHC sits at category level. Stated confidence 72%, and it moves the moment the BOM lands.
One assessment, six readers
The value is not the knowledge base — it is what each reader decides differently because of it. Same rules, same evidence, same confidence score; six renderings.
Exposure surfaces before the chargeback does
A first meeting that isn't about the rate
Compliance stated as a repayment risk
Keep this order, then next season's
Source it compliant the first time
Evidence where an assurance used to go
One knowledge base, six outputs
The intelligence layer is shared and versioned; only the rendering differs. The assessment is written once and read six ways — a risk flag, an opener, memo language, a roadmap, a sourcing filter, an evidence index.