compliance-remediation

# Compliance Remediation Fix compliance issues to unblock market entry. Focus: reformulate, relabel, test, certify. Practical actions with timelines and cost estimates. ## MCP Tools for Remediation Before remediating, pull the test details to understand exactly what failed: ``` # 1. Get full failure details for a compliance test mcp__bastion__get-compliance-test-detail(testId="<test-id>") # Returns: test name, status, failing assets, expected evidence, linked policies # 2. Upload evidence documents (base64-encoded) mcp__bastion__upload-compliance-document(name="CPSR-GlowSerum-2026.pdf", document="data:application/pdf;base64,...") # Returns: evidenceDocumentId # 3. Attach evidence to a failing test mcp__bastion__add-compliance-test-evidence(testId="<test-id>", name="Product safety report", description="CPSR and stability tests for Glow Serum", evidenceDocumentId="<doc-id>") # OR link to an external URL: mcp__bastion__add-compliance-test-evidence(testId="<test-id>", name="Lab test results", description="EN 71 testing by SGS", link="https://example.com/report.pdf") # 4. Mark test ready for auditor review mcp__bastion__mark-compliance-test-ready-for-review(testId="<test-id>") # 5. Exclude a test entirely (with justification and expiry) mcp__bastion__exclude-compliance-test(testId="<test-id>", comment="Not applicable -- product line discontinued", excludeUntil="2027-01-01") # 6. Exclude specific assets from a test (per-asset granularity) mcp__bastion__put-compliance-test-exclude-asset(testsToUpdate=[{"testId": "<test-id>", "assetId": "<asset-id>", "comment": "Dev environment -- not in scope"}]) # 7. Refresh a test after remediation to re-evaluate status mcp__bastion__refresh-compliance-test(complianceIntegrationConfigurationId="<config-id>", testIds=["<test-id>"]) ``` **Workflow**: get-compliance-test-detail -> fix the issue -> upload-compliance-document -> add-compliance-test-evidence -> refresh-compliance-test -> mark-compliance-test-ready-for-review. ## Decision Tree When a compliance check returns FLAG, FAIL, or NEEDS_REVIEW, follow this tree: ```dot digraph { rankdir=TB; node [shape=box style=rounded fontsize=10]; issue [label="Compliance issue\nidentified"]; type [label="What type?" shape=diamond]; ban [label="BANNED SUBSTANCE"]; restrict [label="RESTRICTED SUBSTANCE\n(over limit)"]; label_wrong [label="LABELING\nNON-COMPLIANT"]; cert_missing [label="CERTIFICATION\nMISSING"]; test_missing [label="TESTING\nMISSING"]; reg_missing [label="REGISTRATION\nMISSING"]; reformulate [label="REFORMULATE\nReplace ingredient or\nreduce concentration"]; relabel [label="RELABEL\nUpdate packaging\nto meet requirements"]; certify [label="CERTIFY\nApply for certification\nfrom accredited body"]; test [label="TEST\nCommission lab testing\nfrom accredited lab"]; register [label="REGISTER\nSubmit notification\nor registration"]; exit [label="EXIT MARKET\nDrop this market\n(last resort)"]; issue -> type; type -> ban; type -> restrict; type -> label_wrong; type -> cert_missing; type -> test_missing; type -> reg_missing; ban -> reformulate [label="can replace"]; ban -> exit [label="essential\ningredient"]; restrict -> reformulate [label="reduce conc."]; restrict -> relabel [label="add warning\n(if allowed)"]; label_wrong -> relabel; cert_missing -> certify; test_missing -> test; reg_missing -> register; } ``` ## Remediation Playbooks ### Playbook 1: Banned Substance -- Reformulate **Trigger**: Ingredient is on banned list (EU Annex II, CPSIA prohibited, etc.) **Steps**: 1. Identify the banned substance and the specific regulation 2. Find compliant alternatives with similar function 3. Reformulate with alternative ingredient 4. Test new formulation for safety and stability 5. Update CPSR/safety assessment with new formulation 6. Update labels with new ingredients list 7. Re-notify on regulatory portals (CPNP, FDA, etc.) **Timeline**: 8-24 weeks (depending on complexity) **Cost**: EUR 3,000-20,000 (reformulation + testing + safety assessment) **Common reformulation scenarios**: | Banned Ingredient | Function | Alternatives | Notes | |-------------------|----------|-------------|-------| | Certain parabens (EU restricted) | Preservative | Phenoxyethanol, potassium sorbate, sodium benzoate | Check new preservative efficacy via challenge test | | Titanium dioxide (EU food ban) | Colorant/opacifier | Calcium carbonate, rice starch | Still allowed in EU cosmetics | | Certain PFAS | Water/oil repellent | Silicone alternatives, wax-based | Check state-specific PFAS definitions | | Lead above limit | Colorant contaminant | Purify source, change supplier | Common in imported cosmetics | | Certain phthalates (CPSIA) | Plasticizer | DINCH, DEHT, citrate esters | For toys/children's products | ### Playbook 2: Restricted Substance -- Reduce or Warn **Trigger**: Ingredient is allowed but over the concentration limit, or requires specific warnings **Steps**: 1. Identify the exact limit for this substance in this market 2. Check your current concentration 3. Option A: Reduce concentration below limit, reformulate 4. Option B: Add required warning label (if regulation allows it, e.g., Prop 65) 5. Option C: Apply for exemption (rare, lengthy process) 6. Re-test to confirm new concentration 7. Update documentation **Timeline**: 4-12 weeks **Cost**: EUR 1,000-8,000 **Common restriction scenarios**: | Substance | Market | Limit | Action if over | |-----------|--------|-------|----------------| | Retinol | EU (2025) | 0.3% face, 0.05% body | Reduce concentration | | Prop 65 substances | US-CA | Safe harbor levels vary | Add Prop 65 warning OR reduce below safe harbor | | 26 allergens | EU cosmetics | 0.01% (rinse-off), 0.001% (leave-on) | Must list on label; cannot reformulate away fragrance | | Heavy metals | EU/US | Varies by metal | Purify ingredients, change supplier | | RoHS substances | EU electronics | 0.1% (most), 0.01% (Cd) | Change component supplier | ### Playbook 3: Labeling Non-Compliant -- Relabel **Trigger**: Label is missing required elements, wrong language, wrong format **Steps**: 1. Identify all non-compliant elements (use `labeling-compliance` skill) 2. Design new compliant label 3. Get label reviewed by local expert (especially for language/legal terms) 4. Print new labels 5. Apply to existing stock (sticker overlay if allowed) or repackage **Timeline**: 2-6 weeks **Cost**: EUR 500-3,000 (design + translation + printing) **Sticker overlay rules**: - EU: Stickers allowed if they cover the non-compliant text AND include all required information - US: Stickers allowed if they do not obscure required information - Most markets: Temporary stickers acceptable for existing stock; new production must have corrected labels ### Playbook 4: Missing Certification -- Certify **Trigger**: Product requires CE, UKCA, FCC, or other conformity certification **Decision**: Self-declare or use notified body? | Product | Self-Declaration | Notified Body Required | |---------|-----------------|----------------------| | Most consumer electronics | CE (LVD + EMC) | CE (RED for radio, some LVD categories) | | Toys (most categories) | Not allowed in EU | EN 71 type examination required | | Medical devices | Class I only | Class IIa and above | | Simple general products | GPSR self-assessment | Not required | | Electrical safety (US) | FCC (some categories) | UL/NRTL listing (strongly expected) | **Steps for CE marking (self-declaration)**: 1. Identify applicable directives (LVD, EMC, RED, RoHS) 2. Identify harmonized standards 3. Commission testing at accredited lab 4. Prepare technical documentation (test reports, design docs, risk assessment) 5. Write Declaration of Conformity 6. Affix CE mark to product 7. Keep documentation for 10 years **Steps for CE marking (notified body)**: 1. Select a Notified Body from NANDO database 2. Submit application with product samples + documentation 3. NB performs type examination 4. Receive type examination certificate 5. Implement production quality system (if required) 6. Affix CE mark with NB number **Finding accredited labs and notified bodies**: | Region | Database | URL | |--------|----------|-----| | EU | NANDO | ec.europa.eu/growth/tools-databases/nando | | US | NVLAP | nvlap.nist.gov | | UK | UKAS | ukas.com | | Global | IECEE CB Scheme | iecee.org | ### Playbook 5: Missing Testing -- Commission Lab Test **Trigger**: Safety test, stability test, or microbiological test required but not done **Common tests by product category**: | Product | Required Tests | Accredited Lab Cost | Timeline | |---------|---------------|--------------------| ---------| | Cosmetics | Stability (accelerated + real-time), microbio, preservative efficacy, patch test (if needed) | EUR 1,500-5,000 | 4-12 weeks | | Cosmetics (with SPF) | SPF testing (in vivo or in vitro), UVA protection | EUR 3,000-8,000 | 6-12 weeks | | Electronics | EMC testing, safety testing (LVD), environmental testing | EUR 3,000-15,000 | 4-12 weeks | | Toys | EN 71-1 (mechanical), 71-2 (flammability), 71-3 (migration), 71-9 (organic chemicals) | EUR 2,000-8,000 | 6-16 weeks | | Food | Nutritional analysis, contaminant testing, shelf-life study | EUR 500-3,000 | 2-8 weeks | | Textiles | REACH compliance, azo dyes, formaldehyde, fiber composition | EUR 500-3,000 | 2-4 weeks | **Choosing a lab**: - Must be accredited (ISO 17025) for the specific test - Check if the target market accepts the lab's accreditation (EU accepts labs with EU member state accreditation; some countries require in-country testing) - Get quotes from 3 labs minimum ### Playbook 6: Missing Registration -- Register **Trigger**: Product must be notified or registered before sale **Steps vary by market** (see `market-entry-checklist` skill for full details): - EU cosmetics: CPNP notification (free, requires CPSR) - US cosmetics: FDA MoCRA registration (free) - UK cosmetics: UK SCPN (free, requires UK RP) - EU food: Food business operator registration with member state authority - US food: FDA facility registration + prior notice for imports **Timeline**: Usually 1-5 days once documentation is ready **Cost**: Usually free (but requires all upstream documentation to be complete) ## Remediation Priority Matrix When you have multiple issues to fix: | Priority | Criteria | Do first | |----------|----------|----------| | **P0** | Blocks ALL markets (e.g., banned substance in core formulation) | Reformulate | | **P1** | Blocks largest market (e.g., missing CE for EU) | Certify/test | | **P2** | Blocks secondary markets (e.g., wrong label language) | Relabel | | **P3** | Warning/flag (e.g., Prop 65 for California) | Add warning | | **P4** | Nice to have (e.g., voluntary certification) | Defer | ## Partner Recommendations ### Types of partners you may need: | Partner | When you need them | How to find | Typical cost | |---------|-------------------|-------------|-------------| | **Safety assessor** | CPSR for EU cosmetics | Look for Qualified Person (Article 10, Reg 1223/2009), toxicology background | EUR 1,500-5,000/product | | **Regulatory consultant** | Complex classification, multi-market strategy | Industry associations (e.g., Cosmetics Europe, CTFA) | EUR 150-300/hour | | **Test lab** | Product safety, EMC, stability testing | NANDO, NVLAP, UKAS databases | Varies by test | | **Customs broker** | Import procedures, HS classification | National customs broker associations | EUR 50-200/shipment | | **Responsible Person service** | EU/UK RP if you are not based there | Search "responsible person cosmetics [country]" | EUR 500-3,000/year | | **Translation service** | Label translations (technical/legal accuracy) | Specialized in regulatory translations, NOT general translation | EUR 200-500/language | | **Certification body** | CE/UKCA notified body certification | NANDO database | Varies by product | ## Output Format For each compliance issue, generate a remediation card: ``` REMEDIATION CARD -- [Issue ID] Product: [name] Market: [market] Issue: [description] Type: [banned substance / restricted / label / cert / test / registration] Severity: [P0 / P1 / P2 / P3 / P4] REQUIRED ACTION: 1. [Step] -- [who] -- [deadline] 2. [Step] -- [who] -- [deadline] 3. [Step] -- [who] -- [deadline] ESTIMATED COST: EUR/USD [amount] ESTIMATED TIMELINE: [weeks] PARTNER NEEDED: [yes/no -- if yes, what type] ALTERNATIVE: [if reformulation is too expensive, what else?]