compliance-remediation

name	compliance-remediation
description	Use when fixing compliance issues to unblock market entry, deciding between reformulation or relabeling, finding testing labs or certification bodies, or answering "how do I fix this compliance problem?"

Compliance Remediation

Fix compliance issues to unblock market entry. Focus: reformulate, relabel, test, certify. Practical actions with timelines and cost estimates.

MCP Tools for Remediation

Before remediating, pull the test details to understand exactly what failed:

# 1. Get full failure details for a compliance test
mcp__bastion__get-compliance-test-detail(testId="<test-id>")
# Returns: test name, status, failing assets, expected evidence, linked policies

# 2. Upload evidence documents (base64-encoded)
mcp__bastion__upload-compliance-document(name="CPSR-GlowSerum-2026.pdf", document="data:application/pdf;base64,...")
# Returns: evidenceDocumentId

# 3. Attach evidence to a failing test
mcp__bastion__add-compliance-test-evidence(testId="<test-id>", name="Product safety report", description="CPSR and stability tests for Glow Serum", evidenceDocumentId="<doc-id>")
# OR link to an external URL:
mcp__bastion__add-compliance-test-evidence(testId="<test-id>", name="Lab test results", description="EN 71 testing by SGS", link="https://example.com/report.pdf")

# 4. Mark test ready for auditor review
mcp__bastion__mark-compliance-test-ready-for-review(testId="<test-id>")

# 5. Exclude a test entirely (with justification and expiry)
mcp__bastion__exclude-compliance-test(testId="<test-id>", comment="Not applicable -- product line discontinued", excludeUntil="2027-01-01")

# 6. Exclude specific assets from a test (per-asset granularity)
mcp__bastion__put-compliance-test-exclude-asset(testsToUpdate=[{"testId": "<test-id>", "assetId": "<asset-id>", "comment": "Dev environment -- not in scope"}])

# 7. Refresh a test after remediation to re-evaluate status
mcp__bastion__refresh-compliance-test(complianceIntegrationConfigurationId="<config-id>", testIds=["<test-id>"])

Workflow: get-compliance-test-detail -> fix the issue -> upload-compliance-document -> add-compliance-test-evidence -> refresh-compliance-test -> mark-compliance-test-ready-for-review.

Decision Tree

When a compliance check returns FLAG, FAIL, or NEEDS_REVIEW, follow this tree:

digraph {
  rankdir=TB; node [shape=box style=rounded fontsize=10];
  issue [label="Compliance issue\nidentified"];
  type [label="What type?" shape=diamond];
  
  ban [label="BANNED SUBSTANCE"];
  restrict [label="RESTRICTED SUBSTANCE\n(over limit)"];
  label_wrong [label="LABELING\nNON-COMPLIANT"];
  cert_missing [label="CERTIFICATION\nMISSING"];
  test_missing [label="TESTING\nMISSING"];
  reg_missing [label="REGISTRATION\nMISSING"];
  
  reformulate [label="REFORMULATE\nReplace ingredient or\nreduce concentration"];
  relabel [label="RELABEL\nUpdate packaging\nto meet requirements"];
  certify [label="CERTIFY\nApply for certification\nfrom accredited body"];
  test [label="TEST\nCommission lab testing\nfrom accredited lab"];
  register [label="REGISTER\nSubmit notification\nor registration"];
  exit [label="EXIT MARKET\nDrop this market\n(last resort)"];
  
  issue -> type;
  type -> ban; type -> restrict; type -> label_wrong;
  type -> cert_missing; type -> test_missing; type -> reg_missing;
  
  ban -> reformulate [label="can replace"];
  ban -> exit [label="essential\ningredient"];
  restrict -> reformulate [label="reduce conc."];
  restrict -> relabel [label="add warning\n(if allowed)"];
  label_wrong -> relabel;
  cert_missing -> certify;
  test_missing -> test;
  reg_missing -> register;
}

Remediation Playbooks

Playbook 1: Banned Substance -- Reformulate

Trigger: Ingredient is on banned list (EU Annex II, CPSIA prohibited, etc.)

Steps:

1. Identify the banned substance and the specific regulation
2. Find compliant alternatives with similar function
3. Reformulate with alternative ingredient
4. Test new formulation for safety and stability
5. Update CPSR/safety assessment with new formulation
6. Update labels with new ingredients list
7. Re-notify on regulatory portals (CPNP, FDA, etc.)

Timeline: 8-24 weeks (depending on complexity) Cost: EUR 3,000-20,000 (reformulation + testing + safety assessment)

Common reformulation scenarios:

Banned Ingredient	Function	Alternatives	Notes
Certain parabens (EU restricted)	Preservative	Phenoxyethanol, potassium sorbate, sodium benzoate	Check new preservative efficacy via challenge test
Titanium dioxide (EU food ban)	Colorant/opacifier	Calcium carbonate, rice starch	Still allowed in EU cosmetics
Certain PFAS	Water/oil repellent	Silicone alternatives, wax-based	Check state-specific PFAS definitions
Lead above limit	Colorant contaminant	Purify source, change supplier	Common in imported cosmetics
Certain phthalates (CPSIA)	Plasticizer	DINCH, DEHT, citrate esters	For toys/children's products

Playbook 2: Restricted Substance -- Reduce or Warn

Trigger: Ingredient is allowed but over the concentration limit, or requires specific warnings

Steps:

1. Identify the exact limit for this substance in this market
2. Check your current concentration
3. Option A: Reduce concentration below limit, reformulate
4. Option B: Add required warning label (if regulation allows it, e.g., Prop 65)
5. Option C: Apply for exemption (rare, lengthy process)
6. Re-test to confirm new concentration
7. Update documentation

Timeline: 4-12 weeks Cost: EUR 1,000-8,000

Common restriction scenarios:

Substance	Market	Limit	Action if over
Retinol	EU (2025)	0.3% face, 0.05% body	Reduce concentration
Prop 65 substances	US-CA	Safe harbor levels vary	Add Prop 65 warning OR reduce below safe harbor
26 allergens	EU cosmetics	0.01% (rinse-off), 0.001% (leave-on)	Must list on label; cannot reformulate away fragrance
Heavy metals	EU/US	Varies by metal	Purify ingredients, change supplier
RoHS substances	EU electronics	0.1% (most), 0.01% (Cd)	Change component supplier

Playbook 3: Labeling Non-Compliant -- Relabel

Trigger: Label is missing required elements, wrong language, wrong format

Steps:

1. Identify all non-compliant elements (use labeling-compliance skill)
2. Design new compliant label
3. Get label reviewed by local expert (especially for language/legal terms)
4. Print new labels
5. Apply to existing stock (sticker overlay if allowed) or repackage

Timeline: 2-6 weeks Cost: EUR 500-3,000 (design + translation + printing)

Sticker overlay rules:

• EU: Stickers allowed if they cover the non-compliant text AND include all required information
• US: Stickers allowed if they do not obscure required information
• Most markets: Temporary stickers acceptable for existing stock; new production must have corrected labels

Playbook 4: Missing Certification -- Certify

Trigger: Product requires CE, UKCA, FCC, or other conformity certification

Decision: Self-declare or use notified body?

Product	Self-Declaration	Notified Body Required
Most consumer electronics	CE (LVD + EMC)	CE (RED for radio, some LVD categories)
Toys (most categories)	Not allowed in EU	EN 71 type examination required
Medical devices	Class I only	Class IIa and above
Simple general products	GPSR self-assessment	Not required
Electrical safety (US)	FCC (some categories)	UL/NRTL listing (strongly expected)

Steps for CE marking (self-declaration):

1. Identify applicable directives (LVD, EMC, RED, RoHS)
2. Identify harmonized standards
3. Commission testing at accredited lab
4. Prepare technical documentation (test reports, design docs, risk assessment)
5. Write Declaration of Conformity
6. Affix CE mark to product
7. Keep documentation for 10 years

Steps for CE marking (notified body):

1. Select a Notified Body from NANDO database
2. Submit application with product samples + documentation
3. NB performs type examination
4. Receive type examination certificate
5. Implement production quality system (if required)
6. Affix CE mark with NB number

Finding accredited labs and notified bodies:

Region	Database	URL
EU	NANDO	ec.europa.eu/growth/tools-databases/nando
US	NVLAP	nvlap.nist.gov
UK	UKAS	ukas.com
Global	IECEE CB Scheme	iecee.org

Playbook 5: Missing Testing -- Commission Lab Test

Trigger: Safety test, stability test, or microbiological test required but not done

Common tests by product category:

Product	Required Tests	Accredited Lab Cost	Timeline
Cosmetics	Stability (accelerated + real-time), microbio, preservative efficacy, patch test (if needed)	EUR 1,500-5,000	4-12 weeks
Cosmetics (with SPF)	SPF testing (in vivo or in vitro), UVA protection	EUR 3,000-8,000	6-12 weeks
Electronics	EMC testing, safety testing (LVD), environmental testing	EUR 3,000-15,000	4-12 weeks
Toys	EN 71-1 (mechanical), 71-2 (flammability), 71-3 (migration), 71-9 (organic chemicals)	EUR 2,000-8,000	6-16 weeks
Food	Nutritional analysis, contaminant testing, shelf-life study	EUR 500-3,000	2-8 weeks
Textiles	REACH compliance, azo dyes, formaldehyde, fiber composition	EUR 500-3,000	2-4 weeks

Choosing a lab:

• Must be accredited (ISO 17025) for the specific test
• Check if the target market accepts the lab's accreditation (EU accepts labs with EU member state accreditation; some countries require in-country testing)
• Get quotes from 3 labs minimum

Playbook 6: Missing Registration -- Register

Trigger: Product must be notified or registered before sale

Steps vary by market (see market-entry-checklist skill for full details):

• EU cosmetics: CPNP notification (free, requires CPSR)
• US cosmetics: FDA MoCRA registration (free)
• UK cosmetics: UK SCPN (free, requires UK RP)
• EU food: Food business operator registration with member state authority
• US food: FDA facility registration + prior notice for imports

Timeline: Usually 1-5 days once documentation is ready Cost: Usually free (but requires all upstream documentation to be complete)

Remediation Priority Matrix

When you have multiple issues to fix:

Priority	Criteria	Do first
P0	Blocks ALL markets (e.g., banned substance in core formulation)	Reformulate
P1	Blocks largest market (e.g., missing CE for EU)	Certify/test
P2	Blocks secondary markets (e.g., wrong label language)	Relabel
P3	Warning/flag (e.g., Prop 65 for California)	Add warning
P4	Nice to have (e.g., voluntary certification)	Defer

Partner Recommendations

Types of partners you may need:

Partner	When you need them	How to find	Typical cost
Safety assessor	CPSR for EU cosmetics	Look for Qualified Person (Article 10, Reg 1223/2009), toxicology background	EUR 1,500-5,000/product
Regulatory consultant	Complex classification, multi-market strategy	Industry associations (e.g., Cosmetics Europe, CTFA)	EUR 150-300/hour
Test lab	Product safety, EMC, stability testing	NANDO, NVLAP, UKAS databases	Varies by test
Customs broker	Import procedures, HS classification	National customs broker associations	EUR 50-200/shipment
Responsible Person service	EU/UK RP if you are not based there	Search "responsible person cosmetics [country]"	EUR 500-3,000/year
Translation service	Label translations (technical/legal accuracy)	Specialized in regulatory translations, NOT general translation	EUR 200-500/language
Certification body	CE/UKCA notified body certification	NANDO database	Varies by product

Output Format

For each compliance issue, generate a remediation card:

REMEDIATION CARD -- [Issue ID]
Product: [name]
Market: [market]
Issue: [description]
Type: [banned substance / restricted / label / cert / test / registration]
Severity: [P0 / P1 / P2 / P3 / P4]

REQUIRED ACTION:
1. [Step] -- [who] -- [deadline]
2. [Step] -- [who] -- [deadline]
3. [Step] -- [who] -- [deadline]

ESTIMATED COST: EUR/USD [amount]
ESTIMATED TIMELINE: [weeks]
PARTNER NEEDED: [yes/no -- if yes, what type]
ALTERNATIVE: [if reformulation is too expensive, what else?]