ACCEPTABLE QUALITY LIMIT (AQL) FOR PRODUCT INSPECTIONS

The same toy, sold in Boston and in Berlin, is two different legal products.

Different age scopes. Different chemical limits. Different documents. Different laboratories. And since 1 January 2026, a different kind of document entirely on the European side: a mark that has to be physically present on the toy itself.

This guide is for importers who sell into both markets and are tired of discovering the difference at the border.

What changed on 1 January 2026

Regulation (EU) 2025/2509 on the safety of toys entered into force. It repeals the Toy Safety Directive that has governed the European market since 2009, extends the chemical prohibitions to endocrine disruptors, PFAS and bisphenols, and replaces the paper declaration of conformity with a **digital product passport**. The passport is not a file you keep. The regulation states that **the data carrier shall be physically present on the toy or on an affixed label**. It is a mark on the product, and customs will check it.

Two Markets, Two Regimes, One Toy

	United States	European Union
The law	CPSIA (2008)	Regulation (EU) 2025/2509, in force since 1 January 2026, repealing Directive 2009/48/EC
The toy standard	ASTM F963-23, mandatory for toys made on or after 20 April 2024	EN 71, as the harmonised standard
Who is a child	Certification regime applies to 12 and under. ASTM F963 itself covers toys for children under 14.	Toys for children under 14
The document	Children's Product Certificate	Digital product passport, replacing the declaration of conformity
The laboratory	A laboratory accepted by the CPSC, rule by rule	A notified body, in the cases where one is required
Chemicals	Lead, phthalates, heavy elements	Wider: CMR substances, plus endocrine disruptors, PFAS and bisphenols
At the border	CPSC eFiling, mandatory since 8 July 2026	Customs may retrieve and use the passport data for customs controls and release for free circulation

Two of those rows changed in 2026. Both changed in the same direction: the paperwork moved onto the product, and customs is now the one checking.

What the United States Requires: CPSIA and ASTM F963

The US regime is a certification regime. You test, you certify, and you file.

[CHECKLIST] - Lead: 100 ppm total content in any accessible component part, painted or not. 90 ppm in paint and surface coatings. Both apply to a painted metal toy. - Phthalates: eight prohibited above 0.1 per cent in any accessible component part. - Small parts: a toy for a child under three must not contain a part that fits in the small parts cylinder, before or after use and abuse testing. - ASTM F963-23: the mandatory toy safety standard, for toys manufactured on or after 20 April 2024. - Third-party testing: by a laboratory accepted by the CPSC. Acceptance is granted rule by rule, so a laboratory accepted for lead content is not automatically accepted for ASTM F963. - Children's Product Certificate: issued by you, the importer, on the strength of that testing. - Tracking label: permanent, on the product and on the packaging. - eFiling: since 8 July 2026, the certificate data is transmitted electronically to US Customs at the moment of entry. [/CHECKLIST]

Our CPSIA compliance guide covers all of this in full, including the eFiling change and what the seven certificate data elements actually are.

What Europe Now Requires: Regulation (EU) 2025/2509

On 26 November 2025 the European Parliament and Council adopted a new Regulation on the safety of toys. It was published in the Official Journal in December and entered into force on 1 January 2026. It repeals Directive 2009/48/EC, and it does three things that matter to an importer.

It widens the chemistry. The old directive prohibited CMR substances: carcinogenic, mutagenic and toxic for reproduction. The regulation extends the generic prohibitions to endocrine disruptors (category 1 or 2), to substances toxic to specific target organs, to respiratory and skin sensitisers, and explicitly to PFAS intentionally used in toys and to bisphenols. If your toy has a water-resistant coating, a printed surface or a polycarbonate part, the chemistry question has just been reopened. California has been moving in the same direction, and our Prop 65 compliance guide covers the US state-level equivalent.

It replaces the paper. The declaration of conformity gives way to a digital product passport. See section 6: this is the change with the sharpest operational consequences.

It reaches the marketplace, and this is the part sellers have not understood. The regulation provides that information referring to an offer of toys sold or promoted in online marketplaces, where those toys are not in conformity with it, shall be considered illegal content for the purposes of the Digital Services Act. Not poor practice. Illegal content, in the same legal category the Digital Services Act uses for everything else it obliges platforms to remove.

And it names what the marketplace must then do: providers of online marketplaces have to comply with the notice, action and traceability obligations of the Digital Services Act, and with the marketplace obligations of the General Product Safety Regulation.

Selling a non-compliant toy through a European marketplace is no longer only your problem. It is the marketplace's legal problem, which means the marketplace will make it yours, faster and with less conversation than a regulator would.

It puts the passport in the hands of customs. The regulation provides that the Commission and the customs authorities may retrieve and use the passport data for their duties under Union law, including risk management, customs controls, and release for free circulation. Those verifications are carried out against a list of commodity codes set out in an annex to the regulation. Your toy's compliance record and your customs entry now read from the same file.

The transition is long. That is exactly what makes it dangerous.

Full application is set for 1 August 2030, and until then a toy may be placed on the market under either the old directive or the new regulation. Four and a half years feels like plenty of time. Some provisions do apply from January 2026, but in fairness they concern the designation of notified bodies and the Commission's own procedures, not new obligations on you. Nothing is forcing your hand this quarter. Here is why that is the trap. The digital product passport requires supplier data you do not currently collect, on materials you have never had analysed, carried on a physical mark your factory does not yet apply. That is a supply chain programme, not a printing job, and it runs through factories in Asia that have not heard of it either. Four and a half years is not the time you have. It is the time the work takes.

The Age Trap: 12, 14, and the Toy That Falls Between Them

This is the trap that catches importers who assume the two regimes line up. They do not, and the mismatch is not where people expect.

Threshold	What it governs
12 and under	The CPSIA certification regime. A product designed or intended primarily for children of 12 or under is a "children's product": it needs third-party testing by a CPSC-accepted laboratory and a Children's Product Certificate.
Under 14	The scope of ASTM F963, the US toy safety standard itself.
Under 14	The scope of the European regulation.

Now take a toy aimed at a thirteen-year-old.

It is within the scope of ASTM F963, because the standard covers toys for children under 14. It is outside the CPSIA children's product certification regime, because that regime stops at 12. And in Europe it is fully in scope, with no ambiguity at all.

One toy. Three different answers to a question that sounds simple: is this a children's product?

The practical consequence is that "we don't need a CPC, it's for teenagers" is not the end of the conversation. It is the beginning of a different one.

What Actually Gets Recalled

The most useful thing an importer can read is not a regulation. It is a recall notice, because a recall notice tells you what was found, on which part, and how many units it cost.

One recall, read slowly

In February 2024, the CPSC recalled a six-player croquet set, **sold exclusively on Amazon** between May 2015 and June 2021. About **113 units**. The hazard, as published: the paint or surface coating on **the red mallet, the blue mallet, the red hoop and the winning post** contained lead exceeding the federal lead paint ban. In addition, the coating on the red and blue mallets contained regulated phthalates above the permitted level.

The recall is on the components, not on the product. Four painted parts. Not the croquet set, not the balls, not the bag. The paint, on four specific items. That is where the risk lives in almost every toy recall: in the coating, the plating, the pigment, the soft plastic, the magnet. It is also, precisely, the part of the bill of materials that a supplier is most likely to substitute after your sample has been approved.

One hundred and thirteen units triggered a federal recall. "We are too small to matter" is not a compliance strategy.

And then there is the pattern, which is worse than any single recall.

Four magnet recalls in three weeks

Between 24 February and 12 March 2026, the CPSC published four separate recalls of magnetic toys, all for the same violation of the mandatory standard for toys. | Date | Product | Units | Sold on | Who imported it | | --- | --- | --- | --- | --- | | 24 Feb 2026 | Christmas-themed magnetic chess games | about 5,300 | **Amazon** | A Shenzhen technology company | | 26 Feb 2026 | Magnetic chess games | about 1,300 | **Amazon** | **A garment manufacturer** | | 26 Feb 2026 | Magnetic stick figure toy sets | about 130 | Walmart | A Shanghai technology company | | 12 Mar 2026 | Tabletop magnet chess games | **about 151,600** | **Amazon**, Etsy, game shops | A US company | All four were manufactured in China. The hazard, in the CPSC's words on the largest of them: the games violate the mandatory standard for toys because they contain loose high-powered magnets that fit within the CPSC's small parts cylinder. Swallowed, the magnets attract each other across the intestinal wall, which can cause perforation, blockage, blood poisoning and death.

Read the second row again.

The importer was a garment manufacturer. A clothing company, trading on Amazon under a different name, selling a magnetic toy that violates the federal toy standard. That tells you precisely how much toy safety expertise stood behind that listing, and it is the same amount that stands behind thousands of others.

The rest of the table is just as instructive. Three of the four importers are Chinese companies trading on a marketplace under an invented name, with small volumes: 130 units, 1,300, 5,300. The fourth is an American company, with 151,600 units, sold for seven years. Negligence has no nationality, and no size threshold.

This is not one bad supplier, and it is not an Amazon problem. It is a failure mode that nobody was inspecting for, repeating across marketplaces, in the space of a fortnight.

Note the dates on the sales windows. The magnet game with 151,600 units was sold from October 2018 to September 2025 and recalled in March 2026: seven years on the market. The croquet set was sold from 2015 to 2021 and recalled in 2024. The recall does not arrive at the port. It arrives years later, when the inventory has long since been sold, and the liability is still yours.

The failure modes recur, and every one of them is visible before the container is sealed:

What gets found	Where it hides
Lead in paint	The coating on one component, often applied on a later production run
Phthalates	Soft PVC, grips, coatings, printed surfaces
Lead and cadmium	Plated metal, jewellery findings, small metal parts
Loose high-powered magnets	Anything magnetic, if the magnet can separate and fit the small parts cylinder
Small parts	A component that detaches under use and abuse testing, not on arrival

The Digital Product Passport: A Mark on the Toy, Not a File in Your Drawer

This is the change with the sharpest consequences, and it is the one nobody has explained to importers.

Under the old directive, conformity was a document: a declaration of conformity, signed by the manufacturer, kept on file, produced on request. Under the regulation, it becomes a digital product passport, accessible through a data carrier.

And here is the sentence that changes the work, taken from the regulation itself:

The data carrier shall be physically present on the toy or on an affixed label. Where the size or nature of the toy does not allow it, it shall be affixed to the packaging, if any, or on documentation.

Why this is an inspection problem, not a paperwork problem

A laboratory cannot verify that the data carrier is on the toy. A laboratory sees the sample you sent it, months before the run. The mark has to be applied, correctly, on every unit, by a factory in Asia that has never heard of a digital product passport. Whether it is actually there, on the actual units, in the actual container, is a question that can only be answered by somebody standing in front of them. This is the same shape as the CPSIA tracking label, which Amazon already demands photographic proof of, on the physical product. Two regulators, two continents, the same answer: **the compliance mark is now on the goods, and somebody has to go and look.**

And customs can read it. The regulation gives the customs authorities access to the passport data, and lets them use it for risk management, customs controls and release for free circulation, matched against a list of commodity codes in an annex. Which means the European entry is about to look a great deal like the American one, where CPSC eFiling has required certificate data at the border since July 2026. See our guide to shipping from China to Amazon FBA for what that already looks like in practice.

Third-Party Testing: CPSC-Accepted Laboratories and Notified Bodies

The two regimes look similar and are not. The difference is procedural, and it runs the opposite way to what most importers assume.

The European regulation sets out two routes, and it is explicit about which one you take.

Route	When it applies
Internal production control	Where the manufacturer has applied harmonised standards, published in the Official Journal, covering all the relevant safety requirements identified in the safety assessment. No notified body.
EU-type examination	Everywhere else: where no standard covers the product, where the standards are applied only in part, and in the cases the regulation reserves for it. A notified body examines the type and issues a certificate.

Now put that beside the United States.

	United States	European Union
Is independent testing mandatory?	Yes. Every toy intended primarily for children 12 and under must be tested by a laboratory accepted by the CPSC and certified in a Children's Product Certificate. No exceptions.	Not always. Internal production control is available whenever the harmonised standards cover everything the safety assessment identified.
Who accredits	The CPSC, rule by rule	The notifying authority of a member state
The document	A Children's Product Certificate, citing each rule	A declaration of conformity, becoming a digital product passport

Read that first row again, because it produces a conclusion most people get backwards.

Europe is procedurally lighter and chemically heavier. The US forces you through an accredited laboratory and then holds you to a defined list of limits. Europe may let you assess your own conformity, and then holds you to a broader and more open-ended chemical prohibition, one that now reaches endocrine disruptors, PFAS and bisphenols.

And notice what the internal production control route actually rests on. It is available only where the harmonised standards cover all the safety requirements your own safety assessment identified. So the question is not "did I follow EN 71". The question is "did my safety assessment identify a hazard that EN 71 does not cover", and if it did, you are in EU-type examination whether you like it or not.

Self-assessment is not the absence of testing. It is the absence of somebody else checking your testing. On a chemical regime that has just been widened, that is a heavier responsibility, not a lighter one.

Selling Toys on Amazon: What Each Marketplace Asks For

	Amazon US	Amazon EU
Certificate	Children's Product Certificate	Declaration of conformity, moving to the digital product passport
Test reports	From a CPSC-accepted laboratory	To the harmonised standards
Marking	CPSIA tracking label, and Amazon requests photographs of it on the physical product	CE marking
Representation	Not required	An EU responsible person is required for products placed on the EU market

The photograph requirement on the US side is the one sellers are least prepared for, and it is the clearest illustration of where this is all heading. Amazon does not want your certificate. It wants a picture of the label, on the unit, showing the manufacturer, the location and date of production, and the batch.

That is not a laboratory deliverable. It is an inspection deliverable.

See our guide to product testing for Amazon FBA for why factory-supplied test reports are so often rejected, and our Amazon FBA requirements guide for everything Amazon checks at receiving.

Where the Inspection Fits

Everything on this page converges on a single point in time: the moment before the container is sealed, when the goods, the packaging, the markings and the documents are all in the same building, in Asia.

What an inspection can verify at the factory	What it costs if it is discovered later
That the paint on this production run is the paint that was tested	A recall on four painted components, like the one above
That the material in the container is the material in the laboratory report	A CPSIA violation, and a certificate you signed
That the tracking label is on the product, not only on the carton	An Amazon compliance rejection
That the data carrier for the digital product passport is physically on the toy	A European customs check you fail
That small parts stay attached, and that magnets stay captive	A recall, and possibly a child in hospital

AQF's pre-shipment inspection works from your specification and your approved sample, samples the lot under ISO 2859-1, and includes a functionality check. On the laboratory itself, one piece of advice, and we would give it about any laboratory including one we introduced you to. CPSC acceptance is granted rule by rule. Ask which rules, in writing, before your sample ships. A laboratory accepted for lead content is not accepted for ASTM F963 unless it applied for ASTM F963. Ask for the scope, not for the badge.

And remember what the laboratory report does not cover. It covers the sample it received. It says nothing about who chose that sample, nothing about the production run that followed it, and nothing about whether the data carrier is physically on the toy in the carton. Those are the questions AQF answers, at the factory, because that is where the answers are.

The laboratory certifies the sample. The inspection tells you what is in the container. On toys, more than on any other category, they are two halves of the same control, and neither works alone.

Frequently Asked Questions

What testing is required for toys sold in the United States?

Toys sold in the US must comply with CPSIA and with ASTM F963-23, the mandatory toy safety standard for toys manufactured on or after 20 April 2024. The core requirements are lead (100 ppm total content in any accessible component part, and 90 ppm in paint and surface coatings), the eight prohibited phthalates above 0.1 per cent in accessible component parts, and small parts for toys intended for children under three. For any toy intended primarily for children of 12 or under, the testing must be performed by a laboratory accepted by the CPSC, and the importer must issue a Children's Product Certificate. Since 8 July 2026, the certificate data must also be filed electronically with US Customs at the moment of entry.

What changed in EU toy safety law in 2026?

Regulation (EU) 2025/2509 on the safety of toys entered into force on 1 January 2026, repealing Directive 2009/48/EC. It widens the chemical prohibitions beyond CMR substances to include endocrine disruptors, substances toxic to specific organs, respiratory and skin sensitisers, and explicitly PFAS and bisphenols. It replaces the paper declaration of conformity with a digital product passport, accessible through a data carrier that must be physically present on the toy or on an affixed label. It places obligations on online marketplaces and fulfilment service providers, and it gives the Commission and the customs authorities the right to retrieve and use the passport data for risk management, customs controls and release for free circulation, matched against a list of commodity codes set out in an annex. Full application is set for 1 August 2030, with a transitional period during which toys may be placed on the market under either text.

What is the digital product passport for toys?

It is the document that replaces the declaration of conformity under the new EU toy regulation, and it is reached through a data carrier. The regulation provides that the data carrier shall be physically present on the toy or on an affixed label, and only where the size or nature of the toy does not allow this may it be affixed to the packaging or to documentation. The practical consequence for an importer is that compliance is no longer only a file: it is a mark that has to be correctly applied at the factory, on every unit, and verified there, because a laboratory only ever sees the sample.

Do US and EU toy regulations cover the same ages?

Not quite, and the mismatch catches people out. The US certification regime, meaning the Children's Product Certificate and third-party testing by a CPSC-accepted laboratory, applies to products intended primarily for children of 12 and under. ASTM F963 itself, the US toy safety standard, covers toys for children under 14, and the European regulation also covers toys for children under 14. So a toy aimed at a thirteen-year-old falls within the scope of ASTM F963, outside the CPSIA certification regime, and fully within the European regulation. One product, three different answers to the question of whether it is a children's product.

Is EN 71 the same as ASTM F963?

No. EN 71 is the European toy safety standard series and ASTM F963 is the American one. They cover comparable ground, including mechanical and physical properties, flammability, and the migration of certain elements, but they are different standards with different test methods and different limits. Passing one does not demonstrate compliance with the other, and a toy sold in both markets needs both.

Does the EU require third-party testing for toys?

Not in every case, which is the opposite of the US position. The regulation offers two routes. Where the manufacturer has applied harmonised standards, published in the Official Journal, that cover all the relevant safety requirements identified in its safety assessment, it uses the internal production control procedure and no notified body is involved. Otherwise it must use the EU-type examination procedure, where a notified body examines the type and issues a certificate. The US, by contrast, requires third-party testing by a CPSC-accepted laboratory for every toy intended primarily for children of 12 and under, without exception. The conclusion most importers draw from this is the wrong one: Europe is procedurally lighter and chemically heavier, and self-assessment means the absence of somebody else checking your work, not the absence of the work.

What are the most common reasons toys get recalled?

Component-level failures, not whole-product failures. Published CPSC recall notices repeatedly cite lead in the paint or surface coating on specific parts, regulated phthalates in coatings and soft plastics, lead and cadmium in plated metal, loose high-powered magnets that fit the small parts cylinder, and small parts that detach under use and abuse testing. In February 2024 the CPSC recalled a croquet set sold exclusively on Amazon because the paint on four components, two mallets, a hoop and a winning post, exceeded the federal lead limit, and the coating on two of them exceeded the phthalate limit. About 113 units were involved, so volume is no defence. And between 24 February and 12 March 2026 the CPSC published four separate recalls of magnetic toys for the same violation of the mandatory toy standard, three sold on Amazon and one on Walmart, ranging from about 130 units to about 151,600, all manufactured in China. In one of them the importer was a garment manufacturer. The pattern matters more than any single notice: the same defect repeats across sellers because nobody is inspecting for it at the factory.

How much does toy safety testing cost?

The cost depends on the scope rather than on a list price. What drives it is the number of separate components and materials that must be tested individually, how many regulations apply, whether mechanical and flammability testing is needed as well as chemical analysis, and how many markets you sell into, since US and EU testing are separate exercises on separate standards. A single-material plush toy is a small job. A painted wooden ride-on with metal fittings, an electrical component and a textile seat, sold in both the US and the EU, is not. Ask for a quote based on your bill of materials.

Can toys be tested in China?

Yes, and it is normal practice. What matters is the accreditation rather than the location: for the US market the laboratory must be accepted by the CPSC for the applicable rules, and that acceptance is granted rule by rule. Testing at source also means the result can be tied to what is actually shipped, because an inspection at the factory can confirm that the material in the container is the material that was tested, and that the required markings are physically on the units.

Does Amazon require special documents for toys?

Yes. In the US, Amazon requires a Children's Product Certificate and the supporting test reports from a CPSC-accepted laboratory before approving a seller in children's categories, and it also requests photographs of the CPSIA tracking label on the physical product, showing the manufacturer or private labeller, the location and date of production, and batch information. In the EU, Amazon requires CE marking and a declaration of conformity, and an EU responsible person must be designated for products placed on the European market. The photograph requirement is the one sellers are least prepared for, because it is not something a laboratory can produce.