M Legal, Regulatory and Sustainability Compliance

Selling clothing is a regulated activity. Governments tell you what must be printed on the label, what chemicals may be in the fabric, what you must prove about where the cotton was grown, and what you may say about the planet. This chapter walks a developer through those rules and, more importantly, through the records they force you to keep. In almost every case the legal question comes down to one thing: can you produce the document that proves it, today, on demand?

What you need to know first

Before the rules make sense you need a small vocabulary. Almost none of it is taught to programrs, and all of it will end up in your database.

A statute is a law passed by a legislature. A regulation is the detailed implementation an agency writes under a statute's authority. In the US, regulations are collected in the Code of Federal Regulations, or CFR. Guidance is the agency explaining what it thinks its own rules mean. Guidance is not binding, but ignoring it is how you end up in a fight you lose.

Read a citation like "16 CFR 303" as "title 16 of the Code of Federal Regulations, part 303" — the Federal Trade Commission's textile labeling rule. A citation like "15 U.S.C. 1278a" points at the United States Code, which holds the statutes.

An agency or regulator writes and enforces those rules. Four matter to a US apparel brand:

• The Federal Trade Commission (FTC) polices labels and advertising claims.
• The Consumer Product Safety Commission (CPSC) polices physical safety, especially for children.
• US Customs and Border Protection (CBP) controls what crosses the border and how much you pay to bring it in.
• And in California, the Office of Environmental Health Hazard Assessment (OEHHA) maintains the Proposition 65 chemical list.

Customs vocabulary: duty, entry and landed cost

A duty (the words duty and tariff are used interchangeably) is a tax you pay to the US government when goods enter the country. It is normally a percentage of the price you paid the factory. An entry is the filing that declares a shipment to Customs: what it is, where it is from, what it is worth, what duty is owed.

Landed cost is the true all-in cost of a unit once you add duty, freight, insurance and handling to the factory price. Your software will need it on every purchase order, because it is the number your margin is actually built on.

The importer of record is the legal person who tells Customs "this shipment is mine, here is what it is, here is the duty". That is you. Your factory does not take that role, and neither does your freight forwarder. It makes you responsible for the accuracy of everything on the entry, for years afterwards. A customs broker is a licensed agent who files the paperwork for you. Hiring one does not transfer the legal responsibility. It just means someone competent is typing.

The HTS (Harmonized Tariff Schedule) is a worldwide numbered catalog of every kind of goods. A cotton knit T-shirt is 6109.10.00. A woman's trouser made of synthetic fibers is 6104.63.20. The number sets the duty rate, and apparel rates are unusually high — 16.5% and 28.2% respectively as the schedule stood in July 2026. Those are the general rates that apply to most trading partners, before any extra program is stacked on top. Getting the number wrong causes systematic over- or under-payment, and Customs can reclaim the difference for years.

Country of origin has a narrow legal meaning. It is where the goods were substantially transformed into what they are. Where you shipped them from and where your brand is based have nothing to do with it. For textiles the US applies a specific rule hierarchy, 19 CFR 102.21, which we walk through later.

Certificates, declarations and restricted substances

A certificate is a signed statement that something complies with a named rule:

• A General Certificate of Conformity (GCC) covers a general-use product.
• A Children's Product Certificate (CPC) covers a product for children 12 and under, and must be backed by testing at a lab the CPSC has accepted — in the rules these labs are called third-party conformity assessment bodies.
• A test report is the lab's underlying evidence.
• A supplier declaration — also called a continuing guaranty, a mill certificate or a certificate of compliance — is your vendor telling you in writing that what they sold you meets a standard.

Declarations are cheap; test reports are expensive. Regulators want both, tied to specific goods rather than to your company in general.

A restricted substances list (RSL) tells your factories which chemicals must not be present in the finished product, and at what limit. Those limits are usually written in ppm, meaning parts per million: 100 ppm is 100 milligrams of the substance in one kilogram of material, or 0.01%. Extended producer responsibility (EPR) is the idea that whoever first puts a product on a market pays for its eventual collection and recycling. You register, report how many units you sold, and pay a fee per item.

Substantiation, presumptions and contract terms

Two words that decide cases. Substantiation means having evidence for a claim before you make it; regulators ask what you held in your hands on the day the ad went live. A rebuttable presumption means the law assumes something is true and puts the burden on you to disprove it. That is the mechanism at the heart of US forced-labor enforcement, and the reason your supply chain records have to reach back to the farm.

Three contract words you will meet constantly:

• A warranty is a promise that a fact is true; if it is false, the other side can sue for the loss.
• An indemnity is a promise to pay someone else's costs if a particular kind of trouble happens — typically "if a customer sues you over my product, I pay".
• A chargeback is a retailer deducting money from your invoice as a penalty for breaking one of its rules, such as a late delivery or a wrong label.

Chargebacks arrive silently and automatically, with no lawsuit and often no warning, and they account for a real slice of a young brand's lost margin.

Notice the shape of all of this. Every rule ends in a document. Every document has an owner, a subject (a style, a lot, a shipment), an issue date, an expiry and a retention period. That is a schema, and building it is your job.

Who regulates you, and what they can actually do

New founders under-rate regulators because the letters arrive slowly. Enforcement is rare but lopsided: the expected cost is low right up until the day it kills the company.

The last row bites first. Your first compliance audit will almost certainly come from a buyer's compliance team rather than from a regulator, and they will ask for certificates style by style before they will cut a purchase order. Getting that pack together in an afternoon rather than two weeks is often the difference between landing the account and losing the delivery window.

Labeling apparel for the United States

Three federal requirements land on the same small piece of fabric: fiber content, country of origin, and the identity of the responsible company. All three come from the Textile Fiber Products Identification Act and its rule, 16 CFR 303. Care instructions come from a different rule, 16 CFR 423. They can share one label, and usually should.

Fiber content

List the generic fiber names with percentages by weight in descending order, "65% Rayon / 35% Polyester", or "100% Wool" or "All Wool" for a single fiber. Only fibers present at 5% or more get named. Anything under 5% is lumped together as "other fiber(s)".

There are two exceptions. Wool must always be named and quantified, even below 5%. And a fiber under 5% may be named if it has a clearly established, definite function at that level. That is what makes "96% Cotton / 4% Spandex" legal; the rule's own worked example, at 16 CFR 303.3(a), is "96 percent Acetate / 4 percent Spandex".

A surprising amount of a garment does not count toward those percentages. Non-fibrous parts — zippers, buttons, beads, leather patches, painted designs — are excluded, and so is trim: collars, cuffs, waistbands, binding, labels.

Decorative trim or a decorative pattern is excluded if it covers no more than 15% of the surface area, with the label then reading "exclusive of decoration". Fiber ornamentation is excluded if it is no more than 5% of total fiber weight, with the label reading "exclusive of ornamentation". Linings are excluded when they are structural, but a lining that is there for warmth must be disclosed section by section: "Shell: 100% Nylon / Lining: 100% Polyester".

There is a 3% tolerance on stated percentages (16 CFR 303.43). The rule's own example: a label saying 40% cotton is safe if the true figure is anywhere from 37% to 43%. There is no tolerance at all on a "100%" claim. A blouse that is 97% silk and 3% polyester cannot be labeled 100% silk.

Country of origin

Imported goods must name the country where they were processed or manufactured, in English, on the front of the label. For any garment with a neck, that label must sit at the inside center of the neck, midway between the shoulder seams, or right next to another label in that spot. Fiber content and company identity may go on the back of the same label or on a separate side-seam label. The origin label must not be covered by another label.

"Made in U.S.A." with no qualifier is allowed only when the product is made entirely in the US from US materials. US manufacture from imported fabric has to say so in one statement, such as "Made in U.S.A. of imported fabric". The FTC and CBP have separate origin rules and you must satisfy both.

On top of the labeling rule sits the FTC's Made in USA Labeling Rule (16 CFR 323), which makes it an unfair or deceptive act to label a product "Made in the United States" unless the final assembly or processing happens in the US, all significant processing happens in the US, and all or virtually all components are made and sourced there.

Who you are: company name, house mark or RN

The label must identify the manufacturer, importer or other firm handling the product. You have three ways to do it:

• Use the full legal name the company does business under; a brand or designer name will not do unless it happens to be the legal name.
• Or use a word trademark registered with the US Patent and Trademark Office and used as a house mark, which 16 CFR 303.19 allows in place of the name.
• Or use a Registered Identification Number, always written as "RN" plus digits, for example "RN 123456".

The prefix is part of the number. The FTC issues RNs free of charge, but only to firms in the US. You do not have to have one, but it is shorter than your legal name, anyone can look it up in the FTC's public database, and some retailers ask for it.

If you remove another company's label you must put your own on, carrying all the required information, and keep records of what you removed and from whom for three years.

Care labeling

Every covered garment needs a care label that is permanently attached and stays legible for the useful life of the product. It must give a complete regular-care instruction covering washing (hand or machine, plus a temperature if hot water would harm the garment), bleaching, drying, ironing, and any warnings. "Machine wash. Tumble dry." is a valid minimal instruction. It means any temperature, any bleach, no ironing needed.

If chlorine bleach would harm the garment but oxygen bleach would not, the required wording is "Only non-chlorine bleach, when needed"; "Do not use chlorine bleach" on its own is not compliant. "Dryclean Only" warns that the garment cannot be washed, and you need evidence for both halves of that statement.

The rule's operative words are reasonable basis: reliable evidence supporting each instruction, held before the sale. Sometimes ordinary industry experience is enough. When you use a dye known to bleed, or beads known to be damaged by dry-cleaning solvent, you need test results, and they must support the care of the whole finished garment. Testing the components on their own is not enough.

Care symbols are optional. If you use them in the US they must be the ASTM set named in the rule, ASTM D5489-96c, which 16 CFR 423.8(g) incorporates by reference. The ISO symbol system used across Europe is not accepted here.

STYLE 4417 "Ridge Crew" - long sleeve crew, adult unisex

PERMANENT LABEL  (sewn, inside centre back neck, one end only
                  so the reverse is readable)

  FRONT of label
     MADE IN PORTUGAL          <- origin: front, English, at neck

  BACK of label
     80% COTTON                <- fibre, descending by weight
     20% POLYESTER
     EXCLUSIVE OF DECORATION   <- chest print = 9% surface area
     RN 123456                 <- your FTC identity
     MACHINE WASH COLD         <- care: wash method + temperature
     ONLY NON-CHLORINE BLEACH        bleach
       WHEN NEEDED
     TUMBLE DRY LOW                  dry
     COOL IRON IF NEEDED             iron
     DO NOT DRY CLEAN                warning (needs evidence)

HANGTAG  (the cardboard swing tag; removable, marketing surface)
     "Grown on regenerative farms in the Alentejo"
     "See label for the product's full fiber content."

How the Ridge Crew label decodes

Read that block as a specification. Every line is a field in your database. The origin line sits on the front because the rule says so. Because the label is sewn down at one end only, the reverse counts as accessible, which is what lets fiber and care content live on the back.

"Exclusive of decoration" appears because the chest print covers less than 15% of the surface — an exemption that evaporates the moment any advertisement says what the print is made of. The hangtag names one attribute without giving full fiber content, so it has to carry the FTC's required pointer sentence.

Every one of those decisions depends on data you must already hold: the print's surface-area percentage, the wash-and-dry test behind "do not dry clean", the mill's fiber analysis.

Children's products: CPSIA in outline

A children's product is one designed or intended primarily for children 12 years old or younger. The moment a style crosses that line, a much heavier regime attaches under the Consumer Product Safety Improvement Act of 2008, universally shortened to CPSIA. The extra obligations come in four kinds: testing, certification, tracking, and design rules aimed at specific hazards.

Third-party testing and material changes

Third-party testing. Children's products must be tested by a lab whose accreditation the CPSC has accepted, against every children's product safety rule that applies. Not once and forever, either. Under 16 CFR 1107.21 you must run periodic testing at an interval short enough to give high assurance that production keeps complying, and the interval may never exceed one year.

Two exceptions stretch it: run a documented production-testing program and the third-party interval goes to two years; run continued-compliance testing through a laboratory accredited to ISO/IEC 17025, an international standard for the technical competence of testing laboratories, and it goes to three.

Separately, any material change — in design, in process, or in where a component part is sourced — that you know or should know could affect compliance requires new testing and a new certificate before you ship.

The certificate, and the move to eFiling

The Children's Product Certificate. The CPC is the signed statement that the product complies. Under the CPSC's revised certificates rule (16 CFR part 1110) the importer certifies goods made abroad; for US-made goods it is the manufacturer, or the private labeler if the product is private label. The required content is listed in the block below. Records supporting a certificate must be kept for at least five years from the date the certificate was created (16 CFR 1110.17).

The big operational change is eFiling. Under the final rule published on 8 January 2025 (90 FR 1800, technically corrected in September 2025), certificate data for imported CPSC-regulated products must be transmitted electronically to Customs' ACE system — the Automated Commercial Environment, the government's single window for import filings — at the time of entry, using the CPSC's Partner Government Agency message set.

That requirement took effect on 8 July 2026 for most goods. Goods brought into a foreign trade zone and later entered follow on 8 January 2027. A piece of paper you used to email your broker is now a structured payload your systems must be able to emit, per entry line, on demand.

CHILDREN'S PRODUCT CERTIFICATE - required data elements
(16 CFR 1110.11; the same elements are what gets eFiled to ACE)

 1  product identifier      GTIN / SKU / UPC / model  (>=1 required)
                            GTIN = global trade item number, the
                            number behind a barcode; SKU = your own
                            stock-keeping unit code
 2  product description     enough to match the cert to the goods
 3  rule(s) certified to    each listed SEPARATELY, e.g.
                              16 CFR 1610  flammability, clothing
                              16 CFR 1120  drawstrings (ASTM F1816)
                              16 CFR 1501  small parts
                              15 USC 1278a lead content
 4  certifier               name, street, city, state/province,
                            country, email, phone
 5  records custodian       name or always-staffed job title,
                            plus full contact details
 6  manufacture             date (month + year minimum) and place,
                            with manufacturer name and address
 7  testing                 most recent test date, plus each lab's
                            name and full address
 8  attestation             signed statement; a false statement is
                            a federal crime
 9  retention (1110.17)     certificate + supporting records:
                            5 years from certificate creation date

What the certificate fields imply for your schema

Fields 3, 6 and 7 are the ones that reach into your schema. Field 3 is a many-to-many relation between a style and a list of regulations. Field 6 forces you to know the factory and the production month for each certified batch, which means your purchase orders and goods receipts have to carry that level of detail. A country name on its own will not do.

Field 7 links the certificate to specific dated lab reports, so a certificate is best modeled as a view generated over test records. And field 9 starts a five-year clock on certificate creation, not on sale, which is a retention rule your archiving job must implement literally.

The hazards that actually apply to childrenswear

Drawstrings. Under 16 CFR 1120.3, children's upper outerwear in sizes 2T to 16 (or the equivalent) with drawstrings that does not conform to the ASTM F1816-97 standard is deemed a substantial product hazard. Broadly: neck and hood drawstrings are prohibited up to size 12, and waist or bottom drawstrings are restricted up to size 16.

The rule is deliberately aggressive about sizing. A coat labeled 12–14 is still caught by the neck-drawstring prohibition because part of its range falls inside the banned range, that exact example is written into the rule, and letter sizes map onto numeric ones, with a girls' or boys' L treated as size 12 and XL as size 16.

It is a design rule enforced through your size-range data, which means your size curve is compliance data as well as a merchandising attribute.

Small parts. For products intended for children under three, any component that fits entirely inside the CPSC's test cylinder fails — before or after the standard use-and-abuse testing that simulates a toddler pulling at it. Buttons, snaps, appliqués and pom-poms on toddler garments are the usual culprits.

Flammability. This one applies to all clothing, adult included. 16 CFR 1610 sets three flammability classes for clothing textiles — normal, intermediate, and rapid and intense burning, and bans the third class from use in clothing.

The practically important part is the exemption list. Plain-surface fabrics of any fiber weighing 2.6 ounces per square yard or more are exempt from the testing you would otherwise need to support a guaranty, as are fabrics of any weight made entirely of acrylic, modacrylic, nylon, olefin, polyester or wool. That covers most of a typical adult line. It does not cover light, sheer or raised-surface novelty fabrics, which are exactly the fabrics a young brand falls in love with.

Children's sleepwear is a separate and much stricter regime: 16 CFR 1615 (sizes up to and including 6X) and 16 CFR 1616 (sizes 7 to 14) require either flame-resistant fabric or tight-fitting garments within specified maximum dimensions, tested by production unit.

Lead. Children's products may not contain more than 100 ppm total lead in accessible parts (15 U.S.C. 1278a), and surface coatings are limited to 0.009% by weight, which is 90 ppm, under 16 CFR 1303. In a notice published on 24 June 2026 the CPSC completed its statutory review of whether those limits could go lower and determined that current regulations already require the lowest lead content that is technologically feasible, so the numbers are stable for now.

There is relief here that founders miss. Under 16 CFR 1500.91 the CPSC has determined that textiles do not exceed the lead limits: natural fibers including cotton, linen, wool, silk, cashmere and bamboo, and manufactured fibers including polyester, nylon, rayon, acrylic and spandex, dyed or undyed. The determination excludes any textile carrying a treatment or application that is not made up entirely of dyes, so a coating or a finish puts you back outside it.

In practice the fabric needs no lead testing and the trims do. Zips, snaps, rivets, metal buttons, screen-print inks, heat transfers and appliqués are where lead shows up.

Phthalates. Phthalates are plasticizers, the chemicals that make PVC — polyvinyl chloride, the common plastic used in coated prints and trims — soft and bendy. The 0.1% limits on eight of them in 16 CFR 1307 apply to children's toys and child care articles, meaning products meant to help a child under three sleep, feed, suck or teethe. Apparel as such is outside that scope. A plastic teether sewn onto a bib may pull the bib into scope; a printed T-shirt generally does not. Have your lawyer make that call per style and record the answer alongside the style, with a date.

Tracking labels. Section 14(a)(5) of the Consumer Product Safety Act requires a permanent distinguishing mark on children's products and their packaging, as far as practicable. It has to let you work out where and when the product was made and which batch or production run it came from, and it has to let the buyer work out the manufacturer or private labeler, the place and date of production, and the batch.

On the garment this is a small sewn or printed code. In database terms it means your finished-goods records must be lot-aware for children's styles: you must be able to say which physical run a given unit came from. A style-level inventory model, where all units of style 4417 are interchangeable, cannot satisfy it.

Restricted substances, Proposition 65 and the PFAS wave

Chemical rules are the fastest-moving area in apparel compliance. Learn the mechanisms and build software that absorbs new entries, rather than hard-coding today's list into your code.

The mechanism: restricted substances lists

An RSL is a table of substances, each with a limit, a test method, and the list of places that impose it. You adopt one, attach it to every purchase order and factory agreement as a warranty, and require test reports against it at defined trigger points.

The industry reference is the American Apparel & Footwear Association's Restricted Substances List, a free document that consolidates national and international restrictions on chemicals in finished apparel, footwear and home textiles. The current English edition as of July 2026 is RSL 26, published on 28 January 2026, and the list is revised roughly once a year.

Adopting it means you inherit a maintained view of dozens of jurisdictions instead of tracking them yourself, and it hands your factories a document they have probably already seen.

California Proposition 65

Proposition 65 works through warnings. California lists chemicals known to the state to cause cancer or reproductive harm, and a business may not knowingly and intentionally expose a person to a listed chemical without first giving a "clear and reasonable warning". Nothing on the list is banned outright. Regulations define safe-harbour wording and formats — a "safe harbour" being a form of words the state has pre-approved, so that using it exactly cannot be attacked as inadequate, and exposures below the safe-harbour levels need no warning at all.

What makes it dangerous is the enforcement design. Any private person may sue "in the public interest" after serving a 60-day notice on the alleged violator, the Attorney General and the local prosecutor, backed by a certificate of merit: a signed statement that the person suing has consulted someone with relevant expertise and believes the case has merit.

Civil penalties run up to $2,500 per day per violation, and the plaintiff recovers legal fees. That combination supports a professional enforcement bar that buys products, tests them and issues notices at volume. The typical apparel trigger is a trim component — a PVC-coated print, a phthalate-softened zip pull, lead or cadmium in hardware, and only rarely the fabric.

You need three things on file:

• a per-style assessment with a date and a rationale;
• the test data or exposure analysis behind it;
• and, where a warning is required, the warning text linked to every channel where the product is offered, because the warning has to reach the buyer before they buy.

PFAS: learn the mechanism

PFAS — per- and polyfluoroalkyl substances, the "forever chemicals" used to make fabric shed water and resist stains — are being restricted state by state, quickly and unevenly. Any list printed here would be stale within months, so learn the shape of the laws instead.

Nearly all share four features:

• They regulate the whole class rather than named individual chemicals.
• They prohibit "intentionally added" PFAS and set a total-fluorine or total-organic-fluorine threshold as the practical laboratory test.
• They phase in over several years, with a later date for technical outdoor gear.
• And they push the paperwork down to you in the form of a supplier certificate of compliance.

California's Assembly Bill 1817, now Health and Safety Code sections 108970 onwards, is the archetype others copy. From 1 January 2025 no person may manufacture, distribute, sell or offer for sale in California any new textile article containing regulated PFAS. "Regulated" means either PFAS the manufacturer intentionally added and that have a functional or technical effect in the product, or PFAS present at or above a threshold measured as total organic fluorine: 100 ppm from 1 January 2025, dropping to 50 ppm from 1 January 2027.

Outdoor apparel for severe wet conditions — the statute's examples are offshore fishing, offshore sailing, whitewater kayaking and mountaineering gear, not general outerwear — is exempt until 1 January 2028, but since 2025 it must carry a legible "Made with PFAS chemicals" disclosure, including on online listings.

For your data model, the operative sentence is the one requiring the manufacturer to give everyone who offers the product for sale in California a certificate of compliance signed by an authorized official, which may be electronic. A distributor or retailer that relies on that certificate in good faith is not in violation. The certificate is your shield and your customers' shield, and it is per product.

How other states are following California

Other states copy the pattern with different dates, thresholds and scopes:

• Some ban intentionally added PFAS in textiles outright.
• Some require reporting rather than removal.
• Some single out apparel, footwear and travel gear for their own disclosure rules.

Safer States, an advocacy network, publishes an annual analysis of state chemical policy; its 2026 edition describes a wave of previously enacted state protections moving from adoption into implementation during 2026. Any list of states you write down is a snapshot with a short shelf life. What you should build instead is the matrix below, so that adding a state is a row rather than a release.

RESTRICTED SUBSTANCE MATRIX (excerpt) - what your table holds
TOF = total organic fluorine, the lab measure used for PFAS

substance_group | limit    | basis           | applies_to
----------------+----------+-----------------+-------------------
PFAS (class)    | 100 ppm  | CA AB1817       | textile articles
                |  TOF     | HSC 108970(g)   | sold in CA, 2025
PFAS (class)    |  50 ppm  | CA AB1817       | same, from
                |  TOF     | HSC 108970(g)   | 2027-01-01
Lead, total     | 100 ppm  | 15 USC 1278a    | accessible parts,
                |          |                 | children's prod.
Lead, coating   |  90 ppm  | 16 CFR 1303     | surface coatings,
                |          |                 | children's prod.
Phthalates (8)  |   0.1 %  | 16 CFR 1307     | children's toys +
                |          |                 | child care arts.
AZO dyes        | 30 ppm   | EU REACH Annex  | textiles in skin
(listed amines) |          | XVII, entry 43  | contact, EU
Cadmium         | varies   | Prop 65 / REACH | metal trims

evidence required per style x per jurisdiction:
  supplier declaration  (cheap, annual, per material)
  lab test report       (expensive, per lot or per interval)
  exposure assessment   (Prop 65 only, per style)

Reading the substance matrix

The matrix is the point of this section. Each row is a tuple of (substance group, limit, legal basis, scope), and each is time-bounded, because the California limit tightens on a known future date. The azo-dye row is a good example of how these read: EU REACH Annex XVII entry 43 bans dyes that can release any of a list of aromatic amines above 30 mg per kilogram — that is, 30 ppm — in textiles that touch the skin.

Evaluate a style against the rows in force on the date the goods will be sold, so that a 2026 purchase order for 2027 delivery is checked against 50 ppm rather than 100.

The three evidence types have very different economics:

• Declarations are per material and cheap to refresh annually.
• Lab reports are per lot and expensive enough that you will want to reuse them across every style sharing a fabric.
• Exposure assessments are per finished style.

Make that visible in the schema: evidence attaches to a material or to a style, and a style inherits its materials' evidence.

Customs and trade compliance

Customs is where compliance meets cash, because the outputs are duty payments and released containers. Five duties sit on the importer of record, and all five are yours whether or not you employ a broker.

Reasonable care

US law puts the burden on you. The importer of record must, using reasonable care, file the entry documentation and give Customs the information it needs to assess duties, collect statistics and decide whether the goods may come in at all. "Reasonable care" is a legal standard with concrete content: documented procedures, qualified advisers, binding rulings where classification is unclear, and records that show you did all of that. It is the standard against which negligence penalties are measured, so evidence of your process is itself a defense.

Classification and binding rulings

Classifying apparel is genuinely hard. Chapter 61 of the HTS covers knitted or crocheted garments and chapter 62 covers woven ones. Below that the tree splits by garment type, by gender, by fiber composition, sometimes by water resistance, sometimes by how many panels the garment has. Two styles that look identical on a hanger can differ by more than ten percentage points of duty.

When the answer is unclear you can ask CBP for a binding ruling: you describe the merchandise, CBP tells you the classification, and that answer binds Customs for that merchandise. Past rulings are searchable in CBP's CROSS database, which is the single most useful free classification tool available to a small brand.

Store the HTS number on the style record, together with the date it was determined, who determined it, and the ruling number or the reasoning. Do not let it be retyped onto each shipment. When a style's fabrication changes, a cotton/polyester blend flipping from 55/45 to 45/55, the classification and the duty rate can change with it, and your system should force someone to re-check rather than silently carrying the old number forward.

The tariff stack, and why duty moves

The HTS rate is only the base layer of the bill. Since 2025 US apparel importers have lived through several rounds of extra duties stacked on top of that base, imposed and withdrawn faster than any annual budget can track.

Through 2025 a series of executive orders imposed extra percentage duties under the International Emergency Economic Powers Act (IEEPA), an emergency-powers statute, on imports from many countries.

On 20 February 2026 the Supreme Court decided the consolidated cases Learning Resources, Inc. v. Trump and Trump v. V.O.S. Selections, Inc. It affirmed the judgment in V.O.S. Selections, which had held those IEEPA duties unlawful, and vacated the judgment in Learning Resources with instructions to dismiss that case for lack of jurisdiction.

The same day, Executive Order 14389 declared the IEEPA duties no longer in effect and told agencies to stop collecting them as soon as practicable.

Also the same day, Proclamation 11012 imposed a different, temporary charge: a 10% ad valorem import surcharge — ad valorem just means "calculated as a percentage of the value" — under section 122 of the Trade Act of 1974 (19 U.S.C. 2132), the balance-of-payments provision. It applied to goods entered from 24 February 2026 and ran through 12:01 a.m. eastern daylight time on 24 July 2026.

Section 122 caps such a surcharge at 15% and at 150 days unless Congress extends it by statute, which is why the end date was fixed in advance; no extension had been enacted when this was written. Duties under section 232 (national security) and section 301 (unfair trade practices) were untouched by any of it.

Duty rate is a function, not a column

Do not take the numbers in the paragraph above as today's rate. Take the lesson instead, which is structural and will outlast every one of these measures.

Duty rate is the output of a function over (HTS code, country of origin, date of entry, program claimed), evaluated against a versioned rule table with effective-from and effective-to dates. Store it as a plain column on your style table and you will be wrong within a year, and unable to explain last season's margin.

Two practical consequences follow. First, your landed-cost engine must be able to re-price an old purchase order at the rates that were in force when it actually landed, rather than at today's rates. Second, keep entry-level records obsessively, because when a duty is later held unlawful the refund goes to importers who can document what they paid, line by line.

Valuation

Duty is charged on customs value, and the primary method is transaction value: the price actually paid or payable for the goods when sold for export to the United States, plus certain statutory additions.

The additions catch people out. Assists are things you supply to the factory free or below cost — fabric, trims, patterns, artwork, molds or tooling. Their value must be added to the customs value even though no money changed hands for them in that transaction. So must certain royalties, selling commissions and packing costs. If you buy your own trims and ship them to your factory, that is an assist, and it is dutiable.

Country of origin for textiles

The US applies a specific, ordered rule set to textiles and apparel in 19 CFR 102.21. Apply the tests in sequence and stop at the first one that gives you an answer.

19 CFR 102.21 - textile/apparel origin, applied in order

 (c)(1)  wholly obtained or produced in one country?
            YES -> that country.        NO -> continue
 (c)(2)  did every foreign material undergo the tariff-shift
         (or other) rule in 102.21(e) for this HTS heading,
         all in a single country?
            YES -> that country.        NO -> continue
 (c)(3)(i)   knit to shape?  -> country where it was knit
 (c)(3)(ii)  not knit to shape, and "wholly assembled" in one
             country (with listed exceptions)?
                            -> country of assembly
 (c)(4)  otherwise -> country of the MOST IMPORTANT assembly
         or manufacturing process
 (c)(5)  if still undetermined -> the LAST country in which an
         important assembly or manufacturing process occurred

"tariff shift" = the finished goods fall under a different HTS
heading from the materials that went into them, which the rules
treat as proof that real manufacturing happened there.

"knit to shape" = the panels come off the knitting machine
already in the shape of the garment piece, so nobody cuts them
out of a roll of fabric.

"wholly assembled" = at least two components that pre-existed in
essentially the same condition were combined in a single country.
Minor attachments (appliques, beads, buttons, embroidery) and
minor subassemblies (collars, cuffs, plackets, pockets) do not
break it.

Walk this with a real case. You knit fabric in Taiwan, then cut and sew the garment in Vietnam. Test (c)(1) fails, because the goods were not wholly obtained in one country. Test (c)(2) usually succeeds for cut-and-sew apparel: the rule for HTS headings 6101 to 6117 is met when a garment of two or more component parts is wholly assembled in a single country. Origin is Vietnam.

Now change one fact: the fabric is knit to shape in Taiwan, and Vietnam only links the pieces together and finishes them. CBP handles that case under (c)(3)(i), which sends origin to Taiwan, because for knit-to-shape goods origin follows the knitting. Its published rulings on knit-to-shape sweaters cite exactly that subsection.

That is why "where was it sewn" is not a sufficient field. You need the country of each production step, because the answer is a function of the whole chain.

Free trade agreements and certifications of origin

A free trade agreement (FTA) can eliminate the duty entirely, which on a 28.2% line changes your whole margin. Apparel FTAs typically use yarn-forward rules: the yarn, and every step after it, must originate inside the FTA region. Claiming the preference is not automatic. You must hold a valid certification of origin at the time you make the claim, and you must be able to produce it later.

Under USMCA — the United States–Mexico–Canada Agreement — the certification (19 CFR 182.12) needs no prescribed format and may appear on an invoice, but it must contain specified elements:

• whether the certifier is the importer, exporter or producer;
• the certifier's name, title, address, phone and email;
• the exporter's and producer's details if different (or "Various", or "Available upon request by the importing authorities");
• the importer's details if known;
• the responsible official signing;
• a goods description detailed enough to relate to the invoice and to the Harmonized System nomenclature (the international naming scheme the HTS is built on);
• the HTSUS classification, the US version of that schedule, to six or more digits;
• the applicable rule of origin;
• the invoice number for single shipments;
• the blanket period where one applies;
• and the prescribed certifying statement.

A blanket certification covers identical goods for up to 12 months, and a properly completed certification is valid for four years.

Record retention

Records relating to an entry must be kept for five years from the date of entry (19 CFR 163.4). The exceptions are narrow: drawback records, drawback being a refund of duty on goods you re-export, until the third anniversary of payment, and packing lists for only 60 days from the end of the release period.

Failure to produce a record Customs has demanded carries penalties of up to $100,000 per release, or 75% of the appraised value, whichever is less, for willful failures, and up to $10,000 or 40% of value for negligent ones (19 U.S.C. 1509(g)).

Five years is longer than most startups keep anything. Build the retention rule in on day one, because retrofitting it means discovering that your 2029 self cannot produce your 2026 commercial invoices.

De minimis is gone

For years, shipments valued at or under $800 entered the US duty-free without a formal entry, under the de minimis exemption in 19 U.S.C. 1321(a)(2)(C). That is gone.

Executive Order 14324, signed 30 July 2025, suspended duty-free de minimis treatment for all countries for goods entered on or after 12:01 a.m. eastern daylight time on 29 August 2025, and required such shipments to be filed under an appropriate entry type in ACE. Executive Order 14388, signed 20 February 2026, continued the suspension.

On 24 June 2026 CBP published a rule indefinitely suspending the exemption for mail shipments and setting up a new postal informal entry process — "informal entry" being the lighter-weight filing used for low-value shipments.

If your business model assumed direct-to-consumer parcels shipped from an overseas third-party logistics provider entering the US duty-free, that assumption is dead. Your landed-cost engine must now price duty on every parcel, and your checkout must decide who pays it.

Forced labor: UFLPA and the traceability dossier

Section 307 of the Tariff Act of 1930 prohibits importing goods made wholly or in part with forced labor. The Uyghur Forced Labor Prevention Act of 2021 turned that prohibition into a rebuttable presumption. Goods mined, produced or manufactured wholly or in part in the Xinjiang Uyghur Autonomous Region of China, or by an entity on the UFLPA Entity List, are presumed to be made with forced labor and are prohibited from entry. The presumption reaches goods made in, or shipped through, other countries when they include Xinjiang inputs.

For apparel this is not a niche risk. Xinjiang has historically produced a very large share of China's cotton, and cotton usually crosses several borders on its way to you:

• A gin separates the fiber from the seed and presses it into bales.
• A spinner twists that fiber into yarn.
• A mill knits or weaves the yarn into fabric and dyes it.
• Only then does a cut-and-sew factory cut the fabric into pieces and sew your garment.

Four companies, often in four countries, and the presumption follows the cotton through all of them.

The UFLPA Entity List

The Entity List is maintained by the Department of Homeland Security as chair of the Forced Labor Enforcement Task Force. It began with roughly two dozen listings in June 2022 and, as published in July 2026, runs to about 160 listings spread across its three statutory sections; some entities appear on more than one section, so the number of distinct companies is nearer 145.

The largest single additions came in May 2024, November 2024 and January 2025, and January 2025 was still the most recent addition when this was written.

Several entries are directly apparel-related: garment makers, hair-accessory producers, a cotton and linen company, textile printing and dyeing firms, and the Xinjiang Production and Construction Corps together with its subordinate and affiliated entities, an umbrella that reaches very widely.

Responding to a detention

When CBP detains a shipment, its notice gives you 30 days to respond, with extensions available from the Port Director. You have two routes.

Argue the goods are outside the scope, meaning the inputs were sourced entirely outside Xinjiang and there is no connection to a listed entity. Or seek an exception to the presumption, which requires full compliance with CBP's due-diligence and tracing guidance, complete answers to CBP's questions, and proof by clear and convincing evidence — a demanding standard, well above "more likely than not" — that the goods were not made wholly or in part with forced labor.

Submissions are made electronically, in English, with a translation attached to any document that is in another language.

What CBP asks for is specific: trace the entire supply chain from raw materials to the imported merchandise, identify every party with names and addresses, and provide a production flow chart plus maps of the region where each part originated.

The document list in CBP's detention attachment includes:

• certificates of origin,
• purchase orders,
• invoices and proof of payment,
• packing lists,
• bills of lading,
• shipping and production records,
• inventory records supporting production,
• a list of production steps with chain-of-custody records,
• transportation documents and daily manufacturing process reports.

For cotton specifically, CBP asks for documentation covering the chain from the origin of the cotton at the bale level — a bale being the compressed bundle of raw cotton that leaves the gin — all the way to final production.

TRACEABILITY DOSSIER for one PO - the shape CBP expects
each tier is one step back up the chain that made your garment

PO 2026-0412  Style 4417  6,000 units  Factory: Vinh Long, VN
|
+-- TIER 1  cut & sew        Factory VN-114
|     the plant that cut the fabric and sewed the garment
|     production records, daily process reports, capacity
|     evidence, in/out inventory for this PO
+-- TIER 2  fabric mill      Mill TW-08 (knitting + dyeing)
|     the plant that turned yarn into fabric
|     yarn purchase orders, invoices, proof of payment,
|     bills of lading TW->VN, production date range
+-- TIER 3  spinner          Spinner TR-22
|     the plant that twisted raw fibre into yarn
|     bale purchase records, cotton origin declaration,
|     invoices + payment, transport docs to the mill
+-- TIER 4  gin / bale       Gin BR-04 (Brazil), crop year 2025
      the plant that separated the fibre from the seed
      bale IDs, gin tickets, warehouse receipts, and any
      isotopic or DNA test result (lab methods that read the
      fibre itself to check where the cotton was grown)

cross-cutting: flow chart (1 page), region maps, full party
list with addresses/emails/phones, chain-of-custody index
mapping every document to its step number

Why the dossier has to be collected continuously

This is why traceability is a data problem. You are being asked to reconstruct, on 30 days' notice, a four-or-five level tree for one purchase order, where every node has a party, a date range, a document set, and a quantity that must reconcile with the node below it.

Nobody assembles that from email under time pressure. It has to be collected continuously, as each tier ships, and stored against the purchase order. The quantity reconciliation matters as much as the documents do: if the spinner's invoices account for less yarn than the mill's output required, that gap is exactly what an examiner will find.

Selling into the EU and the UK

If you ship to European customers, including through a marketplace, a separate regime applies, and it is moving toward demanding far more structured product data than US law does.

The General Product Safety Regulation

Regulation (EU) 2023/988, the GPSR, has applied since 13 December 2024. It covers consumer products that have no sector-specific safety law of their own, which is to say ordinary clothing. Four obligations matter to a small brand.

Technical documentation. Before placing a product on the market the manufacturer must carry out an internal risk analysis and draw up technical documentation containing at least a general description of the product and the characteristics relevant to assessing its safety. Where the risks warrant it, that documentation must also include the risk analysis and the solutions adopted, test reports, and the European standards applied. It must be kept up to date and available to market surveillance authorities for 10 years after the product is placed on the market (Article 9).

Identification. Products must bear a type, batch or serial number or other identifying element that is visible and legible to consumers, and the manufacturer's name or trademark plus a postal and an electronic address must appear on the product, its packaging, or an accompanying document.

The responsible person and traceability duties

The responsible person. Article 16 says a product may not be placed on the EU market unless an economic operator established in the Union is responsible for it. A US brand with no EU entity must appoint one — an EU-based importer, authorized representative or fulfillment service provider, and that person's name and contact details must appear on the product, packaging, parcel or accompanying document.

The responsible person must regularly check the product against the technical documentation and the identification requirements, and must be able to show documented evidence of those checks.

Marketplaces and EU retailers now refuse listings that lack a valid responsible-person block, so this is now a commercial gate as much as a legal one.

Traceability and accidents. Under Article 15, operators must be able to identify who supplied them with a product and to whom they supplied it, and to present that information for six years in both directions. Information about a product's risks and the corrective measures taken has a longer clock: ten years.

Accidents causing death or serious health effects must be notified through the EU Safety Business Gateway without undue delay; where the manufacturer is outside the EU, the responsible person must make sure that happens.

Distance selling, anything sold online, must clearly show the manufacturer's identity and contact details, the responsible person's details, product identification including a picture, and any required warnings, with those warnings given in a language consumers in that Member State easily understand.

Ecodesign, the Digital Product Passport, and the destruction ban

Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation (ESPR), is a framework. The product-specific rules arrive later as delegated acts — secondary legislation the Commission writes under powers the regulation gives it. Two things are already concrete.

The first is the destruction ban. Since 19 July 2026, destroying unsold consumer products listed in the regulation's Annex VII, which covers leather apparel and accessories, knitted and woven apparel and clothing accessories, and footwear — has been prohibited under Article 25. Micro and small enterprises are exempt, and medium-sized enterprises come into scope on 19 July 2030.

Article 25(5) required the Commission to set out derogations, and the grounds listed there tell you the shape of them:

• health, hygiene and safety;
• damage from handling or discovered on return that cannot be repaired cost-effectively;
• products unfit for their intended purpose;
• goods offered for donation and refused;
• goods unsuitable for preparing for reuse or remanufacturing;
• goods unsaleable because they infringe intellectual property rights, including counterfeits;
• and cases where destruction genuinely is the option with the least environmental impact.

The Commission adopted the delegated act setting out those derogations, and the implementing act fixing the disclosure format, on 9 February 2026.

Alongside the ban sits a disclosure duty in Article 24. Operators that discard unsold consumer products must publish, annually and on an easily accessible page of their website:

• the number and weight discarded by product type,
• the reasons and any derogation relied on,
• the proportion sent to reuse, recycling, other recovery or disposal,
• and the measures taken and planned to prevent destruction.

The same carve-outs apply: micro and small enterprises are exempt, and medium-sized enterprises start disclosing from 19 July 2030.

That reporting can only come out of inventory data. In schema terms it is a disposal transaction type carrying a reason code and a downstream-treatment code, which is a five-minute change now and a data-archaeology project later.

The Digital Product Passport

The second concrete item is the Digital Product Passport (DPP): a machine-readable record reachable from a data carrier on the product, a QR code or similar, linked to a unique product identifier and, where appropriate, to unique operator and facility identifiers issued under internationally recognized standards.

It is held in a decentralized system, with a Commission-run identifier registry and a public portal. A passport may be specified at model, batch or item level, and access is differentiated by stakeholder, so a consumer, a recycler and a customs officer each see different fields.

The Commission adopted its first ESPR and Energy Labeling Working Plan on 16 April 2025, putting textiles among the priorities and identifying digital product passports as high-potential for the sector. No textiles delegated act had been adopted as of July 2026, so no DPP obligation yet applies to apparel. Watch the working plan rather than guessing a date.

Extended producer responsibility for textiles

Directive (EU) 2025/1892 of 10 September 2025, which entered into force on 16 October 2025, amended the EU Waste Framework Directive to create harmonized EPR for textiles. Whoever makes textile, textile-related or footwear products available on a Member State's market for the first time counts as a "producer" and carries EPR obligations there.

Producers must sign up to a national producer register in every such Member State, and Member States may only allow products on the market if the producer, or its authorized representative, is registered. A producer established in another Member State must appoint an authorized representative in the target Member State by written mandate, and Member States may extend that requirement to producers outside the EU.

In practice the obligations are discharged through a producer responsibility organization, an industry-funded body that collects a per-item fee, modulated by eco-design criteria so that a more durable or more recyclable garment pays less.

The dates are set in the directive:

• transposition into national law by 17 June 2027;
• EPR schemes established by 17 April 2028;
• a harmonized registration format adopted by the Commission by 17 April 2027;
• and the smallest enterprises — fewer than 10 people, with annual turnover and balance sheet both at or under €2 million — in scope from 17 April 2029.

France already runs a mature textile EPR scheme through Refashion, its national producer responsibility organization for clothing and footwear, so none of this is hypothetical: you report units placed on the market by category, you pay per unit, and you get audited on the count.

Great Britain, Northern Ireland and the 2025 Act

The UK. Great Britain is outside the EU GPSR. Northern Ireland is not, so a single UK order can straddle two regimes.

The UK enacted the Product Regulation and Metrology Act 2025 (2025 c. 20), an enabling statute giving ministers broad powers to make product safety and measurement regulations, including powers relevant to aligning with or diverging from EU rules. What that means for apparel will emerge in secondary legislation. Treat the UK as a separate jurisdiction with its own responsible-person and labeling analysis rather than assuming the EU answer carries over.

Sustainability and green claims

The rule for environmental marketing is simple to state and expensive to ignore. You must have competent and reliable evidence for every claim, including every claim a reasonable consumer would take away from your ad, and you must have it before the claim runs.

The FTC Green Guides

In the US the reference is the FTC's Green Guides, 16 CFR part 260. They carry no independent force of law. What they do is state how the FTC will read the deception prohibition in the FTC Act, which in practice makes them the standard.

The current edition dates from 2012. The FTC opened a regulatory review in December 2022 and announced a public workshop on the guides in March 2023, and as of July 2026 no revised version has issued and part 260 stands unchanged. Assume the 2012 guides apply and watch for change.

Three sections do most of the work. Section 260.4 says marketers should not make unqualified general environmental benefit claims at all, because such claims convey far-reaching benefits nobody can substantiate; a brand name of "Eco-friendly" is given as a deceptive example. Any qualification must be clear, prominent, in the same medium, and must not imply that a negligible benefit is significant.

Section 260.13 governs recycled content: the material must have been recovered or diverted from the waste stream, pre-consumer material only counts if it would otherwise have entered that stream, and an unqualified claim requires the entire product or package — excluding minor, incidental components — to be made from recycled material. Manufacturing scrap that the industry routinely reuses does not count.

Section 260.9 governs "free of" claims: even a truthful "PFAS-free" can be deceptive if the substitute poses the same or similar environmental risks, or if the substance was never associated with that product category in the first place.

The EU ban on generic and offset-based claims

Europe is moving faster. Directive (EU) 2024/825, the Empowering Consumers Directive, had to be transposed by 27 March 2026 and applies from 27 September 2026, adding outright prohibitions to the Unfair Commercial Practices Directive.

A generic environmental claim — "environmentally friendly", "eco-friendly", "green", "climate friendly", "biodegradable", "biobased" and similar — is banned unless the trader can demonstrate recognized excellent environmental performance relevant to the claim, evidenced by the EU Ecolabel, an officially recognized EN ISO 14024 scheme (a category of independently certified national or regional ecolabel), or top-class performance under other EU law.

The directive's recitals add that "conscious", "sustainable" and "responsible" should not rest on environmental performance alone, because those words carry a social meaning too.

Claims that a product is carbon or climate neutral because of offsetting — "climate neutral", "CO2 neutral certified", "climate compensated", "reduced climate impact" — are prohibited outright. Forward-looking claims must rest on verifiable commitments set out in a detailed, resourced implementation plan, verified by an independent third-party expert whose findings are made available to consumers.

A complementary Green Claims Directive would have gone further, adding an approval-and-verification regime for environmental claims before they run. In June 2025 the Commission signalled that it intended to withdraw the proposal, citing its simplification agenda and the burden on micro-enterprises, and negotiations stalled.

The proposal has not in fact been withdrawn: as of July 2026 the European Parliament's procedure file still records it as awaiting the Council's first-reading position.

Either way, do not read the stall as a relaxation. The Empowering Consumers prohibitions take effect regardless, and for a small brand they are the sharper instrument, because they are per-claim bans rather than a certification scheme you could at least pay someone to navigate.

Intellectual property

Apparel IP is fragmented. Different pieces of the same garment are protected by different rights, with different terms and different registration mechanics, and clothing designs as such get comparatively weak protection in the US.

Trademarks and trade dress

Trademarks protect the name and the logo. You acquire some rights simply by using a mark in commerce. Registration with the US Patent and Trademark Office gives you the remedies that matter: nationwide notice to everyone else, a legal presumption that your mark is valid, and the ability to record the mark with Customs. Apparel is class 25; retail services are class 35.

Maintenance is a calendar problem. A declaration of continued use must be filed within the year before the sixth anniversary of registration, then within the year before each tenth anniversary, with a six-month grace period and a surcharge (15 U.S.C. 1058). Miss it and the registration is canceled.

Once registered, you can record the mark with CBP for $190 per class (19 CFR 133.3), which puts it in front of the officers screening imports for counterfeits. It is the cheapest counterfeit-enforcement action available to a small brand.

Trade dress protects the overall look and feel of a product or its packaging, where that look tells consumers who made it. It is available in principle for a distinctive silhouette or a signature detail, but it requires distinctiveness and non-functionality, and for product design it requires secondary meaning — actual proof that consumers associate the look with you. It is expensive to establish and mostly relevant to brands with a long-running signature.

Copyright and design patents

Copyright is the workhorse for prints, patterns, embroidery artwork and graphics. The two-dimensional artwork is protectable even though the garment's utilitarian shape is not.

Registration is where founders leave money on the table. Under 17 U.S.C. 412, statutory damages and attorney's fees are unavailable for infringement that begins after first publication and before the registration takes effect, unless you register within three months of first publication. Statutory damages run from $750 to $30,000 per work, rising to as much as $150,000 for willful infringement (17 U.S.C. 504(c)).

Without timely registration you are limited to actual damages and the infringer's profits, which for a small brand usually means the case is not worth bringing at all. So: register each season's original prints within three months of first publication, and record that date in your system.

Design patents protect a new, original, ornamental design for an article of manufacture, with a term of 15 years from grant (35 U.S.C. 173). They are genuinely useful for a distinctive hardware element or bag shape, but they are slow and expensive next to copyright, and are usually reserved for a handful of hero items.

The practical reality: print provenance and mill indemnities

Print infringement reaches a small brand in ordinary ways:

• A designer buys a print at a trade show, or is handed a sample by an agent.
• The mill offers a design from its own library.
• Someone finds a reference on a mood board and asks the mill to "do something like this".

Any of those can put a third party's copyrighted artwork onto 3,000 units of your product, and the claim will land on you, because you are the one selling in the US.

You need two defenses, and you need both. The first is provenance: for every print, a record of where the artwork came from, who created it, on what date, under what agreement, with what evidence.

In-house artwork needs the designer's employment or contractor agreement containing an express assignment or work-for-hire clause — the wording that makes the company, rather than the individual artist, the owner of the copyright — plus the dated source files. Purchased artwork needs the invoice, the license terms including exclusivity and territory, and the seller's warranty of ownership. Mill-library artwork needs the mill's written warranty of ownership and an indemnity.

The second defense is the mill indemnity, and you should be honest about what it is worth. An indemnity from a mill in a country where you could never practically enforce a judgment gives comfort without giving you a remedy. It does buy you three things:

• It changes supplier behavior, because they are now signing something.
• It supports a reasonable-care story.
• And if the mill has a US entity or a bank relationship you can reach, it may actually pay.

Price it accordingly, and never let it substitute for provenance records.

PRINT PROVENANCE RECORD - one row per artwork, immutable

artwork_id        AW-2026-0117
name              "Alentejo Stripe"
source_type       purchased | in_house | mill_library | licensed
source_party      Studio Ferrer SL  (VAT ESB12345678)
acquired_on       2025-11-04
agreement_ref     INV-4482 + LICENCE-2025-11-04.pdf
rights_granted    worldwide, apparel, exclusive 24 months
warranty          seller warrants sole ownership, clause 6
indemnity         yes, uncapped, clause 7
files             /artwork/AW-2026-0117/*.ai  sha256:9c1f...
first_published   2026-02-14   (SS26 line release)
copyright_reg     VA 2-345-678  filed 2026-03-02  (within 3 mo)
used_on_styles    4417, 4418, 4602

Two fields in that record are doing legal work you might not notice. first_published together with copyright_reg filed within three months is what preserves statutory damages and attorney's fees if someone copies you; here the filing is 16 days after publication, comfortably inside the window. Without both dates recorded, you cannot even tell whether you are still inside it.

And used_on_styles is what lets you answer the reverse question at speed. When a demand letter arrives naming an artwork, you need to know within minutes which styles, which purchase orders and which units in which customers' warehouses are affected, because your first decision is whether to stop shipping.

The contracts a wholesale brand actually signs

Compliance obligations mostly arrive through contracts, and every contract creates duties with dates on them. A brand of any size is party to four or five recurring agreement types, each with clauses that reliably cause pain.

Your terms of sale, and the retailer's vendor agreement

Your terms and conditions of sale. Your own document, printed on or referenced by every order confirmation and invoice, and the cheapest legal asset you will ever own. They should:

• set payment terms and late-payment interest,
• define when ownership and risk of loss pass to the buyer,
• limit your liability,
• exclude consequential damages (knock-on losses such as the customer's lost profits, as opposed to the cost of the goods themselves),
• set a short window for shortage and defect claims,
• state your returns policy,
• reserve the right to allocate short supply between customers,
• and specify which state's law applies and which courts hear disputes.

Without them, every dispute is argued from scratch under whichever default rules happen to apply.

Vendor agreements with retailers. The retailer's document, and effectively non-negotiable for a small brand. Expect:

• a warranty that every unit complies with all applicable laws;
• a broad indemnity running from you to the retailer covering product liability, IP infringement and compliance failures;
• a requirement to carry specified insurance, name the retailer as an additional insured (meaning your policy also covers them), and provide certificates proving it;
• and incorporation by reference of a routing guide and a vendor manual.

The routing guide is the retailer's rulebook for how goods must be packed, labeled, documented and delivered, which carrier, which carton label, which delivery window. The vendor manual is the wider operating handbook. Both can be revised by the retailer at any time, both have contractual force, and both carry a price list of chargebacks for every deviation.

Expect also a right of return or a markdown allowance, money you refund when the retailer discounts unsold stock, and audit rights.

The routing-guide incorporation is the sleeper clause: a document you have probably never read, revisable at will by the other side, is part of your contract.

Factory, sales rep and distributor agreements

Factory and supply agreements. Yours to write, ideally as a master supply agreement plus per-order terms:

• Insist that ownership of patterns, tech packs (the specification document that tells a factory exactly how to make the garment), tooling and molds vests in you.
• Insist on a right to inspect and to send third-party inspectors.
• Include a code of conduct prohibiting unauthorized subcontracting, which is precisely where forced-labor and quality risk enter.
• Add warranties of compliance with your RSL and with all applicable law; an obligation to provide traceability documentation within a stated number of days; IP warranties and an indemnity covering artwork the factory supplies; confidentiality; and a clear rule on who owns excess fabric, because factory overruns sold off the books into gray markets, unauthorized resale channels, damage your brand and your retailer relationships at the same time.

Sales representative agreements. These cover commission-based agents who carry your line to stores. Disputes are always about three things:

• which accounts are "house accounts" that you keep and pay no commission on,
• what happens to commission on orders written before termination but shipped after it (the "tail"),
• and whether the territory is exclusive.

Write all three down explicitly. Note also that many US states impose penalties, sometimes multiple damages plus legal fees, for paying earned commissions late after a representative is terminated.

Distributor agreements. A distributor buys from you and resells in a territory. The pain clauses are:

• exclusivity granted without any minimum purchase obligation (so nobody is obliged to develop the territory),
• restrictions on the price the distributor may resell at (which raises competition-law issues in both the US and the EU),
• who registers the trademark locally — never let a distributor register your mark in their own name —
• and termination, including notice periods, compensation entitlements under local law, and what happens to their remaining stock.

CONTRACT OBLIGATION CALENDAR - what the system must chase
MSA = master supply agreement; cl. = clause

due        obligation                          source
---------  ----------------------------------  -----------------
rolling    RSL declarations refresh (annual)   factory MSA cl.9
per PO     traceability pack within 15 days    factory MSA cl.14
2026-08-01 insurance certificate renewal       Retailer A vendor
           (retailer named additional insured)   agreement cl.11
2026-09-30 EPR units-placed report, France     Refashion scheme
2026-11-15 periodic CPSIA testing, kids line   16 CFR 1107.21
2027-01-01 CA PFAS limit drops 100 -> 50 ppm   HSC 108970(g)
2027-02-14 copyright reg deadline, SS27 prints 17 USC 412
2027-03-08 trademark declaration-of-use window 15 USC 1058
2029-08-14 destroy 2024 entry records          19 CFR 163.4

The obligation calendar

That calendar is the honest output of this entire chapter. Almost every obligation described above reduces to a dated task with a source and an owner. Each row names the document that creates the duty, so nobody has to guess why it is there: a clause number in your own factory agreement, a CFR citation, a scheme name.

Almost all of them fail silently, too — nothing breaks on the day you miss one. The consequence arrives one to three years later, as a canceled trademark registration, a rejected insurance claim, an uninsured loss or a document demand you cannot answer.

A compliance calendar with a due date, a responsible person, a source reference and a completion record is a small feature that prevents most of the catastrophic outcomes in this chapter.

Data protection, briefly

A wholesale brand holds less personal data than a consumer brand, but it holds some: buyer contacts at retail accounts, sales rep records, employee and contractor files, and, the moment you add a direct-to-consumer channel, customer records.

In the US the driver is state privacy law, led by California. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses doing business in California that meet any one of three thresholds set in Civil Code section 1798.140(d):

• The first is annual gross revenue above $25 million as written in the statute; the California Privacy Protection Agency adjusts that figure for inflation, so look up the current number rather than trusting the headline one.
• The second is buying, selling or sharing the personal information of 100,000 or more consumers or households.
• The third is deriving 50% or more of revenue from selling or sharing personal information.

"Consumer" includes California employees and business contacts, so a company under the revenue threshold today can be caught by growth. The software-facing obligations are: disclose what you collect, delete it on request, honor opt-outs of sale and sharing, and hold data no longer than is reasonably necessary.

In the EU, the General Data Protection Regulation (GDPR) applies if you offer goods to people in the EU or monitor their behavior. The practical items are:

• a lawful basis for marketing email,
• a record of processing activities,
• a data processing agreement with every processor,
• retention limits,
• breach notification within 72 hours,
• and, if you have no EU establishment, an EU representative.

That is a separate appointment from the GPSR responsible person, even when the same firm provides both services.

The engineering implication is modest but real. Personal data must be identifiable as such in your schema, deletable without breaking financial records, and covered by a retention policy that differs from the five- and ten-year retention you owe on customs and product-safety records. An order line has to survive a deletion request even when the customer's name and address do not.

Insurance: product, cargo, credit

Insurance is where compliance failures become survivable. Three policies matter.

What retailers require on product liability

Product liability cover, usually written as part of a commercial general liability policy, pays for bodily injury and property damage caused by your product.

Retailers require it and specify the limits, the form (occurrence-based rather than claims-made — an occurrence policy covers incidents that happened while the policy was live, even if the claim arrives years later, whereas a claims-made policy only covers claims made while it is live), that they be named as an additional insured, and often a vendor's endorsement extending the cover to them as a seller of your goods.

Required limits vary widely by retailer and product risk, so treat the number in the vendor agreement as the requirement and confirm your certificate matches it exactly. A mismatch routinely holds up a first order.

Watch for cover that excludes products with a recall history, and for certificates that lapse mid-season, which is exactly why the renewal date belongs in the obligation calendar.

Who insures the cargo, and for how much

Cargo insurance covers goods in transit, and who arranges it depends on your Incoterm. Incoterms are the standard three-letter shipping terms published by the International Chamber of Commerce that define where the seller's responsibility ends and the buyer's begins.

Under CIF (cost, insurance and freight) and CIP (carriage and insurance paid to) the seller must insure. CIP requires the broader Institute Cargo Clauses (A); CIF's default is the narrower clauses (C), with the parties free to agree more. Under FOB (free on board) and most other terms, the buyer insures.

Three things matter here:

• Carrier liability is drastically limited by law and by contract, to nothing like the value of your goods, so the carrier is not a substitute for a policy.
• Cover under CIF and CIP must be for at least 110% of the contract value, and 110% is the market convention anyway, because it reflects the margin you lose along with the goods.
• And cover must be in force from the moment risk passes to you, which under FOB is when the goods are loaded, not when they arrive.

Credit insurance and the order-release block

Trade credit insurance pays you if a customer does not. That is not exotic in wholesale apparel, where one department store insolvency can take out a season's receivables. Policies typically cover a percentage of the insured receivable, require you to submit customers for approved credit limits, and impose duties to report overdue accounts within a stated period and to stop shipping to a customer whose limit has been withdrawn.

That last duty is a hard software requirement: you must be able to block order release to an account whose limit was reduced or canceled, in real time, or you will discover at claim time that you shipped uninsured.

The alternative is to factor your receivables — sell your unpaid invoices to a finance company, called a factor, at a discount in exchange for cash now. A factor performs a similar credit-approval function and will also refuse to approve shipments to a weak account. Either way, the credit decision belongs in the order-release path, in code, with an audit trail.

What this means for your ERP

Everything above collapses into one requirement: on any given day, for any given unit you have sold, you must be able to produce a complete, dated, sourced evidence file within hours. That is the design target. Everything below serves it.

Tables and fields

Add a compliance domain alongside product and purchasing. The core entities are:

• a compliance profile per style;
• certificates;
• test reports and supplier declarations;
• restricted-substance rules and results;
• customs classifications and origin determinations;
• traceability nodes per purchase order;
• IP assets;
• and one obligations table driving the calendar.

-- Every style carries a compliance profile. Nullable columns are
-- deliberate: "not yet determined" must be distinguishable from
-- "determined to be false".

-- A CHECK constraint cannot contain a subquery or a set-returning
-- function, so wrap the fibre-percentage sum in an IMMUTABLE
-- helper function and call that from the constraint.
create function fiber_pct_total(fc jsonb) returns numeric
  language sql immutable as $$
    select coalesce(sum((f->>'pct')::numeric), 0)
      from jsonb_array_elements(fc) as f
  $$;

create table style_compliance_profile (
  id                  uuid primary key default gen_random_uuid(),
  tenant_id           uuid not null,
  style_id            uuid not null references style(id),
  is_childrens_product boolean,          -- null = not assessed
  childrens_rationale  text,
  assessed_by          uuid references app_user(id),
  assessed_at          timestamptz,
  hts_code             text,             -- 10 digits, US
  hts_determined_at    date,
  hts_basis            text,             -- ruling no. or reasoning
  country_of_origin    char(2),          -- ISO 3166-1 alpha-2
  origin_rule_applied  text,             -- e.g. '102.21(c)(2)'
  net_weight_g         numeric(10,2),    -- needed for EPR + DPP
  fiber_content        jsonb not null,   -- [{"fiber":..,"pct":..}]
  care_instructions    text[],
  care_basis           text,             -- the "reasonable basis"
  rn_number            text,
  created_at           timestamptz not null default now(),
  constraint fiber_pct_sums_100 check (
    fiber_pct_total(fiber_content) between 99 and 101
  ),
  constraint kids_needs_rationale check (
    is_childrens_product is null or childrens_rationale is not null
  )
);

-- Certificates (CPC, GCC, PFAS certificate of compliance, FTA
-- certification of origin). One row per certificate, immutable;
-- corrections supersede rather than update.
create table certificate (
  id              uuid primary key default gen_random_uuid(),
  tenant_id       uuid not null,
  kind            text not null check (kind in
                    ('CPC','GCC','PFAS_COC','FTA_ORIGIN',
                     'CONTINUING_GUARANTY','SCOPE','TRANSACTION')),
  subject_type    text not null check (subject_type in
                    ('style','material','purchase_order','shipment')),
  subject_id      uuid not null,
  issued_by       text not null,
  issued_on       date not null,
  valid_from      date not null,
  valid_until     date,               -- null = until superseded
  rules_certified text[] not null,    -- e.g. {'16 CFR 1610', ...}
  document_uri    text not null,
  document_sha256 bytea not null,     -- tamper evidence
  superseded_by   uuid references certificate(id),
  retain_until    date not null,      -- computed on insert
  created_at      timestamptz not null default now()
);
create index on certificate (tenant_id, subject_type, subject_id,
                             valid_from desc);

Four design choices there are load-bearing. First, the fiber-sum rule lives in a helper function because PostgreSQL will not let a CHECK constraint contain a subquery or a set-returning function such as jsonb_array_elements. Marking the function immutable is a promise you are making to the database: given the same input it always returns the same answer.

Second, is_childrens_product is nullable, with a constraint forcing a rationale whenever it is set. That makes "nobody has decided yet" a distinct, queryable state, so you can block order release on unassessed styles instead of silently defaulting to "no".

Third, certificates are immutable and superseded rather than updated, because a regulator asking what you held in March 2026 needs the March 2026 record. That is the same append-only discipline you applied to the inventory ledger in chapter 1.

Fourth, retain_until is computed at insert time from the rule for that certificate kind — five years from creation for CPSC certificates, five years from entry for customs documents, ten years for EU technical documentation, so your archiving job works off one indexed column instead of re-deriving retention logic it may well get wrong.

-- Restricted-substance rules are DATA, not code. Time-bounded so
-- that a future-dated order is checked against future limits.
create table substance_rule (
  id              uuid primary key default gen_random_uuid(),
  substance_group text not null,      -- 'PFAS', 'LEAD_TOTAL', ...
  limit_value     numeric,
  limit_unit      text,               -- 'ppm', 'percent'
  jurisdiction    text not null,      -- 'US-CA', 'EU', 'US'
  legal_basis     text not null,      -- 'CA HSC 108970(g)'
  scope           text not null,      -- 'textile_article', ...
  effective_from  date not null,
  effective_to    date                -- null = still in force
);

-- Test results attach to a MATERIAL where possible (reusable) or
-- to a STYLE where the test is of the finished garment.
create table substance_test_result (
  id              uuid primary key default gen_random_uuid(),
  tenant_id       uuid not null,
  subject_type    text not null check (subject_type in
                    ('material','style','lot')),
  subject_id      uuid not null,
  substance_group text not null,
  result_value    numeric,
  result_unit     text,
  detection_limit numeric,
  method          text not null,      -- test method used
  lab_name        text not null,
  lab_accredited  boolean not null,
  tested_on       date not null,
  report_uri      text not null,
  report_sha256   bytea not null,
  valid_until     date                -- periodic-testing interval
);

Why substance rules live in a table

Substance rules live in a table rather than in code because of the PFAS problem: jurisdictions and limits change several times a year, and California's own limit tightens on 1 January 2027. Rows carrying effective_from and effective_to let a single query answer "is this style compliant for delivery on date D into markets M?", and let a non-engineer add a new state's rule without a deployment.

The subject_type split between material, style and lot is what stops you paying for the same fabric test forty times: one mill fabric test propagates to every style that uses it, while a finished-garment test — the kind the Care Labeling Rule's reasonable-basis standard and a Proposition 65 exposure analysis both require — attaches to the style.

The method and detection_limit columns exist because a "not detected" result means nothing until you know what the lab could have detected.

And storing a SHA-256 hash of every report, a short fingerprint that changes if a single byte of the file changes, means you can prove years later that the PDF in your archive is the one the lab actually issued.

Workflows and screens the software must support

• Style creation gate. A style cannot move from "development" to "approved for production" without: fiber content summing to 100, a country-of-origin determination naming the rule applied, an HTS code with a basis, a children's-product assessment with a rationale, and a net weight. These are cheap at creation and brutal to backfill.
• Purchase order release gate. A purchase order cannot be released to a factory unless the style's compliance profile is complete, the required declarations for its materials will still be current on the expected delivery date, and, for children's styles, a CPC exists or is scheduled with a booked lab.
• Goods receipt capture. Receiving must record the factory, the production month, and a lot or batch identifier for children's styles, because the tracking-label rule and the certificate's date-and-place-of-manufacture field both depend on it.
• Sales order release gate. An order cannot be released if the destination market has an unsatisfied requirement — no PFAS certificate for California, no responsible person for the EU, no valid EPR registration for that Member State — or if the account's insured credit limit is exhausted or has been withdrawn.
• Claim publication gate. Any marketing claim attached to a style must reference the evidence records supporting it, and the system must refuse to publish a claim whose supporting certificates are not valid on the shipping date.
• Evidence file export. One button, one style or one purchase order, and out comes a zip file: certificates, test reports, declarations, traceability tree, entry documents, label specification, with an index and hashes. This is the feature that turns a 30-day CBP detention deadline from a crisis into an afternoon.
• Obligation calendar. A single view of everything dated, with an owner, a source reference and a completion record, feeding notifications well ahead of each deadline.

Rules to enforce, and reports people will demand

The reports you will be asked for, usually with little notice:

• the evidence file for a style, a purchase order or an entry;
• expiring certificates in the next 90 days, by style and by market;
• styles blocked from a market together with the specific missing evidence;
• units placed on market by category and country for EPR reporting;
• unsold units discarded by category with reason and treatment codes for the ESPR disclosure;
• duty paid by HTS code to spot classification drift and to quantify what an FTA claim is worth;
• and traceability completeness by open purchase order, which is the leading indicator telling you which shipments would fail a UFLPA detention today.

How this connects to the engineering chapters

Chapter 1's append-only ledger is the same pattern applied elsewhere: compliance evidence is an event log, and reconstructing a past position is the whole point. Chapter 2 supplies the PostgreSQL tools — check constraints for fiber sums, validated jsonb, exclusion constraints so that two rule periods for the same substance and jurisdiction cannot overlap, partial indexes over unexpired certificates.

Chapter 3 matters because eFiling calls to ACE must be idempotent, meaning that sending the same message twice has the same effect as sending it once; an entry filed twice is a customs problem.

Chapter 4 hosts the Partner Government Agency message set alongside your EDI (electronic data interchange, the standard message formats retailers use to send orders and invoices) and accounting integrations — model "government agency" as just another trading partner with a schema and an acknowledgment flow.

Chapter 5's row-level security keeps evidence files scoped to one tenant when a factory or a broker is given limited access. Chapter 7 matters because lab results and declarations arrive as spreadsheets and PDFs, and that import pipeline must validate what it receives against substance_rule.

Chapter 9 owns the retention jobs, the expiry alerting and the tests that prove the export still works. Chapter 11 carries these tables into the reference schema, and chapter 12 should put the compliance evidence model early on the roadmap, because its value is retrospective and its cost grows with every style you ship without it.

Field notes & further reading

• FTC, "Threading Your Way Through the Labeling Requirements Under the Textile and Wool Acts" — the definitive plain-English guide to fiber content, origin and RN labeling, with worked label examples, the 5% and 3% rules, and the trim and ornamentation exemptions.
• FTC, "Clothes Captioning: Complying with the Care Labeling Rule" — what a care label must say, the permanence requirement, the "reasonable basis" standard, and a long FAQ on multi-piece garments, symbols and drycleaning wording. Note that the penalty figure quoted on that page is long out of date; the rule text itself is not.
• 16 CFR part 303, the Textile Fiber Products Identification Act rule — the regulation text behind the guide above, including the 5% rule at 303.3, the house-mark option at 303.19 and the 3% tolerance at 303.43.
• CPSC, "Certificates of Compliance" final rule (90 FR 1800, 8 January 2025) — the revised 16 CFR part 1110: eFiling, certificate content elements, five-year retention, and the 8 July 2026 and 8 January 2027 effective dates.
• CBP, Uyghur Forced Labor Prevention Act — importer guidance and the Attachment to the Notice of Detention listing exactly which documents CBP asks for, including bale-level tracing for cotton.
• 19 CFR 102.21, rules of origin for textile and apparel products — the ordered (c)(1) to (c)(5) hierarchy and the tariff-shift rules your origin determination must cite.
• CBP CROSS, the Customs Rulings Online Search System — free, searchable, and full of rulings on garments almost identical to yours. Read three or four before you argue with your broker about a classification.
• Regulation (EU) 2023/988 (GPSR) — the Article 16 responsible-person requirement, technical documentation and its 10-year retention, the six-year traceability duty in Article 15, distance-selling disclosures and accident notification.
• AAFA Restricted Substances List — a free, regularly updated consolidation of chemical restrictions on finished apparel, footwear and home textiles worldwide. Adopt it as your baseline RSL rather than writing your own.