EU compliance checklist for non-EU sellers
Comprehensive EU compliance checklist for non-EU merchants covering discovery, VAT/IOSS, GDPR consent, packaging EPR/DSA, CBAM prep, evidence kits, and tools.
EU compliance checklist
Follow this end-to-end checklist to enter EU & UK markets with confidence. Content here is operational guidance only—always confirm the legal position with your advisors.
Capture your answers inside the Readiness Check so analytics, finance, and ops teams rely on the same data.
Revisit this checklist every quarter; VAT thresholds, CBAM scope, and packaging quotas can shift when you add new SKUs or countries.
FAQ
What is the fastest way for a non-EU seller to confirm VAT/IOSS obligations?
Run the Readiness Check with your shipping origins, consignment values, and storage locations. If you ship only from outside the EU and consignments stay ≤ EUR 150, IOSS is usually appropriate. Any EU storage creates fixed establishment risk, requiring local VAT plus OSS for cross-border B2C. Keep warehouse addresses, SKU maps, and marketplace liability proofs handy so registrations and filings reconcile.
Do I need both GDPR and UK GDPR compliance if I sell into the UK?
Yes. Treat the UK as a separate regime: store consent logs per jurisdiction, localize copy, and respect Do Not Track/Global Privacy Control by default. For ads and analytics, block scripts until consent. Log DSARs with SLA tracking. If you reuse EU consent data in the UK, document transfer safeguards and retention policies so audits see a clear lawful basis.
How do I know if my packaging requires EPR registration in France or Germany?
France requires an eco-organisme contract and Triman markings for packaged goods placed on the market; thresholds are effectively gone. Germany requires LUCID registration plus a dual system before first parcel ships. Marketplace fulfillment does not remove this duty—you must provide IDs. Keep packaging weight data, contracts, and invoices aligned to each brand/SKU and mirror IDs on product pages, invoices, and marketplace listings.
Does CBAM apply if I import small volumes?
If covered goods stay at or below 50 tonnes per category in a rolling 12 months, you may use the small-importer simplification but still file quarterly reports. Track CN codes, tonnes, and supplier emissions data early. If volumes grow, be ready to appoint a CBAM declarant, purchase certificates, and reconcile emissions vs foreign carbon prices.
At a glance timeline
| Phase | Duration | Owner | Linked tool |
|---|---|---|---|
| Discovery | 1–2 days | Ops/RevOps | Docs hub |
| VAT/IOSS | 4–8 weeks | Finance/Legal | VAT/IOSS Checker |
| GDPR & consent | 1–2 weeks | Product/Marketing | GDPR Generator |
| Packaging & DSA | 2–5 weeks | Ops | EPR & DSA Compliance |
| CBAM | 4–10 weeks | Supply Chain/Sustainability | CBAM Readiness Tool |
Discovery and scoping
Market and channel assessment
Traffic & order sources
Insight collection
Metrics to capture
- Split historical traffic/orders by EU country to test threshold exposure.
- Map channel mix (Shopify, Woo, custom Next.js, marketplaces) because VAT liability differs.
Documentation
Systems
- Export platform tax settings to benchmark against EU VAT explained.
- Log marketing pixels ahead of GDPR basics implementation.
Inventory planning
Storage questions
Actions
- List every 3PL/FBA/warehouse location; EU storage implies fixed establishment.
- Flag goods shipping directly from outside EU to evaluate IOSS vs OSS.
Supplier data
Actions
- Request HS/CN codes per SKU—needed for packaging eco-fees and CBAM overview.
- Collect packaging weight (paper, plastic, glass) to preload French & German packaging forms.
VAT and IOSS workflow
Evaluate schemes
Threshold checkpoints
Local vs OSS
Decision factors
- If EU-wide B2C sales stay under EUR 10k, you can apply “home” VAT; beyond that, opt for OSS or local VAT.
- Consignments ≤ EUR 150 qualify for IOSS as long as goods ship from outside EU and no EU storage is involved.
Fixed establishment
Decision factors
- EU storage or staff triggers local VAT regardless of IOSS.
- Marketplaces may handle VAT, but you still need VAT numbers for returns and audits.
Filing readiness
Document pack
Contents
- Certificate of incorporation + translations.
- Proof of bank account/IBAN for VAT refunds.
Timeline control
Owners
- Finance owns OSS/local submissions; integrate with treasury calendar.
- Legal validates power of attorney for intermediaries.
Documents you'll need
| Category | Items | Used for | Linked doc |
|---|---|---|---|
| Corporate | Articles, director IDs, proof of address | IOSS/OSS/local VAT onboarding | EU VAT explained |
| Fulfillment | 3PL contracts, warehouse leases | Fixed establishment proof | EU compliance checklist |
| Logistics | HS codes, freight invoices | CBAM + customs filings | CBAM overview |
| Packaging | Weight declarations, eco-fee statements | FR/German filings | French & German packaging |
| Privacy | CMP logs, DSAR requests | GDPR/UK GDPR evidence | GDPR basics |
GDPR and consent deployment
Lawful basis selection
Consent-first channels
Data capture
Controls
- Block analytics/ads until consent stored; the GDPR Generator ships ready scripts.
- Use server-side events only after matching consent to order IDs.
Legitimate interest
Controls
- Document balancing tests for transactional emails.
- Provide opt-outs in both EU and UK local languages.
Banner, DSAR, and logging
Implementation beats
Shopify/Woo/Next.js
Steps
- Shopify: Customer Privacy API + theme app blocks.
- Next.js: hydrate banner via middleware so Do Not Track works globally.
DSAR & audit trail
Steps
- Route DSAR form into your CRM with SLA tracking.
- Store consent logs for six years minimum per ICO guidance.
Packaging, DSA, and sustainability
EPR + DSA tasks
France focus
Eco-organisme
Checklist
- Register with Citeo/Léko, embed Triman logos on packaging/product page.
- Surface operator info in footer per French & German packaging.
Marketplace mirroring
Checklist
- Update IDs inside Amazon FR/FR marketplace dashboards.
- Sync translations with privacy policy from GDPR basics.
Germany focus
LUCID steps
Checklist
- Register brand in ZSVR portal, sign a dual system contract.
- Publish DSA operator/contact/complaints snippet across sites.
Proof retention
Checklist
- Archive fee invoices; marketplaces often request proofs during audits.
- Pair VAT IDs with packaging IDs to avoid account suspensions.
Typical timelines & costs
| Workstream | Timeline | Cost range (EUR) | Notes |
|---|---|---|---|
| IOSS onboarding | 4–8 weeks | 1,500–3,000 + annual fee | Needed for non-EU sellers without EU entity |
| Local VAT per country | 6–12 weeks | 600–1,200 per filing | Include sworn translations |
| GDPR banner rollout | 1–2 weeks | 300–1,000 (CMP/license) | Derived from GDPR & UK GDPR Generator |
| France eco-organisme | 2–4 weeks | 80–500 + eco-fees | Prepare packaging weights |
| LUCID registration | 3–5 weeks | 250–1,500 | Dependent on tonnage |
| CBAM readiness sprint | 4–10 weeks | 2,000–10,000 | Data collection + IT work |
CBAM planning
Scope confirmation
Covered goods
Steel/aluminum examples
Tasks
- Map CN 7206–7217 (steel) and 7601–7609 (aluminum) SKUs.
- Validate import volumes; under 50 tonnes annually may qualify for small-importer relief.
Fertilizer/other goods
Tasks
- Tag CN 3102–3105 fertilizers, cement, hydrogen, electricity flows.
- Link suppliers to embedded-emissions statements.
Reporting cadence
Quarterly filings
Declarant prep
Steps
- Appoint an authorized CBAM declarant and register before 2026.
- Align data warehouse exports with the CBAM Readiness Tool.
Evidence storage
Steps
- Keep supplier attestations, customs entries, and emissions calculations for four years.
- Cross-check totals with finance carbon budgets.
Ready to check your obligations? Run the Readiness Check → Launch the workflow
Next actions
- Run the VAT/IOSS Checker using your origins and consignment values.
- Deep dive via EU VAT explained before filing.
- Log owners and timelines in the Readiness Wizard.
EU Market Ready