Sample files from each document kit

Sample, made-up company

1. Written mandate for an authorised representative under Regulation (EU) 2023/988 (GPSR)

Example Lighting Ltd, 1 Road, Shenzhen, China, info@example.com ("the manufacturer"), appoints Example EU Rep GmbH, Hauptstr. 1, Berlin, Germany, rep@example.com ("the authorised representative"), established in the European Union, as its authorised representative under Article 10 of Regulation (EU) 2023/988 on general product safety.

Products: This mandate covers the following products made available on the market of the European Union: Lumo Desk lamp.

Tasks: The authorised representative shall perform the following tasks on behalf of the manufacturer (Article 10(2)):

• provide a market surveillance authority, on its reasoned request, with all information and documentation necessary to demonstrate the safety of the products, in an official language which can be understood by that authority;
• where it considers or has reason to believe that a product is dangerous, inform the manufacturer;
• inform the competent national authorities, through the Safety Business Gateway, of any action taken to eliminate the risks posed by the products, where the manufacturer has not already provided that information, or on the manufacturer's instruction;
• cooperate with the competent national authorities, at their request, on any action taken to eliminate effectively the risks posed by the products;
• provide a copy of this mandate to the market surveillance authorities on request.

Responsible person: The authorised representative is the economic operator established in the Union that is responsible for the products under Article 16(1). It shall perform the tasks in Article 4(3) of Regulation (EU) 2019/1020 and, where appropriate with regard to the possible risks, regularly check that the products comply with the technical documentation and with Article 9(5), (6) and (7), and provide documented evidence of these checks on request (Article 16(2)). The manufacturer shall indicate the name and contact details of the authorised representative on the products, their packaging, the parcel or an accompanying document (Article 16(3)), and in its online offers (Article 19).

Duties of the manufacturer: The manufacturer shall give the authorised representative the technical documentation (Article 9(2)) before the products are placed on the market and keep it up to date; inform it without delay of any risk, complaint, accident or corrective measure concerning the products; and give it any other information it needs to perform its tasks. The manufacturer remains responsible for its own obligations under the Regulation.

Duration: This mandate takes effect on 2026-11-02 and remains in force until either party ends it in writing.

The rest of this document is in the kit.

Sample, made-up company

Drawn up under Article 9(2) and (3) of Regulation (EU) 2023/988 (General Product Safety Regulation). Keep it up to date and available to market surveillance authorities for 10 years after the product is placed on the market. Date: 2026-11-02.

1. Product and parties

2. General description and essential characteristics relevant for safety

LED desk lamp, USB powered.

3. Internal risk analysis (Article 9(2)(a), aspects of Article 6(1))

For each aspect: whether it applies to this product, the possible risk, and the solution adopted to eliminate or mitigate it. Aspects left TO COMPLETE have not been assessed yet.

The rest of this document is in the kit.

Sample, made-up company

Text for the product, its packaging or an accompanying document, and for each online offer, in the language of each country of sale. The headings are fixed text; names, addresses and warnings are as you typed them, and nothing is translated. A language whose warnings you did not type says TO COMPLETE.

English

Sample, made-up company

For each product: technical documentation, the single EU declaration of conformity in each language chosen and, for radio equipment, the simplified EU declaration of conformity and the information for the instructions and the packaging. Date: 2026-11-02.

Which directive: radio equipment (it intentionally emits or receives radio waves for radio communication or radiodetermination) comes under Directive 2014/53/EU, which covers the safety objectives of Directive 2014/35/EU with no voltage limit and the electromagnetic compatibility of Directive 2014/30/EU: it is not subject to those two directives (Article 1(4) of 2014/53/EU; Article 2(2)(a) of 2014/30/EU). Other electrical apparatus comes under Directive 2014/30/EU and, if its voltage rating is between 50 and 1 000 V AC or 75 and 1 500 V DC, Directive 2014/35/EU.

Single declaration: where a product is subject to more than one Union act requiring an EU declaration of conformity, one declaration is drawn up for all of them, identifying each act with its publication reference (Article 15(3) of 2014/30/EU and 2014/35/EU, Article 18(3) of 2014/53/EU). The kit uses the model of Annex VI of 2014/53/EU for radio equipment and of Annex IV of 2014/30/EU for other apparatus, in the wording of the Official Journal, and translates nothing you type.

What this kit does not cover

• Choosing harmonised standards, testing and the assessment itself: the kit records what you enter. It checks the references you list against the Official Journal lists for the Low Voltage and Radio Equipment Directives on the day you make it; the EMC list is not checked.
• A notified body's work, where Annex III or IV applies.
• Whether a specific exclusion applies (Annex I of 2014/53/EU, Article 2(2) of 2014/30/EU, Annex II of 2014/35/EU).
• The evidence for RoHS (the RoHS and REACH document kit covers it), and other Union acts such as ecodesign, batteries, WEEE or the Cyber Resilience Act.
• National rules on the use of radio spectrum in each Member State.

The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any product meets the requirements.

Sample, made-up company

Directive 2014/53/EU (radio equipment), Article 21 and Annex V: technical documentation. Keep it with the EU declaration of conformity for 10 years after the radio equipment has been placed on the market (Article 10(4)). Date: 2026-11-02.

Essential requirements (Article 3)

• Article 3(1)(a): protection of health and safety of persons and of domestic animals and of property, including the safety objectives of Directive 2014/35/EU, with no voltage limit.
• Article 3(1)(b): an adequate level of electromagnetic compatibility as set out in Directive 2014/30/EU.
• Article 3(2): effective use of radio spectrum and support for its efficient use, to avoid harmful interference.

Article 17(4): where, for Article 3(2) or (3), harmonised standards published in the Official Journal were not applied, were applied only in part, or do not exist, the radio equipment must go through Annex III or Annex IV for those requirements, not Annex II.

Analysis and assessment of the risks

The technical documentation includes an adequate analysis and assessment of the risk(s) (Annex III, point 3(c), where EU-type examination is applied; the kit adds it for every procedure). Article 3(1)(a) includes the safety objectives of Directive 2014/35/EU with no voltage limit, so its Annex I is listed too. For each point, record the risk for this product, the measure taken and the evidence (the clause of a standard, a test report). Where a point is not relevant to the product, write so and why.

Article 3(1) and (2) of Directive 2014/53/EU

The rest of this document is in the kit.

Sample, made-up company

3. This declaration of conformity is issued under the sole responsibility of the manufacturer.

5. The object of the declaration described above is in conformity with the relevant Union harmonisation legislation:

• Directive 2014/53/EU (OJ L 153, 22.5.2014, p. 62)

Other Union harmonisation legislation where applicable

• Not applicable

The rest of this document is in the kit.

Sample, made-up company

Hereby, Example Electronics Co., Ltd. declares that the radio equipment type Smart plug SP-2 is in compliance with Directive 2014/53/EU.

The full text of the EU declaration of conformity is available at the following internet address: [TO COMPLETE]

Sample, made-up company

On the product (Article 10(6) and (7), Articles 19 and 20)

• Type, batch or serial number: Batch 2027-01
• Manufacturer: Example Electronics Co., Ltd., Nanshan District, Shenzhen, China, info@example.com (name, registered trade name or registered trade mark, and the postal address, which indicates a single point of contact, in a language easily understood by end-users and market surveillance authorities; on the packaging or in an accompanying document where the size or nature of the product does not allow it)
• CE marking: visible, legible and indelible on the product or its data plate, and also on the packaging; it may be lower than 5 mm on radio equipment if it stays visible and legible. Followed by the notified body's number where Annex IV is applied.

In the instructions (Article 10(8))

Instructions and safety information, clear, understandable and intelligible, in a language easily understood by end-users as the Member State decides, including where applicable the accessories and components, including software, that allow the product to operate as intended:

• [TO COMPLETE] (or "None")

Frequency bands and maximum radio-frequency power transmitted in each:

[TO COMPLETE] (each frequency band and the maximum radio-frequency power transmitted in it, for example 2 400–2 483,5 MHz: 20 dBm e.i.r.p.)

On the packaging and in the instructions (Article 10(10))

The rest of this document is in the kit.

Sample, made-up company

Regulation (EU) 2023/1230 on machinery, Annex IV, Part A. Draw it up before the machine is placed on the market or put into service, and keep it with the EU declaration of conformity for at least 10 years after (Article 10(3)). Date: 2026-11-02.

(a) a complete description of the machinery or related product and of its intended use;

Double-wheel bench grinder, 250 mm wheels, 400 V.

Intended use:

Grinding metal tools in workshops.

(b) the documentation on risk assessment demonstrating the procedure carried out, including: (i) a list of the essential health and safety requirements that are applicable to the machinery or related product; (ii) the description of the protective measures implemented to meet each applicable essential health and safety requirement and, when appropriate, the indication of the residual risks associated with the machinery or related product;

See the separate risk assessment for this machine.

The rest of this document is in the kit.

Sample, made-up company

Annex III, Part B of Regulation (EU) 2023/1230: the manufacturer ensures that a risk assessment is carried out to determine the essential health and safety requirements which apply, and designs and constructs the machine to eliminate hazards or, if that is not possible, to minimise all relevant risks. Date: 2026-11-02.

(a) Limits of the machine: intended use and reasonably foreseeable misuse

Grinding metal tools in workshops.

Reasonably foreseeable misuse:

[TO COMPLETE]

(b) Hazards and hazardous situations

Where the machine is designed to operate with varying levels of autonomy: include hazards that might arise during its lifecycle, foreseeable when it is placed on the market, as an intended evolution of its fully or partially self-evolving behaviour or logic (Annex III, Part B, point 1).

The rest of this document is in the kit.

Sample, made-up company

4. This declaration of conformity is issued under the sole responsibility of the manufacturer.

6. The object of the declaration referred to in point 5 is in conformity with the following Union harmonisation legislation.

• Regulation (EU) 2023/1230

9. Where applicable, the machinery or related product is subject to the conformity assessment procedure based on internal production control (Module A).

The rest of this document is in the kit.

Sample, made-up company

For each toy: the safety assessment (Article 18), the technical documentation (Annex IV), the EC declaration of conformity (Annex III) in each language chosen, and the warnings and label sheet (Articles 4, 6, 11 and 17, Annex V). Date: 2026-11-02.

Directive 2009/48/EC applies until 31 July 2030. Regulation (EU) 2025/2509 on the safety of toys applies from 1 August 2030 and requires a digital product passport for every toy; a passport that contains all the information of the declaration of conformity fulfils the obligation to draw up that declaration (its Article 19(5)). Toys placed on the market in conformity with the Directive before 1 August 2030 may still be made available afterwards (its Article 57(1)).

Route (Article 19): internal production control only when harmonised standards published in the Official Journal, covering all relevant safety requirements of the toy, were applied in full and none of them was published with a restriction. Otherwise, or when you consider that the toy needs third-party verification, a notified body carries out EC-type examination (Article 20).

What this kit does not cover

• Choosing harmonised standards (the EN 71 series and others), testing and the assessment itself: the kit records what you enter.
• A notified body's work, where Article 19(3) applies.
• Whether the product is a toy at all, or one of the products of Annex I that are not toys.
• Other EU acts the toy may also be subject to, such as the Radio Equipment Directive, EMC, batteries, REACH or the GPSR for non-toy parts.
• National rules on the language of warnings and instructions in each Member State.

The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any toy is safe or complies.

Sample, made-up company

Before placing a toy on the market, the manufacturer carries out an analysis of the chemical, physical, mechanical, electrical, flammability, hygiene and radioactivity hazards that the toy may present, and an assessment of the potential exposure to them (Article 18). It forms part of the technical documentation (Annex IV (b)). Date: 2026-11-02.

The toy and its users

• Description: Hand-crocheted soft toy, cotton yarn, polyester filling, 20 cm.
• User limitations (Annex V Part A): [TO COMPLETE]
• [TO COMPLETE] (whether the toy is intended for children under 36 months)

Article 10(2): toys, including the chemicals they contain, must not jeopardise the safety or health of users or third parties when used as intended or in a foreseeable way, bearing in mind the behaviour of children. Assess the toy for the ages it is meant for, and for younger children who may reach it.

Hazards and exposure

For each group, record whether it is relevant, the hazard for this toy, the exposure (who, how, how long, how often), the measure taken and the evidence (the clause of a standard, a test report). Where a group is not relevant, write so and why.

The rest of this document is in the kit.

Sample, made-up company

Article 21 and Annex IV. Drawn up in an official language of the Community (Article 21(2)) and kept with the EC declaration of conformity for 10 years after the toy has been placed on the market (Article 4(3)). Date: 2026-11-02.

(a) Detailed description of the design and manufacture, with the list of components and materials used and the safety data sheets of the chemicals used, from the chemical suppliers

Hand-crocheted soft toy, cotton yarn, polyester filling, 20 cm.

[TO COMPLETE] (each component and material; attach the safety data sheets)

(b) The safety assessment(s) carried out in accordance with Article 18

The safety assessment of this kit.

(c) Description of the conformity assessment procedure followed

The rest of this document is in the kit.

Sample, made-up company

3. This declaration of conformity is issued under the sole responsibility of the manufacturer:

5. The object of the declaration described in point 4 is in conformity with the relevant Community harmonisation legislation:

• Directive 2009/48/EC of the European Parliament and of the Council of 18 June 2009 on the safety of toys (OJ L 170 30.6.2009, p. 1)

The rest of this document is in the kit.

Sample, made-up company

On the toy, a label or the packaging

• Type, batch, serial or model number: Batch 2027-01 (on the toy, or on the packaging or an accompanying document where the size or nature of the toy does not allow it; Article 4(5)).
• Manufacturer: Example Toys Ltd, 1 Main Street, Dublin, Ireland, info@example.com: name, registered trade name or registered trade mark, and an address that is a single point of contact (Article 4(6)).
• CE marking: visibly, legibly and indelibly on the toy, an affixed label or the packaging, before the toy is placed on the market; for small toys and toys of small parts it may be on a label or an accompanying leaflet; where it is not visible from outside the packaging, at least on the packaging (Article 17).
• Instructions and safety information in a language or languages easily understood by consumers, as the Member State decides (Article 4(7)).

Warnings (Article 11 and Annex V)

Clearly visible, easily legible, understandable and accurate, on the toy, an affixed label or the packaging and, if appropriate, in the instructions; on small toys sold without packaging, on the toy itself. Warnings that decide the purchase, such as the minimum and maximum ages, and the other Annex V warnings appear on the consumer packaging or are otherwise clearly visible before purchase, including online (Article 11(2)). The warnings of points 2 to 10 of Annex V Part B are used as worded in the Directive; below they are quoted from each language version.

[TO COMPLETE] (whether the toy is intended for children under 36 months)

• No category of Annex V Part B points 2 to 10 was selected.

English

[TO COMPLETE] (no warning text could be printed yet)

The rest of this document is in the kit.

Sample, made-up company

Directive 2011/65/EU (RoHS) and Article 33 of Regulation (EC) No 1907/2006 (REACH). For each product: technical documentation (Article 7(b), Module A), the EU declaration of conformity (Annex VI) in each language chosen, and the REACH Article 33 information. Date: 2026-11-02.

Article 13(2): the EU declaration of conformity has the model structure of Annex VI, is kept up to date, and is translated into the language or languages required by the Member State where the product is placed or made available on the market. By drawing it up, the manufacturer takes responsibility for the product's compliance (Article 13(3)).

Where the product is also subject to the Low Voltage, EMC or Radio Equipment Directive, those directives require a single EU declaration of conformity for all the Union acts that apply to it (for example Article 15(3) of Directive 2014/35/EU): list those acts, with their publication references, in the declaration.

What this kit does not cover

• Whether an Annex III or IV exemption covers your use, and its expiry date: the kit records the exemptions you state.
• The Candidate List itself: check the current list on the European Chemicals Agency's website.
• Notification to the SCIP database of articles containing a Candidate List substance above 0,1 % w/w (Directive 2008/98/EC, Article 9(1)(i)).
• REACH restrictions (Annex XVII) and authorisation (Annex XIV).
• Registration and reporting as a producer under the WEEE Directive 2012/19/EU in each Member State.
• The requirements of other Union acts, such as electrical safety and electromagnetic compatibility.

The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any product meets the requirements.

Sample, made-up company

Directive 2011/65/EU on the restriction of the use of certain hazardous substances in electrical and electronic equipment, Article 7(b): technical documentation and internal production control in line with Module A of Annex II to Decision No 768/2008/EC. It must make it possible to assess the product's conformity with Article 4, and include an adequate analysis and assessment of the risks. Keep it with the EU declaration of conformity for 10 years after the product has been placed on the market (Article 7(d)). Date: 2026-11-02.

Restricted substances (Article 4(1), Annex II)

Maximum concentration tolerated by weight in homogeneous materials. For each substance, the evidence that every homogeneous material of the product stays within it: supplier declarations, material declarations or analyses, and test reports where the information is not reliable enough.

Evidence collected

[TO COMPLETE] (supplier and material declarations, with the supplier, the part or material, and the date)

Exemptions relied on (Annex III or Annex IV)

The rest of this document is in the kit.

Sample, made-up company

3. This declaration of conformity is issued under the sole responsibility of the manufacturer (or installer):

5. The object of the declaration described above is in conformity with Directive 2011/65/EU of the European Parliament and of the Council of 8 June 2011 on the restriction of the use of certain hazardous substances in electrical and electronic equipment (OJ L 174, 1.7.2011, p. 88):

Signed for and on behalf of: Example Electronics Pvt Ltd

The rest of this document is in the kit.

Sample, made-up company

[TO COMPLETE] (whether the product contains a Candidate List substance above 0,1 % w/w; if it does, the substances and the information for safe use)

Article 33(1) of Regulation (EC) No 1907/2006: any supplier of an article containing a substance meeting the criteria in Article 57 and identified in accordance with Article 59(1) in a concentration above 0,1 % weight by weight (w/w) shall provide the recipient of the article with sufficient information, available to the supplier, to allow safe use of the article including, as a minimum, the name of that substance.

The 0,1 % w/w applies to each article, including each article that is part of a complex product (Court of Justice, judgment of 10 September 2015, C-106/14). The Candidate List is updated about twice a year: check it again and update this information when it changes.

Filled in from the information you entered.

Sample, made-up company

Regulation (EU) 2023/1542 on batteries. For each battery model: technical documentation (Annex VIII, Part A), a label content sheet (Article 13, Annex VI) and the EU declaration of conformity (Annex IX) in each language chosen. Date: 2026-11-02.

Article 18(2): the declaration is translated into the language or languages required by the Member State where the battery is placed or made available on the market or put into service, drawn up in electronic format and, where requested, provided on paper. Keep it up to date.

Article 18(3): where the battery is subject to more than one Union act requiring an EU declaration of conformity, one single declaration covers them all and states the acts and their publication references.

What this kit does not cover

• Module D1 and Module G (Annex VIII, Parts B and C), with a notified body: required for Articles 7 and 8 (Article 17(2)).
• The carbon footprint declaration (Article 7) and the recycled content documentation (Article 8).
• The battery passport itself (Article 77): from 18 February 2027 for LMT batteries, industrial batteries above 2 kWh and EV batteries.
• Battery due diligence (Articles 47 to 52): from 18 August 2027; it does not apply to economic operators with a net turnover below EUR 40 million in the financial year before the last one that are not part of a group above that limit on a consolidated basis.
• Registration as a producer in each Member State (Article 55) and extended producer responsibility.

The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any battery meets the requirements.

Sample, made-up company

Regulation (EU) 2023/1542 on batteries, Annex VIII, Part A (Module A, internal production control). It must make it possible to assess the battery's conformity with the requirements of Articles 6, 9, 10, 12, 13 and 14 that apply to it, and include an adequate analysis and assessment of the risks. Draw it up before the battery is placed on the market, and keep it with the EU declaration of conformity for 10 years after the last battery of this model has been placed on the market (Annex VIII Part A point 4). Date: 2026-11-02.

Analysis and assessment of the risks

[TO COMPLETE] (the risks the battery presents and how the design addresses them)

(a) a general description of the battery and its intended use;

Lithium-ion pack, 3.7 V, 10 000 mAh.

Intended use:

Charging phones.

The rest of this document is in the kit.

Sample, made-up company

What the label and markings of this battery model must show under Regulation (EU) 2023/1542, and the date each rule applies from. The format of the labels of Article 13(1) to (3) will be set by the Commission implementing act of Article 13(10). Date: 2026-11-02.

General information on the label (Annex VI, Part A)

Point 1, Article 38(7): name, registered trade name or registered trade mark, postal address with a single contact point, and, if available, web and email address.

When each label and marking applies (Article 13)

The QR code gives access to: the information of Article 13(1) to (5), the EU declaration of conformity, the due diligence report of Article 52(3) and the waste information of Article 74(1)(a) to (f).

Article 13(7): the labels and the QR code are printed or engraved visibly, legibly and indelibly on the battery; where the nature and size of the battery do not allow it, on the packaging and the documents accompanying the battery.

The rest of this document is in the kit.

Sample, made-up company

3. This declaration of conformity is issued under the sole responsibility of the manufacturer.

5. The object of the declaration described in point 4 is in conformity with the relevant Union harmonisation legislation: … (reference to the other Union acts applied).

• Regulation (EU) 2023/1542

The rest of this document is in the kit.

Sample, made-up company

Commission Regulation (EU) No 10/2011 on plastic materials and articles intended to come into contact with food, and Regulation (EC) No 1935/2004. For each material or article: the declaration of compliance (Article 15 and Annex IV) and the declaration of compliance of Regulation (EU) 2024/3190 on bisphenols (Article 8 and Annex III) in each language chosen, and the outline of the supporting documentation (Article 16) with the migration test conditions of Annexes III and V. Once: the good manufacturing practice record (Regulation (EC) No 2023/2006). Date: 2026-11-02.

Article 15: at the marketing stages other than retail, a written declaration of compliance is available for plastic materials and articles. It is issued by the business operator, contains the information of Annex IV, permits easy identification of the materials or articles it covers, and is renewed when substantial changes in the composition or production change the migration, or when new scientific data become available.

Article 16: the supporting documentation is made available to the national competent authorities on request.

Labelling (Article 15 of Regulation (EC) No 1935/2004): materials and articles not yet in contact with food carry the words ‘for food contact’, a specific indication of their use, or the glass and fork symbol, with special instructions for safe use if necessary, the name and address of the operator responsible established in the Union, and labelling or identification for traceability.

Regulation (EU) 2025/351 amended Regulation (EU) No 10/2011, including Annex IV, points 6, 10 and 11. Plastic materials and articles that complied with the earlier rules and were first placed on the market before 16 September 2026 may continue to be placed on the market until the exhaustion of stocks (Article 4 of Regulation (EU) 2025/351). This kit follows the rules as amended.

What this kit does not cover

• Testing: the migration tests are made by a laboratory. The kit looks up the food simulants and the test time and temperature in the tables of Annexes III and V; it does not apply the derogations of Annex V or the formula of point 2.1.4 (f).
• The specific migration limits and restrictions of Annex I for the substances you use: you state them.
• Products from intermediate stages of manufacture and substances: their declaration has more to say under point 6 of Annex IV.
• Recycled plastic (Regulation (EU) 2022/1616), regenerated cellulose film, ceramics, active and intelligent materials (Regulation (EC) No 450/2009), and materials without specific EU measures such as paper, metal and glass, where national rules may apply.
• Whether a bisphenol or bisphenol derivative may be used: Regulation (EU) 2024/3190 prohibits bisphenol A in the manufacture of plastic food contact materials (Article 3) and other hazardous bisphenols unless authorised in its Annex I (Article 5). The kit writes its declaration (Article 8, Annex III) from your answer.

Sign each declaration before issuing it. The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any material or article complies.

Sample, made-up company

Article 3 of Regulation (EC) No 1935/2004: materials and articles are manufactured in compliance with good manufacturing practice. Regulation (EC) No 2023/2006 sets its rules for all stages of manufacture, processing and distribution, except the production of starting substances (Article 2). Business operator: Example Plastics Pvt Ltd, GIDC Metoda, Rajkot, India, info@example.com. Date: 2026-11-02.

Quality assurance system (Article 5)

An effective and documented quality assurance system, taking account of the adequacy of personnel, their knowledge and skills, and the organisation of the premises and equipment, applied according to the size of the business (Article 5(1)).

[TO COMPLETE] (who is responsible, the staff and their training, the premises and equipment)

Starting materials are selected and comply with pre-established specifications (Article 5(2)).

[TO COMPLETE] (the specification of each starting material and the supplier declarations of compliance received)

Operations are carried out in accordance with pre-established instructions and procedures (Article 5(3)).

[TO COMPLETE] (the written instructions and procedures for each operation)

The rest of this document is in the kit.

Sample, made-up company

[TO COMPLETE] (name, function and signature)

The rest of this document is in the kit.

Sample, made-up company

[TO COMPLETE] (name, function and signature)

Sample, made-up company

Article 16 of Regulation (EU) No 10/2011: appropriate documentation to demonstrate that the material or article complies with the Regulation, made available by the business operator to the national competent authorities on request. It contains the conditions and results of testing, calculations, including modelling, other analysis, and evidence on the safety or reasoning demonstrating compliance. Date: 2026-11-02.

Composition

[TO COMPLETE] (the polymers and the starting substances, additives and other substances used, with their FCM substance numbers in Annex I and the supplier declarations of compliance received for each)

Substances with restrictions or specifications (Annexes I and II)

[TO COMPLETE] (each substance with its specific migration limit or other restriction, and how compliance is shown)

Non-intentionally added substances

[TO COMPLETE] (impurities, reaction and degradation products that may be present, and the assessment under Article 19 and Article 3 of Regulation (EC) No 1935/2004)

The rest of this document is in the kit.

Sample, made-up company

Regulation (EC) No 1223/2009 on cosmetic products. For each product: the index of the product information file (Article 11), the cosmetic product safety report Part A (Annex I) and Part B for the safety assessor, a label check (Article 19) and the CPNP notification data (Article 13). Once: the good manufacturing practice statement (Article 8). Responsible person: Example Cosmetics GmbH, Hauptstraße 1, 10115 Berlin, Germany, rp@example.com. Date: 2026-11-02.

Article 4: a cosmetic product is placed on the market only if a legal or natural person established within the Community is designated as the responsible person. For a product imported into the EU, each importer is the responsible person for the products it places on the market, unless it designates another person by written mandate, accepted in writing.

What this kit does not do

• The safety assessment (Part B): only a qualified safety assessor may carry it out and sign it (Article 10(2)).
• Screening ingredients against the prohibited and restricted substances of Annexes II to VI, the fragrance allergens of Annex III, or CMR classifications. The Commission's CosIng database is not the legal text, and many Annex II entries name groups of substances, so an exact name match would miss them.
• The exposure calculations, toxicological profiles and margins of safety (Part A, sections 7 and 8).
• Notification in the CPNP: you or your responsible person submit it; the data sheet lists what is asked.
• Translating the label: the languages are set by each Member State (Article 19(5)).

The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any product is safe or complies.

Sample, made-up company

Regulation (EC) No 1223/2009, Article 8 and Article 11(2)(c). Compliance with good manufacturing practice is presumed where the manufacture is in accordance with the relevant harmonised standards, the references of which have been published in the Official Journal: EN ISO 22716 (Cosmetics, Good Manufacturing Practices).

[TO COMPLETE] (the manufacturer's statement that the products are manufactured in compliance with good manufacturing practice)

Standard or system followed, certificate or audit, with dates: [TO COMPLETE]

Sample, made-up company

Regulation (EC) No 1223/2009, Article 11. Responsible person: Example Cosmetics GmbH, Hauptstraße 1, 10115 Berlin, Germany, rp@example.com. Date: 2026-11-02.

The responsible person keeps this file for 10 years after the last batch of the product was placed on the market, at the address on the label, readily accessible in electronic or other format to the competent authority of the Member State where it is kept, in a language that authority easily understands (Article 11(1) and (3)).

(a) Description of the product

(c) Method of manufacturing

[TO COMPLETE] (the manufacturing steps, from the raw materials to the filled product, and the manufacturing site)

(d) Proof of the effects claimed

The rest of this document is in the kit.

Sample, made-up company

Regulation (EC) No 1223/2009, Article 10 and Annex I, Part A (cosmetic product safety information); Commission Implementing Decision 2013/674/EU gives the guidelines. Responsible person: Example Cosmetics GmbH, Hauptstraße 1, 10115 Berlin, Germany, rp@example.com. Date: 2026-11-02.

1. Quantitative and qualitative composition

Each substance by chemical name and INCI name, CAS and EC number, with its intended function; for fragrance and aromatic compositions, the name and code number of the composition and the identity of the supplier.

The percentages add up to exactly 100 %.

2. Physical/chemical characteristics and stability

[TO COMPLETE] (the characteristics of the substances and of the product, and the stability under reasonably foreseeable storage conditions)

3. Microbiological quality

The rest of this document is in the kit.

Sample, made-up company

Regulation (EC) No 1223/2009, Annex I, Part B (cosmetic product safety assessment). Responsible person: Example Cosmetics GmbH, Hauptstraße 1, 10115 Berlin, Germany, rp@example.com.

Article 10(2): the safety assessment is carried out by a person holding a diploma or other evidence of formal qualifications awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State. This kit does not write it.

1. Assessment conclusion

[TO COMPLETE] (the safety assessor's statement on the safety of the product under Article 3)

2. Labelled warnings and instructions of use

[TO COMPLETE] (the warnings and instructions the assessor finds necessary)

3. Reasoning

[TO COMPLETE] (the scientific reasoning that leads from the Part A data to the conclusion)

The rest of this document is in the kit.

Sample, made-up company

Regulation (EC) No 1223/2009, Article 19(1). Each item is printed in indelible, easily legible and visible lettering on the container and the packaging, except where marked. Tick each item once it is on the artwork.

The ingredient list

• In descending order of weight at the time they are added; ingredients below 1 % may follow in any order. The kit lists every ingredient by weight, which always meets this.
• Perfume and aromatic compositions are shown by the term 'parfum' or 'aroma'. Substances whose mention is required under 'other' in Annex III are listed in addition: check the fragrance allergens of Annex III for this product; the kit does not.
• Nanomaterials carry the word 'nano' in brackets after the name; the kit adds it to every row marked nano.
• Colorants other than hair colorants may be listed in any order after the other ingredients, by their Colour Index number or Annex IV name; for a range of shades, 'may contain' or '+/-' may be used.
• Impurities, technical substances used in manufacture and not present in the finished product, and materials used in strictly necessary quantities as solvents or carriers for perfume compositions are not ingredients.
• Use the common ingredient names of the glossary of Article 33; where there is none, a term in a generally accepted nomenclature (Article 19(6)).

Where an item cannot be printed

Where the precautions (d) or the ingredients (g) cannot be printed on the label for practical reasons, they go on an enclosed leaflet, label, tape, tag or card, referred to, unless impracticable, by abbreviated information or the hand-in-book symbol of Annex VII, point 1 on the container or packaging (Article 19(2)).

Language

The language of the nominal content (b), the date or period after opening (c), the precautions (d) and the function (f) is set by the law of the Member States where the product is sold to the end user (Article 19(5)). The ingredient names follow the glossary and are not translated.

The rest of this document is in the kit.

Sample, made-up company

Regulation (EC) No 1223/2009, Article 13. Before placing the product on the market, the responsible person submits this information to the Commission electronically, through the Cosmetic Products Notification Portal (CPNP).

Article 13(2)

• The original labelling and, where reasonably legible, a photograph of the corresponding packaging, uploaded when the product is placed on the market.

Article 13(7): where the information changes, the responsible person or the distributor provides an update without delay.

The rest of this document is in the kit.

Sample, made-up company

Manufacturer: Example Devices Co., 1 Road, Shenzhen, China, info@example.com, https://example.com. Products: SmartPlug SP-200. Date: 2026-11-02.

1. Dates (Article 71(2), Article 69)

• 11 June 2026: rules on notified bodies (Chapter IV) apply.
• 11 September 2026: the reporting obligations of Article 14 apply, also to products placed on the market before 11 December 2027 (Article 69(3)).
• 11 December 2027: the rest of the Regulation applies. Products placed on the market before that date are subject to it only if substantially modified from that date (Article 69(2)).

2. Coordinated vulnerability disclosure policy (Annex I Part II (5) and (6))

Example Devices Co. welcomes reports of potential vulnerabilities in its products and in third-party components they contain.

• Where to report: security@example.com. This is the single point of contact of Article 13(17); reporters may choose their preferred means of communication.
• This policy is published at: https://example.com/security.
• What to include: the product and version, a description of the issue, steps to reproduce and any proof of concept, and how to reach the reporter.
• We acknowledge a report within [TO COMPLETE] working days and keep the reporter informed until it is resolved.
• We address and remediate vulnerabilities without delay, in relation to the risks (Annex I Part II (2)), and agree a disclosure date with the reporter.
• Once a security update is available, we publish the fixed vulnerability: its description, the products affected, its impact and severity, and how users can remediate it (Annex I Part II (4)). Where the security risks of publication outweigh its benefits, we may delay publication until users have had the possibility to apply the patch.
• Safe harbour for good-faith research: [TO COMPLETE] (your terms).

3. Vulnerability handling procedure (Annex I Part II, Article 13(6) to (9))

The rest of this document is in the kit.

Sample, made-up company

Article 31 and Annex VII of Regulation (EU) 2024/2847. Draw it up before the product is placed on the market and update it at least during the support period. Keep it, with the EU declaration of conformity, for at least 10 years after placing on the market or for the support period, whichever is longer (Article 13(13)). Date: 2026-11-02.

1. General description (Annex VII point 1)

(a) Intended purpose:

Switches a household appliance on and off from a phone app.

(b) Versions of software affecting compliance with the essential cybersecurity requirements:

• Firmware 2.1

(c) Photographs or illustrations showing external features, marking and internal layout: [TO COMPLETE] (attach)

The rest of this document is in the kit.

Sample, made-up company

Article 13(2) to (4) of Regulation (EU) 2024/2847 (Cyber Resilience Act). Document the assessment, take it into account from planning to maintenance, update it during the support period, and include it in the technical documentation. Date: 2026-11-02.

1. Intended purpose and reasonably foreseeable use

Switches a household appliance on and off from a phone app.

2. Conditions of use: operational environment and assets to be protected

[TO COMPLETE]

3. Known or foreseeable circumstances that may lead to significant cybersecurity risks

[TO COMPLETE]

4. Length of time the product is expected to be in use

The rest of this document is in the kit.

Sample, made-up company

Article 13(18): accompany the product with this information, on paper or electronically, in a language which can be easily understood by users and market surveillance authorities, and keep it available for 10 years or for the support period, whichever is longer. Translate it for each country of sale.

Point 8: the detailed instructions must cover

• (a) the necessary measures during initial commissioning and throughout the lifetime of the product to ensure its secure use: [TO COMPLETE]
• (b) how changes to the product can affect the security of data: [TO COMPLETE]
• (c) how security-relevant updates can be installed: [TO COMPLETE]
• (d) the secure decommissioning of the product, including how user data can be securely removed: [TO COMPLETE]
• (e) how the default setting enabling the automatic installation of security updates can be turned off: [TO COMPLETE]
• (f) where the product is intended for integration into other products, the information the integrator needs to comply with Annex I and Annex VII: [TO COMPLETE]

The rest of this document is in the kit.

Sample, made-up company

3. This declaration of conformity is issued under the sole responsibility of the manufacturer.

5. The object of the declaration described above is in conformity with the relevant Union harmonisation legislation:

• Regulation (EU) 2024/2847

The rest of this document is in the kit.

Sample, made-up company

Annex VII (module A, internal production control) of Regulation (EU) 2025/40. It must make it possible to assess the packaging's conformity with the applicable requirements and include an adequate analysis and assessment of the risks of non-conformity. Keep it with the declaration for 5 years (single-use packaging) after the packaging is placed on the market (Annex VII point 4). Date: 2026-11-02.

(a) General description of the packaging and its intended use

Single-use bottle for still water.

(b) Conceptual design, manufacturing drawings and materials of components

• Body: PET
• Cap: HDPE

Drawings: [TO COMPLETE] (attach)

(c) Descriptions and explanations needed to understand the drawings, schemes and operation of the packaging

The rest of this document is in the kit.

Sample, made-up company

3. This declaration of conformity is issued under the sole responsibility of the manufacturer.

5. The object of the declaration referred to point 4 is in conformity with the relevant Union harmonisation legislation:

• Regulation (EU) 2025/40

The rest of this document is in the kit.

Sample, made-up company

Information and evidence the supplier provides for the operator's due diligence under Article 9(1) of Regulation (EU) 2023/1115, as amended. Each point quotes the Regulation; the supplier's information follows it.

Article 9(1), Regulation (EU) 2023/1115

Operators shall collect information, documents and data which demonstrate that the relevant products comply with Article 3. For this purpose, the operator shall collect, organise and keep for five years from the date of the placing on the market or of the export of the relevant products the following information, accompanied by evidence, relating to each relevant product:

Point (a)

“a description, including the trade name and type of the relevant products as well as, in the case of relevant products that contain or have been made using wood, the common name of the species and their full scientific name; the product description shall include the list of relevant commodities or relevant products contained therein or used to make those products;”

Point (b)

The rest of this document is in the kit.

Sample, made-up company

Example Coffee Exports, 12 Estate Road, Chikmagalur 577101, India, export@example.com 2026-11-02

Dear Example Coffee Imports GmbH,

Please find enclosed the information and evidence for the products listed below, for your due diligence under Regulation (EU) 2023/1115.

• Estate AA, HS code 09011100, 19200 kg

Enclosed:

• for each product, the information under Article 9(1) with the plots of land and a signed supplier statement
• for each product, the GeoJSON file of its plots, for import into the EU Information System

We will provide the evidence listed on request. Kind regards, Example Coffee Exports

Sample, made-up company

Example Coffee Exports supplies these products to buyers in the European Union. Under Regulation (EU) 2023/1115 the buyer must know where and when they were produced, that the land was not deforested after 31 December 2020, and that they were produced legally. Please answer for each plot of land you supply from.

Your details and the location of your plots are used only to show where these products come from. Example Coffee Exports passes them to its EU buyers and keeps them for at least five years, as the Regulation requires the buyer to. Ask Example Coffee Exports if you want to see or correct them.

I confirm that these answers are true to my knowledge. Name: Signature: Date:

The rest of this document is in the kit.

Sample, made-up company

Framework of procedures and measures that ensures that the relevant products the operator places on the market or exports comply with Article 3 of Regulation (EU) 2023/1115, as amended.

Products in scope

Procedure for each product, before it is placed on the market or exported

• 1. Collect the information of Article 9(1) from the supplier with the supplier questionnaire, including the geolocation of every plot of land, and keep it with the evidence for five years.
• 2. Check the classification of every country of production (Article 29, Implementing Regulation (EU) 2025/1093). Where every country is low risk and the assessment of Article 13(1) finds the risk of circumvention or mixing negligible, use simplified due diligence.
• 3. Otherwise, assess the risk against each criterion of Article 10(2) and record how the information was checked and how the degree of risk was determined (Article 10(4)).
• 4. Where the risk is not negligible, adopt risk mitigation measures under Article 11 and record the decision; if the risk stays above negligible, do not place the products on the market or export them (Article 4(4)).
• 5. Submit the due diligence statement in the Information System before placing on the market or export, keep its reference number, and pass it on to customers (Article 4(2) and (7)).

Compliance officer at management level

Not required for SMEs (Article 11(2)(a)). Person responsible: [TO COMPLETE]

The rest of this document is in the kit.

Sample, made-up company

1. Information collected (Article 9(1))

Country classification

Commission Implementing Regulation (EU) 2025/1093, Annex; countries not listed there keep the standard level (Article 1(2)).

2. Risk assessment criteria (Article 10(2))

The rest of this document is in the kit.

Sample, made-up company

Example Kaffee Import GmbH buys these products from you and places them on the European Union market. Under Regulation (EU) 2023/1115 it must know, before doing so, where and when they were produced, that the land was not deforested after 31 December 2020, and that they were produced legally. Please answer for each plot of land the products come from, and send the location of the plots as a GeoJSON, KML or CSV file if you can.

Your details and the location of your plots are used only for this due diligence. Example Kaffee Import GmbH keeps them for at least five years, as the Regulation requires, and gives them to the authorities on request. Ask Example Kaffee Import GmbH if you want to see or correct them.

I confirm that these answers are true to my knowledge. Name: Signature: Date:

The rest of this document is in the kit.

Sample, made-up company

Solvent X

2026-11-02

SECTION 1: Identification of the substance/mixture and of the company/undertaking

1.1 Product identifier

Solvent X

1.2 Relevant identified uses of the substance or mixture and uses advised against

[TO COMPLETE]

1.3 Details of the supplier of the safety data sheet

The rest of this document is in the kit.

Sample, made-up company

UN 1230 METHANOL, 3 (6.1), II, (D/E) Number and description of packages: 2 drums (1A1) Total quantity: 400 L

Sample, made-up company

For each product: the Children's Product Certificate with the content of 16 CFR 1110.11, and the same data as a spreadsheet (CSV). Date: 2026-11-02. Citation codes from CPSC's eFiling list of 2025-12-18.

Imported products: from 8 July 2026 the certificate data are filed electronically with each entry in CBP's Automated Commercial Environment (16 CFR 1110.13(a)(1)), either in full in the entry or by reference to a certificate the importer has entered in CPSC's Product Registry. Products entered from a Foreign Trade Zone follow from 8 January 2027. For goods imported by mail, enter the data in the Product Registry before the goods arrive. The data sheet of this kit lists the fields for the Product Registry or your customs broker; the Word certificate is the copy you give your distributors and retailers (1110.13(b)).

Still to complete

Nothing: every field the certificate needs was filled in. Check each entry against your test reports before you sign.

What this kit does not do

• Decide which rules apply to the product, whether it is a children's product (designed or intended primarily for children 12 years or younger), or whether a testing exclusion applies: you choose them from CPSC's list.
• Test the product: children's products need testing by a CPSC-accepted third party laboratory for each rule that requires it (16 CFR 1107). CPSC lists accepted laboratories on its website.
• Tracking labels, warning labels and registration cards that the Consumer Product Safety Act or the rules require on the product or its packaging.
• General Certificates of Conformity for products that are not children's products.
• File anything with CPSC or CBP.

The kit fills in what you entered and marks the rest TO COMPLETE. It does not state that any product complies; the certifier attests to that by signing.

Sample, made-up company

Certificate under section 14 of the Consumer Product Safety Act and 16 CFR part 1110. Date of the certificate: 2026-11-02.

1. Product covered by this certificate

Product: Wooden stacking rings. Description: Six beech rings on a peg, ages 1 and up

2. Rules, bans, standards and regulations to which the product is certified

3. Finished product certifier

The rest of this document is in the kit.

Sample, made-up company

Starter documents for the information security management system (ISMS) of Example Software GmbH, drawn up on 2026-11-02 from the answers typed into the kit. Clause numbers refer to ISO/IEC 27001:2022 with Amendment 1:2024; buy the standard from ISO or your national standards body to read its requirements.

The files

• 01 ISMS scope: the issues, interested parties and boundaries the scope is based on (clauses 4.1 to 4.3).
• 02 Information security policy (clause 5.2).
• 03 Risk assessment: the method, the criteria and the risk register (clauses 6.1.2 and 8.2).
• 04 Risk treatment plan, for the risk owners' approval (clauses 6.1.3 and 8.3).
• 05 Statement of Applicability: all 93 Annex A controls, included or excluded, why, and whether implemented (clause 6.1.3 d).
• 06 Information security objectives and how they will be achieved (clause 6.2).
• 07 to 13 Topic policies: acceptable use, access control, change management, incident response, supplier security, backup and business continuity, cryptography, each with its SOC 2 criteria, Annex A controls and NIS2 points.
• 14 SOC 2 criteria worksheet: the Trust Services Criteria by number for Security and the categories chosen, to record controls and evidence.
• 15 NIS2 Article 21 measures: the ten points of Article 21(2) quoted from the Directive, the kit documents and Annex A controls for each with their status, and the reporting deadlines of Article 23(4).
• CSV copies of the risk register, the Statement of Applicability and the SOC 2 worksheet, to open in a spreadsheet.

What the kit does not cover

• The other documented information the standard requires, for example evidence of competence (7.2), operational planning (8.1), monitoring results (9.1), the internal audit programme and results (9.2), management review results (9.3) and nonconformities and corrective actions (10.2).
• The procedures behind each control, such as the steps to grant access or restore a backup, and topic-specific policies other than files 07 to 13.
• Certification: only an audit by a certification body can lead to an ISO/IEC 27001 certificate. Look for a body accredited by your national accreditation body.
• Whether NIS2 applies: the national law that transposes Directive (EU) 2022/2555 decides whether an organization is an essential or important entity; file 15 records the measures but does not decide this. List the legal duties that apply to you, such as NIS2 or data protection law, as requirements of interested parties in file 01 and control 5.31.
• A SOC 2 report: only an independent CPA firm can examine the controls and issue one. File 14 names the AICPA criteria by number only; read them in the AICPA publication.

The kit fills in what you entered and marks the rest [TO COMPLETE]. The control names are our own short words, not the text of the standard. Nothing in these files states that your organization meets ISO/IEC 27001, the SOC 2 criteria or the NIS2 Directive.

Sample, made-up company

Internal and external issues (clause 4.1)

Internal issues

• Small IT team

External issues

• NIS2 transposition

Interested parties and their requirements (clause 4.2)

The rest of this document is in the kit.

Sample, made-up company

Purpose

Example Software GmbH protects the confidentiality, integrity and availability of the information it holds and handles within the scope of its information security management system: Development and operation of the company's SaaS platform.

Commitments of top management

• to meet the requirements related to information security that apply to us: legal, regulatory and contractual requirements and those of our customers and other interested parties;
• to improve the information security management system continually;
• to provide the people, time and money needed to run it.

Objectives

Information security objectives are set each year in line with this policy and the results of the risk assessment, with a measure, an owner and a date for each (see document 06). They are monitored and updated when the risks change.

Roles and responsibilities

The rest of this document is in the kit.

Sample, made-up company

Method (clause 6.1.2)

• Risks are identified as threats to the confidentiality, integrity or availability of information within the scope, and each risk is given a risk owner.
• Likelihood and impact are each rated on a scale of 1 (very low) to 5 (very high), using the same scale every time so that repeated assessments give comparable results.
• Risk level = likelihood × impact, from 1 to 25.
• Risks are dealt with in order of level, highest first.

Risk acceptance criterion: a risk with a level of 8 or lower may be accepted by its risk owner. A higher risk is treated, or accepted only with a recorded reason.

The assessment is repeated at planned intervals, at least once a year, and when significant changes are proposed or happen (clause 8.2).

Risk register

The rest of this document is in the kit.

Sample, made-up company

For each risk: the option chosen, the controls, the action, who does it and when (clause 6.1.3). Each risk owner approves the plan and accepts the risk that remains by signing.

Sample, made-up company

All 93 controls of Annex A of ISO/IEC 27001:2022, compared with the controls chosen to treat the risks (clause 6.1.3 c and d). Version of 2026-11-02.

Included: 2. Excluded: 0. Not yet decided: 91.

5. Organizational controls

6. People controls

7. Physical controls

The rest of this document is in the kit.

Sample, made-up company

Objectives consistent with the information security policy and the results of the risk assessment, with the plan to achieve them (clause 6.2). They are monitored, communicated and updated as needed.

Sample, made-up company

Purpose

Sets how the organization's information, devices, accounts and networks may be used, so that everyday work does not put information at risk.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• Use the organization's information, devices and accounts for work; personal use only within the limits set by management.
• Keep passwords and access codes to yourself; never share an account.
• Lock the screen when you leave a device; keep devices updated and with the protection the organization installs.
• Do not install software or connect services that IT has not approved.
• When working remotely, keep screens and conversations away from others and use only the approved secure connection.
• Complete security awareness training when you join and at least once a year.
• Report lost devices, suspicious messages and security events at once, through the channel in the incident response policy (document 10).

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

Purpose

Makes sure that only the right people and systems reach information, with no more access than their work needs.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• Access is given by role, with the least privilege the work needs, and approved by the owner of the information or system.
• Each person has their own account; a shared account is allowed only where there is no other way, with a named owner.
• Multi-factor authentication is required for remote access, for administrator accounts and for systems holding confidential information.
• Administrator rights are given to as few people as possible, used only for administration and logged.
• Access is removed on the last working day of a person who leaves, and changed when someone changes role.
• Access rights are reviewed at least once a year.
• Passwords are long and unique; the password manager the organization provides is used.

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

Purpose

Makes sure that changes to systems, software and infrastructure are planned, tested and approved, so that they create no security weakness or outage.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• Every change to production systems is recorded with its purpose, risk, test result and approval.
• Changes are tested outside production; development, test and production environments are kept apart.
• Code changes are reviewed by someone other than their author before release.
• An emergency change may go ahead first, but is recorded and approved afterwards without delay.
• Security updates are applied according to their severity; known vulnerabilities in systems in use are tracked until fixed.
• Each change has a way back, such as a backup or the previous version.

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

Purpose

Sets how security events are reported, assessed and handled, so that incidents are contained quickly and lessons are learned.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• Everyone reports security events and weaknesses at once to the owner of this policy or the contact the owner names.
• Each event is assessed; if it is an incident, it is given a severity and a person in charge.
• Incidents are contained, their cause removed and systems restored; evidence is kept.
• Customers, authorities and others are informed when the law or a contract requires it.
• If the organization falls under the national law that transposes the NIS2 Directive, significant incidents are reported to the CSIRT or competent authority within the deadlines of Article 23(4): see document 15.
• Personal data breaches are assessed for notification to the data protection authority (GDPR Article 33: within 72 hours where required).
• After each incident, the cause and the lessons are recorded and the risk assessment is updated.

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

Purpose

Sets how the security of suppliers and cloud services is checked and agreed, because their weaknesses can become ours.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• Suppliers that handle the organization's information or run its systems are listed, with what they handle.
• Before signing, their security is checked in proportion to the risk, for example through a certificate, a report or a questionnaire.
• Contracts state the security requirements, incident notification, the right to check, and what happens to the information at the end.
• Cloud services are chosen, used and left according to these rules.
• Critical suppliers are reviewed at least once a year and when they change their service.

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

Purpose

Makes sure that information can be restored and that essential services continue, or resume quickly, after a disruption.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• The information and systems within the scope are backed up on a schedule that matches how much data the organization can afford to lose.
• At least one backup copy is kept apart from the systems it protects and is protected against change and deletion.
• Restoring from backup is tested at least once a year, and the result is recorded.
• A continuity plan names the essential services, the target time to restore each, the people in charge and how to reach them.
• Systems that must stay available have the redundancy their target requires.
• The plan is tested and updated at least once a year and after significant changes.

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

Purpose

Sets when and how encryption is used and how keys are managed.

Scope

This policy applies to Development and operation of the company's SaaS platform, and to everyone who works for Example Software GmbH, including contractors.

Rules

• Information is encrypted in transit over public networks, and at rest on laptops, mobile devices and removable media.
• Confidential information is encrypted at rest where the risk assessment requires it.
• Only current, widely accepted algorithms and protocols are used; outdated ones are switched off.
• Keys are created, stored, changed and destroyed in a controlled way, kept apart from the data they protect, and accessible only to named people.
• Legal restrictions on the use or export of encryption are checked before use.

Responsibilities

The rest of this document is in the kit.

Sample, made-up company

The Trust Services Criteria of the AICPA (2017, with revised points of focus 2022) by number, for the categories in scope: Security (common criteria CC1 to CC9). Security, the common criteria, is always in scope. The topic words are our own; read each criterion and its points of focus in the AICPA publication.

For each criterion, record the controls that meet it (Annex A numbers from the Statement of Applicability, file 05) and the evidence an auditor can inspect, such as a log, a ticket or a signed review.

Security (common criteria CC1 to CC9)

Only an independent CPA firm can examine the controls and issue a SOC 2 report. Nothing in this worksheet states that the organization is ready for one or meets the criteria.

The rest of this document is in the kit.

Sample, made-up company

Record of how Example Software GmbH covers the measures of Article 21(2) of Directive (EU) 2022/2555 (NIS 2 Directive). The quotes are from the Official Journal (OJ L 333, 27.12.2022), checked against its corrigenda.

Whether the organization is an essential or important entity, and which authority it reports to, is decided by the national law that transposes the Directive in each Member State. This record does not decide it: check the national law and the guidance of the competent authority.

For DNS service providers, TLD name registries, cloud computing, data centre and content delivery network service providers, managed and managed security service providers, online marketplaces, online search engines, social networking services platforms and trust service providers, Commission Implementing Regulation (EU) 2024/2690 lays down the technical and methodological requirements of these measures.

Under each point, a second table gives ENISA's mapping of the matching points of the Annex to Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022. Source: ENISA, Technical Implementation Guidance, mapping table version 1.2 (21 August 2025), licensed under CC BY 4.0. Changes: only the ISO/IEC 27001 column is used, sorted under the points of Article 21(2) by the headings of the Annex; control numbers are written as A.x.y; the entry “5.28” under point 10.4 is left out because ISO/IEC 27001:2022 has no clause 5.28. Numbers without “A.” are clauses of the standard. ENISA's mapping is advisory, not legally binding, and does not mean that the standards are equivalent.

Article 21(2)

“The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:”

Point (a)

The rest of this document is in the kit.

Sample, made-up company

Documents for the quality management system of Example Castings Ltd, made on 2026-11-02 from the answers typed on eurules.vedacta.com. They cover what ISO 9001:2026 added or changed against the 2015 edition, plus the core records an audit asks for.

Files

• 01 Scope of the quality management system
• 02 Context and interested parties
• 03 Quality policy
• 04 Roles and responsibilities
• 05 Quality culture and ethics
• 06 Risk register
• 07 Opportunity register
• 08 Quality objectives
• 09 Change plan
• 10 Competence matrix
• 11 External provider evaluation
• 12 Internal audit programme
• 13 Management review
• 14 Nonconformity and corrective action log
• 15 Gap checklist 2015 to 2026

CSV copies of the risk register, the opportunity register and the gap checklist are in the same ZIP, for a spreadsheet.

How to use them

• Search each file for [TO COMPLETE]: every gap left in your answers is marked so.
• Check every document against your copy of ISO 9001:2026. The files are written in our own words and give clause numbers for reference only; they do not contain the text of the standard.
• Have top management approve and sign the scope, the policy and the culture statement.
• Keep the registers and logs up to date; an auditor asks for evidence that they are used.

Not covered

• The text of ISO 9001:2026: buy it from ISO or your national standards body.
• Your process descriptions, work instructions and product records.
• Certification: it needs a working system and an audit by an accredited certification body. These files do not state that your organization meets ISO 9001.

Sample, made-up company

Clause 4.3. The scope is set from the context (4.1), the interested parties and their requirements (4.2) and the products and services.

Requirements not applied

A requirement may be left out only when it does not affect the ability to provide conforming products and services or to enhance customer satisfaction.

Sample, made-up company

Internal issues (4.1)

For example strategy, values and culture, resources, knowledge and performance.

• Ageing CNC fleet

External issues (4.1)

• Automotive customers' supplier codes

Interested parties and their requirements (4.2)

The rest of this document is in the kit.

Sample, made-up company

This policy fits the purpose and context of Example Castings Ltd and supports its strategic direction: grow automotive share.

Commitments

• We meet our customers' requirements and the legal requirements that apply to our products and services.
• We set quality objectives from this policy and review them.
• We keep improving the quality management system.
• We promote a culture of quality and ethical behaviour.

Communication

The policy is available as a document, communicated and understood within the organization, and available to relevant interested parties.

It is reviewed every 12 months and when the context changes.

Sample, made-up company

Clause 5.3. Top management assigns these responsibilities and makes sure they are communicated and understood.

Roles

The rest of this document is in the kit.

Sample, made-up company

New in ISO 9001:2026: top management promotes a quality culture and ethical behaviour (5.1.1), and people are aware of them (7.3). This statement records what that means at Example Castings Ltd and how it is shown.

Our values and expected behaviour

• We stop the line when quality is at risk

How top management promotes them

• Quality first on every management meeting agenda

Awareness (7.3)

Covered at induction and in refresher sessions, together with the quality policy, the objectives and each person's contribution.

The rest of this document is in the kit.

Sample, made-up company

Clause 6.1.2, separate from opportunities since 2026: each risk is analysed and evaluated, the action is in proportion to its potential impact, and the action's effectiveness is checked.

Method

• Likelihood and impact are rated 1 (very low) to 5 (very high); the level is likelihood times impact (1 to 25).
• Risks above level 8 are acted on; risks at or below it are accepted and monitored.
• The register is reviewed at each management review and when a change is planned (6.3).

Sample, made-up company

Clause 6.1.3, new as its own subclause in 2026: opportunities are found, acted on where they are worth it, and the actions are checked.

[TO COMPLETE] (no opportunities entered)

Sample, made-up company

Clause 6.2: measurable objectives consistent with the quality policy, monitored, communicated and updated.

Sample, made-up company

Clause 6.3. Fill in one form for each change to the QMS (a new site, process, product, system or structure). The 2026 edition adds the information needed, communication, monitoring of effectiveness and review of results to the 2015 points.

The rest of this document is in the kit.

Sample, made-up company

Clause 7.2: the competence each role needs, how it is ensured (education, training or experience), action on gaps with a check of its effectiveness, and the evidence kept.

Sample, made-up company

Clause 8.4: criteria to select, evaluate and re-evaluate external providers of processes, products and services. Changed in 2026 (8.4.3): what you tell providers covers their dealings with you and, where it applies, with your customers and other relevant interested parties.

Sample, made-up company

Clause 9.2: audits at planned intervals, each with defined objectives, criteria and scope, by auditors who do not audit their own work; results reported to the managers concerned.

Sample, made-up company

Clause 9.3: top management reviews the QMS at planned intervals, in line with the strategic direction. In 2026 the inputs on risks and on opportunities are separate.

Inputs

Outputs

The rest of this document is in the kit.

Sample, made-up company

Clause 10.2: react to each nonconformity (including those from complaints), find its cause, act, check that the action worked, update risks and opportunities or the QMS if needed, and keep this record.

The rest of this document is in the kit.

Sample, made-up company

What changed from ISO 9001:2015 to 2026, clause by clause, and whether your system covers it: 0 of 13 changes covered on the date above. Clauses that are the same or only reworded are not listed.

Transition: certificates to ISO 9001:2015 stop being valid after 30 September 2029. Ask your certification body for its own dates.

The rest of this document is in the kit.

Sample, made-up company

Documents for the environmental management system of Example Coatings Ltd, made on 2026-11-02 from the answers typed on eurules.vedacta.com. They cover what ISO 14001:2026 added or changed against the 2015 edition, plus the core records an audit asks for.

Files

• 01 Scope of the environmental management system
• 02 Context, environmental conditions and interested parties
• 03 Environmental policy
• 04 Leadership, roles and responsibilities
• 05 Environmental aspects register
• 06 Compliance obligations register
• 07 Risks and opportunities
• 08 Action plan
• 09 Environmental objectives
• 10 Change plan
• 11 Operational control and external providers
• 12 Emergency preparedness and response
• 13 Compliance evaluation record
• 14 Internal audit programme
• 15 Management review
• 16 Nonconformity and corrective action log
• 17 Gap checklist 2015 to 2026

CSV copies of the aspects register, the risk register and the gap checklist are in the same ZIP, for a spreadsheet.

How to use them

• Search each file for [TO COMPLETE]: every gap left in your answers is marked so.
• Check every document against your copy of ISO 14001:2026. The files are written in our own words and give clause numbers for reference only; they do not contain the text of the standard.
• Have top management approve and sign the scope and the policy, and make the policy available to interested parties.
• Keep the registers and records up to date; an auditor asks for evidence that they are used.

Not covered

• The text of ISO 14001:2026: buy it from ISO or your national standards body.
• Which laws and permits apply to you: the obligations register holds the ones you name; nothing is looked up for you.
• Certification: it needs a working system and an audit by an accredited certification body. These files do not state that your organization meets ISO 14001.

Sample, made-up company

Clause 4.3. The scope is set from the context (4.1), the compliance obligations from interested parties (4.2), the units, functions and sites, and the control and influence you have. Everything inside the scope is part of the EMS.

The scope is kept as a document and made available to interested parties.

Sample, made-up company

Internal issues (4.1)

• Old spray booths

External issues (4.1)

• Tighter VOC limits

Environmental conditions (4.1)

New in 2026: the conditions that affect the organization or that it affects.

The rest of this document is in the kit.

Sample, made-up company

This policy fits the purpose and context of Example Coatings Ltd, including the nature, scale and environmental impacts of its activities, products and services, and supports its strategic direction: grow with low-carbon customers. It is the frame for setting environmental objectives.

Commitments

• We protect the environment, including preventing pollution.
• Conserve water
• We fulfil our compliance obligations.
• We keep improving the environmental management system to enhance environmental performance.

Communication

The policy is kept as a document, communicated within the organization and available to interested parties.

It is reviewed every 12 months and when the context changes.

Sample, made-up company

Clauses 5.1 and 5.3. Changed in 2026: top management supports everyone with a relevant role in the EMS, not only other managers.

Roles

Sample, made-up company

Clause 6.1.2: the aspects of activities, products and services that you control or can influence, with their impacts, seen over the life cycle, in normal and abnormal conditions and in emergencies (now named here in 2026).

Significance criteria

• Severity of the impact and its frequency or likelihood are each rated 1 (very low) to 5 (very high); the score is severity times frequency (1 to 25).
• Aspects scoring 12 or more are significant.
• An aspect linked to a compliance obligation is always significant.
• Significant aspects are communicated to the people concerned.

Sample, made-up company

Clause 6.1.3: the legal requirements and other requirements tied to your aspects, how they apply to you, and where they are used in the EMS. Adopted needs of interested parties (4.2) belong here too.

Adopted need: Customer request for low-VOC paints

Sample, made-up company

Clause 6.1.4, its own documented subclause since 2026: the risks and opportunities to address, drawn from the context, parties, scope, aspects and obligations, including external environmental conditions that could affect you, such as floods, heat or water shortage.

Likelihood and impact are rated 1 to 5; the level is likelihood times impact. Risks above level 8 are acted on.

Risks

[TO COMPLETE] (no risks entered)

Opportunities

[TO COMPLETE] (no opportunities entered)

Sample, made-up company

Clause 6.1.5: actions on significant aspects, compliance obligations, and risks and opportunities, built into the EMS or other business processes, with a check of their effectiveness. Rows come from the registers: significant aspects, every obligation and risks above the acceptance level.

Sample, made-up company

Clause 6.2: objectives at relevant functions and levels, from significant aspects, obligations and risks and opportunities; measurable where practicable, with indicators, monitored and communicated.

Sample, made-up company

Clause 6.3, new in 2026: changes that affect the EMS (a new site, process, product, supplier or structure) are carried out in a planned way so the EMS still achieves its intended outcomes. The points below are our suggested way to plan one; the standard does not list them.

The rest of this document is in the kit.

Sample, made-up company

Clause 8.1: operating criteria and controls, control of planned changes, and control or influence over externally provided processes, products and services (2015: outsourced processes), with life-cycle requirements for design, purchasing and providers.

Sample, made-up company

Clause 8.2: the emergencies found in 6.1.2, a planned response to prevent or limit their impact, periodic tests, a review after each test or event, and information and training for the people concerned.

Tests and reviews

Sample, made-up company

Clause 9.1.2: how often compliance is evaluated, the evaluation, the action taken where needed, and what you know of your compliance status.

Sample, made-up company

Clause 9.2. Changed in 2026: each audit has defined objectives as well as criteria and scope. The programme considers the environmental importance of the processes, changes and earlier results; evidence of the programme, its implementation and the results is kept.

Sample, made-up company

Clause 9.3, split in 2026 into general (9.3.1), inputs (9.3.2) and results (9.3.3).

Inputs (9.3.2)

Results (9.3.3)

The rest of this document is in the kit.

Sample, made-up company

Clause 10.2: react to each nonconformity, control and correct it, deal with its consequences including mitigating environmental impacts, find its cause and any similar cases, act in proportion, check that the action worked, and keep this record.

The rest of this document is in the kit.

Sample, made-up company

What changed from ISO 14001:2015 to 2026, clause by clause, and whether your system covers it: 0 of 8 changes covered on the date above. Clauses that are the same or only reworded are not listed.

Transition: ends 30 April 2029 under the rules of Accredia (Italy's accreditation body; three years from the end of the month of publication, April 2026); INAB (Ireland) also gives April 2029. Checked 29 October 2026. Ask your certification body for its own dates.

The rest of this document is in the kit.