Which sustainability claims on packaging are now prohibited

Since September 27, 2026, Dutch law includes twelve new commercial practices that are considered misleading under all circumstances. These are listed in Article 6:193g of the Civil Code, points ab through am. Four concern environmental claims and labels, one concerns legal requirements as a selling point, and the remainder concern lifespan and repair.

These provisions originate from Directive (EU) 2024/825, commonly known as the EmpCo Directive. The Netherlands implemented this through the Implementation Act for the Directive on Improving Sustainability Information for Consumers, Bulletin of Acts and Decrees 2026, 152. The law amends Book 6 of the Civil Code. The Authority for Consumers and Markets (ACM) has been designated as the regulator.

Misleading under all circumstances means that the regulator does not need to prove that the consumer was actually misled. The practice is blacklisted. Consequently, it is prohibited regardless of the context.

Whether you can still use ‘eco’

A general environmental claim such as green, ecological, environmentally friendly, or biodegradable is only permitted when you can demonstrate recognized excellent environmental performance. This can be achieved in three ways: the EU Ecolabel, a national Type I ecolabel such as Milieukeur, or a top-tier rating under other European legislation, such as the energy label.

The legislator specifies the terms covered in the recitals of the directive itself: environmentally friendly, eco-conscious, green, nature-friendly, ecological, ecologically responsible, climate-friendly, gentle on the environment, low-carbon, energy-efficient, biodegradable, and bio-based.

There is a second route, which is the most practical for most brands. An environmental claim is only generic when the specification is missing. If you place the substantiation clearly on the same medium—such as the same box or the same product page—then the claim is not generic. The prohibition of point ac then does not apply.

Be careful about what you use as a specification. The claim and the substantiation must concern the same thing. ‘Energy-efficient’ may be substantiated with an energy label under Regulation (EU) 2017/1369. ‘Biodegradable’ cannot be substantiated with the EU Ecolabel if that label does not set biodegradability requirements for your product group.

Terms such as ‘conscious’, ‘sustainable’, or ‘responsible’ fall outside the ecolabel escape route anyway. These words refer not only to environmental characteristics but also to social characteristics, which an eco-label says nothing about.

What happens to your proprietary sustainability logo

You may only display a sustainability label if it is based on a certification scheme or established by a public authority. A self-designed green circle with the word ‘eco’ in it is no longer allowed. According to the Commission, labels from public authorities outside the European Union are also excluded unless they are backed by a certification scheme.

A certification scheme is strictly defined in the law. It must be open to all traders under fair conditions. The requirements must be developed with experts. There must be a procedure for non-compliance, including suspension or withdrawal of the label. Oversight must be conducted by an independent third party. A proprietary brand program without external auditing does not meet these criteria.

For brands manufacturing in Asia, there is a second pitfall. In its Q of September 22, 2026, the Commission states that labels from public authorities outside the Union do not fall under the exception. A national environmental label from the country of production is therefore not a free pass unless a certification scheme is behind it.

The concept of a ‘label’ is broader than just a logo with a name. The Commission explicitly warns against visual elements in the artwork. Green leaves, water droplets, and similar nature icons can be interpreted by the average consumer as an implicit environmental claim or as a voluntary label. This depends on the context, placement, and the overall impression of the packaging.

Why ‘CE-approved’ is no longer a selling point

Since September 27, 2026, it is misleading under all circumstances to present a legal obligation as a distinguishing feature of your offer. CE marking, RoHS, or an EU safety standard applies to every product in the category. Including such a requirement in your product description as a benefit is therefore no longer permitted.

This is point af, listed as point 10 bis of the blacklist in the directive. It is placed among the environmental provisions but does not concern sustainability. For brands selling via marketplaces, this is an immediate issue. The type of bullet point targeted by this prohibition includes ‘CE-approved’, ‘meets all EU safety standards’, or ‘RoHS-compliant’.

The prohibition does not concern the marking itself. Affixing the CE marking remains mandatory where legislation requires it. The Declaration of Conformity remains the document you sign. It concerns the presentation: you may not present the obligation as something that distinguishes your offer.

There is an exception, which is strictly limited. The Commission confirms that the prohibition does not apply if the requirement only applies to a part of the category. Competing products on the Union market would then fall outside of it. If the requirement applies to everything in your category, you fall under the prohibition. The same reasoning applies to requirements from third countries.

A related prohibition is found in Article 6:193c of the Civil Code: advertising a benefit that is both irrelevant and does not result from any characteristic of the product. The directive cites ‘gluten-free bottled water’ as an example. Water naturally contains no gluten, so it is not a characteristic of that brand. ‘Nickel-free jewelry’ is permitted, as some jewelry does indeed contain nickel.

What to do with packaging that has already been printed

There is no transitional arrangement for old stock. The rules also apply to packaging that was already printed or delivered before September 27, 2026. However, European consumer authorities have agreed that in cases of genuine transitional problems, they will enforce in phases and not immediately demand destruction or recall.

This agreement is set out in the ‘Common Understanding on old stock situations’ by the Consumer Protection Cooperation Network, the association of European consumer authorities. The ACM published the document on July 1, 2026, with a Dutch explanatory note. It is explicitly not a binding interpretation of the directive, but a shared approach for how regulators exercise their powers.

The core principle is that authorities can take objective constraints into account: packaging cycles, stock volumes, previously placed production orders, supply chain dependencies, long shelf life, and the technical feasibility of a correction. They may refrain from requiring destruction or a recall if it would result in disproportionate costs or unnecessary environmental damage.

In return, they expect certain efforts from you. The document lists the actions they consider reasonable:

• Removing or correcting online claims. Digital communications can be adjusted today, so that is the first thing they will look at.
• Updating advertisements and promotional materials. The same argument as above.
• Adjusting new packaging and new orders. What has not yet been printed must go to press correctly.
• Applying stickers or removing labeling where feasible and proportionate.
• Displaying corrective information at the point of sale, including online, for the products concerned.
• Coordinating with suppliers and other parties in the chain.
• Documenting what you did and when, including internal guidelines and substantiation work.

This last point is the one brands often underestimate. The phased approach applies to those who are demonstrably taking action. Without a file showing what you adjusted and when, you have no demonstrable effort. In that case, there is nothing for the regulator to take into account.

How the Packaging Regulation overlaps

Two regimes overlap on packaging. Consumer rules determine whether you may make a claim. The Packaging Regulation additionally sets requirements for claims about recyclability, recycled content, and reusability. Those claims may only be made if they exceed the legal minimum requirement. You must demonstrate this in your technical documentation.

Article 14 of Regulation (EU) 2025/40, the PPWR, has been in effect since August 12, 2026. It sets two requirements for an environmental claim about a packaging property for which the regulation itself provides rules. The claim may only concern what exceeds the minimum requirements, calculated according to the methods in that regulation. Additionally, the claim must specify what it applies to: the packaging unit, a part thereof, or all packaging you place on the market.

The final sentence of that article is what determines the workload. Compliance with these requirements must be evident from the technical documentation accompanying the packaging, as referred to in Annex VII. A recyclability claim is therefore no longer a marketing choice but a file item alongside your conformity assessment.

In practical terms, this means the following: ‘100 percent recyclable’ has only been a valid claim since August 12, 2026, if you can show that your packaging exceeds the minimum requirement of the PPWR. You calculate this using the rules from that regulation. Anyone without that substantiation is making a claim that goes too far under both the Packaging Regulation and Article 6:193g of the Civil Code.

What to remove from your box now

Start with the artwork files held by your supplier, not your website. Inventory every claim, every logo, and every green visual element on the box, label, and manual. Document the basis for each claim. Only then should you determine what must be removed, what you will specify, and what can remain.

1. Retrieve the artwork from your supplier. Not the sales photo, but the print file, including multilingual variants. These often contain claims that never passed through your marketing department.
2. Mark three categories. Text claims. Logos and labels. Visual elements such as leaves, earth, water droplets, and green areas.
3. Find the substantiation for each claim. A test report, a certificate, a calculation, or nothing. ‘Nothing’ is also a result. Then you know the claim must be removed.
4. Test the labels. Is the label based on a certification scheme with independent oversight, or was it established by an EU public authority? If not, it must be removed.
5. Delete offsetting claims. ‘Climate neutral’ and ‘CO2 neutral’ based on offsetting have no substantiation that overrides this prohibition.
6. Check your listings against point af. CE, RoHS, EU standards, and other obligations do not belong in the selling points.
7. Document the planning. Which communication you will adjust and when, which stock is running out, and when the new artwork will go to the printer.

The last point is also the most cost-effective. You can adjust online communications yourself. Printed stock is the expensive part. For that specifically, the documented planning serves as proof of a demonstrable effort.

What applies already

Since September 11, 2026, a manufacturer must report every actively exploited vulnerability and every serious security incident in its product to the National Cyber Security Centre. The initial report must be sent within 24 hours. This obligation also applies to products that have been on the market for years.

This is where the misunderstanding currently affecting most dossiers lies. Many brands have December 11, 2027, in their calendars and assume that nothing is required until then. That is correct for product requirements. It is not correct for the reporting obligation.

Article 71 of the regulation stipulates that Article 14 applies as of September 11, 2026. Article 69, paragraph 3, extends this to all products within the scope. Products placed on the market before December 11, 2027, are also covered.

The Commission’s guidelines make the distinction even sharper. For a product placed on the market before December 11, 2027, the vulnerability management requirements from Annex I Part II do not apply. The reporting obligation, however, does apply. You do not need to change anything about that product, but you must know where to report as soon as something goes wrong.

When you are the manufacturer

You are a manufacturer as soon as you place a product with digital elements on the market under your own name or trademark. Who actually manufactures the product is irrelevant. An importer selling an Asian design under their own brand therefore bears all the obligations the regulation imposes on a manufacturer.

Article 21 establishes this directly. An importer or distributor is considered a manufacturer as soon as they place the product on the market under their own name or trademark. The same applies in the event of a substantial modification to a product already on the market.

For Declaer’s target audience, this is the core of the matter. If you have products manufactured in Asia and put your own brand name on the box, you are legally the manufacturer. Your supplier is not. The size of your enterprise does not change this.

Small and micro-enterprises receive one mitigation. They are subject to the reporting obligation but will not be fined if they miss the initial 24-hour deadline. The report itself remains mandatory.

Which products are covered

A product with digital elements is hardware or software that can connect to a device or a network. Examples include a baby monitor, a smart doorbell, a smartwatch, a router, or an app. Individual components such as a microcontroller also fall under the regulation.

Article 3, paragraph 1, defines the term broadly: a software or hardware product and its remote data processing solutions. Individual components thereof also count. The cloud side of a smart thermostat is included, provided the product lacks a function without that connection.

Products already covered by specific sectoral rules fall outside the regulation. The regulation mentions medical devices under 2017/745 and 2017/746, motor vehicles under 2019/2144, and aviation products under 2018/1139.

If you sell radio equipment, you are already dealing with the requirements from Article 3, paragraph 3, points d, e, and f of the Radio Equipment Directive. The essential requirements of the Cyber Resilience Act encompass all those elements. This is explicitly intended so that one set of requirements remains once the Commission withdraws or amends the old delegated regulation.

How to file a report

In the Netherlands, a report is filed via the digital reporting portal of the National Cyber Security Centre. There is no prior registration requirement. The regulation requires three messages regarding the same case: an early warning within 24 hours, a report within 72 hours, and subsequently a final report.

You report in the Netherlands if your main establishment is located here. If your group has multiple European establishments, the entity with the main establishment reports to the designated CSIRT of that country. The NCSC ensures the report reaches ENISA and the other member states. You therefore report in one place.

All deadlines start the moment you become aware of the vulnerability or the incident. The Commission’s guidelines clarify this: you have knowledge as soon as you have reasonable certainty, following an initial assessment, that exploitation is occurring. You must perform that initial assessment immediately.

Not everything is worth a report. A vulnerability you find yourself, one that comes from a penetration test, or one received via responsible disclosure without known exploitation, does not need to be reported. The obligation only arises upon reliable evidence of exploitation.

When a test house is required

The regulation distinguishes four categories. For a regular product, a self-assessment suffices. Annex III also designates important products in Class I and Class II. Annex IV lists critical products. For these categories, a notified body is required if harmonized standards are missing.

Class I of Annex III is the category for consumer electronics brands to check. It includes, among others:

• Smart home products with a security function, specifically smart door locks, security cameras, baby monitors, and alarm systems.
• Internet-connected toys that can speak, film, or track location.
• Personal wearables for health monitoring and all wearables intended for children.
• Routers, modems, and network switches intended for connection to the internet.
• Smart home virtual assistants for general purposes.

For Class I, you may perform the assessment yourself, but only if you fully apply the harmonized standards. If those standards do not exist, Article 32, paragraph 2, prescribes an EU-type examination or full quality assurance. This means a notified body and therefore lead time and costs.

Determining whether your product falls into a category is done based on its primary functionality. Implementing Regulation (EU) 2025/2392 contains the technical descriptions for this. The distinction between core function and supporting function is decisive: a smartphone with a password manager on it does not itself become a password manager.

Cyber Resilience Act obligations from December 11, 2027

From December 11, 2027, a product with digital elements must comply with the essential requirements of Annex I. This includes a documented risk assessment, a technical file, a conformity assessment, an EU declaration of conformity, and the CE marking. Without that package, the product may not be placed on the market.

An obligation will also be added that extends beyond the sale. You determine a support period appropriate to the expected product lifetime, with a minimum of five years. During that period, you address vulnerabilities with free security updates. You must keep every released update available for a further ten years.

The transition is less abrupt than it seems. Products placed on the market before December 11, 2027, only fall under the requirements if they are substantially modified thereafter. And for a model designed before that date, the guidelines state you do not need to redesign. You perform a risk assessment to demonstrate that existing measures are sufficient.

What you must be able to provide is the substantiation. The risk assessment belongs in the technical file, along with the information on which you based the support period. If an essential requirement is missing, you justify in that same file why it is not applicable.

What you should arrange now

For the reporting obligation, you do not need a product change, but you do need a procedure. Establish who within your organization assesses whether exploitation is occurring, who reports, and via which channel. Without such an arrangement, the 24-hour deadline will expire while you are still figuring things out.

Four things that can be done now, without waiting for 2027:

1. Designate a central contact point where users and researchers can report a vulnerability. This will be mandatory from 2027. Without such a point, a report will only reach you via a detour.
2. Create an account on MijnNCSC or establish that you will use the open reporting form. In MijnNCSC, the warning, the report, and the final report are kept together.
3. Document which components are in your product, down to the open-source libraries in the firmware. Without that list, you will not know if your product is affected when a vulnerability is reported.
4. Contractually establish the support period with your supplier. You are promising the market five years of updates. Your manufacturer in Asia almost certainly has not made that commitment yet.

Sanctions are set out in Article 64. For the essential requirements and Articles 13 and 14, fines can reach 15 million euros. If 2.5 percent of the total worldwide annual turnover is higher, that amount applies. For other obligations, the limit is 10 million euros or 2 percent.

In the Netherlands, the Dutch Authority for Digital Infrastructure (RDI) provides oversight. This inspectorate also designates the test houses. The NCSC is explicitly not a regulator: a report there is not a fine notification or a criminal complaint.