When a regulator, retailer or lawyer asks "How do you know this product is compliant?", you have about a day to answer well. Brands that answer fast have one thing in common: a compliance evidence file per product, ready to share.
Here's a simple structure you can copy.
Key takeaways
- One file per product (or product family with identical materials).
- Every claim points to a source document.
- Include an outreach log, not just the answers.
- A named person reviews and signs a written conclusion.
Why you need it
- Minnesota can require test results within 30 days of a request.
- California AB 347 will have DTSC request proof and register manufacturers.
- EU PPWR requires technical documentation behind every declaration of conformity.
- Retailers ask for compliance files in vendor programs.
- Lawsuits turn on what you knew and when.
A file built once and kept current answers all of them.
The folder structure
/PRODUCT-SKU_Product-Name/
00_Summary.pdf ← one-page conclusion, signed
01_Bill-of-Materials.xlsx ← every component, supplier, PFAS status
02_Declarations/ ← one per component
03_Test-Reports/ ← named by component and date
04_Outreach-Log.xlsx ← every request, follow-up, reply
05_Regulatory-Map.xlsx ← which rules apply, by state/market
06_Filings/ ← copies of reports submitted (e.g., PRISM)
07_Change-History.txt ← what changed, when, why
What goes in each part
00 – Summary (one page)
- Product name, SKU(s), season
- Markets sold (states, EU)
- Rules checked (e.g., Minnesota Amara's Law, California AB 1817 at 50 ppm, Maine 2026 bans, EU PPWR)
- Conclusion per rule: compliant / reportable / gap
- Known gaps and the plan to close them
- Reviewer name, title, signature, date
01 – Bill of materials
Every component, its supplier and item number, risk level, and PFAS status. See PFAS bill of materials.
02 – Declarations
Signed, dated, material-specific supplier declarations. See supplier declaration template.
03 – Test reports
Named clearly (e.g., Membrane_LM-220_TOF_2026-08-30.pdf). Each should match a BOM row.
04 – Outreach log
Date, supplier, contact, what you asked, what they said. This is your evidence of effort when answers are incomplete. See getting suppliers to respond.
05 – Regulatory map
A simple table: rule, applies?, status, evidence reference.
06 – Filings
Copies of anything you submitted: PRISM reports, EPR reports, declarations of conformity.
07 – Change history
When materials, suppliers or rules change, note it here.
The traceability rule
Every number and every "yes/no" in your summary should trace to a document. If your summary says "TOF below 50 ppm," the file should contain the test report that shows it. If it says "no intentionally added PFAS," there should be a declaration for every component.
If you can't trace it, flag it as a gap, not a fact.
Review steps before sign-off
- Completeness: Every component has a declaration? High-risk ones have tests?
- Match: Do documents refer to the exact materials in the BOM?
- Currency: Are documents recent enough (e.g., within 12 months for high-risk)?
- Consistency: Do declarations and tests agree?
- Gaps: Are open items listed with a plan?
- Sign-off: A named person reviews and signs.
How long to keep records
Follow each law's rule. For example, EU PPWR summaries cite five years for single-use packaging documentation and longer for reusable packaging. Many companies keep product compliance files for as long as the product is sold plus several years. Ask counsel for your retention policy.
Keep it current
Set triggers:
- New SKU → new file before launch
- Material or supplier change → update BOM, declarations, tests
- New law or deadline → update regulatory map
- Annual review → refresh high-risk declarations
Example summary page
Product: Trail Rain Jacket, Men's and Women's (SKUs TRJ-M, TRJ-W), FW26 Markets: All US states; EU via distributor Rules checked: California AB 1817 (50 ppm from 2027); New York apparel PFAS law; Minnesota Amara's Law (reporting); Maine 2026 textile ban; EU PPWR (packaging) Conclusion: No intentionally added PFAS in any of 9 components (declarations on file). TOF on shell, membrane and zipper tape below 15 ppm. Not reportable in Minnesota. Compliant with AB 1817 at 50 ppm. Packaging declaration of conformity on file for EU. Open items: Seam tape declaration is from 2025; refresh requested Oct 2026. Reviewed by: Head of Sourcing, signed, dated
One page. Everything else in the folder supports it.
Responding to a request, step by step
When a regulator or retailer asks for proof:
- Confirm exactly what they're asking and the deadline.
- Pull the product's summary page and check it's current.
- Share the summary plus the specific evidence requested, not your whole folder unless asked.
- Log the request and what you sent.
- If gaps exist, say so honestly, with your plan to close them.
Minnesota can require test results within 30 days. With a current file, you'll need days, not weeks.
Evidence file checklist
- Summary page signed and dated
- BOM complete
- Declaration for every component
- Tests for high-risk components
- Outreach log current
- Regulatory map current
- Filings saved
- Change history updated
What to do this week
- Create the folder structure above for your best-selling product.
- Fill it with what you already have, even if incomplete.
- Write the summary page, listing gaps honestly.
- Use it as the model for every other product.
Key terms
- Evidence file: A per-product folder holding everything that proves compliance.
- Traceability: The ability to link every claim to a source document.
- Summary page: A signed one-page conclusion at the front of the file.
- Regulatory map: A table of which rules apply to a product and its status for each.
- Retention period: How long records must be kept.
Mistakes to avoid
- Storing evidence in email threads instead of a product folder.
- Writing conclusions that go beyond the evidence.
- Forgetting to update files after supplier or material changes.
Still have questions?
"Can the file be digital only?" Yes. A shared drive or compliance system works if it's organized and backed up.
"Who should have access?" The owner, sourcing, product and counsel.
"What's the minimum viable file?" A summary page, a BOM, declarations for every component and tests for high-risk ones. Add the rest as you go.
"How do we handle discontinued products?" Keep their files for your retention period.
The bottom line
An audit-ready file is one folder per product with a signed summary on top and traceable evidence underneath. Build it once, keep it current, and requests from regulators or retailers become routine.
How Secuabase helps
We build this file for each product: the BOM, declarations, tests, outreach log and a draft summary with every statement traced to its source. A human on our team checks it before you see it, and your officer signs. We never sign on your behalf.
For our first partners we run it free on one product line. Book a quick chat.
FAQ
What is a compliance evidence file?
A per-product record proving compliance: BOM, declarations, tests, conclusion and outreach log.
How long to keep records?
Follow each law; PPWR summaries cite five years for single-use packaging.
Who signs off?
A named person with authority at your company.
General information, not legal advice. Facts checked October 2026.
Sources