Europe replaced the Toy Safety Directive with a directly applicable Regulation — new chemical bans, a Digital Product Passport, cybersecurity rules for connected toys, and packaging rules that are already live. Here is what changes, when, and what to do first.
Most toy importers have been able to treat EU rules as a static checklist for the last fifteen years: test to EN 71, draw up a Declaration of Conformity, affix the CE mark, ship. That era ended on 1 January 2026, when the Toy Safety Regulation (EU) 2025/2509 entered into force and replaced Directive 2009/48/EC.
The full application date is 1 August 2030 — a 4.5-year transition — which is exactly why so many brands are ignoring it today. That is a mistake with a specific cost: the new requirements touch product chemistry, packaging artwork, label content, supplier contracts, and the data systems behind your technical file. Those are not things you retrofit in a quarter, and the Commission still has to publish the implementing acts that define how the Digital Product Passport actually works.
📊 The three dates that matter:
1 January 2026 — Regulation (EU) 2025/2509 entered into force (adopted and published December 2025).
12 August 2026 — the Packaging and Packaging Waste Regulation (EU) 2025/40 (PPWR) began to apply. This one is already live and covers toy boxes, blister cards, poly bags and display cartons.
1 August 2030 — full application of the Toy Safety Regulation, including the mandatory Digital Product Passport for every toy placed on the EU market.
Under the old Directive, each member state transposed the text into national law. Interpretation drifted, and a toy that passed comfortably in Germany could attract questions in France or Spain. A Regulation is directly applicable in every member state with no national transposition — one text, one interpretation, and no room to shop for the softer reading.
The practical upside: if you build a compliant technical file for the Regulation, it is compliant EU-wide. The practical downside: there is no longer any member state where an out-of-date chemical position is tolerated.
This is the single biggest change to product chemistry in EU toy law. The Regulation bans substances as soon as they are identified as hazardous, rather than waiting for them to be added to a slow-moving annex. In practice, the restrictions now explicitly cover:
⚠️ Where importers get caught: PFAS and bisphenols are rarely in the "hero" material. They live in coatings, plastisol prints, soft-touch overmolds, recycled-content plastic, and fabric finishes. If your specification sheet says only "ABS" or "100% cotton," your technical file does not currently answer the question the Regulation asks — and the material declaration has to come from the mill and the compounder, not from the finished-goods factory's own summary.
Every toy model will need a Digital Product Passport (DPP) — a digital dataset reachable through a data carrier, typically a QR code, placed on the toy itself or, where that is not possible, on the packaging or the instructions. It must be available to consumers at the point of purchase, including online, and customs authorities will be able to check it for toys imported into the EU.
The DPP is not a PDF of your old DoC. It is expected to carry the product identifier, a unique operator identifier, the CE mark reference, the harmonised standards applied, information on substances of concern, and current technical documentation and risk assessment data. It replaces the Declaration of Conformity as the primary proof of compliance.
💡 Reality check on timing: as of 2026, the European Commission has not yet published the implementing acts that define the technical and procedural requirements for the toy DPP, and it is not yet possible to apply for or generate a compliant data carrier. That is normal — the Regulation allows the Commission to define the requirements no later than 18 months before full application. The preparation that pays off now is data hygiene, not QR codes: get your bill-of-materials, material declarations, test reports, and technical file into a single structured dataset per model, so that when the format arrives you are filling a schema rather than rebuilding a filing cabinet.
Smart toys, app-paired plush, and connected robots now carry explicit safety requirements covering cybersecurity and data protection alongside mechanical, electrical, and chemical safety. If your product has an app, a microphone, a camera, or a cloud account, the risk assessment has to address the digital surface — not just the plastic. See our AI companion toy sourcing guide for how that maps onto COPPA and data-minimisation practice in the US market.
Food imitation, intestinal obstruction, and magnets were already covered under the Directive — but indirectly, through general safety requirements and standards such as EN 71-1. Under the Regulation they are explicit essential safety requirements that must be individually assessed and documented. For any toy in the slime, putty, squishy, magnetic-building, or miniature-food categories, that changes the conformity assessment work you must be able to show.
The Regulation sets out clearer warning rules: font-size requirements, the specified "Warning" wording or triangle pictogram, age-grading guidance, and stronger information duties about the company placing the toy on the market. One change catches people late in the artwork cycle — only a single EU contact address may appear on the toy, its packaging, or the accompanying documentation, and it must belong to the responsible economic operator established in the EU.
If a distributor or retailer has historically had their own address printed alongside yours, that artwork has to change.
Manufacturers, EU importers, distributors, fulfilment service providers, and online marketplaces all carry defined responsibilities. Sellers into the EU — including third-country sellers using marketplaces — fall inside the scope. "We only sell on a platform, the platform is responsible" is not a defence under the Regulation.
While the toy Regulation gets the headlines, Regulation (EU) 2025/40 on packaging and packaging waste (PPWR) has applied since 12 August 2026 — it is not a future project. It covers all packaging regardless of material or origin, which in toy terms means printed boxes, blister cards, poly bags, and display cartons.
| PPWR obligation | Who carries it | What it means on a toy SKU |
|---|---|---|
| Producer registration | Producers placing packaging on a member state market | Register in each member state's producer register where you are the producer — often more than one country. Extends the EPR logic you already know from WEEE and batteries |
| Substance limits | Manufacturer / importer | Combined heavy-metal limit of 100 mg/kg for lead, cadmium, mercury, and hexavalent chromium. PFAS restrictions apply in food-contact packaging |
| Conformity assessment and documentation | Manufacturer (importer must ensure it is done) | A conformity assessment per packaging, an EU declaration of conformity, and technical documentation retained for 5 years (10 for reusable packaging) |
| Labelling | Manufacturer / importer | Harmonised pictograms, material labelling, and manufacturer/importer contact information — printed on the artwork your designer is producing right now |
| Distributor verification | Distributor / retailer | Retail buyers must check that the producer is registered and that the labelling and contact information are present. Expect EU retail buyers to ask you for this evidence during onboarding |
📊 Why this matters commercially, not just legally: EU retail buyers and marketplaces increasingly collect this evidence themselves — producer registration numbers, packaging declarations, DPP readiness. An importer who cannot produce them at onboarding gets deprioritised in favour of one who can. Compliance is becoming a sales qualification, not just a legal cost.
Sequenced by effort-to-impact, not by legal deadline order:
| When | Action | Why it must happen in this order |
|---|---|---|
| Now (2026) | Audit the material composition of every EU SKU against the new chemical scope — PFAS, bisphenols, sensitisers, new migration limits | Substance changes cascade: material swap affects tooling, colour matching, testing scope, and cost. Finding out in 2029 is a redesign, not a substitution |
| Now (2026) | Fix PPWR packaging: artwork labelling, pictograms, contact information, and producer registration per market | Already legally in force. Artwork changes are cheap now and expensive mid-season |
| 2026-2027 | Restructure the technical file per model into machine-readable data: BOM, material declarations, test scope, risk assessment | The DPP is a data deliverable. Companies with structured data will populate it in weeks; companies with folders of PDFs will rebuild their file |
| 2027-2028 | Add supply-chain traceability: mill, compounder, and sub-supplier declarations with revision control | Chemical compliance is only as strong as the weakest declaration behind it, and the Regulation puts the burden on the operator placing the toy on the market |
| 2028-2029 | Implement the DPP once the Commission's implementing acts are published, and trial QR data carriers on a pilot SKU | Early trials surface the boring problems — data carrier durability, label space, print quality, online visibility — while there is still time to fix artwork |
| 2030 | Full conformity across the range before 1 August | Stock produced to the old rules still needs to clear; late-stage compliance work collides with peak-season production |
None of this requires a lawyer to start. It requires specific answers:
We produce for the EU market and we treat the new framework as a design input rather than a paperwork task after the fact:
Send us your product and target markets. We'll map the chemical, testing, labelling, and packaging requirements that apply — and quote a route that accounts for them from the prototype stage.
Request a Compliance Review →