One Toy, Four Factories: Why 40% of Your AI Toy BOM Has No Certificate

November 2026 · Sourcing, BOM Traceability and Certification for B2B Toy Buyers

Ask ten AI toy brands how many factories made their hero SKU and most will answer "one". Ask for the shipping marks on the firmware build, the lithium pouch cell, the speaker and the printed circuit board, and the number usually climbs to four or five. The plush is sewn in Yangzhou, the electronics are assembled in Shenzhen, the battery comes from a cell supplier three tiers down, and the voice firmware is written by a software team that has never visited either plant. On the customs entry there is one product, one HS code, one Children's Product Certificate.

That is not a paperwork problem. It is the exact scenario 16 CFR 1107.23 was written for, and it is why so many AI toy certificates are technically valid at signing and quietly invalid six months later — when a factory swaps a cheaper battery protection IC, or a board house changes its solder paste supplier, because a purchase manager asked for a five-cent saving and nobody treated it as a compliance event.

This guide maps the four-factory reality of AI toys onto the US certification framework, shows where the duty actually attaches, and gives you an audit you can run against your own BOM this month.

The four factories behind a single AI plush SKU

A typical USD 39.90 AI plush companion sold into the US breaks down like this:

1. Soft goods plant — pattern, stuffing, fabric, sewing, hand-inserting the electronics module into a zipped or velcro pouch. This is the plant your buyers visit.
2. Electronics EMS plant — PCB assembly, firmware flashing, speaker and microphone mounting, final module test. Often a different city, different province, different quality system.
3. Cell and component suppliers — the lithium-ion pouch cell, the protection circuit, the USB-C port, the MEMS microphone, the display if there is one. These are the tiers that never appear on your BOM unless you ask.
4. Software and content vendor — the voice library, ASR/TTS engine, cloud or edge model, and the app. Not a physical factory, but a party whose changes alter the product's behaviour and, in some cases, its compliance profile.

Add the packer if the retail packaging is printed and assembled elsewhere, and the "one factory" answer becomes even less accurate. None of this is unethical. It is normal manufacturing. The problem is that the certification, the test reports and the purchase order are usually written as if the four-factory reality did not exist.

Where the US rules put the obligation

The CPSA requires certification of children's products to each applicable rule by a third party conformity assessment body, and 16 CFR Part 1107 governs how that testing is done and maintained. Three provisions decide whether your certificate survives a supplier swap.

Material change is defined by effect, not by paperwork. 16 CFR 1107.2 defines a material change as any change in the product's design, manufacturing process, or sourcing of component parts that a manufacturer exercising due care knows, or should know, could affect the product's ability to comply with the applicable rules, bans, standards or regulations. Section 1107.23(a) then requires that when such a change occurs, the manufacturer must submit a sufficient number of samples for third party testing and issue a new Children's Product Certificate. Section 1107.23(d) is the sentence to read aloud to your factory: a material change in the sourcing of component parts results when replacing one part with another could affect compliance, and this includes changes in component part composition, component part supplier, or the use of a different component part from the same supplier.

Read that last clause again. A factory changing the protection IC inside a battery pack from the same vendor is a material change by the regulation's own text, if it could affect compliance. Nobody needs to switch factories to trigger re-testing. A substitution inside one purchase order is enough.

Component part testing is allowed, with conditions. 16 CFR 1109.5(a) lets a finished product certifier rely on component part test reports, but only where the tested part is identical in all material respects to the part actually used, and where testing the part is sufficient to assess compliance. Section 1109.5(c) forbids extending component part tests to rules that require testing the finished product — which matters for mechanical and small-parts rules where the assembled toy, not the module, is the test object. Section 1109.5(f) requires traceability: a certifier must not rely on testing procured by another party unless the parts are traceable. And section 1109.5(g) lists the documentation each supplier must hand you: identification of the part, a lot or batch number, the rules tested, the methods, the test dates, the values, and an attestation from the testing party.

In practice, that documentation list is the single most useful tool a buyer has. Ask four suppliers for section 1109.5(g) documentation and you will learn within a week which of them is actually operating a traceable quality system and which is reconstructing certificates from memory.

Periodic testing runs on a clock. 16 CFR 1107.21 requires periodic third party testing by all manufacturers of children's products. Under the default path the interval may not exceed one year; a documented production testing plan allows at least once every two years; ongoing testing by an ISO/IEC 17025-accredited laboratory allows at least once every three years. The regulation also lists the factors that should shorten the interval, and two of them are explicitly about suppliers and components: the introduction of a new set of component parts into the assembly process, and known process factors that could affect compliance.

The certificate itself is a data problem. 16 CFR 1110.11(a) requires the certificate to identify the product by at least one unique identifier — GTIN, model number, SKU, UPC or an alternate identifier — list each applicable rule separately, name the certifier with full contact details, name the individual maintaining records, and give the date and place of manufacture and of testing, including for each third party body. Section 1110.13(a)(1) requires that for goods manufactured outside the US and offered for import, the certifier eFile the certificate data elements in ACE at the time of entry filing. Section 1110.13(c) requires the certificate to be available within 24 hours of a CPSC or CBP request. Section 1107.26 requires the underlying records, including records describing material changes and the tests run on them, to be kept for five years.

Put together, the obligations read as a single sentence: the certificate is a declaration about a specific product made by a specific plant from specific parts, and it expires the moment one of those facts changes without re-testing.

Two phrases in that sentence are the ones a brand's own purchase team usually breaks. "Made by a specific plant" is a statement about a manufacturing site, and site consolidation is routine when order volumes move between plants. "From specific parts" is a statement about a BOM, and BOMs in China's toy belt drift all season. Neither phrase is enforced by a certificate at rest. Both are enforced by the records behind it.

The four-factory BOM table

The table below maps the usual AI toy bill of materials to who owns it, what evidence exists, and what a buyer should demand. It is the sheet worth attaching to every purchase order.

BOM node matrix

Shell fabric, stuffing, embroidery

• Typical owner: Soft goods plant
• Certificate dependency: Flammability, lead in surface coatings, phthalates
• Evidence a buyer should hold: Third party report citing the exact fabric code and supplier lot; 16 CFR 1303 lead-in-paint test for printed/coated parts
• Why it fails an audit: Factory re-sources fabric to a cheaper mill mid-season without notice; certificate still cites the old mill

Sewn-in electronics pouch and zipper

• Typical owner: Soft goods plant
• Certificate dependency: Small parts, choking hazards, physical/mechanical
• Evidence a buyer should hold: Finished-product test on the assembled toy, not the module
• Why it fails an audit: Module-only tests used where the rule requires the assembled toy

PCB assembly and firmware

• Typical owner: EMS plant
• Certificate dependency: 16 CFR 1505 electrically operated toys, plus FCC/radio rules if applicable
• Evidence a buyer should hold: Test report naming the EMS site; firmware version and hash recorded
• Why it fails an audit: Same board, different EMS site after a capacity crunch; certificate names the old plant

Lithium pouch cell and protection circuit

• Typical owner: Cell supplier, often tier 3
• Certificate dependency: Battery-related rules and shipping/energy requirements; burner-test evidence 1109.5(g) records
• Evidence a buyer should hold: Cell datasheet, UN 38.3 test summary, 1109.5(g) documentation with lot numbers
• Why it fails an audit: Supplier swaps the protection IC within the same brand; by 1107.23(d) a material change

Speaker, microphone, sensors

• Typical owner: Multiple small suppliers
• Certificate dependency: Depends on rule; often feeds EMC and electrical safety
• Evidence a buyer should hold: Part-level reports plus traceability to the production lot
• Why it fails an audit: Reports exist but are not traceable to the imported lot, so 1109.5(f) blocks reliance

Firmware, app, voice content

• Typical owner: Software vendor
• Certificate dependency: Content and privacy compliance, not toy safety rules per se
• Evidence a buyer should hold: Version-controlled release notes mapped to product batches
• Why it fails an audit: Behaviour changes without any change record, breaking the "records of material changes" duty in 1107.26

Retail packaging and inserts

• Typical owner: Packer or printer
• Certificate dependency: Lead in coatings, choking warnings
• Evidence a buyer should hold: Ink and board reports tied to a print run
• Why it fails an audit: Warnings on the carton reference an older SKU identifier than the certificate

Finished goods consolidation

• Typical owner: Trader or brand
• Certificate dependency: The certificate as a whole
• Evidence a buyer should hold: Signed CFC matching the eFiled data set
• Why it fails an audit: Certificate lists a model number the warehouse never sees on the carton

The pattern is consistent: every failure in the right-hand column is a substitution, and every substitution is invisible unless your contract creates an obligation to report it.

Why substitution is the default, not the exception

Substitution is not sabotage. It is what supply chains do when they are squeezed by three forces at once.

• Capacity allocation. In the September-to-November production window, EMS plants allocate lines to the biggest orders. A smaller AI toy order gets moved to a sister site. The board is identical; the plant is not.
• Component end-of-life. Display and sensor supply chains retire parts with short notice. An engineer substitutes a pin-compatible equivalent and considers it a good day's work.
• Cost pressure from the buyer. When a brand asks a factory for a five-cent reduction late in the season, the factory finds it inside the BOM, most often in the battery and the sensor. The buyer gets the saving and inherits the change.

Add the seasonal layer specific to AI toys: Q4 shipments are booked months in advance, the factory schedules change weekly, and the compliance file is assembled once — usually at sampling — and then frozen. By the time the container loads, the frozen file describes a product the factory no longer builds.

The four-factory traceability audit

You can run this audit with the files you already have, without visiting a plant. Budget two weeks.

Week one — map, do not judge.

1. Take your top three SKUs by revenue and list every BOM line with its supplier, part number and manufacturing site.
2. For each line, ask the factory for the 16 CFR 1109.5(g) documentation package. Mark each line "documented", "partial" or "none".
3. Compare the manufacturing site named on the Children's Product Certificate against the site on the last three shipping documents. Mismatch is a finding, not a typo.
4. Pull the version history of firmware and app releases since the certificate date, and list every release that changed audio output, sensor behaviour or language content.

Week two — close the gaps.

1. For every "none" and "partial" line, decide: test the component, or accept finished-product testing at the next periodic interval. Write the decision down with a date.
2. Add a substitution clause to the purchase order. It should require written notice before any substitution of a component supplier, part number or manufacturing site, identify the notice window, and state that undocumented substitution is grounds for chargeback of re-testing costs.
3. Convert the certificate into a living document. Store the CFC, test reports, 1109.5(g) packages and change log in one folder per SKU, indexed by the identifier that appears in ACE.
4. Decide the periodic testing path now, in writing, because the clock runs whether or not you chose a method.

If you want the wider compliance context around these documents — the German route in particular — the TÜV/GS and GPSR requirements for AI plush are set out in our Germany toy market entry guide, and the importer-side test discipline is covered in the eleven-question factory audit. Both assume the same underlying asset: a BOM you can actually trace.

A worked substitution example

A brand certifies an AI plush at USD 39.90 retail in June. The certificate names the soft goods plant and the EMS site, cites the applicable rules, and carries a battery module test report from the cell supplier. In September, the EMS site runs short of the protection IC it used in June and substitutes an equivalent from a second vendor to keep the line moving. The plush is unchanged. The firmware is unchanged. The retail price is unchanged.

Three months later, a customs broker asks for the certificate at entry, as 16 CFR 1110.13 anticipates. The document produced is genuine and complete on its face. The question that matters is whether the battery pack inside the carton is the battery pack described in the report, and the answer is that nobody can demonstrate it without lot-level traceability. That is the gap 1109.5(f) exists to close, and it is closed with a lot number and a signed attestation, not with an email saying "same supplier".

Nothing in this example requires a defect, an injury or a recall. It only requires a substitution made for good operational reasons by a supplier who was never told the substitution was compliance-relevant.

What "identical in all material respects" really costs to prove

The phrase appears in both 1109.5(a)(2) and 1107.23(a), and it is the hinge of the whole system. For a plush toy, proving it is straightforward: the same fabric code, the same stuffing, the same dye lot family. For electronics it is harder, and the burden falls on documentation rather than on opinion.

A practical standard that has worked in audits: for every electronic part that touches a safety rule, you should be able to produce (i) the part number, (ii) the supplier, (iii) the lot or date code, (iv) a test report or a supplier certificate referencing that part number, and (v) an attestation that the testing was performed in compliance with the applicable requirements. If any of the five is missing, the line is not documented, regardless of how confident the factory sounds on a call.

The seasonal wrinkle buyers miss in November

The production cycle for AI toys is front-loaded. Sampling and certification for next season happen while this season's containers are still arriving, which means the compliance file for a 2027 launch is being assembled from parts that will be substituted at least once before the launch ships. Two habits reduce the damage:

• Certify the architecture, not only the sample. Write the certificate's product description and internal change log so that a board revision or a battery supplier change is a documented event with a decision attached, not a silent one.
• Price re-testing into the product plan. A second third party test run is a known cost of doing business on a product with four suppliers. Treating it as an unforeseen expense is why substitutions go unreported.

For the channel side, the holiday restock cycle that compresses these decisions is described in our Black Friday restock window analysis.

The one-page change log

If you build nothing else from this guide, build this. One sheet per SKU, one row per change, five columns:

Change date matrix

2026-09-14

• What changed: Protection IC vendor B substituted at EMS site 2
• Who changed it: EMS plant
• Compliance decision: Material change under 1107.23(d); module re-tested
• Evidence updated: New module report filed, CFC updated

A change log is not bureaucracy. It is the only artefact that lets you answer, eighteen months after the fact, the only question a customs broker, a CPSC investigator or a retail compliance team will actually ask: is the toy in this carton the toy you certified?

Sources

• 16 U.S.C. § 2063 (CPSA section 14) — certification, third party testing and continued testing of children's products. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section2063
• 16 CFR Part 1107 — Testing and Labeling Pertaining to Product Certification, including § 1107.2 (definitions of material change, manufacturing process), § 1107.21 (periodic testing), § 1107.23 (material change), § 1107.26 (recordkeeping). https://www.ecfr.gov/current/title-16/part-1107
• 16 CFR Part 1109 — Conditions and Requirements for Relying on Component Part Testing, including § 1109.5 (conditions, traceability, documentation). https://www.ecfr.gov/current/title-16/part-1109
• 16 CFR Part 1110 — Certificates of Compliance, including § 1110.11 (certificate content) and § 1110.13 (certificate availability, eFiling at entry). https://www.ecfr.gov/current/title-16/part-1110
• 16 CFR Part 1505 — Requirements for Electrically Operated Toys or Other Electrically Operated Articles Intended for Use by Children. https://www.ecfr.gov/current/title-16/part-1505
• 16 CFR Part 1112 — Requirements Pertaining to Third Party Conformity Assessment Bodies (scope of accepted accreditation, including part 1505). https://www.ecfr.gov/current/title-16/part-1112