The Toy Certification File Buyers Never Check: 7 Documents, 10 Years

November 2026 · Certification Files, Traceability and EU/US Compliance for B2B Toy Buyers

Ask a toy factory for its test reports and you will usually get them within an hour. Ask the same factory which of those reports belongs to the batch inside the container currently sitting at your forwarder, and the conversation changes. That gap — between having a certificate and being able to prove which certificate covers which toys — is where almost every buyer's compliance file actually fails.

This is a working guide to the toy certification file an AI toy importer now needs in both the European Union and the United States, what each document is legally required to contain, how long it must be kept, and how to structure it so that a market surveillance authority, a customs officer or a retailer's onboarding team can verify it without a week of email. Every requirement below is cited to the regulation it comes from, and the sources are listed at the end so you can read the original text.

The file is not one document. It is four documents that must agree with each other

Buyers routinely conflate four distinct artefacts. They are prepared by different people, at different times, and they serve different legal purposes:

1. The technical file. The manufacturer's own record of how the toy was designed, which hazards were analysed, which standards were applied and what test reports resulted. It exists to answer "how do you know this product is safe?"
2. The declaration of conformity. A one- or two-page formal statement, signed by a person, that the toy meets the applicable requirements and which standards or procedures were used. It exists to answer "who attests to conformity, and to what?"
3. The certificate of compliance (US) or the marking package (EU). For the US, the finished product certificate filed with CBP; for the EU, the CE marking, the importer's identification, and the instructions and warnings in the right language.
4. The traceability layer. The batch, serial or model number that links each physical toy to documents 1–3. This is the document buyers most often skip, and the one that makes all the others verifiable.

A file with a thick stack of test reports and no traceability layer looks complete in a vendor folder and fails on first inspection. An AI toy makes this worse than a conventional plush because the electronics inside a single SKU can vary by firmware, by microphone module, by battery and by cloud service — all of which change the risk profile without changing the outer shell.

What the EU requires: Directive 2009/48/EC, article by article

For toys, the sector-specific rule remains Directive 2009/48/EC (the Toy Safety Directive). It sets out what the manufacturer must produce and keep, and the retention period is explicitly ten years.

• Risk analysis and technical documentation. Article 4(2) requires the manufacturer to draw up technical documentation and carry out the applicable conformity assessment before placing a toy on the market. Article 21 adds that the documentation must contain all relevant data or details of the means used to ensure conformity, and in particular the documents listed in Annex IV of the Directive. You do not get to choose a shorter format than the Annex IV list.
• Ten-year retention. Article 4(3) requires the manufacturer to keep the technical documentation and the EC declaration of conformity for a period of 10 years after the toy has been placed on the market. Article 5(3)(a) repeats the same ten-year duty for the authorised representative. A factory that "archives" test reports for two years is in breach even if the toy is perfect.
• Identity marking. Article 4(5) requires toys to bear a type, batch, serial or model number or other element allowing their identification, or — where size or nature does not allow it — the information on the packaging or an accompanying document. This is the legal hook for your traceability layer.
• Conformity assessment route. Article 19 is the part buyers misread most. If the manufacturer has applied harmonised standards whose references are published in the Official Journal and which cover all relevant safety requirements, the internal production control procedure (Module A of Decision No 768/2008/EC) is sufficient. EC-type examination with Module C applies where no such harmonised standard exists, where one exists but was not applied or only partly applied, where a standard was published with a restriction, or where the manufacturer decides third-party verification is needed for the toy's nature, design, construction or purpose.
• Thirty-day response window. Article 21(3) lets the market surveillance authority fix a deadline for receiving the technical documentation or a translation of the relevant parts — 30 days, unless a shorter deadline is justified by a serious and immediate risk. If the manufacturer does not comply, Article 21(4) allows the authority to require testing by a notified body at the manufacturer's own expense. That is the concrete cost of a disorganised file.
• Warnings and language. Article 11 governs warnings: they must be clearly visible, legible, understandable and accurate, marked on the toy, a label or the packaging, preceded by the words "Warning" or "Warnings", and warnings that determine the purchase decision (including minimum and maximum user ages) must be visible before purchase — including online. Member States may require the language(s) of their market.
• CE marking before market entry. Article 16(1) requires the CE marking on toys made available on the market; Article 17(1) requires it visibly, legibly and indelibly on the toy, a label or the packaging, and 17(2) requires it to be affixed before the toy is placed on the market.

One practical consequence that catches AI toy brands: Annex IV paperwork is written for a toy with fixed content. A voice toy whose answers are served from a cloud library may have firmware and content revisions the technical file never recorded. The fix is not more paper — it is a revision log in the technical file that ties each firmware build and voice-content version to a dated conformity check.

What the EU requires beyond the toy rules: Regulation (EU) 2023/988

The General Product Safety Regulation applies from 13 December 2024 and repealed Directive 2001/95/EC. It complements the Toy Safety Directive, and several of its provisions apply to toys even though toys are covered by harmonisation legislation — notably the obligations on accidents, recalls, distance selling and the responsible person.

• Technical documentation and ten years. Article 9(2) requires manufacturers to carry out an internal risk analysis and draw up technical documentation before placing a product on the market; Article 9(3) requires them to keep it at the disposal of market surveillance authorities for 10 years after placing it on the market. Article 11(6) puts the same ten-year retention on importers for the copy of that documentation.
• Algorithmic and connected features are part of the safety assessment. Article 6(1)(g) includes, when required by the nature of the product, cybersecurity features necessary to protect the product against external influence, and 6(1)(h) includes "the evolving, learning and predictive functionalities of the product". For an AI companion toy, that means the file must describe how the model's behaviour is bounded — not just what the hardware passed.
• Distance selling disclosures. Article 19 requires online offers to state clearly and visibly the manufacturer's name and contact details, the EU responsible person where the manufacturer is not established in the Union, product identification including a picture and type, and any warning or safety information in the required language. Your product page is part of the compliance file.
• A responsible person in the Union. Article 16(1) bars placing a product on the market unless there is an economic operator established in the Union responsible for the tasks in Article 4(3) of Regulation (EU) 2019/1020, whose name and contact details must appear on the product, packaging, parcel or accompanying document (Article 16(3)).
• Recall machinery with deadlines. Article 36(2) prescribes what a written recall notice must contain — including a headline consisting of the words "Product safety recall", the hazard described without softening language such as "voluntary" or "precautionary", and remedies — and Article 37(2) requires the operator to offer a choice of at least two remedies among repair, replacement or an adequate refund at least equal to the price paid.
• Accident reporting. Article 20 requires the manufacturer to notify accidents through the Safety Business Gateway without undue delay, with importers and distributors informing the manufacturer.

What the US requires: the mandatory toy standard and the certificate that travels with the cargo

The US side has changed shape in the last two years, and the change is precisely in the area of documentation.

• The mandatory toy standard is ASTM F963-23. 16 CFR 1250.2(a) provides that each toy must comply with all applicable provisions of ASTM F963-23, incorporated by reference under 16 CFR 1250.10. Note the carve-out in 1250.2(b): Section 4.2 and Annex 5 of F963, and any provision restating an existing CPSC mandatory standard or ban, or an FDA regulation, are not part of the mandatory standard. A supplier who cites "ASTM F963" without a revision year is giving you an unusable reference.
• Certificates must be filed electronically. 16 CFR Part 1110 now requires importers to file certificates electronically (eFile) with U.S. Customs and Border Protection for imported finished products that are required to be certified, in the format described in 1110.13(a)(1). The certificate is no longer a PDF in a factory drawer; it is an ACE data set your broker transmits.
• Twenty-four hours, not twenty-four days. 16 CFR 1110.13 requires the certifier to issue the certificate on or before the date the finished product is distributed in commerce and make it available for inspection immediately, meaning within 24 hours, upon request by CPSC. If your file lives in a factory's WeChat history, you cannot meet that clock.
• Content of the certificate. 16 CFR 1110.11 requires the identification of the product covered, each CPSC rule to which the product is certified, identification of the importer or domestic manufacturer certifying compliance, contact information for the individual maintaining test records (a position title is acceptable if always staffed), the date (month and year at minimum) and place of manufacture with a full address, the date and place of each third-party test on which the certificate depends, and identification of any third-party laboratory. A certificate missing the lab identification is incomplete on its face.
• Component certificates are not finished-product certificates. 16 CFR 1110.19 addresses component part certificates; the finished product certifier still bears the obligation in 1110.15. When an AI toy BOM spans four sub-suppliers — boards, battery, plush shell, firmware — the component paperwork is evidence, not a substitute.

For the AI toy specifically, add the software layer: an offline toy and a cloud-connected toy are different products in both jurisdictions, because the risk analysis in the EU file and the rule identification in the US certificate must cover what the toy actually does. A supplier that certifies the hardware and ships a later firmware that changes voice behaviour has created a documentation gap nobody is tracking.

The side-by-side comparison buyers should keep at the front of the file

Requirement matrix

Core product rule

• European Union: Directive 2009/48/EC (Toy Safety Directive) + Regulation (EU) 2023/988 (GPSR)
• United States: 16 CFR Part 1250 (mandatory toy standard, ASTM F963-23); CPSIA

Conformity evidence

• European Union: Technical documentation per Art. 4(2) and Art. 21 + Annex IV; EC declaration of conformity
• United States: Children's product certificate per 16 CFR 1110.11

Who signs

• European Union: Manufacturer; authorised representative holds copies (Art. 5(3))
• United States: Importer or domestic manufacturer (16 CFR 1110.7)

Retention period

• European Union: 10 years after placing on the market (Art. 4(3); GPSR Art. 9(3) and 11(6))
• United States: Records must support immediate, 24-hour production to CPSC (16 CFR 1110.13); test-records rule under 16 CFR 1110.17

How it reaches the authority

• European Union: On reasoned request; 30-day deadline to supply (Art. 21(3))
• United States: Filed electronically with CBP via ACE (16 CFR 1110.13(a)(1))

Marking

• European Union: CE marking + manufacturer/importer identity + type/batch/serial/model (Art. 16, 17, 4(5))
• United States: Certification label per applicable rule; CPSC tracking label for children's products

Opaque risk areas for AI toys

• European Union: Cybersecurity and learning/predictive functionality (GPSR Art. 6(1)(g), (h)); warnings in local language (Art. 11)
• United States: Which CPSC rules the connected features fall under; test scope versus firmware version

Recall trigger and cost

• European Union: Safety Business Gateway notification (GPSR Art. 9(8), 20); two-remedy choice (Art. 37(2))
• United States: Section 15 reports under 15 U.S.C. 2064; recall costs carried by the importer of record

Five failure modes that show up in real buyer audits

First: the certificate names the wrong party. In the US, the certifier must be the importer or domestic manufacturer. A certificate issued to a Hong Kong trading company that is not the importer of record is the wrong document, and brokers increasingly reject it at entry.

Second: the standard reference has no revision year. "ASTM F963" is not a citation; ASTM F963-23 is. The same applies in the EU: "EN 71" without the part number and year (EN 71-1, EN 71-2, EN 71-3) does not tell a surveillance authority which risk was covered.

Third: the batch number on the carton does not exist in the test report. Ten-year retention is meaningless if the retained report covers a colourway and a component set that no longer match what shipped. Tie each shipment's batch to a specific report revision.

Fourth: the file has no owner. GPSR Article 14 requires economic operators to have internal processes for product safety in place. A named person, a position that is always staffed, and a shared folder with a documented structure satisfy this better than an eight-page policy nobody opens.

Fifth: the software is invisible. Both EU and US frameworks assume the product is what the file describes. Connected toys that push content updates need a change-control record — which build shipped, when, and what was re-checked.

A practical file structure you can hand to a factory today

You do not need software. You need a numbered structure and a naming convention the factory agrees to use on the production line. A workable structure:

/<SKU>/00-index.pdf                  one page: what is in this file, who owns it
/<SKU>/01-technical-file/            EU Annex IV documents, risk analysis, design/BOM
/<SKU>/02-standards/                 EN 71-1/-2/-3, EN 62115, ASTM F963-23 scope matrix
/<SKU>/03-test-reports/              report per batch/revision, with lab name and accreditation
/<SKU>/04-declarations/              EC DoC (signed, dated), US CPC data set
/<SKU>/05-label-artwork/             CE mark placement, warnings, language variants
/<SKU>/06-traceability/              batch-to-report map, production run log
/<SKU>/07-software/                  firmware and voice-content versions, change log
/<SKU>/08-recall-readiness/          contact list, recall notice draft, remedy options

Two rules make it work in practice. First, the batch-to-report map in 06 is the single most important page in the folder: it is the only document that proves the ten-year archive and the twenty-four-hour obligation connect to physical goods. Second, the file must be mirrored in a location the importer controls, not only at the factory, because GPSR Article 11(6) puts the ten-year obligation on the importer too.

For buyers assembling this for the first time, the sensible sequencing is: collect declarations and test reports for the current production run, build the batch-to-report map for the last two shipments, then backfill the older archive. That order fixes the exposure that matters now — a container under inspection — before the historical paperwork.

If your sourcing spans several factories and component suppliers, the traceability layer is also the place to reconcile them; the approach in One Toy, Four Factories: Why 40% of Your AI Toy BOM Has No Certificate covers how to map a multi-supplier BOM, and the sequence for building a factory file from zero is set out in The One-Day AI Toy Factory Audit: Eleven Questions and the Documents That Expose an Assembler.

Two adjacent requirements are worth folding into the same working session. Button-cell batteries in AI plush toys fall under their own US rule, covered in Reese's Law and AI Toys: What Importers Must Know, and if your channel includes German retail, the GS mark and German-language manual expectations in The $10.7B German Toy Market Is Behind a 10-Page Wall are asked for during onboarding, not after.

What to put in the purchase order so the file exists at all

Most documentation failures are contractual. Three clauses fix the majority:

• Document set as a delivery condition. Name the documents — technical file per Annex IV, EC declaration of conformity, per-batch test reports naming the lab, certificate data for eFiling — as a condition of final payment, not an after-sales request.
• Retention and access. Oblige the factory and its sub-suppliers to keep the technical documentation available to you for at least ten years, and to re-supply it within five working days of a written request. This mirrors Article 4(3) and makes the importer's own GPSR Article 11(6) duty performable.
• Change notification. Require written notice before any change to component supplier, battery cell, microphone, MCU, firmware or voice content, with a re-test plan attached. This is the only mechanism that keeps the file true after the first shipment.

None of these clauses is exotic, and none requires new regulation. They simply move the file from something the factory assembles when asked to something that exists on the date of shipment.

The deadline that is actually approaching

The practical calendar for a buyer shipping into Europe ahead of the 2027 season: the ten-year retention clock has already started for every SKU you placed on the EU market after 13 December 2024, and the US eFiling requirement applies to imported certified products now. There is no amnesty period in which a missing file can be assembled without the factory's cooperation, and factories reorganise, change ownership, or stop answering when an order volume drops.

The file is therefore not a compliance formality. It is the only asset that survives the end of a supplier relationship, and for an AI toy brand it is the one thing that stays with you when the SKU, the firmware and the factory all change.

Sources

• Directive 2009/48/EC on the safety of toys (consolidated text) — https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02009L0048-20191118
• Regulation (EU) 2023/988 on general product safety (OJ L 135, 23.5.2023, p. 1) — https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R0988
• European Commission, Toy safety — https://single-market-economy.ec.europa.eu/sectors/toys_en
• 16 CFR Part 1250 — Safety Standard Mandating ASTM F963 for Toys — https://www.ecfr.gov/current/title-16/chapter-II/subchapter-C/part-1250
• 16 CFR Part 1110 — Certificates of Compliance — https://www.ecfr.gov/current/title-16/chapter-II/subchapter-C/part-1110
• CPSC — eFiling: Does eFiling Apply to Me? — https://www.cpsc.gov/efiling/help
• 15 U.S.C. 2064 — Substantial product hazard reporting (CPSA § 15) — https://www.law.cornell.edu/uscode/text/15/2064