Vendor requirements, product compliance, and naming an owner for each.

System 04 of six · Read time about nine minutes

Of the six systems, compliance is the one founders most consistently underestimate, because it looks like paperwork. It is not paperwork. It is a register of obligations, each with a cost of failure attached, and the cost of failure ranges from a small deduction to a recall.

The diagnostic question is not “are we compliant.” Every brand believes it is compliant. The diagnostic question is: for each obligation, can you name the person who owns it and show the evidence? Where the answer is a shrug, you have found the exposure.

Four categories of obligation

They fail differently and they need different owners, so keep them separate.

Category	Typical obligations	Failure looks like
Product safety & regulatory	Applicable safety standards, age grading and testing where relevant, chemical and materials restrictions, electrical or wireless certification, required warnings and country-of-origin marking	A stop-sale, a recall, or a retailer refusing the item at receiving
Retailer-specific vendor requirements	Vendor agreement terms, insurance certificates and limits, supplier code of conduct, factory audits and social compliance, sustainability or packaging declarations	Onboarding stalls, or the item is set up and cannot ship
Data & identification	GS1 company prefix and GTINs, correct barcode symbology and placement, item setup attributes, dimensional and weight accuracy, digital asset requirements	Item setup rejection, receiving errors, and deductions that repeat every shipment
Commercial policy	MAP policy and its enforcement, authorised-seller policy, channel and territory terms, promotional agreements	Price erosion, a buyer losing confidence in your margin structure, and eventual delisting

Barcodes and item data are where onboarding actually dies

This is unglamorous and it stops more launches than anything else on this page. Buy your own GS1 company prefix rather than acquiring resold barcodes, because retailers verify ownership and a mismatch between the brand on the item and the brand registered against the number is a hard stop.

Then be precise about the attributes. Dimensions and weights are measured at receiving, and a discrepancy between what you declared and what arrived generates a deduction on every shipment until it is corrected. Measure the actual shipping configuration — not the CAD file, not the sample, the thing on the pallet.

Item setup is also where a surprising amount of commercial damage occurs. The attributes you submit determine where the item is classified, which determines which planogram it competes in, which determines what it is benchmarked against. It is worth having a commercial person review the setup rather than treating it as a data-entry task.

Evidence, not assurance

“Our factory says it is compliant” is not compliance. Compliance is a document, from an accredited party, that names the product and the standard and carries a date.

Build a compliance file per SKU containing test reports and certificates with expiry dates, the specification the tests were run against, the artwork version that carries the required marks, the insurance certificate naming the right entity and limits, and the audit reports for the facility. Then check the dates. Certificates expire, standards get revised, and a factory that changes a component without telling you has invalidated a report that still looks valid.

One more discipline: when you change anything — a supplier, a component, a colourant, a packaging material — ask explicitly whether it invalidates existing testing. It frequently does, and it is almost never flagged by the person making the change.

MAP is a policy you enforce, or it is decoration

Minimum advertised price policy occupies a strange position: it is commercial rather than regulatory, but a buyer will check it in about two minutes and it tells them more about your operational maturity than most of what you say in the meeting.

A policy that exists and is not enforced is worse than no policy, because it demonstrates that your stated terms do not predict your behaviour. Enforcement needs to be proportionate and documented — the useful frame is three tiers:

• Minor deviation. A professional, documented reminder. No threats. The point is a clean record that the violation was identified and communicated.
• Moderate deviation. A firm notice citing the specific policy and the specific violation, with an explicit correction window. Tone moves from reminder to expectation.
• Severe or systematic undercutting. Immediate notice and a hold on purchase orders. At this point it is a business decision, not a negotiation.

The commercial logic is straightforward. Retailers invest in brands that protect their shelf investment. A brand that lets unauthorised sellers undercut MAP is, from a buyer’s point of view, a brand that will eventually undercut their margin too. Clean MAP compliance is worth more in a buyer meeting than any co-op budget.

The register

Everything above becomes one artefact: a compliance register. Columns are the obligation, the source (which vendor manual, which regulation, which policy), the owner by name, the evidence and where it lives, the expiry or review date, and the consequence of failure.

It is a boring document. It is also the fastest way to convert a vague sense of exposure into a finite list of things to fix, and it is the single item most likely to be missing when a brand tells us it is retail-ready.

Ownership is the whole point

Compliance failures cluster in the seams — between the product team and the operations team, between the brand and the factory, between the founder and the 3PL. Every obligation that sits in a seam is an obligation that will be missed.

Assign each one to a named individual, not a function. “Operations owns labelling” is how labelling gets missed. A person owns labelling, and that person knows they own it.

Next in the series: System 05 — sell-through, velocity, and building a buyer case that survives scrutiny.