Trade Essays

CE marking — Conformite Europeenne — is the EU mandatory product safety marking indicating that the manufacturer declares the product meets applicable EU health, safety, and environmental requirements. It is a conformity mark, not a quality mark — it says nothing about product performance beyond meeting minimum legal requirements.

Products requiring CE marking for Indian exporters: Machinery (moving parts that can cause injury), Low Voltage Equipment (electrical equipment 50-1000V AC), Radio Equipment (WiFi, Bluetooth, mobile devices), Medical Devices (EU MDR 2017/745), PPE (helmets, gloves, safety footwear), Construction Products, and Toys.

The conformity assessment process: Step 1 — Identify applicable EU directive(s). Step 2 — Identify applicable harmonised EN standards. Step 3 — Conduct conformity assessment (self-declaration Module A for lower-risk products; Notified Body Module B/C for higher-risk products). Step 4 — Compile Technical Documentation including risk assessment and test reports. Step 5 — Issue EU Declaration of Conformity. Step 6 — Affix CE mark.

Common mistakes Indian manufacturers make: (1) Assuming CE marking equals one test from one lab — it requires a manufacturer declaration against specific legal requirements; (2) Using non-accredited test laboratories — harmonised standard tests must come from ISO 17025 accredited labs; (3) Missing the EU Declaration of Conformity requirement; (4) Not updating CE marking when products change — any significant design change requires new conformity assessment; (5) Treating CE marking as a one-time exercise rather than ongoing compliance obligation.

REACH principle is simple: No data, no market. The burden of proof for chemical safety lies with manufacturers and importers — not regulatory authorities. If a substance is not registered or properly exempt, it cannot be placed on the EU market.

How REACH affects Indian exporters: (1) Direct chemical exporters: EU importer must register substances imported in quantities above 1 tonne per year with ECHA. The Indian exporter should appoint an EU-based Only Representative who acts as registrant. (2) Downstream product exporters: If your textile, leather, electronic component, or plastic part contains chemicals, those chemicals must be registered or not restricted. EU REACH Article 33 requires notification to customers if products contain SVHC above 0.1% by weight.

SVHC — Substances of Very High Concern: ECHA Candidate List currently contains 240+ SVHCs. Common SVHCs affecting Indian exporters: lead compounds in PVC and electrical cables, chromium VI in leather, phthalates in plastics, PFAS in water-repellent textiles and non-stick coatings.

Practical compliance steps: (1) Map chemical inputs against the ECHA SVHC Candidate List and REACH Restriction Annex XVII; (2) Appoint an EU REACH Only Representative if exporting chemicals directly; (3) Obtain REACH compliance certificates from chemical suppliers; (4) Test finished products for SVHC at an ISO 17025 accredited laboratory; (5) Issue Article 33 SVHC notifications to EU customers; (6) Include REACH compliance declarations in EU buyer contracts.

EU food law is built on Regulation (EC) 178/2002 establishing four principles: food safety, traceability, rapid alert (RASFF), and the precautionary principle. These cascade through hundreds of specific regulations covering pesticide MRLs, additives, contaminants, labelling, hygiene, and import conditions.

The five most common EU compliance failures for Indian agro-food exports:

1. Pesticide MRL exceedances. EU MRLs are often 10-100x lower than Codex Alimentarius standards. Common failures: Indian pepper (ethylene oxide, EU MRL 0.05 mg/kg — banned at detectable levels), Indian cumin (pyrethroid insecticides), Indian coriander (organophosphate residues). Solution: pre-export testing against EU MRL database at NABL-accredited laboratory.

2. Aflatoxin contamination. EU allows maximum 5 micrograms per kg total aflatoxins in spices. Indian nutmeg, chillies, and some peppers frequently fail due to improper post-harvest drying and storage. Solution: moisture-controlled storage, HACCP implementation, pre-shipment mycotoxin testing.

3. Labelling non-compliance. EU Regulation 1169/2011 requires nutrition declaration, allergens in bold, best before date, storage conditions, country of origin, and net quantity — in the official language(s) of the country of sale. English-only labels are illegal for sale in Germany, France, Italy, and Spain.

4. Additives not approved in EU. Some FSSAI-permitted additives are not on the EU approved additives list (Regulation 1333/2008). Cross-check every additive before export.

5. Novel food status. Some traditional Indian ingredients are classified as novel foods in EU (not widely consumed before May 1997) — requiring pre-market safety assessment and EFSA authorisation.

GDPR applies to any organisation processing personal data of EU residents regardless of where the organisation is located. An Indian software company in Bengaluru processing EU customer data for its German client is subject to GDPR. Fines for serious violations: up to EUR 20 million or 4% of global annual turnover — whichever is higher.

The 6 essential GDPR obligations for Indian IT companies:

1. Data Processing Agreement (DPA). When processing EU personal data on behalf of an EU client (as a data processor), a DPA must be in place specifying what data is processed, purposes, security measures, sub-processing arrangements, and obligations of both parties. EU clients will not engage Indian IT vendors without a signed DPA.

2. Standard Contractual Clauses (SCCs). Data transfers from EU to India require SCCs — standard contractual terms approved by the EU Commission. Include Module 2 SCCs (Controller-to-Processor) in all India-EU contracts.

3. Data Protection Officer. Indian IT companies processing EU personal data at large scale should appoint a DPO who monitors compliance, conducts Data Protection Impact Assessments, and serves as the contact point for EU supervisory authorities.

4. Records of Processing Activities. Maintain a record of all personal data processing: what data, what purpose, where stored, who has access, retention period. Mandatory for organisations with 250+ employees.

5. Data breach notification. Notify EU client within 24 hours (contractual) and relevant supervisory authority within 72 hours if breach poses risk to individuals. Have a breach response plan ready.

6. Technical security measures. Implement: encryption at rest and in transit, role-based access controls, multi-factor authentication, regular penetration testing, and security awareness training. Document for client audits.