The Product Compliance Check: The 6-Step Audit Aussie Shopify Founders Run Before a New SKU Goes Live

You have a supplier sample on the desk, a launch date locked in, and a product page half built. The question nobody in the business has asked is whether it is actually legal to sell the thing in Australia.

Most Aussie founders treat compliance as a paperwork layer. Returns policy, privacy page, BAS lodged on time. Underneath that sits Australian product safety law, and it behaves completely differently. It does not care whether you knew. It does not care that your supplier told you the product was fine. Supplying goods that fail a mandatory standard is a strict liability offence, which means intent is not a defence.

In December 2025 the Federal Court ordered surf and streetwear retailer City Beach to pay $14 million for supplying products that breached the button and coin battery standards. Eighteen months earlier, Davie Clothing, the company behind The Oodie, paid $101,280 across six infringement notices because six styles of Kids Beach Oodie shipped without a high fire danger warning label. Around 2,400 units had gone out, sold direct through their own website. One consumer complaint started the investigation.

That second example is the one worth sitting with. It was not a mass retailer with 500 stores. It was a direct to consumer brand selling from its own Shopify site, with a product most people would never think of as regulated. A hooded beach towel.

Here is the six-step check to run before any new SKU goes live.

Step 1: Find Out Whether Your Product Touches One of the 50 Mandatory Standards

There are 50 mandatory standards in force in Australia right now. Not thousands. Fifty. That is a small enough number that every founder can genuinely know whether their catalogue is exposed, and yet almost nobody checks.

They cluster into eleven product topics: home and garden (9 standards), baby and toddler products (8), chemicals and poisons (7), kids’ toys (6), unregistered vehicles (6), electronics and technology (5), sports and recreation (5), vehicle accessories (5), clothing and fashion accessories (3), industry tools and machinery (2), and cosmetic and health products (1).

Go to the ACCC Product Safety mandatory standards database and filter by topic. Then run every product line in your catalogue against the list. Not every SKU individually at this stage, just the lines. If you sell candles, kids sleepwear, toys, cosmetics, anything with a coin cell battery, anything a toddler could reach, anything tall enough to topple, assume you have an obligation until you have confirmed you do not.

Two standards worth flagging because they caught a lot of brands off guard. The toppling furniture standard started on 4 May 2025 and applies to a lot of flat-pack storage that Aussie homewares brands sell. The infant sleep products standards commenced on 19 January 2026. If you added either category in the last two years and never re-ran this check, you are the exact profile the ACCC finds.

The check itself takes about ninety minutes for a catalogue of 200 SKUs. Block it out this week.

Step 2: Understand That One Product Can Breach Two Standards at Once

This is the trap that turned City Beach’s problem into a $14 million problem, and it is the part most founders miss entirely.

Mandatory standards come in two flavours. A safety standard governs how the product is built. For button batteries that means secure battery compartments, compliant packaging, and the product passing specific compliance tests. An information standard governs what you have to tell the customer. Same product, different obligation, separately enforceable.

City Beach admitted that between June 2022 and October 2024 it supplied products breaching the button battery safety standard on more than 54,000 occasions, and products breaching the button battery information standard on more than 56,000 occasions. Two standards, two sets of contraventions, one catalogue of toys, digital notepads, keyrings, lights and light-up Jibbitz accessories for Crocs.

City Beach argued the appropriate penalty was $4.5 million with a 30 per cent discount for early admissions, landing at $3.15 million. The Court accepted the ACCC’s number instead. Fourteen million.

Since 28 March 2026, the maximum penalty for a company is the greater of $100 million per contravention, three times the benefit obtained, or 30 per cent of adjusted turnover during the breach period. That figure doubled from $50 million. For an individual, the maximum is $2.5 million.

You are not going to cop a hundred million dollar penalty. But the six infringement notices that hit The Oodie were sized for a business exactly like yours, and infringement notices do not require the ACCC to prove anything in court.

Step 3: Ask Your Supplier for Evidence, Not Reassurance

Ask a factory whether their product meets Australian standards and the answer is always yes. Ask for the test report and the conversation changes.

Under the Australian Consumer Law, the supplier obligation runs the length of the chain. Manufacturer, importer, distributor and retailer can all be liable at the same time, and it does not matter whether the party upstream is offshore. If you import it and list it, you are a supplier. Your factory being in Guangdong does not move the obligation off you.

So the request is specific. For any SKU where a mandatory standard applies, get:

• The test report itself. Issued by a recognised laboratory, dated, naming the exact standard and the exact model or style code you are buying.
• A declaration of conformity signed by the manufacturer, naming the Australian standard rather than the European or American equivalent. CE marking is not evidence of Australian compliance.
• Artwork proofs for any required warning label, showing the mandated wording, minimum text size and placement.
• Batch traceability. If you cannot tie a unit back to a production run, you cannot run a targeted recall later. You end up recalling everything.

A test report against the wrong version of a standard is worth nothing. Australian standards get updated. The toys standard for children up to and including 36 months was remade in 2023. The care labelling information standard was remade in 2023. If your supplier hands you a 2019 report, it may still be valid, or it may not be, and finding out is your job rather than theirs.

This is the same discipline that sits behind the supplier risk audit. Compliance evidence is just one more thing a single-vendor dependency can quietly take away from you.

Step 4: Put the Required Wording Where the Standard Says It Goes

Information standards are prescriptive about placement, not just content. Getting the words right and the location wrong is still a breach. The Oodie matter is the clean example: the ACCC found the fire label was neither fixed to the garment nor displayed on the website.

That last clause matters enormously for a Shopify brand. Several standards require the mandated information to appear at the point of sale, which for you is the product page, not a swing tag the customer sees after the parcel arrives.

Three that catch Aussie DTC brands most often:

Children’s Nightwear and Limited Daywear

The Consumer Goods (Children’s Nightwear and Limited Daywear and Paper Patterns for Children’s Nightwear) Safety Standard 2017 requires a fire danger warning label with prescribed wording and category. It covers more than pyjamas. Limited daywear brought hooded towels into scope, which is precisely where The Oodie landed.

Cosmetics Ingredient Labelling

The Consumer Goods (Cosmetics) Information Standard 2020 requires the full ingredient list in descending order of volume or mass, with colour additives listed last. It applies to every supplier in the chain, imported or locally made. If you run a beauty or skincare brand, this is not optional and INCI naming conventions apply.

Care Labelling for Clothing and Textiles

The Consumer Goods (Care Labelling) Information Standard 2023 draws on AS/NZS 1957 and requires care instructions on clothing and textile products. Most apparel founders assume their supplier handles it. Most suppliers assume the brand has specified it.

Separately, country of origin is a mandatory trade description at the border under the Commerce (Trade Descriptions) Act 1905. Any origin claim you make on the site also has to be accurate, because a wrong one becomes a misleading conduct issue under the ACL rather than a labelling one. Our consumer law playbook covers where those two regimes meet.

Step 5: Build a Compliance Register Inside Shopify

Compliance falls over when the evidence lives in someone’s inbox. The founder who sourced the product leaves, the ops manager takes over, and eighteen months later nobody can produce a test report for a SKU that is still selling forty units a week.

Build the register where the products already are. Shopify metafields are free and take about an hour to set up.

Setting It Up

1. In Shopify admin go to Settings, Custom data, Products and select Add definition.
2. Create Mandatory standard as a single line text field. Populate it with the exact standard name, or the words none applicable. Never leave it blank, because blank is indistinguishable from unchecked.
3. Create Compliance evidence as a File field so the test report PDF attaches directly to the product record.
4. Create Label status as a single line text field with a short controlled vocabulary: sewn in, printed, on page, missing.
5. Create Next compliance review as a Date field. Set it twelve months out for anything with a standard attached.
6. Create Supplier batch reference as a single line text field, so a recall can be scoped to a production run instead of the whole SKU.
7. Use Bulk edit from the Products list to fill all six columns across your catalogue in one sitting.
8. Save a filtered product view named Compliance gaps that shows any product where evidence is missing or the review date has passed.

Then add the operating rule that makes it work: a new product does not move to Active until those fields are filled. Put it in the product launch SOP and give whoever publishes products the authority to hold a launch.

Pair it with the free ACCC recall alerts. Subscribe at productsafety.gov.au and route them to a shared inbox rather than one person’s email. When a competitor in your category gets recalled for a component you also use, you want to know that week.

Step 6: Set the Two-Day Incident Clock Before You Need It

Here is the obligation almost no Australian founder knows about. If you become aware that a person has suffered serious injury, illness or death associated with a consumer good you have supplied, in Australia or overseas, you must notify the Commonwealth Minister within two days. The ACCC receives those reports.

Two days. Not two business days in most readings, and certainly not two days from when your lawyer finishes reviewing it. The clock starts when you become aware.

Failing to report is a criminal offence. The maximum fine is $16,650 for a company and $3,330 for an individual. Those numbers are small compared to a standards breach, but the reputational and evidentiary damage of a late report inside a bigger investigation is not.

The same two-day rule applies if you start a voluntary recall. You have two days to notify, and if you sold the product to customers overseas, ten days to tell them and give the ACCC a copy of that notice.

What to have ready before anything happens:

• A single named owner. One person decides whether an inbound complaint is a safety incident. Not a committee.
• A trigger definition your support team can apply. Any mention of burn, choking, swallowing, electric shock, laceration, hospital or emergency department escalates within the hour. Write it into your recall playbook triggers.
• An incident log with date and time of awareness recorded at the moment it happens. That timestamp is the only thing that proves you met the deadline.
• Pre-drafted holding copy for the product page and a saved Shopify draft that pulls the SKU from sale in under five minutes.

Roughly 650 consumer product recalls are notified to the ACCC every year, and only about half of the affected products come back. Excluding vehicles, that leaves around 1.7 million recalled items sitting in Australian homes, touching close to one in four households. Recall return rates are the reason the ACCC is unimpressed by brands that report late.

How the Six Steps Compound

Run individually, these look like six admin tasks. Run together, they change what your business is capable of.

Step 1 tells you which part of your catalogue carries risk, so you stop spreading attention evenly across 200 SKUs and concentrate it on the 60 that matter. Step 2 stops you fixing the label and leaving the build non-compliant, or the reverse. Step 3 converts supplier assurances into documents you can actually produce when asked.

Steps 4 and 5 are where this starts paying you back. Once the register exists, compliance stops being a memory exercise and becomes a field on a product record, which means it survives staff turnover, agency changes and your own bad weeks. Step 6 means that on the day something does go wrong, you are executing a plan instead of writing one at eleven at night.

There is a commercial payoff too, and it is not small. The ACCC has named unsafe products on online marketplaces as a priority and has already commenced Federal Court proceedings against Amazon Australia over button batteries in children’s backpacks. Marketplace controls and takedown speed are tightening. Brands that can produce compliance evidence on request will keep their listings live while competitors get delisted mid-quarter with no warning and no appeal.

Compliance is not a legal cost. It is the thing that stops one consumer complaint turning into a delisting, a recall and a penalty in the same fortnight.

Your Pre-Launch Compliance Checklist

Copy this into your product launch SOP. Nothing goes Active until every line is answered.

• Which of the 50 mandatory standards applies to this product? Answer must name a standard or say none applicable.
• Does it carry a safety standard, an information standard, or both?
• Do we hold a dated test report from a recognised laboratory, naming the correct Australian standard and this exact style code?
• Do we hold a signed declaration of conformity from the manufacturer?
• Is the required warning wording on the product, on the packaging, and on the product page where the standard requires it?
• Is the label artwork approved against the prescribed wording, size and placement?
• Have we recorded the supplier batch reference so a recall can be scoped to a production run?
• Are the six compliance metafields populated on the Shopify product record?
• Is a review date set twelve months out?
• Does the support team know the escalation triggers, and does one named person own the two-day reporting decision?

If you sell kids products, toys, cosmetics, apparel, furniture or anything containing a coin cell battery, run this against your existing catalogue before you run it on the next launch. The exposure you already carry is bigger than the exposure you are about to add.

Inside eCommerce Circle, Protection is one of the ten pillars we work on with every member, and product compliance is the part founders discover far too late. If you want a second opinion on where your catalogue sits, let’s talk.

This article is general information for Australian Shopify operators and is not legal advice. Mandatory standards change. Always check the current standard at productsafety.gov.au or speak to a lawyer before relying on any of it.