Ali Nadhaif
Ali Nadhaif, Cybersecurity Engineer
EPR Registration Numbers:
What Amazon Sellers Need to Know in 2026
Extended Producer Responsibility (EPR) is now one of the most common reasons Amazon sellers lose their listings in the EU. If you sell products with packaging, electronics, or batteries in Germany, France, or other EU countries, you need valid EPR registration numbers — and Amazon is actively enforcing this. This guide covers everything you need to know about EPR in 2026: which registrations you need, how to get them, and how to avoid listing suspensions.
1. What Is EPR and Why Does It Matter?
Extended Producer Responsibility (EPR) is an environmental policy that requires producers and sellers to take financial responsibility for the end-of-life disposal of their products and packaging. In the EU, this means registering with national compliance schemes, reporting the quantities of packaging, electronics, and batteries you place on each market, and paying fees to fund recycling and waste management.
For Amazon sellers, EPR is not optional. Since 2022, Amazon has been requiring valid EPR registration numbers for sellers in Germany, and enforcement has expanded to France and other EU countries. Without valid numbers displayed in your Seller Central account, Amazon will deactivate your listings — sometimes without warning.
EPR obligations apply to every seller who places products on the market, regardless of where the seller is based. If you ship products to an Amazon warehouse in Germany or France, or if you sell to customers in those countries, you are considered a producer under EPR law and must register.
2. The Three Parts of EN 18031
The EPR registrations you need depend on what you sell and where you sell it. There are three main categories of EPR obligations that affect Amazon sellers: packaging EPR, WEEE (electronics waste) EPR, and battery EPR. Each country has its own registration system and requirements.
Understanding which registrations apply to your products:
-
EN 18031-1: Network Security (RED Art. 3.3(d)) Protects network infrastructure from harm. Applies to any device connecting to the internet. Covers access control, secure communications, software update mechanisms, and resilience against attacks. -
EN 18031-2: Privacy Protection (RED Art. 3.3(e)) Safeguards personal data and user privacy. Applies to devices that process personal information — wearables, cameras, voice assistants, health monitors. Covers data minimization, encryption, consent mechanisms, and secure storage.
-
EN 18031-3: Fraud Prevention (RED Art. 3.3(f)) Prevents unauthorized financial transactions. Applies to devices involved in monetary exchanges — payment terminals, connected vending machines, smart meters with billing. Covers transaction integrity and authentication.
-
Most IoT devices need Part 1 at minimum If your device connects to any network, EN 18031-1 applies. Most consumer IoT products also trigger Part 2 due to personal data processing.
-
Multiple parts can apply simultaneously A smart payment terminal would need all three parts. A connected thermostat that collects user data needs Parts 1 and 2. Identify your product's functions to determine scope.
3. Key Security Requirements
Each EU country administers its own EPR scheme with different registration portals, compliance organizations, and reporting deadlines. The two most critical markets for Amazon sellers are Germany and France, as both have strict enforcement and Amazon actively checks registration numbers.
Germany requires registration in LUCID (verpackungsregister.org) for packaging, with the EAR Foundation (stiftung-ear.de) for electronics, and with the Umweltbundesamt for batteries. France requires registration with multiple eco-organisations depending on the product category — Citeo for packaging, ecosystem for electronics, and Corepile or Screlec for batteries.
4. How to Register Step by Step
The registration process varies by country and category, but follows a general pattern. First, determine which EPR categories apply to your products. Then register with the relevant national authority or eco-organisation. Finally, link your registration numbers to your Amazon Seller Central account and begin reporting quantities.
Register at verpackungsregister.org with your company details, product categories, and estimated packaging volumes. You will receive a LUCID registration number. Then contract with a licensed dual system provider (e.g., Der Grüne Punkt, Interseroh) to handle recycling obligations. Enter your LUCID number in Amazon Seller Central under the EPR compliance section.
Register at stiftung-ear.de with your product details, brand name, and categories. Non-EU sellers need an Authorised Representative for ElektroG registration. Processing takes 4-8 weeks. Once registered, you receive a WEEE registration number to enter in Seller Central.
Register with the Umweltbundesamt (UBA) for any product containing batteries. Join a battery take-back scheme (GRS Batterien or similar). This applies to all battery types including built-in lithium batteries in electronics.
France requires separate registrations for packaging (Citeo or Léko), electronics (ecosystem), batteries (Corepile or Screlec), and furniture if applicable. Each eco-organisation has its own portal and fee structure. You receive a unique producer number (UIN) for each category.
Important: Registration alone is not enough. In Germany, you must also contract with a licensed dual system provider (like Der Grüne Punkt or Interseroh) for packaging, and submit annual volume reports. Failure to maintain active contracts or report quantities will invalidate your registration and trigger Amazon listing removals.
5. Common Mistakes That Get Sellers Blocked
Many Amazon sellers make preventable mistakes when handling EPR compliance. The most common errors lead to listing suspensions, fines, or both. Understanding these pitfalls upfront can save you significant time and money.
In Germany, having a LUCID number is only half the requirement. You must also have an active contract with a licensed dual system provider. Many sellers register in LUCID but skip the dual system contract, which makes their registration invalid. Amazon can detect this because the LUCID database shows contract status.
Registering under the wrong product or packaging category is a common error that can result in underpayment of fees and compliance violations. For example, registering plastic packaging as paper, or categorizing a consumer electronic device under the wrong ElektroG category. Authorities audit registrations and incorrect categorization can result in fines.
EPR registration is not a one-time event. Germany requires annual quantity reports by May 15, and your dual system contract must be updated with actual volumes. France has its own reporting calendar. Missing these deadlines can invalidate your registration and trigger listing removals on Amazon.
6. How to Prepare Your Product
Getting registered is only the first step. Ongoing compliance requires regular reporting, timely fee payments, and staying current with regulatory changes. Each EPR scheme has its own reporting calendar — Germany requires annual reports by May 15, while France has different deadlines depending on the eco-organisation.
Recommended compliance maintenance steps:
-
Determine which parts of EN 18031 apply Map your product's functions to the three parts. Does it connect to a network? Process personal data? Handle financial transactions? This determines your compliance scope.
-
Conduct an internal security review Before engaging an external assessor, review your product against the standard's requirements. Check authentication, encryption, update mechanisms, and data handling. Identify obvious gaps early.
-
Engage a qualified assessment provider Work with a team that has hands-on experience with EN 18031 testing. They should be able to perform gap analysis, penetration testing, and help you build the required technical documentation.
-
Build your technical file Compile your threat model, risk assessment, test reports, security architecture documentation, and Declaration of Conformity. This file must be maintained and available for market surveillance authorities for 10 years.
7. EN 18031 vs ETSI EN 303 645
EPR and GPSR are separate regulatory frameworks that both affect Amazon sellers, but they serve different purposes. GPSR (General Product Safety Regulation) focuses on product safety — requiring an EU-based responsible economic operator, proper labelling, and safety documentation. EPR focuses on environmental responsibility — requiring producers to fund the recycling and disposal of their products and packaging.
You need to comply with both. Having an EU Authorised Representative for GPSR does not satisfy your EPR obligations, and having EPR registration numbers does not satisfy GPSR requirements. Amazon checks for both independently. EUUK Compliance can handle both requirements under a single subscription, ensuring you have complete coverage.
8. Key Dates and Timeline
EPR enforcement has accelerated significantly in 2025-2026. Amazon now performs automated checks of EPR registration numbers against national databases. German authorities have increased inspections of online marketplaces, and France has implemented new reporting requirements. Key developments for 2026:
-
January 2022: RED Delegated Acts Published The European Commission published delegated regulations activating Articles 3.3(d), 3.3(e), and 3.3(f) of the Radio Equipment Directive for cybersecurity, privacy, and fraud prevention.
-
February 2025: EN 18031 Published in Official Journal The harmonized standard EN 18031 (Parts 1-3) was formally cited in the Official Journal of the EU, providing a presumption of conformity pathway.
-
August 1, 2025: Compliance Becomes Mandatory All new radio equipment placed on the EU market must comply with the cybersecurity requirements. Products already on the market before this date are not affected.
-
December 2027: Cyber Resilience Act Applies The CRA introduces additional cybersecurity requirements that build on RED. Products already compliant with EN 18031 will have a significant head start on CRA compliance.
-
Ongoing: Market Surveillance EU market surveillance authorities can request technical documentation and test products at any time. Non-compliant products face recall, fines, and market withdrawal.
9. Frequently Asked Questions
-
Can I self-certify compliance with EN 18031? For most products, yes. The manufacturer performs an internal production control assessment (Module A) and issues a Declaration of Conformity. However, some higher-risk product categories may require third-party involvement under the Cyber Resilience Act.
-
Does EN 18031 apply to Bluetooth-only devices? Yes. EN 18031 applies to all radio equipment within scope of the RED delegated acts. Bluetooth devices that connect to networks or process personal data are covered.
-
What if my product is already ETSI EN 303 645 certified? You have a good foundation but will need a specific EN 18031 gap analysis. The standards overlap significantly but EN 18031 has additional and more specific requirements in several areas.
-
How long does EN 18031 assessment take? A typical assessment takes 4-8 weeks depending on product complexity and current security maturity. Products with significant gaps may need additional time for remediation and retesting.
-
Do I need to test every product variant? Not necessarily. If product variants share the same hardware platform, firmware, and communication stack, a single assessment may cover the product family. Differences in security-relevant features would require additional assessment.
-
What documentation do I need to maintain? You must maintain a complete technical file including: risk assessment, security architecture documentation, test reports, Declaration of Conformity, and user instructions regarding security features. This documentation must be available for 10 years after the last product is placed on the market.