# Compliance Product Guidance

[![npm](https://img.shields.io/npm/v/@cleo-labs/skills-mcp?label=%40cleo-labs%2Fskills-mcp)](https://www.npmjs.com/package/@cleo-labs/skills-mcp)
[![npm downloads](https://img.shields.io/npm/dm/@cleo-labs/skills-mcp)](https://www.npmjs.com/package/@cleo-labs/skills-mcp)
[![MCP server](https://img.shields.io/badge/MCP-server-blue)](./mcp-server)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![Skills](https://img.shields.io/badge/skills-52-blue)](./skills)
![GitHub stars](https://img.shields.io/github/stars/Cleo-Labs-IA/skills_library?style=social)
[![Cleo Labs](https://img.shields.io/badge/built%20by-Cleo%20Labs-0008CF)](https://cleolabs.co)
[![Powered by Cleo Legal API](https://img.shields.io/badge/powered%20by-Cleo%20Legal%20API-0008CF)](https://legaldata-public.cleolabs.co)
[![CI](https://github.com/Cleo-Labs-IA/skills_library/actions/workflows/mcp-server.yml/badge.svg)](https://github.com/Cleo-Labs-IA/skills_library/actions)

**Read in your language:** [English](./README.md) · [Français](./README.fr.md) · [Español](./README.es.md) · [Deutsch](./README.de.md) · [日本語](./README.ja.md) · [简体中文](./README.zh.md)

AI compliance copilot for physical products — REACH, FDA, CE, customs, and 24 more regulations, inside your Claude Code / Cursor / Codex.

## What is this?

Selling a physical product across borders means navigating 25,000+ regulations spread across 49 countries: substance bans you've never heard of, labels that change every quarter, customs codes that move duty rates by 12%, marketplace rules that delist you overnight. Most small brands learn this the expensive way — at the border, or after Amazon takes the listing down.

Compliance Product Guidance is **52 production-grade skills + 2 MCP servers** that teach an AI agent how to answer one question: *"What do I actually need to do to sell this product in this market?"*

The hero skill is `product-compliance`. You paste an ingredient list (or BOM, or formula), pick your target markets, and it runs:

```
ingredients  →  CAS resolution  →  13 regulatory databases  →
verdict per substance per market  →  Revenue-at-Risk calculation
```

Sample output:

```
Retinol 0.4%   EU: BLOCKED (Annex III cap 0.3% face products, eff. Nov 2025)   €/year at risk: ~€180k
Retinol 0.4%   US: OK (no federal cap; CA Prop 65 warning not required at this dose)
Retinol 0.4%   UK: BLOCKED (UK Cosmetics Reg mirrors EU Annex III)
Retinol 0.4%   JP: REVIEW (quasi-drug threshold — needs MHLW review)
```

Same pattern works for an electronics BOM (RoHS, REACH SVHC, CE/FCC, battery reg), a food recipe (allergens, novel foods, FDA FSMA), a textile (PFAS, fiber labeling, OEKO-TEX), or any of the 23 product verticals below.

## Install

```bash
# As an MCP server (fastest)
npx -y @cleo-labs/skills-mcp@latest

# As Claude Code skills (file-based)
git clone https://github.com/Cleo-Labs-IA/skills_library.git ~/.claude/skills/comply
```

The npm package is the one-line install for **Claude Desktop, Cursor, Continue, Zed, and any MCP-compatible client**. The skills appear as native MCP resources (`skill://<name>`), parameterized prompts, and three structured tools (`list_skills`, `find_skill`, `read_skill`).

Drop this into your client config:

```json
{
  "mcpServers": {
    "cleo-skills": {
      "command": "npx",
      "args": ["-y", "@cleo-labs/skills-mcp@latest"]
    }
  }
}
```

For **Claude Code**, the `git clone` variant drops the skills into `~/.claude/skills/comply` and they auto-trigger when you ask about substances, labels, customs, markets, or recalls — no manual invocation needed.

### Manual copy

```bash
git clone https://github.com/Cleo-Labs-IA/skills_library.git
cp -r skills_library/skills/* ~/.claude/skills/
```

### Cursor / Codex / other Claude-skills-compatible runtimes

Point your skills directory at `skills_library/skills/`. Each skill is a self-contained folder with a `SKILL.md` plus references — runtime-agnostic by design.

See [`mcp-server/README.md`](./mcp-server/README.md) for full MCP setup (Docker, per-client examples) and [INSTALL.md](./INSTALL.md) for the 30-second version and [EXAMPLES.md](./EXAMPLES.md) for real prompts.

## The 52 skills

### Core compliance engine (6)

The skills that touch your actual product.

| Skill | What it does |
|-------|--------------|
| `product-compliance` | **Hero skill.** Full substance check across 13 databases, verdict per market, Revenue-at-Risk. |
| `substance-screening` | Deep ingredient/material screening: INCI→CAS, concentration margins, per-jurisdiction verdicts. |
| `labeling-compliance` | Country-specific labels: INCI, allergens, warnings, CE/UKCA marks, multi-language rules. |
| `testing-certification` | Required tests/certs per product per market (CPSR, CE, FCC, UL, EN 71, HACCP). Lab selection, cost, timeline. |
| `claims-substantiation` | Validate marketing claims: EU 655/2013, FDA drug-vs-cosmetic, FTC, green claims. |
| `market-entry-checklist` | Step-by-step: classify → regulations → substances → labels → certs → customs → notification. |

### Cross-market intelligence & action (14)

The skills that move you from "we have a problem" to "we shipped it."

| Skill | What it does |
|-------|--------------|
| `regulatory-intelligence` | Signal monitoring: substance bans, labeling changes, recalls, enforcement dates. |
| `multi-jurisdiction-scan` | Parallel scan across all target markets. RED/ORANGE/YELLOW/GREEN per market. One agent per jurisdiction. |
| `customs-and-trade` | HS code, duty, landed cost, dual-use, sanctions. |
| `hs-classification` | Customs nomenclature discipline: classify via GRI from part number + description + composition, reconcile codes across national tariffs, BTI rulings, multi-signal (HS + UN code + end-use) -> route to duty/controls/restrictions. |
| `compliance-audit-sprint` | Pre-launch sprint: identify → map → check → verify → estimate cost. Dispatches parallel agents. |
| `compliance-remediation` | Fix issues to unblock market entry: reformulate, relabel, test, certify. |
| `evidence-blitz` | Parallel gather of compliance evidence for audit, certification, or marketplace listing. |
| `responsible-person` | Set up EU RP, UK RP, US Agent, EAEU AR, China NMPA holder. Mandate letters, costs, obligations. |
| `packaging-compliance` | EPR per EU member state, PPWR transition, SUP, plastic tax, US state EPR. |
| `recall-response` | Severity assessment, authority notification (EU 10 days, US 24h, UK 3 days), close-out. |
| `product-safety-incident` | CPSC 24h, EU Safety Gate 10-day, risk matrix, root cause, consumer comms. |
| `import-export-docs` | Commercial invoice, packing list, EUR.1/REX/USMCA, DG declarations, Incoterms 2020. |
| `marketplace-compliance` | Required docs per platform per category: Amazon EU GPSR+EPR, Walmart, Shopify, Etsy, TikTok Shop. |
| `regulatory-calendar` | Notification renewals, cert expiry, upcoming enforcement (GPSR, CRA, MoCRA GMP, EUDR, ESPR). |

### Cross-cutting regulatory regimes (6)

Horizontal regimes that hit any product, whatever the category — the 2024-2027 EU regulatory wave enterprise buyers (LVMH, Chanel, Schneider) ask about first.

| Skill | What it does |
|-------|--------------|
| `cybersecurity-compliance` | Connected/IoT/digital products: CRA (EU) 2024/2847, RED cyber 2022/30 + EN 18031, NIS2, UK PSTI, US Cyber Trust Mark, ETSI EN 303 645, IEC 62443, SBOM, vuln disclosure. |
| `digital-product-passport` | DPP across ESPR 2024/1781, Battery passport 2023/1542, textile + construction, data carriers (QR / GS1 Digital Link / NFC), EU DPP registry. |
| `battery-compliance` | EU Battery Reg 2023/1542 (portable/LMT/EV/industrial/SLI): carbon footprint, recycled content, due diligence, passport (18 Feb 2027), removability, transport, EPR. |
| `dangerous-goods-transport` | Hazmat transport: 9 UN classes, IATA DGR / IMDG / ADR / 49 CFR, lithium UN 3480/3481/3090/3091 + UN 38.3, packing groups, DG declaration. |
| `responsible-sourcing` | Conflict minerals 3TG (EU 2017/821, Dodd-Frank 1502, CMRT), EUDR commodities, forced labour (UFLPA, EU 2024/3015), CSDDD, CITES exotic materials. |
| `packaging-traceability` | Product ref / batch / formula code -> full packaging BOM: suppliers, per-material quantities, primary/secondary/tertiary, origin, recyclability, recycled content. Feeds EPR, DPP, claims. |

### 23 industry verticals

Deep, regulation-specific playbooks per product category:

`cosmetics-compliance` · `food-compliance` · `electronics-compliance` · `textile-compliance` · `toy-compliance` · `alcohol-spirits-compliance` · `supplement-compliance` · `jewelry-compliance` · `medical-device-compliance` · `pet-product-compliance` · `automotive-aftermarket-compliance` · `agricultural-compliance` · `tobacco-vape-compliance` · `sporting-goods-compliance` · `baby-children-products-compliance` · `household-chemicals-compliance` · `candle-fragrance-compliance` · `sustainability-compliance` · `firearms-compliance` · `optical-eyewear-compliance` · `baby-formula-compliance` · `herbal-medicine-compliance` · `professional-cosmetics-compliance`

Each vertical covers the full regulatory stack for that category across EU, US, UK, Canada, Japan, Korea, China, ASEAN — not a summary, the actual articles, fee structures, notification portals, and transition dates.

### Reference & integration (3)

`compliance-frameworks-ref` (regulation reference index) · `compliance-mcp-tools` (Cleo Legal API + Cleo Insight integration patterns) · `compliance-reporting` (per-product per-market matrix, exportable).

## The MCP moat

Most skill libraries are static knowledge — they age the day they ship. This one is wired to live data via two MCP servers:

- **Cleo Legal API** — customs classification, substance lookups, duty calculation, landed cost, sanctions screening. The data backbone for `product-compliance`, `customs-and-trade`, and `substance-screening`.
- **Cleo Insight** — live regulatory signals across **25,000+ regulations in 49 countries**. The signal feed for `regulatory-intelligence`, `multi-jurisdiction-scan`, and `regulatory-calendar`.

**The skills work standalone** — without MCP, they fall back to web search and file-based evidence with the same prompt structure. With MCP enabled, the same prompts get back current data instead of best-effort lookups.

## Multi-agent by default

The Tier 3 action skills dispatch parallel agents via `superpowers:dispatching-parallel-agents`:

- `compliance-audit-sprint` — one agent per target market
- `multi-jurisdiction-scan` — one agent per jurisdiction cluster
- `evidence-blitz` — one agent per document category

A multi-market launch audit that took a regulatory consultant 3 weeks runs in ~12 minutes.

## Built for

- Indie founders and small product teams (1–10 people) launching physical goods
- D2C brands expanding from one market to three, five, or ten
- Marketplace sellers fighting delisting (Amazon GPSR, EPR, MoCRA)
- Operators handling REACH, CLP, FDA MoCRA, Prop 65, GPSR, CRA, EUDR, CE/UKCA/FCC, EN 71, and the long tail
- Regulatory consultants who want first-pass screening done in minutes, not days

## Not built for

We're not trying to replace your specialists. **We get you 80% of the way there so your specialist can focus on the hard 20%.**

- We don't replace a **CE Notified Body** audit (Class IIa+ medical devices, Cat III PPE, etc.)
- We don't replace a **Cosmetic Product Safety Assessor** signing your CPSR
- We don't replace a **licensed customs broker** for actual border clearance
- We don't replace **legal counsel** for litigation, enforcement defense, or product liability
- We don't give legal advice. Always verify against official sources before a shipping decision.

## Why we built this

We're Anaëlle (CEO) and Naomie (CDO), the cofounders of [Cleo Labs](https://cleolabs.co). We started compliance work because we kept watching the same scene repeat: a small brand spends 14 months building a beautiful product, ships their first container into Rotterdam or Felixstowe, and gets it held at customs over a missing REACH dossier or an Annex III substance they didn't know was capped last quarter. A 40-foot container blocked at the EU border costs €15–40k in storage, demurrage, and rework before anyone touches the product itself.

The knowledge to prevent that exists. It just isn't where the founder is — it's locked in €800/hour consultant decks and 4,000-page regulation PDFs. So we put it where the founder is: in their AI agent. That's this repo.

## Examples

See [EXAMPLES.md](./EXAMPLES.md) for full walkthroughs (face cream in EU+UK, Bluetooth speaker in US+EU, chocolate to Japan, toy safety, Amazon EU evidence pack).

## Contributing

PRs welcome — especially new vertical playbooks, jurisdiction updates, and corrections to substance limits. Start with [CONTRIBUTING.md](./CONTRIBUTING.md) and [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md). Security issues: see [SECURITY.md](./SECURITY.md).

## License

MIT. See [LICENSE](./LICENSE).

## Disclaimer

> **This is compliance guidance, not legal advice.**
>
> The skills provide a starting point based on publicly available regulations. They do not replace a qualified regulatory consultant, Notified Body, safety assessor, customs broker, or legal counsel.
>
> Regulatory data (substance limits, enforcement dates, fee amounts, classification rules) changes constantly. Always verify critical information against the official source (EUR-Lex, FDA, gov.uk, MHLW, etc.) before making a business decision. Cleo Labs is not liable for decisions made on the basis of these skills.

---

Built by [Cleo Labs](https://cleolabs.co). Backed by the MARIA engine — 25,000 regulations, 49 countries, live.