Get Resource

Pull up your California packaging invoice for this year. There is a new line on it: an extended producer responsibility charge billed under six flat material rates, and the number on that line is not the real one. It is an interim fee, the state's placeholder while the actual formula that decides what you owe from 2027 onward sits in draft rulemaking. Circular Action Alliance wants California EPR packaging fees 2026 paid now and the certainty supplied later, and that order of operations should bother every producer writing the check.

This is not a uniquely Californian habit, and it is not a uniquely American one either. Oregon billed a full, permanent rate from day one, or permanent as these things go, and California billed a number first and wrote the rules around it after. That gap between the two approaches is the whole story here.

When Do California EPR Packaging Fees 2026 Start?

California began invoicing extended producer responsibility fees on packaging in 2026 using six flat material rates, while the CMC formula that will set the real 2027 price per category is still in draft rulemaking, not settled law.

This is not happening in isolation. The UK's Plastic Packaging Tax rose to £228.82 per tonne on packaging under 30% recycled content from 1 April 2026, up from £223.69, according to RÖDL. Fee-first, rules-later is becoming the default move, the same sequencing that showed up when the EU's PPWR and the wider US EPR patchwork both went live ahead of their own enforcement guidance.

The defensible read: California isn't sloppy, it's impatient. Waiting for a finished CMC formula before collecting anything meant another year of zero funding for the recycling infrastructure the fee exists to pay for. The less defensible part is asking producers to budget against a number that can still move, exactly the redesign math covered in where sustainable packaging technology is heading in 2026.

Run the numbers state by state and the spread sharpens, and the list of states is nowhere near finished. Maryland's fees don't start until 2028 at the earliest. Minnesota's reimbursement floor lands February 2029. Washington hasn't set a date. A national brand can pay full freight in Oregon while owing nothing in three other states for years yet. EPR Atlas's fee tracker, current through September 2026, puts the numbers below side by side. Whether the final CMC rate eventually lands above or below this interim number is genuinely unclear, and anyone who claims certainty there is guessing.

That exemption line matters more than it looks. A brand shipping a modest volume in standard corrugate can sit comfortably under it and owe nothing, right up until one high-volume SKU or a new retail partner pushes total packaging weight over, at which point the whole catalog becomes reportable at once, not just the product that tipped the scale.

California vs. Oregon: What You're Actually Paying

California's interim fee and Oregon's fully finalized rate are not the same instrument: one is a placeholder pending 2027 rulemaking, while the other is the number producers already budget against for every pound they ship. The table below is what actually changes your invoice.

That gap between formats isn't a rounding error, and it's why packaging redesign belongs in the same meeting as compliance budgeting. Treat California's 2026 number as a floor, not a ceiling.

Who Pays Extended Producer Responsibility Packaging Fees?

The producer of record, meaning whoever's brand name sits on the package, owes California, Oregon, and Colorado's EPR fees directly, and retailers or contract manufacturers aren't on the hook unless a contract says otherwise.

EPR Packaging Compliance 2026: Who's Exempt

Treating this as one national EPR program is the wrong move, and plenty of compliance teams still make it. Exemption isn't automatic either: most programs count packaging weight across the whole catalog, not per SKU, so a dozen small product lines can cross the threshold on aggregate even when no single product looks heavy.

The bigger friction point is timing, not the rate itself. Producers are filing and paying against a number regulators openly admit isn't final, echoing what happened when the EU's Cyber Resilience Act reporting deadline went live months before its own enforcement guidance fully settled.

• Check aggregate packaging weight across the whole catalog, not per product.
• Confirm which entity in your supply chain is the legal producer of record.
• Don't lock in a 2027 packaging redesign budget off the 2026 interim rate alone.

If you already have a 2026 invoice with an EPR line on it, don't file it away as this year's number and move on. Pull your packaging bill of materials this week, run each material through EPR Atlas's per-pound tracker for every state you ship into, and flag anything in laminate or flexible plastic before California's CMC rulemaking closes the gap between interim and final.

The vulnerability report lands on a Friday afternoon. Someone on a security mailing list has proof that a bug in your firmware is being exploited in the wild, on customer devices, right now. Before 11 September 2026 that started a conversation with engineering. After it, it starts a stopwatch. Cyber Resilience Act compliance turns that moment into a filing deadline measured in hours, and the clock does not care that your incident lead is on a plane.

Why Does The 11 September Deadline Matter?

The 11 September 2026 date matters because it is the first Cyber Resilience Act obligation with real enforcement behind it, arriving well ahead of the full application of the Act at the end of 2027.

The mechanism is narrower than the headlines suggest. You file once, through the CRA Single Reporting Platform, to the computer security incident response team in the country where your main establishment sits, and that team passes it on to every other CSIRT where the product is sold. ENISA sees it at the same time. One filing, one platform, twenty-seven markets covered. Set against the patchwork most manufacturers already handle under other EU rules, including the transparency duties that came into force under the EU AI Act in August, this part is a real simplification.

The common advice right now is to wait for the harmonised standards before doing anything. That advice is wrong for reporting. Wrong for most of the Act, actually, but reporting is where it costs you soonest. Standards govern how you demonstrate that a product meets the essential requirements, and those obligations arrive more than a year later. Article 14 reporting does not wait for a standard. It needs a named person, a monitored inbox and a decision rule about what counts as evidence of exploitation, all of which you can build this month.

Cost is where this stops being an engineering conversation. The European Commission's 2022 impact assessment, the document that underpins the Act, priced compliance at roughly 2% of the €1.485 trillion of EU turnover the rules touch. That is the same order of magnitude producers found when packaging EPR reporting landed across seven US states this year, and the pattern rhymes. A rule written for accountability produces, first, a data collection problem.

Look at the development uplift on its own. It is not a fee you pay at the end, and it is not something a certification body sells you. It is threat modelling, dependency hygiene, a signed update channel and someone whose job is to say no to a shipping date. Firms already doing that will barely feel the Act. Firms treating security as a pre-launch audit will find that the money was never the hard part.

What Cyber Resilience Act Compliance Costs

The Act charges a manufacturer twice, once to prove a product is secure before it ships and then continuously for its whole supported life, which is why the assessment fee everyone quotes understates the bill.

The numbers below are the ones a finance lead asks for first. Two of them are choices rather than fixed costs, namely the assessment route you take and how long you commit to supporting the product.

Read the fines rows twice. Each tier is an amount or a percentage of worldwide turnover, whichever is higher, so the ceiling scales with the company rather than with the product. A small firm's exposure sits near the cash figure. A large one's does not, and that asymmetry is deliberate.

How Do Manufacturers Comply Without Tripping Up?

Manufacturers comply by deciding now who files, from which legal entity, and on what evidence, because most first-year failures will be procedural rather than technical: the right facts, reported by the wrong entity, after the window closed.

Start with the definition, because it is doing more work than people expect. A vulnerability counts as actively exploited when there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. Reliable evidence, not a proof of concept, and not a scanner finding. A severe incident is one affecting the product's ability to protect sensitive data or functions, or one that has led to malicious code being introduced or executed. Both definitions are broad enough that your triage rule matters more than your detection tooling.

Small manufacturers feel this hardest, for the same reason they felt AI adoption hardest: the fixed cost of doing something properly does not shrink with headcount. The arithmetic in the real costs and honest ROI of AI agents for small business has the same shape here. What nobody can tell you yet is how proportionately enforcement will land on a small firm whose exposure arrived through an unmaintained dependency it did not write. The Act has language for open source stewards. Whether a market surveillance authority reads that language generously in year one is a guess, and the likelier outcome is that early enforcement targets firms that ignored a report rather than firms that filed a clumsy one.

• End-of-life components. If a dependency stopped receiving fixes, you inherit the reporting duty for whatever it does next.
• Entity confusion. The filing comes from the manufacturer, which in a group structure is often not the company whose name sits on the support portal.
• Clock start. The window opens when you become aware, not when you finish investigating.
• Contract gaps. Suppliers who owe you nothing on disclosure timing will quietly consume a window you cannot extend.

If you make anything with software in it and sell it in Europe, the useful step this week is small. Find out which legal entity is the manufacturer, and give that entity a monitored address a CSIRT filing can come from. Most of the rest can wait a month. That cannot.

The pallet shipped in June. The bill for it arrived in a completely different shape: a producer registration number, an annual report with a hard filing date, and a fee schedule keyed to the exact multi-layer laminate somebody specified back in 2019. On 12 August 2026 the European Union's Packaging and Packaging Waste Regulation began to apply, and seven US states already had live programs pulling data from producers. Packaging quietly stopped being a procurement line and became a filing obligation.

Why It Matters

Start with what is enforceable right now, because that is a much shorter list than the trade press suggests. PPWR's first tranche is design and paperwork. Every unit has to be recyclable. Heavy metals are capped across lead, cadmium, mercury and hexavalent chromium. Material composition travels on the pack as a pictogram now, not buried in a spec sheet. Producers must appear in a national register before anything is sold, distributors verify that they did, and online marketplaces assess the same evidence before listing. Brussels ran the identical staging pattern it used for the EU AI Act obligations that went live earlier this month: transparency duties first, the expensive structural rules years later.

The American side is messier, and messier is more expensive. Seven states now run packaging EPR, and 31 May 2026 dragged annual producer reports and pre program simplified reports into the same fortnight for six of them. That single clustered date is the part most teams underestimated. A filing is not a sustainability report. It wants unit counts, material weights and format detail per SKU, which means the material substitutions that have been reshaping supply chains since 2024 now have to be documented at the pack level rather than described in a slide.

And here is where the money actually sits. Eco-modulation means the fee is set by how hard your format is to recycle, not by how much of it you ship. Resource Recycling's April 2026 read of Colorado's interim base dues put more than $1.50 a pound between the cheapest and the most punished format, which is a bigger swing than most packaging teams have ever seen on a raw material line. So the cheapest option on the purchase order stops being the cheapest option on the year. It is the same shape as AI unit prices collapsing while enterprise bills climbed: the per unit number improves, the invoice does not.

The penalty figure is the one that changes behaviour, and it changes it in an unhelpful direction. Because exposure accrues daily rather than per filing, a late or bounced submission turns into a running meter instead of a fine you can budget once and forget. That pushes teams toward filing something defensible on time rather than filing something accurate, and regulators have already started sending submissions back where the numbers do not line up. Nobody has built the audit capacity to catch that at scale yet.

What Actually Changed, Line By Line

Below is the part worth printing and taping to a wall, because the obligations arrived from four different directions and none of them share a vocabulary. Read it as a scope check rather than a calendar.

Read that table again and notice how little of it is about recycling. Most of it is about evidence: who holds it, and how fast it can be produced when a program office asks. The calendar underneath is just as lopsided.

Four fixed points on the compliance calendar, running from California's source reduction plans through to the EU's single use bans at the start of 2030.

Friction Points

The standard advice this year is to hold off on redesign until the fee schedules settle. That advice is wrong, and it is wrong for a boring reason: the lead time on a format change is longer than the gap between fee announcements. Requalifying a laminate, revalidating a seal, retooling a line and clearing a customer's own spec review runs past a year in most categories. Wait for certainty and you will be paying the punitive rate through the whole requalification window you could have started in 2026.

The second problem is that eco-modulation is being sold as a recycling policy when it behaves like an industrial policy. That is my read, not a finding, and it is genuinely unsettled. If the fee gap is large enough to move material choice, it works. If it is small enough to pass through to the shelf price, it just becomes a consumption tax with extra paperwork, which is roughly what happened to every compliance regime that ended up squeezing whoever actually files. Nobody has a clean answer yet. Or rather, nobody outside the producer responsibility organisations does, and they are not publishing the elasticity data.

Then there is the software question. Compliance platforms are being pitched hard right now, and the honest arithmetic looks a lot like the real cost and ROI maths for small business automation: the tool is cheap, the data cleanup around it is not. Watch for these:

• Supplier specification gaps. If your vendors cannot give you gram weights and layer structures per component, no platform will fix that for you.
• SKU level mapping. Programs want packaging tied to units sold in that jurisdiction, which most ERP setups do not natively express.
• Claims already printed. Artwork approved before October carries recyclability wording that becomes a legal exposure the moment enforcement starts.
• Jurisdiction drift. An injunction in one state does not pause the filing clock in the other six.

Pull your top twenty packaging formats by volume this week and score each one on two columns only: can a supplier give you the full material breakdown by weight, and would you defend its recyclability claim in front of a state program office. Anything scoring badly on both is your 2027 budget problem, and it is cheaper to find it now than in a bounced filing.

Related: California's 2026 EPR packaging fees