Get Resource

The bill has one line you will read and one rule you will not be shown. The line is a rate per tonne. The rule is the awkward one: you can be made to register for plastic packaging tax even when your packs are clean enough to owe nothing. Few suppliers lead with that. And on 1 April 2027 the definition of "recycled" shifts under your feet.

Why does the plastic packaging tax still bite a compliant pack?

Because registration and payment are separate duties: you register once you handle enough plastic packaging components, and you pay only on components below 30% recycled plastic, so a compliant pack still carries filing duty.

GOV.UK's business guidance sets the registration trigger at 10 tonnes of finished plastic packaging components manufactured or imported. For a small importer, that means registering before you owe a penny. Rödl's briefing of 6 March 2026 makes the sharper point: registration is required even when no tax is due because every component clears the line. A compliant pack still comes with a return, a deadline and penalty exposure. Read our take on the EU packaging EPR rules that went live in August and you will see the same pattern: the paperwork arrives first, the cost second.

Now the number. GOV.UK puts the rate from 1 April 2026 at £228.82 a tonne, up from £223.69 a year earlier. The line is a cliff, not a slope. At 29% recycled content you pay the full rate on the whole component; at 30% you pay nothing. Set against the £200 of 2022, my own arithmetic from GOV.UK's rate history gives a rise of about 14% in four years, so budget the next April step before it lands. The same cliff logic runs through California's packaging fees invoiced ahead of final rules: regulators publish the bill first and the detail later.

Four numbers decide whether this is a paperwork problem or a cost problem: where the line sits, what a tonne costs, when registration starts and how long you keep proof.

The record-keeping duty is the one that outlasts everyone's memory. Staff move on, suppliers merge, and a certificate you cannot find is a claim you cannot make. Attach each delivery's declaration to the purchase order, not to someone's inbox.

So the useful question is not whether your pack is green. It is which side of the line each pack lands on, and what you can show HMRC to prove it. The table below separates the two.

Which packs owe tax, and which only owe paperwork?

A pack below the recycled line owes tax and paperwork, while a pack above it owes paperwork alone, provided you pass the registration threshold and can prove every recycled claim to HMRC when asked.

Read down the middle column and one pattern shows: the tax is binary, so the only lever you control is margin. Read the right column and a second one shows: the paperwork is where most of the exposure sits.

What changes for recycled claims on 1 April 2027?

From 1 April 2027, pre-consumer plastic waste no longer counts as recycled, and chemically recycled plastic must be proven by mass balance with third-party certification meeting HMRC's minimum standards.

HMRC released preparation guidance and minimum certification requirements on 28 August 2026, but detailed guidance is not expected until early 2027, according to Packaging Gateway. The rules finalise months before the deadline, and your supplier contracts will not wait for them. My opinion, and only that: a rule landing this late is one HMRC expects importers to absorb at their own cost, so do not hold your breath for a grace period. Our note on sustainable packaging technology and supply chains covers why suppliers rarely volunteer this detail.

Mass balance is an accounting method: a recycler tracks how much recycled feedstock enters a plant, then attributes that amount to output. Packaging Gateway's summary lists an attribution declaration per delivery or batch, six-year record retention, quarterly balancing and site-specific conversion factors. Fuel-use material is excluded from the calculation, so a supplier claim that counts fuel outputs cannot count toward your percentage.

• Ask what share of each supplier's recycled content is pre-consumer waste.
• No third-party certificate, no recycled claim.
• Get written confirmation that fuel outputs are excluded.
• File declarations by delivery, not by quarter.

This week, pull your last twelve months of plastic packaging tonnage, ask each supplier for its offcut share and the certifier's name, then decide by month-end: reformulate with a safe margin above the line, or pay the rate and document everything else.

Pull up your California packaging invoice for this year. There is a new line on it: an extended producer responsibility charge billed under six flat material rates, and the number on that line is not the real one. It is an interim fee, the state's placeholder while the actual formula that decides what you owe from 2027 onward sits in draft rulemaking. Circular Action Alliance wants California EPR packaging fees 2026 paid now and the certainty supplied later, and that order of operations should bother every producer writing the check.

This is not a uniquely Californian habit, and it is not a uniquely American one either. Oregon billed a full, permanent rate from day one, or permanent as these things go, and California billed a number first and wrote the rules around it after. That gap between the two approaches is the whole story here.

When Do California EPR Packaging Fees 2026 Start?

California began invoicing extended producer responsibility fees on packaging in 2026 using six flat material rates, while the CMC formula that will set the real 2027 price per category is still in draft rulemaking, not settled law.

This is not happening in isolation. The UK's Plastic Packaging Tax rose to £228.82 per tonne on packaging under 30% recycled content from 1 April 2026, up from £223.69, according to RÖDL. Fee-first, rules-later is becoming the default move, the same sequencing that showed up when the EU's PPWR and the wider US EPR patchwork both went live ahead of their own enforcement guidance.

The defensible read: California isn't sloppy, it's impatient. Waiting for a finished CMC formula before collecting anything meant another year of zero funding for the recycling infrastructure the fee exists to pay for. The less defensible part is asking producers to budget against a number that can still move, exactly the redesign math covered in where sustainable packaging technology is heading in 2026.

Run the numbers state by state and the spread sharpens, and the list of states is nowhere near finished. Maryland's fees don't start until 2028 at the earliest. Minnesota's reimbursement floor lands February 2029. Washington hasn't set a date. A national brand can pay full freight in Oregon while owing nothing in three other states for years yet. EPR Atlas's fee tracker, current through September 2026, puts the numbers below side by side. Whether the final CMC rate eventually lands above or below this interim number is genuinely unclear, and anyone who claims certainty there is guessing.

That exemption line matters more than it looks. A brand shipping a modest volume in standard corrugate can sit comfortably under it and owe nothing, right up until one high-volume SKU or a new retail partner pushes total packaging weight over, at which point the whole catalog becomes reportable at once, not just the product that tipped the scale.

California vs. Oregon: What You're Actually Paying

California's interim fee and Oregon's fully finalized rate are not the same instrument: one is a placeholder pending 2027 rulemaking, while the other is the number producers already budget against for every pound they ship. The table below is what actually changes your invoice.

That gap between formats isn't a rounding error, and it's why packaging redesign belongs in the same meeting as compliance budgeting. Treat California's 2026 number as a floor, not a ceiling.

Who Pays Extended Producer Responsibility Packaging Fees?

The producer of record, meaning whoever's brand name sits on the package, owes California, Oregon, and Colorado's EPR fees directly, and retailers or contract manufacturers aren't on the hook unless a contract says otherwise.

EPR Packaging Compliance 2026: Who's Exempt

Treating this as one national EPR program is the wrong move, and plenty of compliance teams still make it. Exemption isn't automatic either: most programs count packaging weight across the whole catalog, not per SKU, so a dozen small product lines can cross the threshold on aggregate even when no single product looks heavy.

The bigger friction point is timing, not the rate itself. Producers are filing and paying against a number regulators openly admit isn't final, echoing what happened when the EU's Cyber Resilience Act reporting deadline went live months before its own enforcement guidance fully settled.

• Check aggregate packaging weight across the whole catalog, not per product.
• Confirm which entity in your supply chain is the legal producer of record.
• Don't lock in a 2027 packaging redesign budget off the 2026 interim rate alone.

If you already have a 2026 invoice with an EPR line on it, don't file it away as this year's number and move on. Pull your packaging bill of materials this week, run each material through EPR Atlas's per-pound tracker for every state you ship into, and flag anything in laminate or flexible plastic before California's CMC rulemaking closes the gap between interim and final.

The vulnerability report lands on a Friday afternoon. Someone on a security mailing list has proof that a bug in your firmware is being exploited in the wild, on customer devices, right now. Before 11 September 2026 that started a conversation with engineering. After it, it starts a stopwatch. Cyber Resilience Act compliance turns that moment into a filing deadline measured in hours, and the clock does not care that your incident lead is on a plane.

Why Does The 11 September Deadline Matter?

The 11 September 2026 date matters because it is the first Cyber Resilience Act obligation with real enforcement behind it, arriving well ahead of the full application of the Act at the end of 2027.

The mechanism is narrower than the headlines suggest. You file once, through the CRA Single Reporting Platform, to the computer security incident response team in the country where your main establishment sits, and that team passes it on to every other CSIRT where the product is sold. ENISA sees it at the same time. One filing, one platform, twenty-seven markets covered. Set against the patchwork most manufacturers already handle under other EU rules, including the transparency duties that came into force under the EU AI Act in August, this part is a real simplification.

The common advice right now is to wait for the harmonised standards before doing anything. That advice is wrong for reporting. Wrong for most of the Act, actually, but reporting is where it costs you soonest. Standards govern how you demonstrate that a product meets the essential requirements, and those obligations arrive more than a year later. Article 14 reporting does not wait for a standard. It needs a named person, a monitored inbox and a decision rule about what counts as evidence of exploitation, all of which you can build this month.

Cost is where this stops being an engineering conversation. The European Commission's 2022 impact assessment, the document that underpins the Act, priced compliance at roughly 2% of the €1.485 trillion of EU turnover the rules touch. That is the same order of magnitude producers found when packaging EPR reporting landed across seven US states this year, and the pattern rhymes. A rule written for accountability produces, first, a data collection problem.

Look at the development uplift on its own. It is not a fee you pay at the end, and it is not something a certification body sells you. It is threat modelling, dependency hygiene, a signed update channel and someone whose job is to say no to a shipping date. Firms already doing that will barely feel the Act. Firms treating security as a pre-launch audit will find that the money was never the hard part.

What Cyber Resilience Act Compliance Costs

The Act charges a manufacturer twice, once to prove a product is secure before it ships and then continuously for its whole supported life, which is why the assessment fee everyone quotes understates the bill.

The numbers below are the ones a finance lead asks for first. Two of them are choices rather than fixed costs, namely the assessment route you take and how long you commit to supporting the product.

Read the fines rows twice. Each tier is an amount or a percentage of worldwide turnover, whichever is higher, so the ceiling scales with the company rather than with the product. A small firm's exposure sits near the cash figure. A large one's does not, and that asymmetry is deliberate.

How Do Manufacturers Comply Without Tripping Up?

Manufacturers comply by deciding now who files, from which legal entity, and on what evidence, because most first-year failures will be procedural rather than technical: the right facts, reported by the wrong entity, after the window closed.

Start with the definition, because it is doing more work than people expect. A vulnerability counts as actively exploited when there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. Reliable evidence, not a proof of concept, and not a scanner finding. A severe incident is one affecting the product's ability to protect sensitive data or functions, or one that has led to malicious code being introduced or executed. Both definitions are broad enough that your triage rule matters more than your detection tooling.

Small manufacturers feel this hardest, for the same reason they felt AI adoption hardest: the fixed cost of doing something properly does not shrink with headcount. The arithmetic in the real costs and honest ROI of AI agents for small business has the same shape here. What nobody can tell you yet is how proportionately enforcement will land on a small firm whose exposure arrived through an unmaintained dependency it did not write. The Act has language for open source stewards. Whether a market surveillance authority reads that language generously in year one is a guess, and the likelier outcome is that early enforcement targets firms that ignored a report rather than firms that filed a clumsy one.

• End-of-life components. If a dependency stopped receiving fixes, you inherit the reporting duty for whatever it does next.
• Entity confusion. The filing comes from the manufacturer, which in a group structure is often not the company whose name sits on the support portal.
• Clock start. The window opens when you become aware, not when you finish investigating.
• Contract gaps. Suppliers who owe you nothing on disclosure timing will quietly consume a window you cannot extend.

If you make anything with software in it and sell it in Europe, the useful step this week is small. Find out which legal entity is the manufacturer, and give that entity a monitored address a CSIRT filing can come from. Most of the rest can wait a month. That cannot.