CE marking, GDPR and e-invoicing: the compliance checklist before a US manufacturer meets an EU distributor

An EU distributor that takes on your line also takes on part of your regulatory risk. Its buyer will ask about conformity, documents and data before asking about price, because the distributor answers to its own market surveillance authority, data protection authority and tax office. Arriving with these answers ready is the difference between a supplier who is easy to list and one who creates work.

Putting it simply: confirm whether your products need CE marking (a US listing does not count), decide who in the EU is the responsible economic operator, treat your contact list as personal data under the GDPR, follow each country's email rule, ask your distributor how e-invoicing affects your invoices, and translate the product information your buyers and users will read.

1. CE marking: a UL listing is not a CE mark

Your Europe explains that with CE marking "the manufacturer indicates that a product meets the requirements set out in EU product rules." It applies only to products covered by EU rules that require it, such as electrical equipment, machinery, personal protective equipment and medical devices. If no such act covers your product, you must not affix the mark, and general product safety rules apply instead.

The manufacturer identifies the applicable requirements, carries out the conformity assessment (by itself or with a third-party body where the act requires one), prepares technical documentation, signs an EU declaration of conformity and keeps the documentation for at least 10 years after the product is placed on the market.

A UL or ETL listing does not replace any of this. The International Trade Administration's EU guide is direct: "testing and certification to U.S. standards for the U.S. market is generally not sufficient for exporting to the EU." A lighting manufacturer, for example, falls under the Low Voltage Directive, which covers electrical equipment rated between 50 and 1,000 V AC.

2. An economic operator established in the EU

Under Article 4 of the Market Surveillance Regulation (EU) 2019/1020, applicable since July 16, 2021, a product covered by the listed legislation, including electrical equipment, machinery, PPE and construction products, "may be placed on the market only if there is an economic operator established in the Union" responsible for it. That operator can be an EU manufacturer, the importer, an authorized representative with a written mandate, or a fulfillment service provider. It must check that the declaration of conformity and technical documentation exist, answer authorities, report risks and cooperate on corrective action. Its name and contact details go on the product, packaging, parcel or an accompanying document.

The ITA adds a point worth reading twice: EU authorities "are under no legal requirement to notify the U.S. manufacturer or exporter when their product is considered a potential risk." They notify the EU operator.

Two related regimes: since December 13, 2024 the General Product Safety Regulation applies the same requirement to consumer products (Article 16), and a medical device whose manufacturer is not established in the EU may only be placed on the market once the manufacturer designates a sole authorized representative (MDR, Article 11). Your distributor may act as importer, but agree in writing who carries these duties. For products placed on the market after December 9, 2026, the new Product Liability Directive (EU) 2024/2853 also makes that importer, or your authorized representative, liable for damage caused by a defective product when you are outside the EU, so expect the distributor to ask for an indemnity and product-liability insurance.

3. GDPR: your contact list is personal data

The GDPR can reach a company with no EU establishment when it processes personal data of people in the EU in connection with offering them goods or services, or monitoring their behavior (Article 3(2)). Plan as if it applies to your outreach. In that case Article 27 requires a written designation of a representative in the EU, unless your processing is occasional, involves no large-scale sensitive data and is unlikely to create a risk. Article 14 requires you to tell each contact where you got their details within a reasonable period and at the latest one month after you obtained them, or in your first message if that comes sooner; holding a list for months before writing is not allowed.

Data coming the other way, such as end-customer or lead data your distributor sends you, is a transfer to the US. The Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework on July 10, 2023; data can flow freely to US companies that certify under the framework and appear on the Department of Commerce's DPF List; only companies subject to FTC or Department of Transportation jurisdiction are eligible. The General Court dismissed a challenge to the decision on September 3, 2025 (Case T-553/23); an appeal to the Court of Justice was lodged on October 31, 2025 (C-703/25 P). Certify, or agree on another safeguard such as the Commission's standard data protection clauses (Article 46), before you receive such data.

4. Email rules are national, and stricter than CAN-SPAM

CAN-SPAM is an opt-out model: the FTC says it "gives recipients the right to have you stop emailing them", requires opt-outs to be honored within 10 business days and "makes no exception for business-to-business email." The ePrivacy Directive requires prior consent for email marketing to individual subscribers and leaves the protection of companies to each member state. France's CNIL allows a B2B email without prior consent to a company's generic address (info@, contact@), and to a named professional address only if the person was told it could be used for prospecting, the email relates to their job and it offers an easy opt-out. Germany's § 7 UWG treats email advertising without the addressee's prior express consent as an unreasonable nuisance, with no B2B exception. Cresques shows the lawful first-contact channel for each country so the rule is settled before a word is written.

5. E-invoicing: your distributor's systems are changing

In France, since September 1, 2026 every business must be able to receive electronic invoices through an approved platform, and large and mid-sized companies must issue them; small and micro businesses follow on September 1, 2027. The obligation covers transactions between businesses established in France; dealings with foreign companies fall under a separate e-reporting duty.

In Germany, businesses established there have had to be able to receive e-invoices since January 1, 2025. Issuers may still use paper or other formats until the end of 2026, or the end of 2027 if their prior-year turnover was up to EUR 800,000.

These rules mainly bind your distributor's domestic sales. If you register for VAT in either country, for example to sell on delivered-duty-paid terms, check your own position with an advisor.

6. Product information in the local language

The Low Voltage Directive requires instructions and safety information "in a language which can be easily understood by consumers and other end-users, as determined by the Member State concerned," and the GPSR has a similar rule for consumer products. Budget for translated manuals, labels and data sheets before the first order.

What this means for a US manufacturer

Walk into the first meeting with a one-page compliance sheet: which EU acts apply and where the declaration is, who your EU economic operator is, how you handle contact data and transfers, which contact rule you followed, how you will invoice, and which documents exist in the distributor's language. It tells the distributor that listing you will not create extra work.