The rule, in plain terms
For a children's product subject to a children's product safety rule, 16 CFR 1107.26 requires the manufacturer (which, for imports, is commonly the importer acting as certifier) to keep a defined record set for five years and to make it available to CPSC on request — hard copy or electronic. Records kept in another language must be producible immediately and translated to English within 48 hours of a CPSC request.
Source: 16 CFR 1107.26, eCFR (checked 2026-07-17; eCFR displayed “up to date as of 5/19/2026”). Scope note: this section covers children's products. We do not extend it to general certificates of conformity here.
The six record classes — and where each one usually breaks
| Required record (1107.26(a)) | Where it breaks in practice |
|---|---|
| Copy of the CPC, product clearly identifiable | Certificate exists, but which SKUs and which version it covers is ambiguous once variants ship. |
| Third-party certification test records, per manufacturing site | Reports live in email threads; the per-site requirement is missed when a second factory comes online. |
| Periodic testing records (one of three allowed schemes) | The scheme in use was never written down, so nobody can show the interval logic. |
| Representative-sample records, incl. selection procedure and basis for inference | Samples were tested, but the procedure and the inference basis were never documented. |
| Descriptions of all material changes (design, process, sourcing) + tests run and values | The change happened in purchasing; compliance found out at re-order. No linkage from change to test. |
| Undue-influence procedures, training materials, attestations | A policy PDF exists; the training records and attestations do not. |
Record list paraphrased from 1107.26(a)(1)–(6), checked 2026-07-17 (link above). The failure modes are our operational observations, not regulatory text.
What “ready in five years” looks like operationally
- Version everything. A certificate is not one artifact; it is a chain of versions, each tied to the evidence that supported it at the time.
- Field-level provenance. Every value on the certificate should answer “which document says so?” without a search party.
- Change control as a record, not a habit. 1107.26(a)(5) effectively asks for your material-change log with test linkage — that is a data structure, not a memory.
- 48-hour translation is a logistics test. If your test reports are in another language, know today who translates them and how fast.
Run the Certificate Data Health Check against one of your certificates — it runs entirely in your browser — or read how eFiling changed the stakes in 2026.