CPSC Certificate Gap Checker (CPC/GCC pre-check)

Batch US import-compliance pre-check for e-commerce sellers. Feed it 1–100 product records; for each SKU it answers:

• Is this a children's product (CPSA: designed or intended primarily for ages 12 or younger) or a general-use product?
• Which certificate does US law require at import — a Children's Product Certificate (CPC) or a General Certificate of Conformity (GCC)?
• Which specific CPSC rules (16 CFR parts / statutes) apply, and is third-party testing at a CPSC-accepted lab required?
• What is missing before the shipment clears — as an actionable gap checklist (certificate, testing, tracking label, eFiling).

Why now: since July 8, 2026, importers of most regulated consumer products must eFile certificates of compliance with CBP via the PGA Message Set (Federal Register 2024-30826). No certificate data = detention risk at the border.

Input

{
  "products": [
    {
      "id": "SKU-001",
      "title": "Rainbow Stacking Rings Toy for Babies 6-18 Months",
      "description": "Colorful plastic stacking rings with painted wooden base.",
      "materials": "ABS plastic, painted beech wood"
    }
  ],
  "fetch_urls": true
}

title is required; everything else is optional but more text = better classification. url is fetched best-effort only (direct → datacenter proxy → Jina Reader) when description is missing or short; a failed fetch never blocks the check.

From a catalog CSV: export your product list, keep the columns you have (title/description/category/age_range/materials/url/id), and convert the rows to this JSON array — one object per SKU, up to 100 per run. Each text field is capped at 4000 chars.

Every run also appends a final batch summary row (record_type: "summary") with counts: how many SKUs need CPC vs GCC vs none, how many were billable, and how many need human review — so you can triage 100 SKUs at a glance without reading each record.

Output (per SKU)

{
  "record_type": "sku",
  "ok": true,
  "id": "SKU-001",
  "classification": "childrens",
  "certificate_required": "CPC",
  "evidence_hit_ratio": 1,
  "applicable_rules": [
    {
      "rule_id": "16cfr1250",
      "cfr_cite": "16 CFR part 1250",
      "title": "Children's toys",
      "test_standard": "ASTM F963",
      "third_party_lab_required": true,
      "reason": "category:toys",
      "evidence_quote": "Stacking Rings Toy"
    }
  ],
  "gap_checklist": [
    "Children's Product Certificate (CPC) required before import/distribution, citing: 16 CFR part 1250; ...",
    "Third-party testing by a CPSC-accepted laboratory required for each cited rule (find labs: cpsc.gov/labsearch)",
    "Permanent tracking label required on product and packaging (CPSA section 14(a)(5))",
    "From July 8, 2026: importers must eFile certificate data with CBP via the PGA Message Set (cpsc.gov/eFiling)"
  ],
  "confidence": "high",
  "warnings": [],
  "disclaimer": "Automated pre-check ... NOT legal advice ..."
}

How it works (and why you can trust the citations)

1. LLM classification only — the model maps your listing text to a fixed category catalog and attribute flags (painted surface, soft plastic, button battery, under-3 age grading). It is forbidden from writing regulation numbers.
2. Deterministic rule matrix — every citation comes from rules/cpsc-matrix.json, hand-transcribed from the two official CPSC certification lists (children's rules list, complete as of 2024-12-05, canonical at 16 CFR 1112.15; GCC rules list, current as of 2024-08-08). The LLM cannot invent a rule.
3. Mechanical validation — every category/flag must exist in the matrix, and every evidence_quote must be a verbatim substring of your input text. Anything that fails verification is dropped and logged in warnings, never silently kept.

Honest billing

Pay per event sku-gap-checked. You are not charged whenever confidence: "low", which we deliberately trigger in every case where the answer isn't trustworthy:

• age classification is ambiguous (sparse/garbage listing text — the exact case where a wrong "none" would be most dangerous);
• conflicting signals (e.g. a listing calls itself "adult" but matches a children-only category) — downgraded to review, never billed as a confident "none";
• the model proposed matches but all evidence failed verification, or the applicable rules were entirely gated out.

The design bias is: when in doubt, mark it low and don't charge. A confident "no certificate needed" is only ever billed when there was real, verified signal behind it. The batch summary reports billable separately from total so you can see exactly what you paid for.

vs. CPSC's free Regulatory Robot

CPSC's official Regulatory Robot is a great interactive questionnaire — but it is designed for one product at a time ("you'll need to run the Robot one time for each product"), answered manually. This Actor does the batch/API version of the same triage: 100 SKUs from your catalog CSV in one run, judged from listing text, with machine-checkable citations. For any single ambiguous product we recommend the Robot as a second opinion — the checklist even links to it.

This is also not a recall monitor (there are plenty of those on Apify) — it is a pre-import certificate gap check.

Limits (read this)

• Pre-check tool, NOT legal advice and not a compliance determination. Testing labs and compliance professionals make the final call.
• Covers CPSC certification rules only — FDA, FCC, EPA, USDA, state rules (e.g. CA Prop 65) are out of scope.
• The rule matrix is a snapshot of CPSC's two official certification lists (children's rules complete as of 2024-12-05; GCC rules current as of 2024-08-08 — roughly 18 months old at time of writing). The canonical live list is 16 CFR 1112.15; matrix version, retrieved date, and source URLs ship in rules/cpsc-matrix.json. We re-sync against the CFR periodically — check the matrix version before relying on it for a newly regulated category.
• test_standard is populated only where CPSC names a specific standard on the rule page (toys → ASTM F963, sleepwear → FF 3-71/FF 5-74). For every other rule it is null — that means "consult the cited CFR part for the test method", not "no testing required".
• Classification is text-only. It reads your listing fields (and, best-effort, the page). It does not see product photos, and a determined seller who mislabels a children's product as "adult, not a toy" can fool the age call — in that case the tool degrades to an unbilled none/ambiguous rather than a confident wrong answer, but it is not a substitute for honest product data. evidence_quote proves a quote exists in your text; it does not prove the quote is semantically airtight.
• Each output record carries evidence_hit_ratio (share of the model's proposed evidence that survived verbatim verification) — use it to decide which SKUs deserve a manual second look.

Development

pnpm install
pnpm typecheck   # tsc --noEmit, zero errors is the bar
pnpm test        # vitest: matrix invariants, validate layer, match layer
pnpm smoke       # offline end-to-end (no network, no LLM)
pnpm golden      # real-LLM acceptance vs hand-labeled expectations (needs DEEPSEEK_API_KEY)

Secrets live outside the repo in ~/.secrets/cpsc-cert-gap.env (falls back to ~/.secrets/tender-extractor.env). Never commit .env.

Architecture (single-direction deps): main → fetch/extract/match/validate → rules → domain. The LLM provider chain (DeepSeek default / Anthropic / claude-code subscription loop) is inherited from tender-extractor, including the prefix-cache prompt constraints documented in src/extract/prompts.ts.