Product Safety Compliance Checklist for Shopify Stores

Most Shopify merchants don’t need a 50-page compliance manual. They need a checklist they’ll actually follow. This article is that checklist — built specifically for U.S.-facing Shopify stores selling physical consumer products. Work through it once to set up the baseline, then revisit quarterly.

1. Confirm whether the rules apply to you

Federal product-safety rules administered by the Consumer Product Safety Commission (CPSC) apply if you sell consumer products to U.S. customers. Most physical goods on Shopify qualify. A small number of categories — food, drugs, cosmetics, firearms, motor vehicles — fall under other agencies (FDA, ATF, NHTSA) and have their own regimes.

• You sell physical, non-exempt consumer products to U.S. customers.
• You’ve identified any product categories that fall under separate regulators (food, drugs, cosmetics, etc.) and have a plan for those.
• You understand that the rules apply whether you manufacture, import, dropship, or rebrand.

2. Set up CPSC recall monitoring

You can’t respond to a recall you don’t know about.

• You subscribe to CPSC recall email alerts (the bare-minimum free option), or
• You use an automated catalog-matching monitor like RecallDocket that compares CPSC recalls against your live Shopify catalog every day, and
• You have a named person on your team who owns “recall monitoring” as a responsibility.

For more detail on monitoring options, see How to Check if Your Products Have Been Recalled.

3. Build an internal incident-response procedure

Most Section 15(b) penalty cases turn on what the company did in the first 24 hours after learning of a hazard. Have the procedure written down before you need it.

• You have a one-page written incident-response procedure stored somewhere everyone on the team can find.
• The procedure names the person who escalates and the person who decides whether to file.
• The procedure covers: stop sales, quarantine inventory, identify affected orders, draft Section 15(b) report if required, notify customers, document the decision.
• Customer support knows when to trigger the procedure (any complaint involving injury, fire, electrical hazard, choking, allergen, or “the product broke and hurt someone”).

4. Section 15(b) reporting readiness

• You understand that Section 15(b) applies to retailers, not just manufacturers. (See Section 15(b) Reporting Explained.)
• You can identify a “reportable” event: information that reasonably supports a conclusion that a product is defective, non-compliant, or creates an unreasonable risk.
• You can produce a Section 15(b) draft within the 24-hour window after becoming aware of a reportable event.
• You have a SaferProducts.gov Business Portal account already created (do this before you need it — the account-creation flow is non-trivial).
• You’re prepared for the July 8, 2026 eFiling deadline — electronic submission via the Business Portal becomes the only accepted channel for most filers.

5. Customer notification templates

When a recall affects a product you’ve sold, you need to notify customers quickly and clearly. Draft the templates in advance.

• You have a customer-notification email template that includes:
  • The product name and model
  • The official CPSC hazard description (don’t soften it)
  • A link to the official recall page
  • The specific remedy (refund, repair, replace) and how to claim it
  • A contact path for follow-up questions
• You have a process to pull a list of affected customers from Shopify’s order data using product, date range, and SKU filters.
• You log every notification sent (who, when, which recall).

6. Inventory and storefront controls

• You can pull a SKU from your storefront in under 5 minutes (manual unpublish, draft status, or app-based controls).
• You have a process for quarantining on-hand inventory so it cannot accidentally ship.
• You know how to disable any third-party fulfillment integrations for a specific SKU.
• You have a way to flag a recalled product in your internal records so it isn’t accidentally re-published later.

7. Recordkeeping

The cheapest form of insurance against a CPSC enforcement action is a clean, contemporaneous paper trail.

• You keep records of every CPSC recall that affected your catalog, the date you became aware, and the action you took.
• You keep records of every Section 15(b) report drafted or submitted, including the submission confirmation.
• You keep copies of every customer notification sent in connection with a recall.
• You keep records of all returns, refunds, repairs, and replacements processed under a recall.
• Records are retained for at least 5 years (longer if a settlement or consent decree requires it).

8. Supplier and product onboarding

A surprising number of safety incidents are introduced at onboarding — a new supplier or a new product type lands in the catalog without anyone checking for existing regulatory issues.

• New suppliers are screened against any open CPSC enforcement actions or recall history.
• New products are checked against existing CPSC recalls for the same brand and model family.
• Children’s products and infant products go through an extra checklist — these categories have additional federal requirements (CPSIA, third-party testing, tracking labels).
• You have documentation for any safety certifications a product claims (CPC, GCC, applicable standards).

9. Insurance and contracts

• You have product-liability insurance with limits appropriate for your catalog size and price points.
• Your policy’s reporting requirements are mapped against your internal incident-response procedure (so you don’t accidentally void coverage by reporting late to the insurer).
• Your supplier contracts include indemnification language for safety defects originating with the supplier.
• You have a documented process for invoking indemnification — names, contact methods, expected response windows.

10. Quarterly review

A compliance checklist that never gets revisited is theater. Block 60 minutes every quarter to:

• Confirm the recall monitor is still running and surfacing matches.
• Spot-check that customer notifications from any matches were actually sent and logged.
• Verify the SaferProducts.gov Business Portal account is still active and credentials are accessible.
• Read any new CPSC guidance or rule changes published since the last review.
• Walk a new hire (or yourself) through the incident-response procedure in dry-run mode.

How RecallDocket maps to the checklist

RecallDocket is designed to cover steps 2, 4, 5, and parts of 7 directly:

• Step 2 (monitoring): daily catalog matching against the official CPSC recall feed.
• Step 4 (reporting readiness): pre-filled, CPSC-formatted Section 15(b) drafts you paste into SaferProducts.gov.
• Step 5 (notifications): customer notification templates that pull product, recall, and remedy data automatically.
• Step 7 (recordkeeping): a compliance dashboard that records every alert, draft, submission, and notification with timestamps.

The free tier covers up to 100 products and the daily recall monitor — enough to get the checklist’s most important step running today.

Install RecallDocket on Shopify →

Further reading

• What Shopify Merchants Need to Know About CPSC Recalls
• Section 15(b) Reporting Explained: A Retailer’s Guide
• How to Check if Your Products Have Been Recalled
• CPSC Recall Penalties: What Happens If You Don’t Comply

Not legal advice. This checklist is general information for educational purposes only and is not legal advice, does not create an attorney-client relationship, and does not substitute for a qualified product-safety attorney or compliance professional. CPSC rules change over time; verify current requirements with the CPSC or your counsel.