EU Packaging Regulation PPWR: Why PFAS Restrictions Are Now a GRC Topic

Since 12 August 2026, the new EU Packaging and Packaging Waste Regulation, known as the PPWR, has generally applied across the European Union. Its first immediately visible requirement is highly concrete: food-contact packaging may no longer be placed on the EU market if it reaches or exceeds certain PFAS concentration limits.

For many companies, packaging regulation may initially sound like an environmental, product or procurement issue. In reality, however, the PPWR is a classic GRC topic. It affects product design, supplier management, material data, technical documentation, conformity evidence, ESG strategy, audit readiness and market access. Any company selling packaged products in the EU will increasingly need to know not only which packaging is used, but also whether it can prove that this packaging meets the new requirements.

Key Takeaways

The PPWR entered into force on 11 February 2025 and has generally applied since 12 August 2026. It covers packaging and packaging waste regardless of material or origin and sets requirements for manufacturing, composition, reusability, recoverability and waste management.

The most urgent requirement concerns PFAS restrictions for food-contact packaging. Since 12 August 2026, such packaging may no longer be placed on the EU market if it reaches or exceeds 25 ppb for individual PFAS, 250 ppb for the sum of certain PFAS, or 50 ppm for total PFAS.

There is no general stock-depletion grace period for already manufactured food-contact packaging containing PFAS. Packaging that was placed on the market before 12 August 2026 may remain on the market. Packaging placed on the market after that date must comply with the limits.

For GRC leaders, this means that packaging compliance must become manageable across suppliers, materials, products, documentation, controls and evidence.

Why the PPWR Is More Than Environmental Regulation

The PPWR aims to reduce packaging waste, strengthen recycling, save primary resources and simplify the EU internal market through more harmonised rules. The regulation creates a framework for the entire packaging lifecycle, from product design to waste treatment. This includes restrictions on certain single-use plastics, requirements for takeaway containers, recyclability requirements and the reduction of problematic substances such as PFAS in food-contact packaging.

The GRC impact lies exactly in this breadth. Packaging is not just a shell around a product. It is part of product conformity, supply chain governance, sustainability strategy and market access. A change in material can affect suppliers, costs, shelf life, food safety, transport, brand presentation, recyclability and regulatory documentation.

This makes the PPWR a cross-functional topic. Legal teams need to understand the requirements. Procurement needs to engage suppliers. Product management needs to review packaging design and material decisions. ESG teams need reliable data for sustainability and circular economy goals. Compliance and internal audit need to ensure that evidence is available and robust.

PFAS: The First Concrete Compliance Test

PFAS are often referred to as “forever chemicals” because they are highly persistent and can accumulate in the environment and living organisms. In packaging, they have been used, among other things, for their water-, grease- and dirt-repellent properties. Examples can include coated fast-food packaging, takeaway containers, baking paper, food wrappers and other packaging with grease-barrier functionality.

The PPWR addresses this directly. Article 5 contains specific concentration limits for food-contact packaging. Market surveillance authorities can verify compliance with these PFAS limits. Since there is currently no fully harmonised EU testing methodology for PFAS in food-contact packaging, the quality of internal evidence becomes even more important.

Companies need to show which materials are used, which supplier declarations are available, which tests have been performed, which batches are affected and how decisions were documented. PFAS compliance is therefore not a one-off material check. It is a process involving supplier requests, risk assessment, testing, approval, documentation and ongoing monitoring.

Why Supplier Risk Now Becomes Packaging Risk

Many companies do not manufacture packaging themselves. They source boxes, films, labels, coatings, trays, cups, bags or composite materials from external suppliers. In many cases, packaging is further processed by converters, printers, logistics partners or co-packers.

This is exactly where the GRC risk arises. A company can only be confident that its packaging is PPWR-compliant if it understands its supply chain sufficiently. This applies not only to direct suppliers, but also to material sources, coatings, additives, recycled content and, where relevant, sub-suppliers.

In practice, requesting a generic sustainability statement will not be enough. Companies need specific, current and product-related evidence. For food-contact packaging, this is especially important: Which PFAS risks exist? Which materials and coatings are used? Which tests or certificates are available? Which supplier obligations apply? And how is it ensured that material changes are communicated?

Vendor risk management is therefore moving to a new level. It is no longer only about the financial stability, information security or data protection posture of a supplier, but also about material and product conformity.

PPWR Readiness Requires Data Governance

The PPWR shows very clearly that ESG and product regulation are becoming increasingly data-driven. Companies need to manage not only objectives, but also material data, packaging types, supplier information, technical documents and evidence.

This starts with basic questions: Which products use which packaging? Which packaging comes into contact with food? Which materials contain barrier coatings? Which suppliers provide which components? Which version of a packaging item is currently on the market? Which stocks were placed on the market before or after 12 August 2026?

This turns packaging compliance into a data and process issue. Without clear master data, ownership, versioning and evidence, a company will struggle to prove which packaging was placed on the market, when and under which conditions.

2028 and 2030: The Next Requirements Are Coming

The PFAS restrictions are only the beginning. From 2028, harmonised packaging labels are expected to help consumers sort packaging correctly. These labels will create new requirements for packaging data, material classification and design coordination.

From 2030, the PPWR will intervene even more strongly in packaging design. The regulation includes requirements for packaging minimisation. Manufacturers or importers must ensure that the weight and volume of packaging are reduced to the minimum necessary for its functionality.

For grouped packaging, transport packaging and e-commerce packaging, a maximum empty space ratio of 50 percent is also foreseen once the relevant requirements become applicable.

For companies, this means that waiting until every detail requirement becomes directly applicable is risky. Packaging design, supplier contracts, material changes, testing, labels, product approvals and data models all require lead time.

Why Excel Quickly Reaches Its Limits in Packaging Compliance

Many companies will initially try to manage PPWR requirements through Excel, supplier questionnaires and email approvals. That is understandable, but risky in the long term.

The challenge lies in the dynamics. Packaging changes. Suppliers switch materials. New tests become necessary. Authorities publish guidance. Labels are harmonised. Further requirements follow in 2030. At the same time, companies must be able to explain in an audit why a packaging item was classified as compliant and which evidence supported that decision.

If packaging data, supplier confirmations, tests, risk assessments, product approvals and remediation measures sit in separate files, an evidence problem emerges. This is typical of mature GRC topics: the challenge is not only to achieve compliance, but to make it repeatable, auditable and manageable.

What Companies Should Do Now

Companies should first clarify whether they place food-contact packaging on the EU market or use such packaging in their products. They should then assess whether PFAS-relevant materials, coatings or supplier risks exist. Crucially, this should not be treated as a one-time supplier request, but as part of an ongoing control process.

At the same time, companies should build or update their packaging inventory. Without visibility into packaging types, materials, suppliers, products and markets, a reliable PPWR roadmap is difficult to create. Documentation of the placing-on-the-market date is particularly important, because companies must distinguish between packaging placed on the market before and after 12 August 2026.

The next step is a gap assessment for upcoming requirements. 2028 and 2030 may sound far away, but they are not. Packaging changes require design decisions, supplier qualification, testing, budget, communication and operational implementation.

Conclusion: The PPWR Turns Packaging Into a GRC Data Topic

The new EU packaging rules show how strongly sustainability, product safety and compliance are converging. The PFAS restrictions for food-contact packaging are the first visible implementation test. Further requirements on labels, recyclability, recycled content, reuse and packaging minimisation will follow.

For GRC leaders, the key message is clear: packaging compliance is not an isolated environmental project. It requires clear ownership, reliable supplier data, documented risk assessments, controls, technical evidence and audit-ready decisions.

Companies that start now can reduce regulatory risk and create better transparency across products, supply chains and ESG data. Zazoon helps companies build PPWR readiness as an integrated GRC practice: from requirements and risks to suppliers, controls, evidence and audit trails.

FAQ

What is the PPWR?

The PPWR is the new EU Packaging and Packaging Waste Regulation. It replaces the previous Packaging Directive in many areas and creates a more harmonised framework for packaging and packaging waste in the EU.

Since when does the PPWR apply?

The PPWR entered into force on 11 February 2025 and generally applies from 12 August 2026. Some requirements apply later, including certain labelling and design requirements.

What changes for PFAS?

Since 12 August 2026, food-contact packaging may no longer be placed on the EU market if it reaches or exceeds certain PFAS concentration limits. The limits apply to individual PFAS, the sum of certain PFAS and total PFAS.

Is there a grace period for old stock?

There is no general stock-depletion grace period for food-contact packaging containing PFAS. Packaging placed on the market before 12 August 2026 may remain on the market. Packaging placed on the market after that date must comply with the limits.

Which companies are affected?

Affected companies include those placing packaging or packaged products on the EU market. This can include manufacturers, importers, distributors, brand owners, food companies, e-commerce providers and Swiss exporters.

Why is the PPWR a GRC topic?

The PPWR connects product compliance, ESG, supplier management, data governance, technical documentation, internal controls and audit readiness. Companies must not only understand the requirements, but also prove their implementation.

How does Zazoon support PPWR readiness?

Zazoon helps companies centrally manage requirements, risks, suppliers, controls, actions and evidence. This makes packaging compliance traceable, efficient and audit-ready.