The regulation asks your suppliers questions. You collect the answers
EU packaging conformity under Regulation (EU) 2025/40 runs on supplier declarations: recyclability, recycled content, substances of concern, per packaging item. In practice collecting them means a chase by email, a folder of PDFs in every shape a supplier can invent, and somebody eyeballing each one against what the rules actually require.
The Declaration of Conformity you sign later needs evidence behind every item. A declaration that's missing, incomplete or quietly inconsistent with itself is usually discovered at the worst moment - when someone asks for the file.
Suppliers get a signed link. A rule engine screens what comes back
You send each packaging supplier a signed link. They answer a questionnaire generated from the ruleset and upload their declaration. A deterministic rule engine screens the submission for completeness and internal consistency, and the supplier gets either a confirmation or a named list of what's missing. You keep a per-item evidence file and a coverage report, ready to sit behind a Declaration of Conformity.
A model does exactly two jobs: reading an uploaded document into named fields with a confidence on each, and drafting the covering paragraph of a gap notice. It never produces a pass or a fail. Verdicts come from the engine evaluating versioned JSON - no model, no network, no clock - so the same submission against the same ruleset gives the same findings in the same order.
The gap notice paragraph a model drafted is marked as AI-generated, readable and machine-detectable; the rule-written confirmations and reminders are deliberately unmarked. That's Article 50 of the EU AI Act, handled where the work happens.
Invite, declare, screen, report
Twelve workflows on self-hosted n8n, one rule engine, a store on n8n Data Tables with Postgres when you outgrow them. A single-workflow version of the collection campaign is published as an n8n template: Collect packaging declarations from CSV.
It screens documents. It refuses to pretend it certifies packaging
It doesn't decide whether packaging conforms, it isn't legal advice, and it doesn't replace a notified body or a technical file. That limit is stated in the repository, on the supplier form and in every email, because a compliance tool that overstates its scope is worse than no tool.
The rule engine has no model, no network and no clock. Every finding names the rule and the value that tripped it, so a gap notice is an argument a supplier can answer, not a verdict to argue with.
Checks live in versioned JSON, and the supplier questionnaire is generated from it - change the ruleset and the questions, the checks and the reports move together. The shipped ruleset is an example built to exercise every check type, not a legal reading of the regulation.
Invitations, tokens, reminders, escalation and state are plain n8n, with every transition written to an event log. The interesting part is small and auditable; the rest is machinery you can read in an afternoon. MIT licensed.