Why spreadsheet compliance breaks at scale for online sellers

Every e-commerce business starts the same way with compliance: a folder on a shared drive, a spreadsheet with column headers like “CE Certificate Y/N” and “Last Checked,” and the best intentions. It works. For a while.

Then you add your 50th product. Then your second supplier. Then a marketplace asks you to prove that the wireless earbuds you're selling have a valid Declaration of Conformity covering the Radio Equipment Directive. And you realize the spreadsheet says “Y” but the document it refers to is a scan from 2022 for a different model number.

This isn't a failure of diligence. It's a failure of tooling. And it's the most common operational pattern in e-commerce compliance today.

The anatomy of spreadsheet compliance

Let's be precise about what “spreadsheet compliance” looks like in practice, because it's the baseline almost every SME starts from:

Look familiar? That's because it is familiar. This is how the vast majority of e-commerce businesses track product safety compliance. And it has three fatal flaws.

Flaw 1: The spreadsheet is not the evidence

A spreadsheet cell that says “Y” for CE certification is an assertion, not evidence. When a market surveillance authority asks for the Declaration of Conformity for product CH-0092, they don't want to see a green cell in a spreadsheet. They want the document. The actual, current, correctly-attributed document.

The spreadsheet points todocuments, but the linkage is fragile. File names change. Documents get updated without the spreadsheet being updated. Files move between folders. Versions proliferate. Within six months of starting, the mapping between your spreadsheet and your actual document corpus starts to drift. Within a year, it's fiction.

Flaw 2: There's no structure inside the documents

When your supplier sends you a 12-page test report as a PDF, the compliance-relevant information is insidethat document: the test standard applied, the accreditation number of the lab, the date of testing, the product model covered, the results. But none of that information is accessible to your systems. It's locked in unstructured text.

This means every time someone needs to verify a fact, “Does this test report cover EN 71-1?”, they have to open the PDF and read it. For one product, that's a minor inconvenience. For 500 products, it's an operational impossibility. You end up trusting the spreadsheet's assertion instead of verifying the evidence.

Flaw 3: There's no review workflow

A spreadsheet doesn't have a concept of “this product has been reviewed and approved for compliance.” It has cells. Someone can change a cell from “N” to “Y” and there's no audit trail, no approval gate, no way to distinguish between “reviewed and approved by someone qualified” and “updated by an intern who wasn't sure what to put.”

When an authority asks “who approved this product as compliant and when?”, the honest answer is often: “someone updated a spreadsheet at some point.” That's not a defensible position.

The five breaking points

Spreadsheet compliance doesn't fail all at once. It fails at predictable breaking points that correlate with business growth:

What the alternative looks like

The alternative isn't “a better spreadsheet.” The alternative is a system of record where the compliance data is the documentation, where facts are extracted from source documents, linked to specific products, structured into a format that supports review workflows, and publishable to every channel from a single approved version.

Here's what that looks like in practice:

Step 1: Import what you have

Start with your existing catalog. Upload the CSV export from your shop system. Every SKU gets a compliance record, initially empty, but structurally complete. Your existing identifiers, GTINs, and product classifications are preserved.

Step 2: Attach the evidence

Upload the supplier documents you already have: Declarations of Conformity, test reports, safety data sheets, product specifications. These get versioned, fingerprinted, and linked to the products they cover.

Step 3: Let AI extract the structured data

Instead of manually reading each document and transcribing facts into a spreadsheet, AI extraction pulls out the structured information automatically: which entity is the manufacturer, which is the importer, what test standards were applied, what the CE declaration covers, what warnings apply.

Critically, every extracted fact maintains source provenance, you can trace any data point back to the specific document and location it came from. This isn't AI making things up. It's AI reading documents the way a compliance officer would, but at scale.

Step 4: Review by exception

Not every product needs a human decision. Products where all evidence is present, all required fields are populated, and no conflicts were detected can be bulk-approved. Your attention goes where it's actually needed: the products with conflicting importer data, missing CE declarations, or incomplete warning texts.

This is the review-by-exception model. Instead of reviewing everything (which you won't do), or reviewing nothing (which is what happens with spreadsheets), you review the exceptions. The 80% that's clean flows through. The 20% that needs attention gets triaged.

Step 5: Publish from one source of truth

Once a product's compliance record is approved, you can generate outputs for every channel from the same data: public safety pages for your own shop, PDF exports for marketplace submissions, CSV and JSON for automated feeds. Update the dossier once, and every output reflects the change.

The operational difference

The difference between spreadsheet compliance and structured compliance is the difference between a filing cabinet and a database. Both can store information. But only one of them lets you:

• Answer “show me every product where the CE declaration is older than 12 months” in seconds
• Know exactly who approved a product as compliant and when
• Trace any published fact back to its source document
• Detect conflicts between different documents for the same product
• Onboard a new team member who can immediately see the status of any product

A spreadsheet records what you believe is true. A system of record can prove it.

When to make the switch

There's no perfect time. But there are reliable signals:

• You've had a moment where you couldn't find a document you knew you had
• A marketplace has asked you for compliance evidence and it took more than an hour to produce
• More than one person in your organization touches compliance data
• You sell the same products on more than one channel
• You've ever discovered that a “compliant” product was missing a document

If any of these apply, your spreadsheet has already passed its useful life. The question isn't whether to switch, it's how much undocumented risk you accumulate before you do.