EU Toy Safety Regulation 2025/2509
Regulation (EU) 2025/2509 entered into force on 1 January 2026 and replaces the Toy Safety Directive 2009/48/EC. But "in force" and "applicable" are different dates here, and several compliance summaries collapse them into one — the Regulation gives industry a 54-month transition, with the old Directive only repealed on 1 August 2030. Two obligations are pulled forward of that: battery-safety rules from February 2027, and the Digital Product Passport plus the main enhanced safety obligations from mid-2028. Connected toys are named directly in scope, not swept in by inference.
Last updated 16 August 2026
Regulation (EU) 2025/2509 was published in the Official Journal on 12 December 2025 and entered into force on 1 January 2026. A number of compliance summaries state or imply that toys placed on the market from that date must already carry a Digital Product Passport — they're reading "entry into force" as "applicable," which isn't what the text does. The Regulation runs a 54-month transition: the current Toy Safety Directive 2009/48/EC stays in force for toys placed on the market under it, and the new Regulation only becomes fully applicable — with the Directive repealed — on 1 August 2030. What changed on 1 January 2026 is that the rulebook exists and the clock on the transition period started, not that the new obligations are live yet.
Source: European Commission; Adherent; Eurofins.
Battery-safety requirements apply from February 2027, ahead of the general application date: access to small batteries without a tool is restricted, and where a toy's size or nature requires it, a rechargeable battery must instead be inaccessible, removable or replaceable only by an independent professional. The Digital Product Passport and the Regulation's main enhanced safety obligations — replacing the paper Declaration of Conformity with a QR-code-accessible digital record covering safety and compliance data, kept available for 10 years after the toy is placed on the market — apply from mid-2028. Both dates sit inside the transition period, ahead of the 1 August 2030 date when the whole Regulation, and the DPP requirement for every toy on the market, is live.
Source: PSQR; TecEx Global Compliance.
CEN published updated versions of EN 71-1 (mechanical and physical properties) and EN 71-8 (activity toys) in early 2026, revised to align with the new Regulation. The current, pre-revision versions of both standards are fully replaced in July 2027 — after that date, citing EN 71-1 or EN 71-8 for presumption of conformity means citing the 2026 revision. That's a standards-citation deadline, separate from and earlier than the Regulation's own February 2027 and mid-2028 application dates — a technical file referencing the outgoing standard version needs updating on its own timeline.
Source: TecEx Global Compliance; BRC.
The Regulation adds a distinct category for connected toys — toys that establish a connection to the internet or to another device — and requires their safety assessment to specifically evaluate cybersecurity and data-privacy risks alongside the particular vulnerabilities of children using them as intended. It also cross-references the AI Act, the Cyber Resilience Act and the Radio Equipment Directive for toys that fall inside those regimes too, so a connected or IoT toy can carry safety obligations under more than one EU regulation simultaneously, not just the toy-specific rules. For our IoT and connected-device ICP segment, that makes this a directly relevant regulation, not an adjacent one.
Regulation (EU) 2025/2509 was published in the Official Journal on 12 December 2025 and entered into force on 1 January 2026. Entry into force is not the same as full applicability, though several compliance summaries state or imply otherwise: the Regulation gives industry a 54-month transition period, and the current Toy Safety Directive 2009/48/EC is only repealed, with the new Regulation becoming fully applicable, on 1 August 2030.
Two sets of obligations are pulled forward ahead of the 2030 general application date. Battery-safety requirements — restricting access to small batteries without a tool, and requiring rechargeable batteries in some toys to be removable or replaceable only by an independent professional — apply from February 2027. The Digital Product Passport and the Regulation's main enhanced safety obligations apply from mid-2028, replacing the paper Declaration of Conformity with a QR-code-accessible digital record.
CEN published revised versions of EN 71-1 (mechanical and physical properties) and EN 71-8 (activity toys) in early 2026, updated to align with the new Regulation. The current, pre-revision versions of both standards are fully replaced by July 2027 — after that date, a manufacturer citing EN 71-1 or EN 71-8 for presumption of conformity needs to be citing the 2026 revision, not the version it may have used for a product already on the market.
Yes, directly. The Regulation names connected toys — toys that establish a connection to the internet or another device — as a distinct category, requiring safety assessments that specifically evaluate cybersecurity and data-privacy risks alongside the particular vulnerabilities of children using them as intended. The Regulation also cross-references the AI Act, the Cyber Resilience Act and the Radio Equipment Directive for toys that fall within those regimes too, so a connected toy can carry obligations from more than one regulation at once.
The dates that matter depend on what you make: a battery-powered toy needs the February 2027 access and removability rules solved well before the DPP work starts, a connected toy needs a cybersecurity and data-privacy assessment on top of the standard EN 71 testing, and every toy needs a technical file that cites the right standard version once the pre-2026 EN 71-1/EN 71-8 texts expire in July 2027. We scope which of those tracks apply to your product range and manage the transition against the real dates, not the collapsed "it's all live now" version several summaries give.
Book a scoping call