Supplier Sustainability Claim Verification Audit Guide

Written by: Scott Steveson, Specialist, Wellness Quality Institute

Key Takeaways

• US brands face growing legal and commercial risk when sustainability claims lack competent and reliable scientific evidence that meets the FTC substantiation threshold at 16 CFR 260.2.
• ISO 14021:2026 and ISO/IEC 17029 together create a two-layer model. ISO 14021 defines claim and evidence requirements, while ISO/IEC 17029 governs the competence of independent verification bodies.
• Recycled-content claims must distinguish pre-consumer from post-consumer material, include percentage disclosures, and rely on Transaction Certificates per shipment rather than Scope Certificates alone.
• Scope-locking prevents a single dataset from being extended beyond its verified product, facility, production period, and parameter range. This protection reduces the risk of overextended claims.
• The Wellness Quality Institute applies these standards through its Plastic-Free Pathway Verification program to help US teams convert laboratory data into defensible, scope-locked sustainability claims.

How ISO 14021 and ISO/IEC 17029 Work Together in Supplier Audits

ISO 14021 and ISO/IEC 17029 address different layers of the same problem. ISO 14021 governs what a self-declared environmental claim must say and what evidence must support it. ISO/IEC 17029 governs the competence and independence of the body that reviews whether a claim meets a defined standard.

ISO 14021:2026, published in June 2026 as the third edition, replaces ISO 14021:2016. The update introduces a significant structural shift. Self-declared environmental claims must now be developed and managed under a documented environmental statement programme, which is a formal internal system that sets criteria, evidence rules, and clear internal responsibilities. Ad hoc claims no longer satisfy the standard’s intent.

ISO 14021 is a requirements and guidance standard. It confers no “ISO 14021 certified” status, so a company either conforms to it or does not. That distinction matters because it leaves a gap. Conformance remains self-assessed unless an independent body reviews it.

ISO/IEC 17029 fills that gap. It defines the competence, impartiality, and process requirements for validation and verification bodies, which are the third parties that examine whether a claim meets a specified standard. Under ISO/IEC 17029, verification assesses past claims by checking reported data against existing evidence and records. Validation assesses forward-looking claims. For supplier sustainability audits, verification is the relevant function. A body reviews whether the supplier’s existing dataset supports the claim being made.

Together, the two standards create a two-layer model. ISO 14021 defines what the claim must be and what evidence must support it. ISO/IEC 17029 defines who can credibly decide whether that evidence is sufficient.

FTC Rules That Shape Recycled-Content Claims

The FTC Green Guides at 16 CFR 260.13 set specific rules for recycled-content claims that go beyond the general substantiation standard.

An unqualified recycled-content claim, which means a claim without a percentage, is permissible only when the entire product or package, excluding minor incidental components, is made from recycled material. Partial recycled content requires a clear and prominent percentage disclosure by weight. The FTC also requires that claims distinguish pre-consumer material, which covers manufacturing offcuts and waste diverted before reaching a consumer, from post-consumer material, which covers material recovered after consumer use. Pre-consumer material qualifies only when the supplier can show it would otherwise have entered the waste stream. Internal manufacturing scrap that is routinely reused within the industry does not qualify.

The FTC treats lack of documentation at the time a claim is made as lack of substantiation. That timing rule is critical for procurement teams. The evidence must exist before the claim is published, not assembled afterward in response to a challenge.

The FTC has also addressed the Möbius loop symbol, which is the three-chasing-arrows recycling icon. An unqualified Möbius loop on packaging is likely to convey both that the package is recyclable and that it is made entirely from recycled material. That interpretation requires substantiation for both messages or clear qualification of each.

Scope-Locking: Keeping Each Claim Tied to Its Data

Scope-locking keeps each sustainability claim tied to the exact dataset that supports it and blocks any extension beyond that boundary. This practice is the single most important control for preventing one product’s test result from turning into a company-wide or product-line claim.

A scope boundary specifies the verified product or SKU, the production or sampling period the data came from, the analytical method used, the tested parameter range, and the specific facility or supply chain node reviewed. A dataset collected from one production run at one facility does not support a claim about a different facility, a different formulation, or a different period.

Scope boundaries can appear in supplier contracts as a condition of using any sustainability claim in downstream marketing. To enforce these boundaries, the contract language should require the supplier to provide documentation of the exact scope covered by any dataset it supplies. This requirement prevents ambiguity about what the data actually covers. The contract should also prohibit the brand from extending that scope without fresh data, which keeps claims tied to verified evidence. Finally, it should specify re-verification triggers, which are events that require the supplier to produce updated evidence before the claim continues in use, because conditions change over time and stale data cannot support current claims.

The Wellness Quality Institute applies scope-locking as a core element of its Plastic-Free Pathway Verification program. Every verification decision is bound to a defined scope that covers the specific product, the tested particle-size range, the polymer panel reviewed, and the production period. No company-wide or product-line claim may be extended from a single dataset. Claims that exceed the registered scope are prohibited under WQI’s governing standard, WQI-CS-01.

How ISO/IEC 17029 Shapes Third-Party Verification Bodies

ISO/IEC 17029:2019 sets out requirements for the competence, impartiality, and consistent operation of validation and verification bodies. The standard mandates a formal impartiality policy, a dynamic risk register to identify and manage threats to independence, and a structured process for selecting, training, authorizing, and monitoring personnel.

The process structure that ISO/IEC 17029 requires includes pre-engagement competence review, strategic planning with sector-specific risk assessments, evidence collection, and independent technical review by personnel who were not involved in the original review work. It also requires documented protocols for handling post-issuance facts that could affect statement validity. That last requirement, a process for handling new information after a statement is issued, keeps a verification durable instead of a snapshot that becomes misleading as circumstances change.

Accreditation under ISO/IEC 17011, which is the standard for accreditation bodies, is the mechanism that confirms a verification body meets ISO/IEC 17029’s requirements. Accreditation makes a verification statement credible to third parties in a way that self-assessment cannot.

The Wellness Quality Institute applies the ISO/IEC 17029 model to plastic-content claims. The institute does not perform laboratory testing. That separation between the body that runs the tests and the body that reviews the results forms the structural basis of independence. WQI reviews existing laboratory datasets against defined criteria and issues a verification decision: Standard Met or Standard Not Met.

Shipment-Level Proof: Transaction Certificates vs Scope Certificates

Transaction Certificates and Scope Certificates serve different functions in a recycled-content supply chain, and both are required for a downstream claim to be defensible.

A Scope Certificate, used in frameworks such as the Global Recycled Standard, proves that a company is certified to produce compliant products within the standard’s scope, but does not by itself prove that every item sold is certified. It is a facility-level or operator-level credential. It confirms the supplier is capable of handling certified material and has the systems in place to do so. It is issued annually after inspection.

A Transaction Certificate is issued per shipment. It certifies that a specific shipment contains verified recycled content and is the document required for downstream sustainability claims. It lists the exact material, supplier, quantity, lot number, and valid dates.

The practical implication is straightforward. A Scope Certificate tells a procurement team that a supplier is qualified. A Transaction Certificate tells them that this specific order is what the supplier says it is. A certified operator can lawfully handle both certified and non-certified material on the same site, so a Scope Certificate alone cannot confirm whether a specific shipment came from the certified production run. Both documents are required, and the Transaction Certificate should be requested at the point of purchase order, not after delivery.

EU Empowering Consumers Directive: What It Means for US Suppliers

Directive (EU) 2024/825, the Empowering Consumers Directive (EmpCo), applies from 27 September 2026 to all companies that communicate environmental or sustainability claims to consumers in the EU, including companies based in the US. Geographic location of the company does not determine applicability. The location of the consumer does.

Under EmpCo, non-specific environmental claims such as “green,” “sustainable,” or “environmentally conscious” are prohibited unless they are specific, substantiated, and verifiable. Sustainability labels and seals may only be used if awarded by a state authority or based on a transparent, audited certification system. Company-owned labels that give the impression of third-party certification are not permitted.

Violations may result in fines of up to 4% of annual EU turnover, confiscation of revenues from misleading claims, and market access restrictions or bans.

For US suppliers selling into EU markets, EmpCo creates a direct substantiation obligation that mirrors, and in some respects exceeds, FTC requirements. The practical effect is that a supplier’s evidence package must satisfy both regimes at the same time. A claim that passes FTC scrutiny may still fail EmpCo if it lacks the audited certification system or verifiable target documentation the directive requires.

The UK Competition and Markets Authority’s January 2026 guidance, “Making green claims: Getting it right, across the supply chain,” adds a parallel obligation for suppliers reaching UK markets. That guidance advises downstream entities such as retailers not to assume upstream claims are compliant, but instead to maintain contractual arrangements and regular evidence checks. This approach places the verification burden on the supply chain as a whole, not only on the brand making the consumer-facing claim.

Evidence Boundary Checklist for Supplier Claims

The table below maps common sustainability claim types to the evidence layers required to substantiate them under the frameworks discussed in this article. Every data point is drawn from the sources cited inline above.

Claim Type	Minimum Evidence Required	Key Standard or Authority	Common Deficiency
Recycled content (percentage)	Percentage by weight, pre/post-consumer distinction, chain-of-custody documentation, Transaction Certificate per shipment	16 CFR 260.13; ISO 14021:2026	Scope Certificate presented without Transaction Certificate; pre-consumer scrap misclassified as post-consumer
Plastic or microplastic content reduction	Independent laboratory dataset; defined particle-size range and polymer panel; method documentation; blank and contamination controls; scope-locked to specific product and production period	FTC 16 CFR 260.2; WQI-CS-01	Single dataset extended to product line; detection floor not disclosed; method not validated for the product matrix
General environmental benefit (“eco-friendly,” “green,” “sustainable”)	Life cycle assessment or specific attribute measurement with comparison baseline; third-party review where available; claim must not imply no negative environmental impact	FTC 16 CFR 260.4; ISO 14021:2026; EmpCo Directive (EU) 2024/825	Unqualified claim with no specific attribute identified; vague terms used as standalone claims
Forward-looking sustainability target (“on track to be plastic-free by 2030”)	Publicly accessible, verifiable targets; realistic implementation plan with allocated resources; transparent progress reporting; documented baseline	EmpCo Directive (EU) 2024/825; ISO/IEC 17029 (validation function)	Target stated without implementation plan or funding allocation; no baseline data to measure progress against

Re-verification Triggers and Evidence Freshness

A verification decision reflects the evidence available at a specific point in time. Several events make that evidence stale and require fresh data review before a claim continues in use. Each of the following triggers represents a change that could invalidate the original dataset’s applicability to the current product or process.

Events that trigger re-verification include:

• A change in the product formulation, packaging material, or manufacturing process
• A change in the supplier providing a key input material
• A change in the production facility or a significant change in production volume
• A change in the analytical method or laboratory used for testing
• A regulatory update that alters the substantiation standard applicable to the claim
• A legal challenge or enforcement inquiry that calls the existing evidence into question
• Expiration of the verification period

WQI applies a 24-month maximum verification period, measured from the sampling date of the most recent accepted dataset. Continued claim use after expiration requires re-verification using current data. Expired registry entries remain publicly visible and marked “Expired.” The record stays honest over time instead of quietly disappearing. That transparency keeps a verification credential meaningful at the moment a retailer, journalist, or litigant checks it.

Frequently Asked Questions

Does ISO 14021:2026 create a certification?

No. As explained earlier, ISO 14021 is a conformance standard, not a certification. Companies sometimes seek “ISO 14021 certification” because other ISO standards, such as ISO 9001, do offer certified status. The key difference is simple. ISO 14021 defines what a claim must look like and what evidence must support it, but leaves the assessment of conformance to the company itself or to a separate verification body under a different framework such as ISO/IEC 17029.

What happens if a supplier’s dataset fails scope review?

The outcome depends on the review framework in use. Under WQI’s Plastic-Free Pathway Verification program, a Standard Not Met outcome is private. It carries no public claim, no logo rights, and no registry listing. It is never described as a failed product, because the outcome often reflects the testing rather than the product itself. Common issues include an unsupported analytical method, reporting limits that do not meet the required threshold, incomplete contamination controls, or a dataset that covers a narrower scope than the claim being made.

The company may submit corrected or additional information for future review. Participating in the review process creates no public downside risk. For procurement teams writing supplier contracts, the equivalent protection is a clause requiring suppliers to notify the brand immediately if a dataset fails an internal or third-party scope review, and suspending the related claim until updated evidence is available.

How does the EU Empowering Consumers Directive affect US suppliers who do not sell directly into the EU?

The directive applies based on where the consumer is located, not where the company is based. A US supplier whose products reach EU consumers through a distributor, retailer, or e-commerce channel falls within scope. Beyond direct applicability, the directive creates indirect pressure through supply chains. EU-based brands and retailers subject to EmpCo must substantiate the environmental claims they make about their products. They will increasingly require their US suppliers to provide traceable, audited evidence behind any sustainability claim that feeds into a consumer-facing statement.

The UK Competition and Markets Authority’s 2026 supply chain guidance creates a parallel obligation for suppliers reaching UK markets. US suppliers whose claims may reach either market should document their evidence in a way that satisfies both FTC substantiation requirements and the audited-certification expectations of EmpCo.

Why is a raw laboratory report insufficient to support a recycled-content or plastic-reduction claim?

A laboratory report records what an instrument found under specific conditions. It does not, on its own, show that the method was appropriate for the product matrix, that contamination controls were adequate, that the reporting limits are sufficient to support the claim being made, or that the result applies to anything beyond the specific lot and parameter range tested.

The FTC requires that substantiation exist at the time a claim is made and that it consist of competent and reliable scientific evidence. That phrase means the evidence must be evaluated by qualified persons using methods generally accepted in the relevant profession. A raw report satisfies none of those requirements independently. Independent review of the dataset, method, and controls against a defined standard converts a laboratory result into a defensible market claim. That review also prevents a single product’s result from being extended, without fresh evidence, into a claim about an entire product line or company.

Scope-Locking Checklist for Supplier Contracts

The following checklist is designed for procurement and legal teams to adapt and insert into supplier agreements where sustainability claims are a condition of supply. Each item addresses a specific enforcement or litigation risk identified in the frameworks discussed above.

1. Define the claim scope in writing. Specify the exact product or SKU, the production or sampling period, the facility, and the parameter range covered by any dataset the supplier provides in support of a sustainability claim.
2. Require pre-consumer/post-consumer distinction. For recycled-content claims, require the supplier to document and distinguish pre-consumer from post-consumer material, with evidence that pre-consumer material would otherwise have entered the waste stream.
3. Require Transaction Certificates per shipment. Do not accept a Scope Certificate as shipment-level proof. Require a Transaction Certificate for each order where a recycled-content or sustainability claim applies.
4. Prohibit scope extension without fresh data. Include an explicit clause prohibiting the brand from using a dataset to support a claim beyond the scope it covers. Require the supplier to notify the brand before any change that would affect the claim’s validity.
5. Specify re-verification triggers. List the events, such as formulation change, supplier change, facility change, method change, or regulatory update, that require the supplier to produce updated evidence before the claim continues in use.
6. Require independent review for material claims. For claims that will appear on consumer-facing packaging or in retailer submissions, require that the supporting dataset be reviewed by an independent third party against a defined standard, not self-reported.
7. Set a maximum evidence age. Specify that datasets older than 24 months from the sampling date are insufficient to support an active claim without re-verification.
8. Require disclosure of detection limits. For plastic or microplastic content claims, require the supplier to disclose the analytical method’s detection floor and the polymer panel tested. Prohibit any claim that implies detection below the method’s validated range.
9. Address EU and UK market obligations. If products may reach EU or UK consumers, require that the supplier’s evidence package satisfy the substantiation expectations of Directive (EU) 2024/825 and the UK CMA’s supply chain guidance, not only FTC requirements.
10. Retain documentation before the claim is made. Require that all supporting documentation be provided to the brand and retained before any claim is published, not assembled in response to a challenge.

Turn real lab data into a claim you can support. Talk to the Wellness Quality Institute about Plastic-Free Pathway Verification.