Back to Blog
Consumer Product Safety / CPSC Compliance 9 min read • Sep 19, 2026

CPSC Keeps Five Years of Test Records. Your 24-Hour Report Runs on a Chronology Nobody Wrote Down.

16 CFR 1107.26(b) keeps certification and periodic test records for five years, producible on request and translated into English within 48 hours. 16 CFR 1115.13(d)(6) then asks for a chronological account beginning with the first information that led to the report — facts that live only in a call nobody was required to keep.

CPSC keeps five years of test records while your 24-hour report runs on recollection. Under 16 CFR 1107.26(b) certification and periodic test records are retained five years, produced for the CPSC on request and translated into English within 48 hours. Under 16 CFR 1115.13(d)(6) the report must open with a chronological account of the first information that led to it, and no rule requires that conversation to be recorded or retained.

A quality manager at a juvenile products company takes a call on a Thursday afternoon. A retailer’s buyer mentions, almost in passing and mostly as small talk, that two stores have sent back the same stroller with a cracked hinge. It is not framed as a complaint. It arrives between a delivery-schedule question and a conversation about next quarter’s planogram. The call ends. Nobody writes it down.

Under 16 CFR 1115.11(a), that call may have already started the clock.

This is the part of consumer product safety reporting that surprises people who have read the regulation only for its deadlines. The famous number is twenty-four hours. The number that actually decides whether a firm reported late is the one nobody can see: the moment a person capable of understanding what they were hearing, heard it.

The Clock Starts When Someone Capable of Understanding It Hears It

16 CFR 1115.11(a) is explicit about the trigger. The Commission “will deem a subject firm to have obtained reportable information when the information has been received by an official or employee who may reasonably be expected to be capable of appreciating the significance of the information.”

Not when it reaches the legal department. Not when someone opens a ticket, files a complaint record or escalates it to the safety committee. When a person who would understand it hears it.

1115.11(b) then closes the escape route that most firms would reach for next. The firm is deemed to know “what a reasonable person acting in the circumstances in which the firm finds itself would know,” including whatever a “reasonably expeditious investigation” would have surfaced.

Read those two subsections together and the practical effect is this. A quality manager is, by any ordinary reading, an official who may reasonably be expected to appreciate the significance of two returns of the same component failure. Constructive knowledge attaches to the conversation whether or not anyone treated it as a reportable event at the time, and it attaches to what a diligent look would have found, not merely to what anyone actually went and found.

So the operative fact is a Thursday call. And the regulation that defines it contains no requirement whatsoever that the call be recorded, logged, summarised or retained.

Five Days to the CEO, Ten to Investigate, Twenty-Four Hours to File

The time computations in 1115.14 stack on top of that unrecorded moment.

1115.14(a) excludes weekends and holidays from the computation. That sounds like relief and is mostly a complication: it means the windows cannot be reconstructed by counting forward on a wall calendar, and it means the start date has to be accurate to the day before any of the arithmetic works at all.

Notice the shape of 1115.14(d) in particular. It is not a deadline in the ordinary sense. It is a deeming provision. Day ten does not merely end a period; it substitutes a legal assumption for a factual one. Whatever the firm actually knew on day ten, the Commission proceeds as though it knew everything a diligent investigation would have turned up. A firm that spent those ten days without realising the clock was running does not get those days back.

Every one of these windows is measured from a conversation, and none of them requires that conversation to exist in any durable form.

The clock cascade in 16 CFR 1115.14, running from a conversation no rule requires to exist. Information is heard by someone capable of appreciating it, then 1115.14(b) allows five days to reach the CEO, 1115.14(d) allows ten days to investigate and evaluate, and 1115.14(e) requires the report within 24 hours. 1115.14(a) excludes weekends and holidays from the computation, and 1115.11(b) deems the firm to know what a reasonable person would have known.
Every window in 1115.14 is measured from a conversation. Not one of them requires the conversation to have been recorded.

The Rule Says Attach the Drawings. It Only Asks You to Remember the Rest.

The asymmetry is not scattered across the regulation. It is written into a single list, two items apart.

16 CFR 1115.13(d)(4) says that if “technical drawings, test results, schematics, diagrams, blueprints, or other graphic depictions are available, attach copies.” The verb is attach. The artifact already exists in a fixed form, someone locates the file, and it travels with the report exactly as it was.

Two items later, 1115.13(d)(6) asks for “the manner in which and the date when the information about the defect, noncompliance, or risk … was obtained,” and then this: “Give a chronological account of facts or events leading to the report under section 15(b) of the CPSA, beginning with receipt of the first information which ultimately led to the report.”

The verb there is give, and there is nothing to attach. Engineering artifacts get produced. The first information — a buyer’s aside on a Thursday call — gets rebuilt from recollection, possibly months later, and its date is no longer a matter of memory or courtesy. It is a regulatory fact, and it is the fact from which an enforcement reviewer will count backwards to decide whether the firm reported immediately or reported late.

A chronology assembled this way has a characteristic failure mode. It is not usually wrong about what happened. It is wrong, or merely unsupported, about when the firm first heard it — which is the only element of the account that the deadlines actually run on.

Two items in one list from 16 CFR 1115.13(d). Item (d)(4) says that if technical drawings, test results, schematics, diagrams, blueprints or other graphic depictions are available, attach copies. Item (d)(6) asks for the manner in which and the date when the information was obtained, and a chronological account of facts or events beginning with receipt of the first information which ultimately led to the report.
Two items apart in the same list: the engineering artifact gets attached, and the conversation that gave it meaning gets remembered.

Records Last Five Years. The Conversation Lasts Until Friday.

Compare what the same agency demands of paper. Under 16 CFR 1107.26(b), a children’s product manufacturer must maintain certification and periodic test records for five years, make them available to the CPSC on request, and translate them accurately into English within 48 hours of a request.

That is a complete records regime in one subsection: a retention period, a production obligation and a turnaround time, all enforceable, all specific. It reflects a clear judgment that test results are too important to leave to anyone’s filing habits.

Five years of retention for the test result. No standard at all for the call that decided what the test result meant.

The gap is not an oversight so much as an artifact of what regulators can practically compel. Documents can be required to persist because documents already exist. Conversations would have to be created first, and no part of 1115 asks anyone to create them. The obligation to account for those conversations, however, survives in full.

And Someone Signs

1115.13(a) has the chief executive officer sign written reports unless that authority is delegated in writing, and the delegation certifies “the accuracy and completeness of information in such documents.”

Sit with what that means when combined with 1115.13(d)(6). One person — the CEO, or the individual to whom the CEO delegated in writing — attests to the accuracy and completeness of a chronology built from other people’s recollections of calls they never personally took. The signature is individual. The knowledge behind it is secondhand, distributed, and in the ordinary case undocumented.

Most compliance programs respond to this by tightening the review at the end: more sign-off layers, a longer approval chain, a legal read before filing. None of that improves the underlying record, because by the time a draft report exists, the Thursday call is already months gone. The review can only make the chronology more carefully worded. It cannot make it better evidenced.

Where the Chronology Is Actually Created

The fix sits upstream of the report, in places that do not feel like compliance while they are happening.

The retailer call. The supplier check-in. The Monday quality review where somebody says “we have seen three of these now.” Those are the moments 1115.13(d)(6) will eventually ask about, and the reason they go unrecorded is precisely that nobody in the room believes they are recording the start of a regulatory timeline. They are discussing a hinge.

By the time anyone knows a conversation mattered, the window to capture it faithfully has closed. Which means the only workable approach is to capture the ordinary ones, routinely, before anybody has decided which of them will turn out to be the first information.

AmyNote captures those conversations while they are still routine. Transcription runs on OpenAI’s Speech API and holds up on the vocabulary this work actually uses: substantial product hazard, date code, lot number, periodic testing interval. Speaker identification carries across sessions, so a remark stays attached to the person who made it, and every session is timestamped — precisely the pairing of manner and date that 1115.13(d)(6) asks for. Anthropic’s Claude Opus adds summaries and semantic search, so “when did we first hear about the hinge” becomes a query instead of an excavation through inboxes and calendars.

The honest limits belong in the same paragraph, not a footnote. Recording requires checking applicable consent law and company policy first, and rules differ by jurisdiction and by who is on the call. Once counsel opens a reportability review, those interviews usually belong to counsel and may be privileged; coordinate before capturing anything. AmyNote is iOS only, has no free tier, and holds no SOC 2, ISO 27001, HIPAA or GDPR certification.

On privacy, AmyNote does not use customer data to train AI models and does not sell content. Audio and text are encrypted in transit with TLS, and the saved library of recordings, transcripts and notes lives on the user’s iPhone or iPad. AmyNote is equally clear about the limit: local-first is not local-only, and when transcription or an AI summary runs, a processing copy may be retained on its cloud so the request can complete.

Getting Started

Twenty-four hours is not enough time to reconstruct who knew what, and when. It was never meant to be — the twenty-four hours begins after the firm already has information reasonably supporting the conclusion, which is to say after the five days, the ten days and the Thursday call that none of the deadlines require anyone to have kept.

Capture the calls while they are ordinary, and keep them searchable. AmyNote does that in a few taps, and the trial needs no credit card.

Originally published as an X Article by @AmyNoteApp.

The Chronology Is Created Upstream of the Report.

AmyNote records the retailer call, the supplier check-in and the Monday quality review while they are still ordinary, and keeps them timestamped and searchable. Transcription runs on OpenAI’s Speech API and analysis on Anthropic’s Claude Opus, both contractually barred from training on customer data, with TLS in transit and a local-first library on the device. One flat price per account: $12.99 a week, $19.99 a month or $99 a year, every feature included. The honest list first: iOS only, no free tier, and no SOC 2, ISO 27001, HIPAA or GDPR certification. Local-first is not local-only — when transcription or an AI summary runs, a processing copy may be retained. Recording requires checking applicable consent law and company policy, and once counsel opens a reportability review, coordinate before capturing anything.

3-Day Free Trial — No Credit Card

Related Articles