Why Teams Still Ship PPWR via Excel, and Where It Breaks
Many European packaging manufacturers still run PPWR compliance on spreadsheets rather than on dedicated PPWR software. That is not a surprise. It is a workflow choice that once made sense and has since ossified. What is interesting is not how many teams work this way but the four organisational patterns underneath it, and the very specific moments at which each one breaks.
The patterns below are illustrative composites, not case studies of named companies. They describe workflows that are common in mid-size manufacturers, from a few dozen SKUs to several hundred. The breakage points follow from how each workflow is built, and from what PPWR now asks manufacturers to produce on request.
What “we use Excel” really means
When a manufacturer says they “use Excel for compliance,” they almost never mean a single spreadsheet. They mean a network: a master file in SharePoint, an email folder for supplier attestations, a binder of signed PDFs, and at the centre of it one analyst who can navigate the network in under five minutes. The network is held together by that analyst's working memory.
This worked, often for years, because PPWR did not yet apply, supplier requests were rare, and audits, when they happened, were narrow. PPWR has applied since 12 August 2026, and none of those conditions still hold.
Pattern 1 — The cross-brand workbook
The setup. One master Excel file in SharePoint. SKU rows below; brand columns to the right (Brand A, Brand B, Brand C). Each brand owner edits their own column. The compliance lead “rolls up” weekly into a summary tab.
Why it worked. No new tool to procure. Everyone knows Excel. One file, one source of truth, one weekly rollup. Defensible to the CFO.
How it breaks. As the SKU count and the number of editors grow, the file slows down, save conflicts become routine, and the working copy turns into “the version someone else has open.” When a national authority's request lands and the file is locked by a brand owner who left two weeks ago, the problem is not missing data. It is that nobody can retrieve it.
Pattern 2 — Email-as-workflow
The setup. Supplier sends a PFAS attestation PDF to a shared compliance inbox. The inbox has rules: subject contains “PFAS” → folder. The folder has subfolders by year, by quarter, by supplier.
Why it worked. Email is universal. Suppliers do not need to learn a new tool. PDFs feel “audit-ready” because they are signed and dated.
How it breaks. Cross-cutting queries. When an authority asks for the PFAS evidence behind all food-contact SKUs, the folder system, which indexes by date and supplier rather than by SKU, cannot answer quickly. Someone has to open attachments one by one. Under Article 15(10), documents requested by a national authority are due within 10 days. A team that needs most of that time just to find the files has little left for checking them.
Excel rarely fails because the formulas break. It fails when the one person who knows where the data lives is out of the office.
Pattern 3 — The compliance binder
The setup. A physical or PDF binder. Each SKU is a section. The section contains the specification sheet, the recycled-content certificate, the PFAS attestation, the supplier confirmation and the EU declaration of conformity.
Why it worked. Tactile, lawyer-friendly, each SKU feels complete on its own.
How it breaks. Updates. When the rules change, every affected section needs revisiting. The PPWR PFAS limits are the current example: since 12 August 2026, food-contact packaging must stay below 25 ppb for any single PFAS, 250 ppb for the sum of PFAS and 50 ppm for total PFAS (Article 5(5)). Every food-contact section built on an older supplier statement needs checking against those values. For a hypothetical 380-SKU portfolio at five minutes per check, that is more than 31 hours of work that few teams have spare. The binder remains, but it goes silently stale, and the staleness is invisible until someone looks at the dossier date.
Pattern 4 — The unicorn analyst
The setup. One person knows where everything is. The Excel master file, the email folder, the binder, the shared drive, the subcontractor data sources. They can answer any compliance question in minutes.
Why it worked. They are genuinely good. They built the system, they maintain it, and everything routes through them.
How it breaks. They go on leave. They get promoted. They leave the company. The institutional knowledge walks out with them, and the replacement spends weeks reconstructing what was held in working memory. If an authority request arrives during that window, the dossier exists only in the head of someone who is no longer there.
The moment Excel actually breaks
Across these patterns, the failure is rarely “the Excel formulas broke.” The breakage points are specific and repeatable.
- Personnel change. The unicorn analyst is unavailable; the replacement cannot navigate the network.
- Save conflict or file lock. The master workbook is inaccessible at the moment an authority request lands.
- Search timeout. The supplier dossier exists but cannot be found and checked in the time available.
- Stale data after a rule change. Nobody had the bandwidth to refresh existing data, and the staleness is discovered only when someone asks for it.
The four hooks that pull teams off Excel
Teams that move to a structured compliance platform rarely do so because they were sold on automation. They usually move because one of four very specific hooks lands.
- The audit-failure hook. An inspection or a customer audit goes badly. Remediation work, possible reformulation and, once national penalty rules are in place (due by 12 February 2027, Article 68), fines turn pain into urgency.
- The personnel-change hook. The unicorn analyst leaves or moves. The successor refuses to inherit “the system” and demands a structured replacement as a condition of taking the role.
- The regulator-request hook. An authority asks for a specific dossier, and the compliance team spends days compiling a response that a structured system would return in minutes. The decision to migrate often follows within the same week.
- The board-question hook. The CFO asks “what is our portfolio risk in numbers?” and the answer does not fit in an Excel rollup. This is the cleanest hook because it lands before an audit, not after one.
What you can do this week
If your compliance workflow matches any of the four patterns above, and many do, often more than one at once, three actions for the next seven days are worth more than any platform evaluation.
- Run a Day-1 drill on your own portfolio. Pick a plausible authority question, such as “show me the PFAS evidence for SKU X against the Article 5(5) limits,” and time yourself answering it. If the answer is not ready the same day, treat that as a sign that the retrieval layer is broken.
- Identify your unicorn. If one person could leave tomorrow and take most of the institutional knowledge with them, that person is your single highest-risk point. Document what they know within thirty days, regardless of platform decisions.
- Map your data flow. Where does supplier data enter? Where does it get filed? How is it retrieved? In the patterns above, most failures are retrieval failures, not collection failures. The data exists; it cannot be reached in the time available.