What Retailers Must Do To Stay Vape Law Compliant
What UK Retailers
Must Do to Stay
Vape Law Compliant
Five working pillars sit behind every legally compliant UK vape retailer. Age verification at 18, MHRA notified stock only, TPD labelling audits, WEEE take-back plus documented due diligence records. Here is how each one runs in practice.
A UK vape retailer stays compliant by running five pillars in parallel. Age verification on every sale with Challenge 25 in store plus digital ID at online checkout. MHRA notified stock only cross-checked against the gov.uk notified product database. Labelling and packaging audits on every delivery to catch undersized health warnings, missing batch codes or non-English labels. WEEE take-back scheme membership plus in-store or postal return for customers. Documented due diligence records retained for six years covering training, test purchase results, supplier invoices plus Trading Standards correspondence. Skip any of the five and the retailer is exposed to penalty action.
Three numbers every UK
vape retailer plans around
Buyer age, record retention plus health warning size. Trading Standards officers test every retailer against these three numerical anchors first.
Minimum buyer age
The legal minimum buyer age for every vape product. Challenge 25 plus digital age verification keep the margin.
Record retention window
The standard UK period retailers keep age verification logs, supplier invoices plus training records.
Pack warning coverage
Minimum front and back pack area that must show the nicotine health warning on every SKU stocked.
Five pillars that keep a UK vape retailer on the right side of the law
UK vape compliance is not complicated in principle. It is about running five things well every single day. Every Trading Standards investigation lands on one of these five pillars. Every fixed penalty notice or prosecution is a failure of at least one of them. Here is what each pillar actually looks like in a working UK vape shop or online store.
Pillar 1: age verification on every sale
The buyer must be 18 or over. Every single transaction has to carry evidence of that. In store this means Challenge 25 plus staff who know how to apply it. Online this means a second-factor age check at checkout.
- In-store Challenge 25. If a buyer looks under 25, ask for photo ID. Accept passport, UK photo driving licence or PASS card only.
- Online digital ID. Yoti, AgeChecked or a credit reference bureau check plus optional courier signature on high-risk orders.
- Refusal register. Every declined sale logged with date, time, reason plus staff initials. Evidence of an active policy.
- CCTV behind the counter. Footage retained for at least 28 days covering every till position.
Pillar 2: MHRA notified stock only
Every SKU on the shelf must be on the MHRA notified e-cigarette product database. Retailers do not notify products themselves but they are liable for selling non-notified stock. The check runs on every new line before it reaches customers:
- Supplier due diligence. Check every supplier’s trading history plus ask for MHRA notification numbers before ordering.
- SKU database cross-check. Verify every new flavour plus strength against the gov.uk database before listing.
- Ongoing monitoring. Subscribe to MHRA safety alerts. Remove any recalled SKUs within 28 days.
- Record keeping. Link every SKU in your till system to its MHRA notification reference.
Pillar 3: labelling and packaging audits
Labelling is the single most common trigger for Trading Standards action. A routine delivery audit catches 90% of the issues. Check every new batch for:
- 30% health warning front and back of the retail pack.
- English-language ingredient list plus nicotine strength clearly printed.
- Batch code plus expiry date readable without a magnifying glass.
- UK producer or importer address not a PO Box.
- Child-resistant closure on every e-liquid bottle.
- No youth-appeal imagery or health claims anywhere on the packaging.
Pillar 4: WEEE take-back registration
Any retailer selling rechargeable vape devices is drawn into the WEEE Regulations. The duties split into two parts:
- Distributor Take-Back Scheme (DTS) membership or an equivalent alternative such as a compliance scheme.
- In-store drop-off for spent vapes. Free of charge regardless of brand or where purchased.
- Online return route for internet retailers. A prepaid postal envelope typically does the job.
- Signage at the counter advising customers of the take-back option.
- Partner with a producer compliance scheme such as Valpak or Ecosurety if scale warrants.
Pillar 5: due diligence records
The final pillar is the paperwork. Under the Nicotine Inhaling Products Regulations 2015 retailers have a statutory defence where they can show they took all reasonable precautions. The defence only works if the documentation exists:
- Staff training records. Documented Challenge 25 training plus refresher dates for every employee.
- Age verification logs. Refusal register plus digital verification audit trail.
- Supplier invoices plus MHRA reference file. One record per SKU linking purchase to notification.
- Test purchase results. Any Trading Standards test purchase result plus the retailer’s response plan.
- Incident log. Record of any suspected proxy purchase or under-age attempt plus the resolution.
- Annual compliance review. Internal audit signed off by a senior manager plus retained in a compliance file.
Four daily habits that
keep a UK vape retailer legal
Challenge 25 on every sale
If the buyer looks under 25 ask for ID. No exceptions. Log refusals. Check the till before each shift.
Check every delivery
Inspect labelling, batch codes plus packaging on each new box. Reject any SKU that fails before it enters stock.
Empty the take-back bin
Empty the in-store vape take-back bin weekly. Arrange collection with your WEEE scheme on the agreed schedule.
File the compliance paperwork
Every training log, delivery audit plus refusal record gets filed in the compliance folder. Six-year retention.
Compliant UK vape retailer vs
retailer exposed to enforcement
Trading Standards officers build an initial risk profile on every visit within about ten minutes. Here is what they are looking for on each side of the line.
Low enforcement risk
- ✓Challenge 25 signage at the counter with refusal log visible.
- ✓MHRA reference file linking every SKU to a notification number.
- ✓Delivery audit form completed on every new batch.
- ✓Take-back bin with clear customer messaging.
- ✓Staff training records including refresher dates.
- ✓Annual compliance review signed off by a senior manager.
High enforcement exposure
- ✗No visible Challenge 25 signage or training records.
- ✗Unknown stock origin. No link between SKU plus MHRA notification.
- ✗No delivery audit. New stock goes straight to shelf.
- ✗No take-back bin or customer signage.
- ✗Verbal staff training only. No dated records.
- ✗No compliance folder. Nothing to show an inspector on arrival.
Retailer compliance sits at the sharp end of UK vape regulation. For the full set of FAQs covering age verification, MHRA notification, labelling plus the 2026 vape tax visit our vaping FAQs hub. Every major UK vape compliance question sits inside.
Back to the Vaping FAQs hub
This article sits inside our complete FAQs knowledge base. Head back to the hub for the full index covering MHRA rules, TPD, the 2025 disposable ban, the 2026 vape tax plus retailer compliance.
More on UK vape retailer compliance
Retailer compliance is built on three deep topics. Our dedicated guide on age verification laws for vaping in the UK covers every accepted method plus the records Trading Standards expect to see. Our breakdown of penalties for selling vapes to underage customers sets out the FPN plus court consequences that follow a failed test purchase. Online retailers face a set of additional duties covered in how online vape sales are regulated.