For retailers whose catalogue cannot be sold to everyone

Age Restricted and Regulated Product Integration

Some catalogues carry rules. A product may be lawful in one state and prohibited in the next, may need an age check at the door rather than at the checkout, may be limited to a certain quantity per purchase, or may simply not be allowed on an aeroplane. In most businesses those rules live in the heads of two experienced staff and in a note taped to a monitor.

This page is about moving them into the systems instead: compliance attributes held on the product record, enforcement at checkout based on the destination and the customer, dispatch that produces the right documentation and refuses the wrong carrier, identification captured and recorded at handover, and an audit trail you can produce without a week of searching.

Book a Compliance Systems Call (03) 9003 0111

The Shape of the Risk

8 jurisdictions

Six states and two territories

With genuinely different rules on several common product categories

Per product, per state

The level the rules actually work at

A single national policy is either too strict to trade on or not strict enough

2 checkpoints

Checkout and handover

Passing one does not satisfy the other, and both need recording

Audit on request

What a regulator or insurer asks for

Records you can produce quickly are worth more than policies you can quote

Four Reasons Compliance Belongs in the Data

Every one of these problems is solvable with rules on a product record, and almost unsolvable with training alone.

Australian rules differ by state and territory

Liquor licensing, delivery conditions, weapons and knife legislation, pool and agricultural chemicals, fireworks and several other categories are regulated at state and territory level, and the differences are material rather than cosmetic. Products that are entirely ordinary in one jurisdiction are prohibited in another, and delivery conditions such as identification at handover or restricted delivery times vary as well. A national rule set cannot express that. A destination aware rule set can.

Compliance is product data, not policy prose

If the only record that an item needs an age check is a paragraph in a staff manual, then every channel, every feed and every new employee is an opportunity to get it wrong. Restrictions belong on the product as structured attributes: minimum age, permitted and prohibited destinations, quantity limits, whether identification is required at handover, whether a licence or permit must be recorded, whether it can travel by air. Once they are data, every system downstream can respect them.

An age gate at checkout is not an age check

A tick box asking whether the customer is over eighteen is a statement of intent, not verification, and for many categories the obligation attaches at the point the goods are handed over. That means the delivery process has to be part of the compliance design: no authority to leave, identification sighted and recorded, refusal handled properly with the goods returned, and the record kept. Building the checkout carefully and ignoring the doorstep leaves the real risk untouched.

The rules follow the product into marketing

Advertising restrictions apply to several regulated categories, and the major advertising and shopping platforms have their own policies on top of the law. Restricted lines need to be suppressed from product feeds, excluded from automated recommendation widgets and email campaigns where appropriate, and kept out of promotions that would breach local rules on discounting or inducements. If the compliance flag lives on the product, the marketing integrations can honour it automatically rather than relying on someone remembering.

Six Controls That Do the Work

These are the mechanisms that turn a compliance position into behaviour the systems enforce every time.

Rules attached

Compliance attributes

Each product carries its restriction data: category, minimum age, permitted and prohibited states and territories, quantity caps per order and per period, licence or permit requirements, dangerous goods classification and transport limitations. Maintained once in the system that owns product data and syndicated to every channel, so the online store, the marketplaces and the trade portal all apply the same rules.

Blocked early

Checkout enforcement

The cart checks the delivery destination against each line, applies quantity caps, captures date of birth or permit details where they are required, and blocks or warns with an explanation rather than a generic error. Telling a customer plainly that an item cannot be delivered to their state saves a cancellation, a refund and a complaint, and it is much cheaper than discovering it at dispatch.

On file

Permit and licence capture

Where a purchase requires the customer to hold a licence, permit or professional registration, the details and any document are captured at the point of order, checked for expiry, and attached to the order record. For trade and account customers the credential can sit on the account with its expiry monitored, so a lapsed permit stops the next order rather than being noticed at an audit.

Shipped legally

Dispatch and documentation

Dangerous goods classifications drive carrier selection, packing rules, segregation and labelling, and the paperwork is generated rather than handwritten. Items that cannot travel by air are kept off air services automatically, and orders needing identification at handover are flagged to the carrier and excluded from authority to leave, because a parcel left at a door is a compliance failure as well as a customer service one.

Recorded

Identification at handover

For categories where the check happens at delivery or collection, the requirement travels with the consignment, the outcome comes back, and refusals are handled as a defined process with the goods returned and the payment resolved. The same applies at a collection counter, where the staff prompt and the record need to exist in the system rather than depending on the person rostered that day.

Evidence ready

Audit trail and reporting

Who was verified, how, when, by whom, what was declared, which permit was relied on and which rule applied at the time. Kept for the retention period that applies to your category, searchable by order and by customer, and exportable. This is the part that makes an inspection, an insurance question or a complaint a short conversation.

Compliance Tasks, Before and After

Task	Traditional	Rules in the System	Notes
Order to a state where an item is prohibited	Caught at dispatch, if at all	Blocked at checkout with a reason	The explanation matters: a clear message prevents the support contact as well as the breach.
Quantity limits	Policed by an alert staff member	Capped per order and per period	Per period caps need customer matching, so duplicate accounts undermine the control.
Licence or permit purchases	Emailed copies in a folder	Captured, expiry monitored	An expired credential should stop the next order automatically rather than at audit.
Dangerous goods on air freight	Rejected at the depot	Service excluded automatically	Aerosols, flammables and certain batteries are the usual culprits, and rejections cost days.
Identification on delivery	Left to the driver to remember	Flagged on the consignment	Also means no authority to leave, which needs to be set rather than assumed.
Restricted lines in ad feeds	Removed manually, sometimes	Suppressed by the product flag	Platform policies are stricter than the law in several categories, so the flag should cover both.
A regulator asks for records	A week of searching	Exported from the order history	Retention periods differ by category, so the design has to know which applies.
Marketplace seller lists a restricted item	Discovered by a customer	Screened at submission	Platform operators carry their own exposure here, separate from the seller’s.

Where Restricted Product Selling Goes Wrong

Rules hard coded into the website theme

A developer adds a state restriction to the checkout template because it was quick. Two years later nobody remembers it exists, the marketplace channel does not have it, and a replatform loses it entirely. Restrictions belong on the product record in the system that owns product data, applied by the integration layer to every channel. That way a rule change is a data change, and adding a channel does not mean rebuilding the compliance logic from memory.

Assuming the courier will enforce anything

Carriers vary widely in what they will do about identification checks, and some will not do them at all on standard services. If your compliance position depends on a check at the door, you need a service that genuinely provides it, confirmed in writing, with the requirement flagged on every consignment and the outcome returned to you. Equally, do not assume a carrier will catch a dangerous goods item you failed to declare. Sometimes they will, and the ones that do not are the expensive ones.

Age gates that record nothing

A tick box that is not stored, or a date of birth field that is never retained, gives you no evidence at all. Decide what you need to be able to prove for each category, capture that, and keep it for the required period. At the same time, do not collect more than you need. Identity documents are sensitive information under the Privacy Act 1988 and the Australian Privacy Principles, so record the fact and the type of check rather than keeping scans of licences when that is not required.

One national rule applied everywhere

Businesses often respond to complexity by adopting the strictest rule nationally. It is defensible and it costs sales, sometimes a lot of them in the states where the product is perfectly ordinary. The alternative is not recklessness, it is destination aware rules maintained deliberately with legal input, reviewed on a schedule because these laws change. If you are going to be strict, at least know the price of it and revisit the decision rather than leaving it in place by default for a decade.

Promotions that breach category rules

Several regulated categories restrict how products may be promoted, including limits on discounting, inducements, loyalty points and free samples, and some restrictions apply in particular states only. Promotional engines rarely know any of this. The safe pattern is for the compliance flag to feed the promotion rules, so a restricted line cannot silently be included in a site wide discount or a points multiplier that is not permitted where the customer lives.

Over engineering a small problem

If you sell five restricted lines into one state, a review queue and a well trained team may be entirely adequate, and we will tell you that. The case for building enforcement into the systems grows with the number of restricted lines, the number of channels, the number of jurisdictions you ship to and the seriousness of the consequence. What we would not accept is the middle position, where the rules are real, the volume is meaningful, and the enforcement is somebody’s memory.

How Yes AI Approaches Compliance Integration

We start from your legal position

We are systems people, not your lawyers. You or your adviser define what the rules are for your categories and jurisdictions, and we turn that into product attributes, checkout behaviour, dispatch controls and records. Keeping that boundary clear is how the result actually matches your obligations.

Rules once, enforced everywhere

Restrictions are held as data in the system that owns products and applied by the integration layer to the website, the marketplaces, the trade portal, the tills and the feeds. Adding a channel then inherits the compliance position instead of reopening it.

Built, hosted and monitored by us

The integration runs on a managed cloud automation layer we operate, with record level logging and same day alerting. When a carrier changes what it will accept or a channel changes a policy, that surfaces as an alert rather than as a rejected consignment.

Records designed for the inspection

Verification events, permits relied on, the rule version applied at the time and the retention period for your category, all searchable and exportable. We design the audit trail as a deliverable rather than as a side effect of logging.

From Notes on a Monitor to Enforced Rules

Five steps. A first category enforced across checkout and dispatch is usually live in five to eight weeks.

Document the rules with your adviser

Per category and per jurisdiction: age, destination, quantity, permit, transport and promotion restrictions, plus record keeping and retention obligations. This is the input, and it needs to be authoritative.

Model them as product attributes

A structured attribute set that can express every rule you documented, held in the system that owns product data, with an owner responsible for maintaining it as laws change.

Enforce at checkout and in dispatch

Destination and age checks, quantity caps, permit capture, carrier and service selection, documentation and handover requirements. Built with clear customer messaging rather than silent failures.

Pilot on the highest risk category

Live on the category with the most exposure, with manual review running in parallel for the first few weeks so we can compare the system decision against the experienced human one.

Extend, review, keep current

Remaining categories and channels, then a scheduled review of the rule set because this legislation moves. Monitoring, documentation and audit exports confirmed with whoever would face the inspection.

FAQ

Can an online store really apply different rules by state?

Yes, and for several categories it is the only way to trade sensibly across Australia. The mechanism is straightforward once the data model is right: each product carries permitted and prohibited destinations, the cart evaluates the delivery address against every line, and the customer gets a clear explanation rather than a failed order. The work is not technical, it is in establishing the rules accurately with legal input and keeping them current, because state and territory legislation in these categories changes more often than most retailers expect. That maintenance needs an owner.

Is a date of birth field at checkout enough for age restricted products?

Rarely, on its own. A self declared age is a statement by the customer, and for many categories the obligation attaches at the point of handover rather than at the point of sale. The practical position for most Australian retailers selling age restricted goods online is to do both: capture and retain the declaration at checkout, then require identification at delivery or collection with no authority to leave, and record the outcome. Your specific obligations depend on the category and jurisdiction, which is a question for your adviser rather than for us, and we build to whatever they confirm.

How do we keep dangerous goods off the wrong freight service?

By treating the classification as product data and letting it drive service selection. Aerosols, flammable liquids, certain lithium batteries, some pool and garden chemicals and a range of other items are restricted or prohibited on air services and subject to packing, labelling and documentation requirements on road. Once the classification and any transport limitation sit on the product record, the integration can exclude unsuitable services automatically, apply packing and segregation rules at the bench, and generate the declarations rather than relying on someone remembering which lines are a problem.

What records should we keep, and for how long?

Enough to show that the control operated, for as long as your category requires. In practice that usually means the verification event with its type, time and outcome, the permit or licence relied on if any, the rule version in force when the order was placed, the delivery outcome including any refusal, and the identity of the staff member or carrier involved. Retention periods vary by category and jurisdiction, so it is worth confirming yours. One caution: collect the minimum that satisfies the obligation, because identity documents are sensitive information under the Privacy Act 1988 and holding scans you do not need is its own risk.

We operate a marketplace. Who is responsible if a seller lists a restricted item?

The seller carries their obligations and the operator carries its own, and pointing at the seller is not usually a complete answer. Practically, an operator should screen submissions against a prohibited and restricted list, require sellers to declare restricted categories, apply your destination and age rules to their offers rather than trusting them to, and be able to remove a listing quickly. That screening belongs in the catalogue moderation process so it happens before anything becomes visible, not after a customer notices. Get advice on your specific exposure, because it varies by category.

Will this stop us from advertising and promoting properly?

It should stop you promoting in the ways that are not permitted, and leave the rest alone. Several regulated categories limit advertising, discounting and inducements, and the major advertising and shopping platforms apply their own policies which are often stricter than the law. Having the restriction on the product record means feeds can exclude those lines automatically, campaigns can filter them, recommendation widgets can skip them, and promotion rules can refuse to apply a site wide discount where it is not allowed. The alternative is a person remembering every time, which works until the week they are on leave.

How long does this take and what does it cost to run?

A first category enforced across checkout and dispatch is typically five to eight weeks once the rules are documented, and documenting them properly with your adviser is often the longer part. Ongoing cost matters more in this area than most, because the legislation and the carrier and platform policies keep moving: budget for hosting, monitoring, a scheduled review of the rule set, and same day response when something changes. Across integration work of this kind, ongoing support tends to run roughly twenty to forty percent of the initial build over time. We quote a fixed build price plus a flat monthly managed fee.

Put the Compliance Rules Where They Cannot Be Forgotten

Book a call. Bring the rules your adviser has set and we will show you how they become product data, checkout behaviour and an audit trail.