Who regulates you, and when
Updated
More regulators reach this product than any other in the estate, and none of them licenses you.
Four federal agencies and a state
EPA if you make a pesticidal claim. CPSC for hazardous substance labeling and child-resistant packaging. FTC for advertising. OSHA for workplace supply and for your own employees. DOT for transport. And California for ingredient disclosure.
No license, no pre-market approval and no inspection, unless you cross into pesticides. The obligations are continuous rather than gated, which is why they are easy to be unaware of.
EPA
Under FIFRA, any product claiming to kill or control microorganisms is an antimicrobial pesticide requiring registration.
The claim triggers it rather than the chemistry.
Registration brings efficacy data, product chemistry, an approved label, an establishment number and state registrations on top.
CPSC
The Federal Hazardous Substances Act and 16 CFR Part 1500: cautionary labeling for household products containing hazardous substances.
The Poison Prevention Packaging Act and 16 CFR 1700.14: child-resistant packaging above named thresholds, with sodium and potassium hydroxide at 2 percent the one that most often catches a cleaner.
FTC and OSHA and DOT
FTC for advertising claims, including the Green Guides on environmental and safety claims.
OSHA for the hazard communication standard: a safety data sheet and GHS labeling when supplying for workplace use, and information and training for your own employees.
DOT for transport, where a flammable, corrosive or oxidizing product is hazardous material with packaging, marking and documentation requirements.
Everyone else
California for ingredient disclosure and Proposition 65, plus VOC limits on consumer products, all attaching to selling into the state.
Other states with their own disclosure schemes and restricted substances.
Local fire code and waste disposal rules.
Your insurer, whose exclusions are more likely to affect you than any of the above.
And retailers, who in practice ask more questions than any regulator will.