Business Advice
GPSR: The General Product Safety Regulation and What It Requires of You
Most manufacturers learned about GPSR not from a legal bulletin but from Amazon, eMAG or another marketplace that suddenly demanded the name and address of an “EU responsible person” — or the listing would be suspended. That was not a platform whim but the enforcement of a regulation that has applied since 13 December 2024.
Two years on, many companies still have only what the platform asked for: a filled-in field. The Regulation itself requires considerably more — from anyone who manufactures or imports consumer products, not only from online sellers.
Key Takeaways
- Regulation (EU) 2023/988 (GPSR) has applied since 13 December 2024 and replaces Directive 2001/95/EC on general product safety.
- The scope is every consumer product for which no specific sectoral legislation exists — and for products that do have it, GPSR fills the gaps.
- The manufacturer owes an internal risk analysis and technical documentation — even where the product carries no CE marking and involves no notified body.
- A “responsible person” established in the EU is required for every product offered on the Union market. Without one the product cannot be lawfully made available.
- A complaints register is mandatory, along with investigation of those complaints — a requirement almost nobody actually meets.
- Dangerous products are notified through the Safety Business Gateway, alongside informing affected consumers.
- Online offers carry extra duties — a mandatory data set in every listing.
What GPSR is and who it covers
GPSR is Regulation (EU) 2023/988 on general product safety, adopted on 10 May 2023, in force since 30 May 2023 and applicable from 13 December 2024. It repeals Directive 2001/95/EC and turns general product safety from a nationally transposed rule into a directly applicable regulation.
The core rule is one sentence: only safe products may be placed or made available on the market. Everything else in the Regulation describes how that is demonstrated.
How it relates to sectoral law. If your product is machinery, a toy, electrical equipment or a medical device, its own specific regime applies. GPSR acts as a safety net — it covers the aspects and risks the sectoral act does not, and applies in full to products with no legislation of their own. The two regimes do not exclude each other; they complement each other.
The manufacturer’s obligations
- Safety by design. The product is designed and manufactured to be safe in normal and reasonably foreseeable use — including foreseeable misuse by children and vulnerable consumers.
- Internal risk analysis. The risks associated with the product are assessed and the result documented. This applies even where no harmonised standard exists.
- Technical documentation. The file describes the product, its essential characteristics and the risk analysis. It is retained and produced on request by the authority.
- Traceability. The product carries a type, batch or serial number, along with the manufacturer’s name and contact address.
- Information and warnings. Instructions and safety information in a language easily understood by consumers in the relevant country.
- Complaints channel and register. Consumers are given a way to complain, and an internal register of complaints, withdrawals and recalls is maintained.
- Corrective measures and notification. Where a product is suspected to be dangerous, action is immediate — corrective action, informing consumers and notifying authorities through the Safety Business Gateway.
Point 6 is the most neglected. The complaints register is not a formality — it is the evidence that you monitor your product on the market. At an inspection the first question is usually “show us the complaints from the last two years and what you did about them”. Answering “we have no complaints” without a register is worse than answering with three complaints and three investigations.
The EU responsible person
| Situation | Who the responsible person is |
|---|---|
| Manufacturer established in the EU | The manufacturer itself |
| Non-EU manufacturer with an EU importer | The importer |
| Non-EU manufacturer with no importer | An authorised representative in the EU |
| Direct sale from a third country to a consumer | An EU fulfilment service provider |
For a company that manufactures within the EU the question answers itself — you are the responsible person. But if you import products from a third country and resell them, you take on the importer’s role with its full weight: verifying conformity, retaining documentation and carrying liability for a dangerous product.
What online selling requires
The Regulation requires every online offer to display a minimum data set before purchase:
- the manufacturer’s name, registered trade name or trade mark, with a postal and electronic contact address;
- the same details for the EU responsible person where the manufacturer is outside the Union;
- product identification data, including an image, type and batch or serial number;
- warnings and safety information in the relevant language.
This is why marketplaces introduced mandatory fields. Filling them in, however, does not make you compliant — it only unlocks the listing. The remaining obligations, including the technical file and the complaints register, stay with you.
What happens with a dangerous product
- Immediate corrective action. Stopping sales, withdrawal from distributors or recall from consumers, according to the severity of the risk.
- Notifying the authority through the Safety Business Gateway, describing the risk, the affected batches and the measures taken.
- Informing affected consumers by means that actually reach them — directly where you hold contact details, publicly where you do not.
- A remedy for the consumer. On recall, repair, replacement or refund is offered, without limiting the choice to a voucher alone.
Where an ISO 9001 system helps
| GPSR requirement | Corresponding ISO 9001 element |
|---|---|
| Risk analysis and documentation | Design and development (8.3), risks and opportunities (6.1) |
| Batch traceability | Identification and traceability (8.5.2) |
| Complaints register | Customer satisfaction (9.1.2), nonconformity (10.2) |
| Corrective measures and recall | Corrective action (10.2) |
| Control of component suppliers | Externally provided processes (8.4) |
| Information and instructions | Customer communication (8.2.1) |
The conclusion is practical: a company certified to ISO 9001 already has 70–80 % of what is needed. What is missing is the aim — the risk analysis has to address consumer safety, not only quality, and complaints have to be kept as a register with deadlines rather than as emails in a sales inbox.
Do you hold a technical file for your products?
We review GPSR scope, prepare the risk analysis and the technical files, set up the complaints register and connect it all to your ISO 9001 system.
Conclusion
GPSR is legislation that looks abstract until a product incident happens. Then the questions become very concrete: did you have a risk analysis, did you keep complaints, did you notify the authority in time, and can you say which batches are affected.
Companies that answer with documents avoid the fine and keep the customer. Those that answer with explanations usually lose both. The difference is a few days of work, done in advance.
Frequently Asked Questions
What is GPSR and when did it start to apply?
GPSR is Regulation (EU) 2023/988 on general product safety. It was adopted on 10 May 2023, entered into force on 30 May 2023 and has applied since 13 December 2024, replacing Directive 2001/95/EC. As a regulation it applies directly in all Member States.
Which products does GPSR cover?
GPSR covers consumer products for which no specific EU sectoral legislation exists. For products with their own legislation, such as machinery, toys or electrical equipment, it applies in a complementary way — to the aspects and risks the sectoral act does not cover.
Do I need an EU responsible person?
Yes. A product may only be made available on the Union market if an economic operator established in the EU is responsible for it. For a manufacturer inside the EU this is the company itself. Where the manufacturer is outside the EU, the role falls to the importer, an authorised representative or a fulfilment service provider.
Is technical documentation required if the product has no CE marking?
Yes. GPSR requires the manufacturer to carry out an internal risk analysis and compile technical documentation regardless of whether the product is subject to CE marking. The file describes the product, its essential characteristics and the risk analysis, and is produced on request by the market surveillance authority.
What is the complaints register?
The manufacturer must provide a channel through which consumers can complain and must keep an internal register of complaints, withdrawals and recalls. The register records the complaints received and the outcome of their investigation. It is the main evidence that you monitor your product after it is placed on the market.
What must be done when a product is found to be dangerous?
Immediate corrective action is taken according to the severity of the risk, the market surveillance authority is notified through the Safety Business Gateway, and affected consumers are informed. On recall the consumer is offered repair, replacement or refund, without the choice being limited to a voucher alone.
Is ISO 9001 enough for GPSR compliance?
Not on its own, because GPSR is legislation rather than a standard and does not accept certificates as evidence. An ISO 9001 system does cover much of the required process — risk management, traceability, complaints, corrective action and supplier control — leaving the task of aiming those processes at consumer safety.