The new GPSR guideline breaks down the core obligations for businesses.

The General Product Safety Regulation (GPSR), (Regulation (EU) 2023/988), has been setting the new general framework for non-food consumer product safety in the EU since its application date of 13 December 2024.

This Regulation repeals the former General Product Safety Directive (GPSD) and is now actively enforced by national Market Surveillance Authorities (MSAs) across the Union.

Our analysis draws directly from the new European Commission’s official guideline, finalized in November 2025 based on feedback and questions raised during this first year of implementation, and aims to help businesses, particularly SMEs, better understand and fulfil these obligations.

The guideline’s core insights are:

• The GPSR applies to all consumer products, including software and applications.
• Establishes consistent safety requirements across online and offline markets.
• Modernises risk assessment with expanded safety considerations.

Compliance is mandatory, and businesses that breach their obligations can be subject to fines imposed by Member States.

The GPSR casts a remarkably broad net of product coverage, extending far beyond traditional physical goods.

If a consumer can buy it, GPSR applies.

This wide scope ensures that virtually every product consumers might encounter falls under careful safety scrutiny.

The regulation applies to an extensive range of products, including:

• Tangible physical products.
• Non-tangible digital products.
• Mixed-nature items.
• Software and standalone applications.

This broad definition confirms that the Regulation covers:

• New, used, repaired, and reconditioned products.
• Software and APPs (including for example chatbots).
• Non-Harmonised product categories not covered by specific EU harmonisation legislation, such as childcare articles, furniture, and gymnastic equipment.
• Products with specific EU safety legislation (harmonised products), only to the risks or aspects not covered by that specific legislation.

The GPSR modernises risk assessment by expanding the scope of hazards that manufacturers must consider by expanding the definition of safety beyond physical harm.

Safety risks now explicitly cover threats to physical health, mental health and psychological well-being effects.

For instance, a product’s design should not create risks for consumers’ cognitive abilities or cause depression, anxiety or poor sleep quality.

The mandatory risk assessment must now incorporate risks arising from new technologies:

• Cybersecurity features: Measures necessary to protect the product against external influences.
• Evolving functionalities: Risks posed by self-learning or predictive capabilities.
• Interconnection: The effect a product may have on other products, and vice-versa (e.g., software causing device overheating).

All businesses involved must also take due account of the precautionary principle, proactively preventing hazards when there are reasonable grounds for concern, even where scientific evidence is uncertain.

Taking this principle into account during the design stage ensures the product is “safe by design”.

For any product covered by the GPSR and offered to EU consumers, there must be a Responsible Person (RP) established within the EU.

The RP requirement extends to all non-harmonised products, expanding upon the scope of the Market Surveillance Regulation (MSR).

This designation follows a mandatory cascade:

1. EU Manufacturer (if established in the EU).
2. Importer (if the manufacturer is established outside the EU).
3. Authorised Representative (if appointed by the manufacturer via a written mandate).
4. Fulfilment Service Provider (FSP) (if no manufacturer, importer, or mandated AR is established in the EU, the FSP automatically becomes the RP for the products they handle).

The RP acts as the main point of contact for Market Surveillance Authorities (MSAs) and must ensure continuous compliance. RP’s obligations include:

• Serve as primary contact for MSAs.
• Verify the Technical Documentation (TD).
• Condutct regular compliance checks.
• Manage accident reporting via the Safety Business Gateway if the manufacturer is outside the EU.
• Providing all necessary information and documentation to MSAs upon request.

For more information, check our Authorised Representative guide.

Manufacturers have the primary responsibility to ensure products are safe by design.

This role applies to any operator who:

• Manufactures a product.
• Has a product designed or manufactured.
• Markets the product under the person’s name or trademark (rebranding, white-labelling). Substantially modifies a product (physically or digitally, affecting safety).

The manufacturer must conduct an internal risk analysis for all products they place on the market.

This analysis must be systematically documented in the Technical Documentation (TD).

The TD serves as proof to authorities that a risk analysis has been carried out and must include:

• A general product description.
• Essential safety characteristics.
• All identified risks (regardless of their risk level).
• The solutions adopted to eliminate or mitigate the risks.

If you’re interested in learning more about the risk assessment, check out our webinar about risk assessment for GPSR compliance.

Product labelling ensures traceability throughout the supply chain.

The following information must be easily visible and legible:

• Product identification.
• Manufacturer details.
• Responsible Person details.
• Instructions and warnings.

This information must be placed on the product itself. Only if the size or nature of the product prevents this, may it be moved to the packaging or an accompanying document; aesthetic reasons are not sufficient justification.

Digital labelling alone is NOT sufficient to meet these obligations. It can only be used in addition to physical labels.

An “electronic address” must enable direct communication with the manufacturer or RP, such as an email address or a dedicated contact form on a website. A static website is generally insufficient.

The GPSR mandates the systematic use of the Safety Business Gateway (SBG), the EU web portal maintained by the Commission, for businesses to communicate with MSAs regarding dangerous products and accidents.

Mandatory reporting triggers:

• Accidents: Manufacturers must report any accident associated with the use of their product that results in death or serious adverse effects on a person’s health and safety (including temporary or permanent injuries, illnesses, or chronic health effects).

This notification must be made through the SBG without undue delay from the moment the manufacturer knows about the accident.

If the manufacturer is outside the EU, the Responsible Person must ensure the accident is reported.

Importers and distributors must inform the manufacturer (or the RP if the manufacturer is non-EU) of any known accidents.

• Dangerous Products: Any economic operator (manufacturer, importer, distributor) who believes a product they have placed on the market is dangerous must immediately inform the MSAs via the SBG and take corrective measures.

Internal processes and complaints: 

All economic operators must establish internal procedures and have a communication channel (electronic address, phone number, or dedicated website section) for consumers to submit complaints and report accidents.

Manufacturers and importers must keep an internal register of these complaints and accidents, retaining personal data only for the necessary period (maximum 5 years) for investigation purposes.

The GPSR includes mandatory requirements aimed at improving the low effectiveness of product recalls.

The GPSR regulations mandate an unprecedented level of transparency and consumer engagement in product recall processes.

• Direct notification of all affected consumers that can be identified.
• Safety-Only subscriptions: If operating registration or loyalty schemes, businesses must offer consumers the choice to join solely for safety-related purposes, excluding marketing contact.
• Recall notice template: The written recall provided to consumers must follow  the mandatory recall notice template set out in the Commission Implementing Regulation (EU) 2024/1435.
• Recalls must clearly describe the hazard and must not use expressions that might diminish the risk perception, such as “voluntary,” “precautious,” or stating that “no accidents have been reported”.
• Recall information must be made accessible to persons with disabilities.

In the event of a product recall, businesses must offer the consumer a choice of at least two of the following remedies:

1. Repair of the recalled product.
2. Replacement with a safe product of equal type and value.
3. An adequate refund of at least the price paid by the consumer.

The chosen remedy must be effective, cost-free, and timely, and must not involve significant inconvenience to the consumer.

Furthermore, consumers are entitled to claim remedies under the GPSR without a time limit, reflecting the objective of eliminating dangerous products from the market.

Providers of online marketplaces (OMPs), who facilitate distance contracts between traders and consumers, are subject to specific safety obligations under Chapter IV of the GPSR, which complement and further specify obligations already laid down by the Digital Services Act (DSA).

Key obligations for OMPs include:

• Registration on the Safety Gate Portal
• Single point of contact designation.
• Rapid response to market surveillance removal orders (acting within two working days of receipt).
• Process notices related to product safety issues within three working days.
• Provide and display the mandatory traceability and safety information on the product listing.
• Cooperation on product recalls.
• Repeat offenders suspension of service.

Online marketplaces are no longer mere transaction platforms but active participants in the product safety ecosystem. The GPSR positions them as critical gatekeepers of consumer protection.

Since the GPSR entered into application in December 2024, compliance has moved from a preparatory phase to a mandatory, enforced reality. 

The complexity of defining roles across manufacturers, importers, responsible persons, and online marketplaces, particularly where a single company performs multiple functions, requires continuous internal auditing and strategic adaptation.

For manufacturers, the maintenance of the 10-year Technical Documentation based on a thorough risk analysis remains the foundational pillar of ongoing compliance.

For all economic operators, mastering the Safety Business Gateway for accident and risk reporting is fundamental.

Our 25+ years of compliance experience make us the ideal partner, particularly in acting as your Authorised Representative or Responsible Person in the EU and UK, simplifying these complex regulatory requirements.

Contact our team of specialists today.