GPSR

GPSR — General Product Safety Regulation (EU 2023/988)

The General Product Safety Regulation (GPSR, Regulation EU 2023/988) is the EU’s foundational horizontal product safety law. It replaces the 2001 General Product Safety Directive (GPSD, 2001/95/EC) with a significantly modernised and strengthened framework — one that is explicitly designed to address the realities of online sales, digital products, and connected devices that the original directive failed to adequately cover.

GPSR entered into application on 13 December 2024 and now serves as the baseline safety net for consumer products sold in the EU. Where sector-specific legislation applies (such as the Machinery Regulation or the Radio Equipment Directive), GPSR covers only the aspects and risks that legislation does not address (Article 2(1)).

Key Facts

What Changed from GPSD to GPSR?

The shift from a Directive to a Regulation is itself significant — it means GPSR applies uniformly across all 27 EU member states without national variation. Beyond that, the substantive changes are substantial:

Who Must Comply?

GPSR introduces obligations across the entire supply chain, extending beyond manufacturers. The operator obligations in Articles 9–18 do not apply to products subject to Union harmonisation legislation, which sets its own (Article 2(1)):

Manufacturers

• Ensure products are safe before placing them on the EU market.
• Prepare and maintain technical documentation demonstrating safety.
• Affix necessary markings and provide clear safety information.
• Provide channels for consumer complaints, investigate complaints and accidents, and keep an internal register of them (Art. 9(11)–(12)).
• Inform consumers and — through the Safety Business Gateway — the authorities immediately about dangerous products (Art. 9(8)), and notify accidents without undue delay (Art. 20).
• Take corrective actions including product recalls when a safety risk is identified.

Importers

• Verify that the manufacturer has fulfilled their obligations before import.
• Ensure products bear required markings and documentation.
• Inform manufacturers of safety issues; withdraw products if necessary.
• Keep a copy of the technical documentation available to authorities for 10 years (Art. 11(6)).

Distributors (including Online Retailers)

• Verify basic compliance indicators before placing products on the market.
• Cooperate with authorities and economic operators in recall actions.
• Keep records enabling traceability.

Online Marketplace Operators (new under GPSR)

• Register on the EU Safety Gate portal.
• Designate a single point of contact for market surveillance authorities and one for consumers (Art. 22(1)–(2)).
• Take down listings of dangerous products notified by authorities.
• Remove identical listings of the same dangerous product where the authority’s order requires it (Art. 22(5)).
• Cooperate with market surveillance authorities.

Fulfilment Service Providers (new under GPSR)

• Cooperate with recalls and safety actions for products passing through their facilities.
• Report dangerous products they become aware of.

The “General Safety Requirement” — What Does “Safe” Mean?

The core of GPSR is a general safety requirement: any consumer product placed on the EU market must be safe. A product is considered safe if it does not present any risk, or only the minimum risks compatible with the product’s use — taking into account the expected users, including vulnerable populations (children, elderly, persons with disabilities).

To determine safety, GPSR recognises a hierarchy of evidence sources:

1. EU harmonised standards — Products conforming to applicable harmonised standards are presumed safe.
2. European or international standards — Other recognised standards provide supporting evidence.
3. Commission decisions or guidance — Technical guidance published by the Commission.
4. Industry codes of good practice — Voluntary codes may be considered.
5. State of the art — General level of safety technology in the field.

For electronics and IoT manufacturers: If your product is covered by a sector-specific directive (e.g., RED, LVD, Machinery Regulation), GPSR applies as the safety baseline for any risk not covered by that sector-specific legislation. GPSR and sector-specific rules co-exist — GPSR fills the gaps.

Digital Products and Software Updates

GPSR explicitly addresses challenges posed by products with digital features:

• Software updates that affect safety fall under GPSR. If a software update changes the safety characteristics of a physical product, the update must not reduce the product’s safety level.
• Connected products must remain safe throughout their reasonably foreseeable use, including foreseeable misuse.
• OTA (Over-the-Air) updates that introduce new safety risks must be treated as modifications with potential re-assessment obligations.

This is particularly relevant for embedded hardware manufacturers: a firmware update that inadvertently disables a protective function (e.g., overvoltage protection, thermal shutdown) could trigger GPSR obligations.

Traceability Requirements

GPSR introduces mandatory traceability obligations:

• Products must bear a type, batch, serial number, or other identifier allowing them to be identified.
• Products must display the manufacturer’s name, registered trade name, postal address, and contact details — either on the product itself or on its packaging.
• A data carrier on the product may be required for certain product categories under a traceability system set by delegated act (Art. 18); QR codes can otherwise be used voluntarily to give the information in digital form (Art. 21).

For hardware manufacturers producing IoT devices in volume, this means the manufacturing and labelling process must be capable of applying unique identifiers per unit or per batch — a production engineering requirement, not just a documentation checkbox.

Post-Market Surveillance Obligations

GPSR places continuing obligations on manufacturers after a product is placed on the market — not just a one-time pre-market compliance exercise. The Regulation itself does not use the term “post-market surveillance”:

• Manufacturers must provide channels through which consumers can submit complaints and report accidents or safety issues (Art. 9(11)).
• Complaints and accident information must be investigated and kept in an internal register, together with recalls and corrective measures (Art. 9(12)).
• Dangerous products must be reported to national authorities immediately through the Safety Business Gateway (Art. 9(8)).
• Authorities then exchange the information through the EU Safety Gate (RAPEX successor) rapid alert system (Art. 26).

Safety Gate has three parts: the rapid alert system used by authorities, the public Safety Gate Portal, and the Safety Business Gateway through which economic operators inform authorities and consumers (Art. 25, 27, 34). Only providers of online marketplaces must register with the Safety Gate Portal (Art. 22(1)).

GPSR and CE Marking

GPSR does not itself require CE marking — CE marking is required by specific technical directives and regulations (RED, LVD, Machinery, MDR, etc.). However:

• Products subject to sector-specific CE marking legislation are generally excluded from GPSR’s scope for the aspects covered by that legislation.
• GPSR applies to consumer products that have no sector-specific regulation requiring a CE mark.
• A CE-marked product still has obligations under GPSR for any safety aspects not covered by its CE marking legislation.

GPSR vs. Other EU Regulations

Corrective Actions and Recalls

GPSR establishes clearer obligations for product recalls:

• Economic operators must have internal processes for product safety in place (Art. 14); a documented recall plan is good practice, not a named GPSR requirement.
• Recalls must be communicated directly to affected consumers where contact information is available.
• Authorities must be informed of dangerous products through the Safety Business Gateway (Art. 9(8)); national authorities then notify serious-risk measures through Safety Gate (Art. 26).
• Corrective actions must be free of charge to consumers.
• Refusal of a recall by a small percentage of consumers does not exempt the manufacturer from obligations.

From Our Experience

Working through GPSR readiness assessments with hardware manufacturers in 2024–2025, these are the gaps we consistently identify:

The thermal protection firmware update problem. We worked with a consumer electronics manufacturer who issued a power management firmware update that shifted the thermal shutdown threshold by 2°C — moving it just outside the device’s tested and certified operating parameters. Under GPSR, a software update that negatively alters a product’s safety characteristics can trigger a re-assessment obligation. The manufacturer was unaware that their standard OTA release process had no safety-impact gate. We now recommend that every firmware release for CE-marked products includes an explicit safety-delta review step before deployment — asking: “Does this update change any parameter that was part of the safety assessment?”

Non-EU manufacturers discovering the EU Responsible Person requirement late. A recurring pattern in our work: Asian and US hardware manufacturers who have been selling into Amazon EU for years under the GPSD regime discover in late 2024 that GPSR requires an EU-established responsible person (Article 16) and that online offers must name it (Article 19). An EU importer fills this role by law; for direct sales without an importer it is a mandated authorised representative or a fulfilment service provider. The responsible person must be able to make the product safety documentation available and is the contact for market surveillance authorities. Companies that had no such arrangement in place faced Amazon EU delisting pressure in December 2024. The lesson: GPSR market readiness includes both documentation and a formal representative structure.

Post-market surveillance as a real process, not a checkbox. GPSR’s complaint-handling and register duties (Art. 9(11)–(12)) are legally binding, but most manufacturers we assess have no systematic process — just ad-hoc response to returns. A minimal viable PMS under GPSR requires: a customer complaint tracking system that flags safety-relevant issues, a review cadence (e.g., quarterly), a defined escalation path to the EU Responsible Person or Notified Body, and documented evidence of review. Setting this up requires approximately 2–3 weeks of process design, but cannot be retroactively created if an authority asks for records.

The “it’s CE marked, so GPSR doesn’t apply to us” misunderstanding. CE marking under RED, LVD, or the Toy Safety Directive does not exclude a product from GPSR. CE marking covers the specific essential requirements of those directives. GPSR applies to safety aspects not addressed by the sector-specific legislation — for example, the physical mechanical robustness of an enclosure that isn’t tested under RED, or the stability of a smart home device that could tip over. We repeatedly see manufacturers assume CE = GPSR exemption, when in practice GPSR is an additional, parallel obligation.

Related Terms

• CE Marking — Required by sector-specific directives, not by GPSR itself; GPSR is complementary.
• Technical File — GPSR requires technical documentation demonstrating product safety.
• Post-Market Surveillance — Monitoring after placing on the market; GPSR requires complaint handling and an internal register (Art. 9(11)–(12)).
• EU Responsible Person — EU-established economic operator required for products covered by GPSR Article 16.
• Safety Gate / RAPEX — The EU rapid alert system through which authorities exchange alerts on dangerous products.
• CRA — Cybersecurity regulation that complements GPSR for products with digital elements.

Official Sources

• GPSR — Regulation (EU) 2023/988 — EUR-Lex full text
• EU Safety Gate portal — European Commission
• GPSR implementation guidance — European Commission (DG JUST)
• GPSR replaces GPSD — EUR-Lex (repealing Directive 2001/95/EC)

GPSR affects any hardware manufacturer selling consumer products in the EU — even companies that are already CE-marked under RED or LVD. Our EU compliance consulting covers GPSR obligations alongside cybersecurity regulations, so your product launch is covered on all fronts: from technical file preparation and safety documentation to post-market surveillance processes and Safety Business Gateway notifications.