General Product Safety Regulation (GPSR): What It Requires

The General Product Safety Regulation is the safety baseline that applies to every consumer product sold in the EU — regardless of whether a product-specific law like the Low Voltage Directive or Toy Safety Directive also applies. It’s Regulation (EU) 2023/988, in force since December 2024, and it replaced the older General Product Safety Directive. If your product has no dedicated EU safety law of its own — no electrical directive, no toy directive, nothing product-specific — GPSR is still not optional. It’s the rule that exists precisely to catch everything else.

This guide covers what GPSR actually requires, who it applies to, what changed from the old directive, and where sellers most often get it wrong.

General product safety regulation at a glance

Think of it as two layers. Product-specific directives (electrical safety, toys, machinery) sit on top for the products they cover. GPSR sits underneath everything, filling every gap those directives leave — and applying entirely on its own for products no specific directive reaches at all.

GPSR applies underneath every product-specific directive, and stands alone for products no specific EU law reaches.

What changed from the old directive

GPSR replaced the General Product Safety Directive (2001/95/EC) — and the shift from directive to regulation matters more than it sounds. A directive gets transposed into each member state’s own national law, with room for local variation; a regulation applies identically, word for word, across the entire EU the moment it takes effect. Beyond that legal mechanics change, several substantive things are new:

• A mandatory EU-based “responsible person.” Non-EU manufacturers now need someone established in the EU who can be contacted by authorities and consumers — this didn’t exist under the old directive in the same form.
• Explicit coverage of online marketplaces. Marketplaces now have direct obligations under Article 22, not just the sellers using them.
• Digital and connected products addressed directly. The safety assessment now has to consider cybersecurity and evolving product behaviour (software updates, connectivity) as part of “safety,” not just physical hazards.
• Stronger recall and remedy rights for consumers. A recalled product now comes with a defined choice of repair, replacement, or refund, rather than being left to national rules to define.

None of these changes were cosmetic. The responsible-person requirement in particular closed a gap that had let some non-EU sellers operate with effectively no EU-based accountability — a national authority could identify a dangerous product but had no straightforward way to reach anyone legally responsible for it inside the EU. The marketplace obligations closed a parallel gap: before GPSR, a marketplace’s role in a product’s safety was largely undefined in law, even though marketplaces had become the primary channel through which many non-compliant products reached EU consumers.

Who it applies to

GPSR reaches every “economic operator” in the chain, not just the brand on the box:

• Manufacturers — carry the primary safety obligation, including the risk assessment and technical documentation
• Importers — responsible for verifying the manufacturer has met their obligations before placing a product on the EU market, and for acting as a fallback point of contact where needed
• Distributors — expected to check basic compliance markers (labelling, required information) before making a product available, without needing to re-verify the full technical file
• The responsible person — a specific new role, covered in depth below
• Online marketplaces — direct obligations to cooperate with authorities and act on unsafe-product notices, independent of what individual sellers do

If you’re private labelling a product made by someone else, you typically take on manufacturer obligations for GPSR purposes — the same pattern that applies under CE marking rules, covered in our complete guide to CE marking requirements.

The responsible person requirement

This is the piece of GPSR that catches the most non-EU sellers off guard. If you manufacture outside the EU, GPSR requires a person or company established within the EU who takes on a defined set of responsibilities: being contactable by market surveillance authorities, keeping the technical documentation and declaration available on request, cooperating with authorities on corrective action, and informing the manufacturer of complaints or safety concerns received.

The responsible person sits between a non-EU manufacturer and both EU authorities and consumers — a role that didn’t exist in this form under the old directive.

This role can be filled by an importer, an authorised representative, a fulfilment service provider, or a dedicated third party — it doesn’t have to be a new hire, but it does have to be a real, contactable EU entity with the specific responsibilities assigned to it, not just a mailing address.

How long does putting this in place actually take?

Unlike lab testing for a specific directive, most of GPSR’s requirements are documentation and process, not physical testing — which means the timeline is largely about how organized the underlying information already is, not about waiting on a lab queue. Appointing a responsible person, if you don’t already have one, can be arranged quickly through an existing importer or a dedicated service provider — this is typically the fastest single item to close. The risk assessment and technical documentation take longer if they don’t already exist, since they require genuinely thinking through foreseeable use and misuse rather than filling in a template; sellers who already have a CE-marking technical file for the product usually have most of the raw material, just not necessarily organized in GPSR’s specific shape.

The complaints-handling and accident-reporting process is the piece most often left until last, because it doesn’t feel urgent until it’s needed — but it’s also one of the easier gaps for an authority or marketplace to spot, since “do you have a defined process” is a straightforward yes/no question to ask.

What documentation it actually requires

GPSR expects, at minimum:

• A risk assessment covering foreseeable use and misuse of the product
• Technical documentation sufficient to demonstrate the product is safe — separate from, though it can overlap with, a CE-marking technical file where one also exists
• Instructions and safety information the average consumer can actually understand and act on
• Traceability information — a way to identify the product, its manufacturer, and (for non-EU manufacturers) its responsible person
• A defined internal process for handling accident reports and complaints, and for cooperating with a recall if one becomes necessary

For a product already covered by a specific directive (electrical, toys, machinery), much of this overlaps with what that directive already requires — GPSR mainly adds the parts those directives don’t cover, like the general safety assessment for aspects the specific directive doesn’t reach, and the accident-reporting and remedy obligations. For a product with no applicable directive at all, this list is the entire compliance picture — there’s no separate technical file to lean on, which is exactly why sellers of genuinely novel or hard-to-classify products sometimes underestimate what GPSR alone requires. “No specific law applies” gets misread as “not much is required,” when the reality is that GPSR’s full documentation set still applies in that case, just without a directive’s testing regime layered on top.

Marketplace obligations under GPSR

Article 22 puts direct obligations on online marketplaces themselves, not just the sellers using them: registering with the EU’s Safety Gate portal, designating a single point of contact for authorities, and cooperating on removing unsafe products flagged through that system. In practice, this is why a marketplace compliance team can suspend a listing faster than a national authority ever could — the marketplace has its own legal exposure under GPSR now, independent of whether a regulator has gotten involved, which gives it direct incentive to act quickly on anything that looks like a gap.

This also explains a pattern many sellers notice but don’t immediately connect to GPSR: a listing gets flagged not because a government inspector examined the product, but because an automated or manual marketplace review found a missing document or an inconsistency between the listing and the required safety information. The marketplace isn’t doing this as a courtesy — it’s protecting its own position under Article 22, and a seller’s compliance gap becomes the marketplace’s problem the moment a product is listed on it.

GPSR vs. product-specific directives — how they interact

The relationship confuses people because it isn’t “one or the other” — it’s layered, and the two operate on different questions.

A product covered by a directive still needs both — the directive’s specific technical requirements, and GPSR’s general safety, traceability, and reporting obligations sitting underneath. A product with no applicable directive needs only GPSR, but needs it in full; “no directive applies” is never the same as “no EU safety law applies.”

Common mistakes

Assuming CE marking covers GPSR

A CE-marked product still needs to meet GPSR’s baseline — CE marking demonstrates compliance with the specific directives it covers, but GPSR reaches things those directives don’t: the general risk assessment, traceability, accident reporting, and (for non-EU manufacturers) the responsible person requirement. “It’s CE marked” is not the same statement as “it’s GPSR compliant.”

Not appointing a responsible person

Non-EU manufacturers sometimes miss this entirely, especially if they were selling into the EU before GPSR took effect and haven’t revisited their setup since. It’s one of the most concrete, checkable requirements in the regulation — and one of the easiest for a marketplace or authority to verify is missing.

Treating GPSR as only relevant to “unregulated” products

Because GPSR is most visible as the rule for products with no specific directive, sellers of electrical goods or toys sometimes assume it doesn’t apply to them at all. It always applies — as a baseline layer for regulated products, and as the entire rulebook for everything else.

Reusing an old risk assessment without updating it for GPSR’s scope

A risk assessment written for a product-specific directive was scoped to that directive’s particular hazards — electrical risk, mechanical risk, whatever the directive targets. GPSR expects a broader assessment covering foreseeable use and misuse generally, which isn’t automatically the same document. Sellers who assume their existing directive-specific risk assessment already satisfies GPSR sometimes discover the gap only when a marketplace or authority asks for the general safety assessment specifically and the existing document doesn’t cover it.

A quick pre-listing checklist

• Confirm whether a product-specific EU directive also applies — GPSR sits underneath it, not instead of it
• If manufacturing outside the EU, confirm a responsible person is appointed and genuinely contactable
• Confirm the risk assessment and technical documentation exist and are current
• Confirm instructions and safety information are written for an average consumer, not a technical audience
• Confirm there’s an internal process for handling complaints and accident reports, not just a plan to react if something happens

None of these are one-time tasks — GPSR compliance is a maintained state, not a certificate you file once and forget. Revisit this checklist whenever the product, the manufacturer’s location, or the sales channels change.

Frequently asked questions