Summary
The GPSR is Regulation (EU) 2023/988 on general product safety. It has applied across the EU since 13 December 2024 and replaces the General Product Safety Directive 2001/95/EC.
It covers all non-food consumer products that are not already governed by sector-specific EU safety legislation, and it fills gaps in products that are. That dual role is why the Commission describes it as a safety net rather than a standalone product regime.
Three changes matter most in practice. Every product sold in the EU must have a responsible economic operator established in the EU, which affects every non-EU brand selling direct. Online listings must carry specified safety information before the point of purchase. Online marketplaces carry their own obligations, separate from those of the sellers using them.
The Commission published guidelines on applying the GPSR on 19 November 2025, nearly a year after the Regulation began to apply. Businesses that built their compliance position before that date should check it against the guidelines.
Official text: Regulation (EU) 2023/988
Key GPSR Definitions
Definitions are drawn from Article 3 of the Regulation.
| Term | Definition |
|---|---|
| Product | Any item, whether or not interconnected to other items, supplied or made available, whether for consideration or not, in the course of a commercial activity, including in the context of providing a service, and which is intended for consumers or is likely to be used by consumers under reasonably foreseeable conditions |
| Safe product | A product which, under normal or reasonably foreseeable conditions of use, including the actual duration of use, does not present any risk or only the minimum risks compatible with the product’s use, considered acceptable and consistent with a high level of protection of the health and safety of consumers |
| Dangerous product | Any product which is not a safe product |
| Risk | The combination of the probability of an occurrence of a hazard causing harm and the degree of severity of that harm |
| Serious risk | A risk requiring rapid intervention and follow-up, including where the effects may not be immediate |
| Economic operator | The manufacturer, authorised representative, importer, distributor, fulfilment service provider, or any other natural or legal person subject to obligations under the Regulation |
| Manufacturer | Any natural or legal person who manufactures a product or has a product designed or manufactured, and markets that product under their own name or trade mark |
| Responsible person | An economic operator established in the Union who is responsible for the compliance tasks set out in Article 16 |
| Online marketplace | A provider of an intermediary service using an online interface which allows consumers to conclude distance contracts with traders for the sale of products |
| Recall | Any measure aimed at achieving the return of a product that has already been made available to the consumer |
| Withdrawal | Any measure aimed at preventing a product in the supply chain from being made available on the market |
What the GPSR Replaced and Why
The 2001 General Product Safety Directive was built for a market in which most consumer goods reached buyers through physical retail, and in which product safety risks came from materials, mechanics, and chemistry.
Two developments made it inadequate. Direct-to-consumer sales from outside the EU grew to the point where a large share of products reaching European consumers had no EU-established operator anywhere in the chain. And connected products, software-driven goods, and AI-enabled devices created risk categories the 2001 text did not contemplate.
EU-OSHA’s summary states the position directly: the 2001 Directive needed updating to address product safety challenges from emerging technologies, including artificial intelligence and connected devices, and to set clear obligations for online marketplaces (EU-OSHA).
Switching from a directive to a regulation had its own effect. A directive requires each member state to transpose it into national law, which produced twenty-seven variations on the same rules. A regulation applies directly and identically in all member states, with no transposition step.
Scope: Which Products the GPSR Covers
The GPSR applies to consumer products placed on the EU market where no sector-specific EU legislation covers the relevant safety aspect.
| Situation | GPSR applies |
|---|---|
| Consumer product with no sector-specific EU safety law | Yes, in full |
| Consumer product covered by harmonised legislation, for aspects that legislation does not address | Yes, as a safety net |
| Product covered by harmonised legislation, for aspects that legislation does address | No, the sector law governs |
| Second-hand products supplied in the course of a commercial activity | Yes, with limited exceptions |
| Products supplied as part of a service, used by consumers | Yes |
| Food, feed, medicines, medical devices, plants, animals | No, excluded under Article 2 |
| Products supplied exclusively B2B with no consumer use foreseeable | Generally no |
The safety net function is the part most often missed. A product subject to the Machinery Regulation or the Toy Safety Directive is not outside the GPSR. It is outside the GPSR only for the safety aspects its sector law covers. Anything the sector law leaves unaddressed falls back to the GPSR’s general safety requirement.
Second-hand goods are also caught where the sale is commercial. A business reselling refurbished electronics is within scope. A private individual selling a used item is not.
The Responsible Person: Article 16
This is the single provision with the widest commercial reach, and the one that changed market access for non-EU sellers.
Article 16 provides that a product may be placed on the EU market only if there is an economic operator established in the Union who is responsible for specified compliance tasks. No responsible person means no lawful sale, regardless of how good the product is.
Who can act as responsible person
| Operator | Can act as responsible person |
|---|---|
| Manufacturer established in the EU | Yes |
| Importer established in the EU | Yes |
| Authorised representative appointed in writing by the manufacturer | Yes |
| Fulfilment service provider established in the EU | Yes, where no other operator fills the role |
| Distributor established in the EU | Yes, in practice, where it imports or holds the role |
| Any entity established outside the EU | No |
The order matters. Where a manufacturer is outside the EU and has appointed no authorised representative, the obligation attaches to whoever in the chain is established in the Union. For direct-to-consumer sellers using an EU fulfilment provider, that provider can end up carrying the role without having negotiated for it.
What the responsible person must do
| Task | Detail |
|---|---|
| Hold the declaration and technical documentation | Verify these exist and keep them available for the required period |
| Provide information to authorities | Supply documentation on reasoned request, in a language the authority can understand |
| Cooperate on corrective action | Work with market surveillance authorities on action to eliminate risk |
| Inform the manufacturer | Notify the manufacturer of any product presenting a risk |
| Appear in product information | Name and contact details must be on the product, packaging, or accompanying documents |
The responsible person is not a postbox. It is the operator a market surveillance authority will contact, and the one expected to produce documentation when asked.
GPSR Obligations by Role
| Role | Core obligations |
|---|---|
| Manufacturer | Carry out internal risk analysis. Draw up technical documentation. Ensure product identification and traceability. Mark the product with manufacturer details. Provide safety instructions in a language consumers understand. Take corrective action and notify authorities where a product is dangerous |
| Importer | Verify the manufacturer has met its obligations. Not place a product on the market where it has reason to believe it is unsafe. Ensure storage and transport do not compromise conformity. Mark its own name and contact details on the product or packaging |
| Distributor | Verify the manufacturer and importer have complied, including on product identification, responsible person details, and safety information. Not make available a product it knows or should presume to be dangerous |
| Authorised representative | Perform the tasks in the written mandate. Hold documentation. Cooperate with authorities |
| Fulfilment service provider | Ensure storage, packaging, addressing, and dispatch do not compromise product safety. Act as responsible person where no other operator does |
| Online marketplace | Register on Safety Gate. Designate a single contact point. Have internal product safety processes. Act on authority orders and consumer notifications |
Information Required for Online Sales: Article 19
Article 19 is the provision that reshaped e-commerce product listings. It requires specified information to be visible before the consumer completes the purchase, not after.
| Information | Required |
|---|---|
| Manufacturer name, registered trade name or trade mark | Yes |
| Manufacturer postal and electronic address | Yes |
| Responsible person name and contact details, where the manufacturer is outside the EU | Yes |
| Information identifying the product, including type, batch or serial number | Yes |
| Product picture | Yes |
| Warnings and safety information, in the languages of the member states where the product is offered | Yes |
Two points drive compliance failures.
The language requirement is per member state of sale, not per language the seller prefers. A product offered in Germany, France, and Spain needs warnings in German, French, and Spanish.
The information must be in the offer itself. A link to a separate page, a downloadable PDF, or details that only appear after purchase does not satisfy the requirement that the information be provided before the consumer is bound.
GPSR and Online Marketplaces: Article 22
Article 22 gives marketplace operators obligations that sit alongside, not instead of, those of the sellers on their platforms.
| Obligation | Detail |
|---|---|
| Safety Gate registration | Register in the Safety Gate Portal and publish the details |
| Single contact point | Designate a point of contact for market surveillance authorities, and a separate one for consumers |
| Internal processes | Maintain internal processes for product safety to comply with the Regulation |
| Act on orders | Act on authority orders to remove dangerous product listings, within two working days of receipt |
| Notify consumers | Inform affected consumers where a product sold through the platform is recalled |
| Design for compliance | Design the interface so sellers can provide the Article 19 information |
| Cooperate | Cooperate with authorities and with economic operators on recalls and corrective action |
The two working day deadline for acting on removal orders is a hard operational requirement, and it has driven marketplaces to push verification obligations onto sellers. The practical result is that most large platforms now refuse listings without responsible person details, which enforces Article 16 commercially before any authority becomes involved.
Safety Gate and the Safety Business Gateway
GPSR Regulation establishes Safety Gate as a three-part system.
| Component | Function | Users |
|---|---|---|
| Safety Gate Rapid Alert System | Exchange of information between national authorities and the Commission on dangerous non-food products | Member state authorities, Commission |
| Safety Gate Portal | Public information on recalled and dangerous products, and a channel for consumer complaints | Consumers |
| Safety Business Gateway | Channel for businesses to notify authorities of dangerous products and accidents | Economic operators, marketplaces |
Where an economic operator becomes aware that a product it has placed on the market is dangerous, it must take corrective measures and notify market surveillance authorities through the Safety Business Gateway. This is a mandatory notification, not a discretionary one.
Portals: Safety Gate and the Safety Business Gateway.
Recalls and Consumer Remedies
The GPSR strengthened the position of consumers affected by a recall, and the drafting here is more demanding than the 2001 Directive.
| Requirement | Detail |
|---|---|
| Direct notification | Where an operator holds consumer contact details, affected consumers must be notified directly |
| Recall notice content | The notice must be clear, must not minimise the risk, and must avoid wording that reduces consumer response |
| Remedy offered | Consumers must be offered at least two of: repair, replacement, or refund |
| No disincentives | The remedy must be free of charge and must not impose significant inconvenience |
The requirement to avoid minimising language is specific and is enforced. Recall notices that describe a safety defect as a product update, or that bury the hazard, do not comply.
GPSR Enforcement and Penalties
The GPSR does not set a Union-wide maximum fine. Article 44 requires member states to lay down penalties that are effective, proportionate, and dissuasive, and to notify them to the Commission.
| Enforcement measure | Available to authorities |
|---|---|
| Require corrective action | Yes |
| Order withdrawal from the market | Yes |
| Order recall from consumers | Yes |
| Order removal of online listings | Yes, with a two working day compliance window for marketplaces |
| Impose penalties | Yes, at levels set in national law |
| Block access to online interfaces | Yes, where other measures have failed |
Penalty levels vary materially between member states. Businesses operating across several markets should check national implementing law rather than assuming a common ceiling.
GPSR Commission Guidelines, November 2025
The Commission published guidelines on the application of the GPSR on 19 November 2025, almost a year after the Regulation became applicable.
The delay matters for anyone who built a compliance position in late 2024 or early 2025 on their own reading of the text. The guidelines address practical questions the Regulation leaves open, including scope boundaries, the operation of the responsible person requirement, and the treatment of distance selling.
Compliance positions documented before November 2025 should be reviewed against the guidelines rather than assumed to still hold.
GPSR and Other EU Frameworks
The GPSR overlaps with several other instruments, and the interactions are not all symmetrical.
| Framework | Relationship to GPSR |
|---|---|
| Sector harmonised legislation, for example the Machinery Regulation or Toy Safety Directive | Takes precedence for the safety aspects it covers. GPSR fills gaps |
| Regulation (EU) 2019/1020 on market surveillance | Operates alongside GPSR, providing the market surveillance framework |
| Cyber Resilience Act, Regulation (EU) 2024/2847 | Covers cybersecurity of products with digital elements. GPSR covers general safety. Both can apply to a connected consumer product |
| EU AI Act, Regulation (EU) 2024/1689 | Covers AI systems by risk classification. A consumer product with embedded AI can be subject to both |
| Product Liability Directive (EU) 2024/2853 | Civil liability for defective products, applying to products placed on the market from 9 December 2026. Separate from GPSR’s regulatory obligations |
| Digital Services Act, Regulation (EU) 2022/2065 | Platform obligations on illegal content. Article 22 GPSR obligations sit alongside DSA obligations for marketplaces |
A connected consumer product sold by a non-EU brand through an EU marketplace can therefore engage the GPSR, the CRA, the AI Act, and the Product Liability Directive at once, with different operators carrying different obligations under each.
GPSR and Non-EU Sellers: What Changes
For a business outside the EU selling to European consumers, the GPSR changed market access rather than adding paperwork.
| Requirement | Detail |
|---|---|
| Responsible person | Must be in place before products are offered, not after a marketplace asks |
| Per product line | The responsible person must cover the products being sold. A single appointment does not automatically cover an expanding catalogue |
| Named in listings | Responsible person contact details must appear in the online offer under Article 19 |
| Documentation accessible | The responsible person must be able to produce technical documentation on request, which requires the manufacturer to supply it |
| UK establishment | Does not satisfy the EU establishment requirement following Brexit |
The last point catches UK businesses regularly. A UK entity cannot act as an EU responsible person, and a UK address in a product listing does not satisfy Article 19 where the manufacturer is outside the EU.
GPSR Compliance Checklist
| Step | Action |
|---|---|
| 1 | Confirm whether each product falls within GPSR scope, including where sector legislation applies only partially |
| 2 | Identify the responsible person for each product line, and confirm they are established in the EU |
| 3 | Put the appointment in writing where an authorised representative is used |
| 4 | Carry out and document the internal risk analysis |
| 5 | Compile technical documentation and keep it current |
| 6 | Mark product identification and manufacturer details on the product, packaging, or accompanying documents |
| 7 | Translate warnings and safety information for every member state of sale |
| 8 | Audit online listings against the Article 19 information requirements |
| 9 | Establish the internal process for notifying the Safety Business Gateway |
| 10 | Prepare a recall procedure that meets the notification and remedy requirements |
| 11 | Review your position against the Commission guidelines published 19 November 2025 |
| 12 | Map overlapping obligations under the CRA, AI Act, and Product Liability Directive where products have digital elements |
FAQ
What does GPSR stand for?
General Product Safety Regulation. The full citation is Regulation (EU) 2023/988 of the European Parliament and of the Council of 10 May 2023 on general product safety.
When did the GPSR come into force?
GPSR entered into force on 30 May 2023 and has applied since 13 December 2024. Entry into force and application are separate dates, and the application date is the one that creates obligations.
What did the GPSR replace?
Directive 2001/95/EC on general product safety. It also repealed Council Directive 87/357/EEC on products appearing to be other than they are.
Which products does the GPSR cover?
All non-food consumer products placed on the EU market that are not covered by sector-specific EU safety legislation, plus any safety aspects of harmonised products that the relevant sector legislation does not address. Food, feed, medicines, medical devices, live plants, and live animals are excluded.
Do I need a responsible person under the GPSR?
If your product is placed on the EU market, yes. Article 16 requires an economic operator established in the Union to be responsible for specified compliance tasks. Without one, the product cannot lawfully be placed on the market.
Can a UK company be an EU responsible person?
No. Under GPSR, the responsible person must be established in the European Union. A UK entity does not satisfy this following Brexit, and neither does a Swiss, Norwegian, or any other non-EU establishment.
What must appear in an online product listing?
Under Article 19: the manufacturer’s name and postal and electronic address, the responsible person’s details where the manufacturer is outside the EU, information identifying the product including type and batch or serial number, a picture of the product, and warnings and safety information in the languages of the member states where the product is offered. All of it must appear before the consumer completes the purchase.
What are the GPSR penalties?
The Regulation does not set a Union-wide maximum. Member states set penalties in national law and must ensure they are effective, proportionate, and dissuasive. Authorities can also order withdrawal, recall, removal of listings, and blocking of online interfaces, which for most businesses is the more significant exposure.
Does the GPSR apply to second-hand products?
Yes, where they are supplied in the course of a commercial activity, subject to limited exceptions. A business reselling refurbished goods is within scope. A private individual selling a used item is not.
How does the GPSR differ from CE marking?
CE marking indicates conformity with specific harmonised EU legislation that mandates it, such as the Machinery Regulation or the Toy Safety Directive. The GPSR does not introduce a marking of its own. It imposes a general safety requirement and traceability obligations that apply whether or not a product carries CE marking.
What is the Safety Business Gateway?
The portal through which economic operators notify market surveillance authorities of dangerous products and of accidents caused by products. It forms part of Safety Gate alongside the Rapid Alert System and the public portal.
Do online marketplaces have their own obligations?
Yes. Article 22 imposes obligations on marketplace providers that are separate from those of the sellers using the platform, including Safety Gate registration, designating contact points, maintaining internal product safety processes, and acting on authority removal orders within two working days.
Sources
- Regulation (EU) 2023/988, full text
- EU-OSHA, Regulation 2023/988/EU overview
- European Commission, product safety
- Safety Gate portal
This guide reflects Regulation (EU) 2023/988 and the Commission guidelines published 19 November 2025, as at October 2026. Penalty levels and certain enforcement procedures are set in national law and vary between member states. Published by Grecta for general informational purposes. It is regulatory analysis, not legal advice.
