There is no GPSR certificate. No filing, no approval, no notified body. What the General Product Safety Regulation asks for instead is a file — and the ability to produce it the day an authority or a marketplace asks. GPSR technical documentation is the obligation most sellers discover through a platform compliance request rather than through their own compliance review.
This guide sets out what Regulation (EU) 2023/988 requires you to hold, how the internal risk analysis works, and where cosmetic brands are and are not affected.
Key takeaways
- The GPSR has applied since 13 December 2024, replacing the old General Product Safety Directive.
- It is the safety net: it catches consumer products not fully covered by sector-specific legislation.
- The core duty is an internal risk analysis plus technical documentation demonstrating the product is safe.
- There is no certificate — compliance is evidenced by producing the file on request.
- Non-EU sellers need a responsible economic operator established in the EU. This is not the same role as a cosmetic Responsible Person.
- Cosmetics are largely covered by their own regulation, but the accessories brands sell alongside them are often caught.
What changed in December 2024
The GPSR replaced Directive 2001/95/EC. Two differences matter in practice. Because it is a regulation rather than a directive, it applies directly and identically across all member states, with no national transposition to interpret. And it shifts the emphasis firmly onto documentary proof: the burden is on you to have already assessed the product and written it down.
Article 9 carries the central obligation for manufacturers. Before placing a product on the market you must carry out an internal risk analysis and draw up technical documentation containing, as a minimum, a general description of the product, its essential characteristics relevant to safety, an analysis of the possible risks, and the solutions adopted to address them.
What the file has to contain
The documentation is not a template with your logo on it. It has to be about your product.
| Requirement | What it means in practice | Evidence to hold |
|---|---|---|
| Product description | What it is, what it is for, who uses it | Specification, drawings, photographs, intended-use statement |
| Essential safety characteristics | The features that determine whether it is safe | Materials, dimensions, electrical or mechanical properties |
| Risk analysis | Hazards, foreseeable use and misuse, exposure, severity | Documented assessment with reasoning and conclusions |
| Mitigations | Design choices, warnings and instructions relied on | Artwork, instruction leaflets, test reports |
| Applicable standards | Any harmonised or other standards applied | Standard references and conformity evidence |
| Traceability | Ability to identify the product and its batch | Type or batch number, economic operator details on pack |
You must keep the documentation for ten years from placing the product on the market and make it available to authorities on request.
The internal risk analysis
This is where generic packs fail. A defensible risk analysis works through your product specifically:
- Hazard identification — mechanical, chemical, thermal, electrical, hygiene, choking, entrapment, and hazards arising from the product’s interaction with other items.
- Foreseeable use and misuse — including use by children where that is realistic, and use in ways the instructions discourage but consumers predictably attempt.
- Exposure — how often, for how long, and by whom.
- Severity and probability — combined into a risk rating.
- Mitigation and residual risk — what the design removes, what warnings address, and what remains.
Traceability, marketplaces and the EU operator
Three GPSR duties sit outside the file itself and generate most of the enforcement contact.
Traceability on the product
The product or its packaging must carry a type, batch or serial number allowing identification, plus the name and contact details of the manufacturer and, where relevant, the importer.
The responsible economic operator
A product may not be placed on the EU market unless there is an economic operator established in the Union responsible for specified tasks — verifying the documentation exists, keeping it available, and cooperating with authorities. If you are outside the EU, you need one.
Marketplace listing information
Online listings must display specified information before purchase, including the manufacturer’s details, the responsible EU operator, and any warnings or safety information. Missing listing data — not a missing file — is what triggers most platform takedowns. If you sell through marketplaces, our guide to safety documentation for Amazon EU covers the adjacent cosmetic requirements.
Does the GPSR apply to cosmetics?
Mostly not, and this is worth being precise about rather than selling into the confusion.
Cosmetic products are comprehensively regulated by Regulation (EC) No 1223/2009, which covers safety assessment, notification, labelling and market surveillance. Where sector-specific legislation covers a matter, the GPSR does not duplicate it. Your CPSR and PIF remain the framework for your cosmetics.
What frequently is caught is everything else in the range: applicators, brushes, sponges, jade rollers, gua sha tools, devices, cases and gift-set components. Those are consumer products with no vertical regulation of their own, and the GPSR is precisely the regime designed to cover them. Brands that consider themselves “cosmetics only” often have a dozen articles in scope.
Borderline items need care in both directions — our guide on whether essential oils are regulated as cosmetics shows how classification drives which regime applies. And if any part of your range is a hazardous mixture, CLP obligations apply as well: classification, labelling, an SDS and a poison centre notification.
When something goes wrong
The GPSR also sets out what you do after a problem emerges. If you have reason to believe a product you placed on the market is dangerous, you must take corrective action immediately and notify authorities through the Safety Gate portal. Recall notices have prescribed content, must reach affected consumers directly where you can identify them, and cannot be worded to minimise the risk. Having this planned before you need it is the difference between a controlled recall and an improvised one.
Bringing it all together
GPSR compliance is documentary discipline rather than certification. Assess the product honestly, write the assessment down, put traceability on the pack, appoint an EU operator if you are outside the Union, get your marketplace listings complete, and know your Safety Gate route before an incident forces you to learn it.
If a platform has written asking you to evidence GPSR compliance, what they want is the responsible operator, the listing information and confirmation that a risk analysis and technical documentation exist. Our GPSR Technical Documentation Guidance builds that against your actual range — and tells you honestly which of your products the regulation does not reach.
Frequently asked questions
Is there a GPSR certificate?
No. The GPSR has no approval, registration or certification step, and there is no notified body involved. Be cautious of anyone selling a “GPSR certificate” — compliance is demonstrated by holding technical documentation and producing it when an authority or marketplace asks.
Does the GPSR apply to my cosmetics?
Largely no. Cosmetics are comprehensively covered by Regulation (EC) No 1223/2009, so the GPSR does not duplicate those safety obligations. It commonly does apply to non-cosmetic articles sold alongside them — applicators, brushes, tools, devices and gift-set components.
What is a responsible economic operator under the GPSR?
An economic operator established in the EU that is responsible for specified tasks for your product, including ensuring the technical documentation exists, keeping it available and cooperating with authorities. Without one, a product cannot lawfully be placed on the EU market. It is a different role from a cosmetic Article 4 Responsible Person.
How long must I keep the technical documentation?
Ten years from the date the product was placed on the market, available to authorities on request. In practice that means it needs to be stored somewhere retrievable years later, not left on a former employee’s laptop.
A marketplace has asked for GPSR compliance. What do I send?
Typically the manufacturer and responsible EU operator details, the required pre-purchase listing information, product traceability markings, and confirmation that an internal risk analysis and technical documentation exist. Platforms rarely want the full file itself; they want evidence that it exists and who is accountable.
What is Safety Gate?
Safety Gate is the EU rapid alert system for dangerous non-food consumer products. If you have reason to believe a product you placed on the market is dangerous, you must take corrective action and notify through Safety Gate. It also functions as a public database, which makes it a useful source when assessing risks for similar products.
