The General Product Safety Regulation (GPSR) in practice: How the EU’s new regime is reshaping recall communications and manufacturer obligations

The General Product Safety Regulation (EU) 2023/988 (‘GPSR’), which has applied since 13 December 2024, fundamentally reformed EU product safety law. It sets out manufacturers’ obligations in greater detail, imposes strict rules on recall communications, and gives consumers a right to a reme-dy in the event of a recall.

In practice, many of these requirements initially raised more questions than they answered. The European Commission’s GPSR Guidelines (‘Guidelines’), published in November 2025, now provide important guidance, although they are not legally binding and, in some respects, stretch the text of the regulation. In parallel, German courts and authorities have begun to enforce the GPSR, and its interplay with the revised German Product Liability Act increases the liability risk for companies.

Key changes under the GPSR

Expanded obligations for manufacturers

The GPSR sets out manufacturers’ obligations in considerably more detail than the previous framework did. Before placing a product on the market, manufacturers must now carry out an internal risk analysis and prepare technical documentation (Article 9(2) GPSR) and have internal procedures in place to ensure that the product remains safe throughout series production (Article 9(4) GPSR). Products must bear a type, batch or serial number (Article 9(5) GPSR) and must also show the manufacturer’s name, postal address and electronic address, on the product itself wherever possible (Article 9(6) GPSR).

Obligations continue after the product is on the market. Manufacturers must provide publicly accessible communication channels for consumers and keep an internal register of complaints, recalls, and corrective measures (Article 9(11), (12) GPSR). A company that sells a product under its own name or trademark (Article 13(1) GPSR) or substantially modifies it (Article 13(2) GPSR) is treated as the manufacturer. Obligations also extend to providers of online marketplaces (Article 22 GPSR) and fulfilment service providers.

Recall communications

The GPSR marked a clear break with established recall communication practice. Under the GPSR, in the case of a product safety recall, or where certain information has to be brought to the attention of consumers to ensure the safe use of a product (safety warning), economic operators must notify all affected consumers they can identify directly and without undue delay, using the personal data at their disposal (Article 35(1) GPSR). Where not all affected consumers can be reached directly, a clear and visible recall notice must be disseminated through other appropriate channels, such as the company’s website, social media, newsletters, retail outlets, and, where appropriate, the mass media (Article 35(4) GPSR).

Where consumers are informed in writing, this must take the form of a recall notice (Article 36 GPSR). The notice must contain mandatory information on the product, the hazard, the action consumers should take, and the remedies available. It must also be available in the language of the Member States where the product was made available. A template for recall notices is set out in Implementing Regulation (EU) 2024/1435. According to the Commission, its use is not mandatory as long as the notice contains all the information required by Article 36 GPSR.

The consumer right to remedy

The GPSR introduced a right that had no precedent in EU product safety law: a consumer right to remedy in the event of a recall. The economic operator responsible for the recall, usually the manufacturer, must offer consumers an effective, cost-free, and timely remedy (Article 37(1) GPSR). As a rule, consumers must be offered a choice of at least two of the following: repair, replacement with a safe product of the same type, or an adequate refund of at least the price paid (Article 37(2) GPSR). Offering only one remedy is permissible when the others would be impossible or disproportionate.

The financial impact can be considerable. The refund must be at least equal to the price paid, and the GPSR does not appear to allow any deduction for the consumer’s use of the product. Even after years of use, consumers may therefore be entitled to a refund of the full purchase price. Since consumers choose among the remedies offered, companies should base their recall budgets on the more expensive of these options.

The Commission’s GPSR Guidelines

Background and legal status

Many of the GPSR’s requirements proved to be unclear in practice, and some were hard to implement if read literally. The Commission’s Guidelines required under Article 17(2) GPSR were therefore eagerly awaited. The Commission adopted the Guidelines on 19 November 2025, together with separate guidelines on the Safety Business Gateway. The Guidelines are not legally binding; only the Court of Justice can give a binding interpretation of the regulation. In practice, however, market surveillance authorities are likely to rely on them for interpretation.

Determining roles and scope

The Guidelines require companies to first determine what role they play for each product, for example as manufacturer, importer, distributor, or provider of an online marketplace. A company may have different roles for different products and must then comply with the corresponding obligations in parallel. The Guidelines provide a separate checklist for each role. On scope, the Commission takes a broad view. The GPSR covers ‘any item’, whether tangible or intangible, including apps and software such as chatbots, as well as second-hand, repaired, and refurbished products.

Standards and the presumption of conformity

Products that comply with European standards published in the Official Journal of the European Union are presumed to be safe (Article 7(1)(a) GPSR). The Guidelines confirm that this also applies to standards published under the former General Product Safety Directive. Where no such standard exists, the Commission expects manufacturers to assess all potential risks in full. This goes further than the regulation requires. Under Article 9(2) GPSR, the depth of the risk analysis depends on how complex and risky a product is, not on whether a standard exists. For simple, low-risk products, a short risk analysis should therefore be enough.

Harmonised products

For products covered by sector-specific Union harmonisation legislation, such as toys or vehicles, it has been disputed how far the GPSR’s role as a safety net extends. Some argued that economic operators should compare the requirements of the sector-specific rules with those of the GPSR and determine, obligation by obligation, which regime applies to them. The Guidelines do not provide for such a gap analysis. This suggests that, in the Commission’s view, the general obligations of economic operators under Chapter III, Section 1 GPSR do not apply in addition to the obligations under the sector-specific legislation. For manufacturers of harmonised products, this provides welcome legal certainty.

Risk assessment requirements

Where the GPSR applies, Article 9(2) GPSR requires the risk analysis to be documented in the technical documentation in every case. Its scope depends on the complexity of the product. The documentation must be prepared for each product model, cover all identified risks irrespective of their level, and be kept up to date for 10 years. The assessment must also take account of vulnerable consumers and characteristics such as gender. Depending on the product, it must further address cybersecurity and evolving, learning, or predictive functions. A non-binding model template sets out the product description and, risk by risk, the measures taken.

Manufacturer details and contact channels

According to the Guidelines, an ‘electronic address’ may be an email address or a dedicated section of the company’s website that allows consumers to contact the company directly and easily. A website alone is not sufficient. Manufacturer details may be moved from the product to its packaging only where the size of the product requires it, not for aesthetic reasons. German market surveillance authorities have traditionally taken a more liberal approach. It therefore remains to be seen whether this strict view will prevail. However, companies should be able to justify where they place this information in the event of a dispute.

Accident reporting

Article 20 GPSR introduced an entirely new reporting obligation. The German language version in particular left open whether temporary, non-serious adverse effects also had to be reported. The Guidelines clarify that only accidents resulting in death or serious adverse effects on health and safety must be reported, although such effects may be temporary as well as permanent. Minor injuries therefore do not have to be reported. However, the Guidelines do not define when effects become ‘serious’.

Recall practice

As a rule, the operator in the supply chain that holds the consumer data should contact consumers, which makes cooperation along the supply chain essential. Data provided by consumers for safety purposes only must not be used for marketing. Publishing information on the Safety Gate Portal does not release companies from the obligation to contact consumers directly. If a repair or replacement is not completed within a reasonable time, the consumer is entitled to a full refund.

Open questions

Many questions remain unanswered. The Guidelines do not explain, for example, when corrective measures are ‘justified’. In other respects, they go further than the Regulation itself. Some of the Commission’s expectations have no clear basis in the text of the GPSR and are better understood as recommendations than as legal requirements. Since market surveillance authorities may nevertheless rely on them, companies should identify these points and decide on a case-by-case basis whether to follow them.

First disputes and enforcement

Almost two years after the GPSR began to apply, there is still no case law from the higher courts. In Germany, however, enforcement has started through an established route. Competitors and trade associations are using unfair competition law to pursue breaches of the GPSR’s information obligations.

In one of the first decisions on the GPSR, the Hechingen District Court (GRUR-RD 2026, 13762) ruled on an action brought by a trade association. The court held that a trader had infringed unfair competition law by offering a product on a large online marketplace without the manufacturer details required by Article 19(a) GPSR. It classified these details as material information within the meaning of Sections 5a(2) and 5b(4) of the German Act against Unfair Competition, meaning that omitting them gave rise to an injunction claim. The court rejected the trader’s defences that it had entered the data in the seller back end, that the details appeared in another language version and that it had only limited control over the shared product page. Relying on established case law of the Federal Court of Justice, it held that what matters is the offer actually displayed to consumers. Traders who benefit from a marketplace must also accept responsibility for the way it presents their offers.

Public enforcement is gaining momentum as well. Under the amended German Product Safety Act, in force since 19 February 2026, failing to set up a communication channel or keep a complaints register is now a regulatory offence. Other Member States have also tightened their enforcement rules. Italy, for example, introduced a new sanctions regime by Legislative Decree No. 78/2026, which has been in force since 16 May 2026.

The more significant litigation risk, however, may lie elsewhere. The GPSR’s notification, record-keeping, and consumer communication obligations create a paper trail. Risk assessments, technical files, incident records, and recall notices can later help claimants identify the alleged defect and the affected products. They can also help qualified entities identify the affected consumers for representative actions. Once the new Product Liability Directive has been transposed, its disclosure obligations and rebuttable presumptions will add further weight to these documents. In Germany, this will take place through the revised Product Liability Act, which provides for court-ordered disclosure of technical documentation and product monitoring data and presumes a product to be defective where mandatory EU safety requirements have been breached. Manufacturers should therefore handle every safety incident with one eye on the regulator and the other on the courtroom.

Key takeaways for businesses

Almost two years after it began to apply, the GPSR is no longer only a compliance topic. Enforcement by competitors and authorities is increasing, and the Commission’s Guidelines now shape how the regulation is applied in practice.

Although the Guidelines are not binding, authorities are likely to rely on them. Economic operators should therefore use them as a practical starting point.

The checklists help companies determine their role for each product, and the allocation of responsibilities they propose can be adopted or adapted in supply and distribution agreements. This is particularly important for product recalls. Under Articles 35 to 37 GPSR, companies must contact affected consumers directly, issue a recall notice with the required content, and offer an effective, cost-free remedy.

These steps cannot be organised from scratch once a safety problem arises. Where the Guidelines go beyond the text of the GPSR – or leave questions open, for example on when corrective measures are ‘justified’ – companies should decide case by case and record their reasoning. From 9 December 2026, such documentation, together with technical documentation and product monitoring data, may also become evidence in product liability proceedings, as the revised German Product Liability Act allows courts to order its disclosure.