The New EU Product Reality: A Guide to the General Product Safety Regulation (GPSR) and Digital Products

The European Union's General Product Safety Regulation (GPSR) officially took effect in late 2024, but its true operational impact is only now reshaping global supply chains in 2026. Designed to replace a two-decade-old directive, the GPSR modernizes consumer protection for the digital age. It establishes a non-negotiable baseline: no product, whether a physical toy or a downloadable application, can be sold in the EU without a designated safety representative and a comprehensive risk assessment. For manufacturers and online sellers, this represents a permanent shift from reactive safety recalls to proactive, continuous compliance.[1]

The previous framework, the General Product Safety Directive (GPSD), was drafted before the smartphone era and focused almost entirely on physical goods. The GPSR closes the gaps left by the GPSD, reflecting the profound shift in the scope of products now available to consumers. It broadens the definition of a product to include interconnected devices and explicitly addresses the risks posed by modern supply chains, including direct-to-consumer e-commerce shipments from outside the European Union.[1][2]

The most significant departure from previous frameworks is the explicit inclusion of digital products. Standalone software, previously operating in a regulatory gray area, is now squarely in scope. The European Commission has clarified that unless software falls under specific sectoral legislation, it must meet GPSR safety requirements. This means developers must proactively assess the safety characteristics of their code, document potential risks, and ensure that their digital products do not pose a threat to consumers.[1]

Defining "safety" for a non-physical product introduces new complexities. Under the GPSR, safety is no longer limited to the risk of physical injury. It now encompasses cybersecurity vulnerabilities that could lead to indirect harm, as well as risks to mental health, particularly for products aimed at children. Software developers must now conduct rigorous risk assessments that evaluate how their code interacts with other systems and whether a failure could result in a dangerous situation for the end user.[1][2]

To prove that these assessments have been conducted, the GPSR introduces a stringent archiving requirement. Developers and manufacturers must maintain comprehensive technical documentation detailing the product's design, safety characteristics, and risk mitigations. Crucially, this documentation must be retained for a full 10 years after the product is placed on the market. This decade-long liability tail forces the tech industry to adopt archiving practices traditionally reserved for medical devices or automotive parts.[1]

The mechanism of enforcement has also evolved from border checks to algorithmic marketplace audits. The GPSR mandates that every product placed on the market must have a "Responsible Person" established within the EU. This economic operator—whether a manufacturer, importer, or authorized representative—acts as the primary point of contact for market surveillance authorities. They are legally accountable for ensuring that the product meets all safety requirements and that the technical documentation is readily available.[1][2]

For non-EU sellers, the Responsible Person mandate represents a significant operational hurdle. Initially, many international retailers treated this as a simple paperwork exercise, appointing a representative to clear marketplace listing gates ahead of the 2024 deadline. However, authorities are now actively testing this system. A seller whose representative cannot produce the required technical documentation within hours of a request is deemed non-compliant, regardless of the product's actual safety record.[2]

Online marketplaces bear new, heavy responsibilities under the regulation. Platforms like Amazon, eBay, and AliExpress are no longer just passive intermediaries; they are legally required to establish a regulated position for digital supply chains. This includes gathering compliance information from sellers, displaying safety warnings prominently on product pages, and establishing internal processes for swiftly removing listings for dangerous or non-compliant products.[1][2]

When a marketplace receives a notice from a surveillance authority, the takedown process is rapid and often automated. In 2026, sellers are experiencing the GPSR not as a distant regulatory framework, but as an active algorithmic enforcement regime. Listings are being suspended not just for safety failures, but for missing documentation or inadequate labeling. This strict enforcement leaves unprepared sellers locked out of the European market until they can retroactively assemble the required compliance paperwork.[2]

The intensified market surveillance is further supported by changes to customs rules, notably the phasing out of the €150 customs duty exemption. Previously, this exemption allowed many low-value direct-to-consumer shipments to bypass stringent checks, creating a loophole for non-compliant goods. With the removal of this threshold, every package entering the EU is now subject to the same rigorous accountability standards, significantly increasing the volume of goods scrutinized by national authorities.[2]

To manage this increased volume, the GPSR relies on enhanced cooperation between the European Commission, member states, and international organizations. The regulation establishes a unified Safety Gate portal, allowing authorities to rapidly share information about dangerous products and coordinate EU-wide recalls. The goal is to create a uniform enforcement net that prevents non-compliant products from simply moving from a strict member state to a more lenient one.[1]

Despite the clear mandates, uncertainty remains regarding the practical enforcement of software safety. While physical goods have established testing standards, the criteria for evaluating the safety of a standalone app are less defined. Developers must navigate this ambiguity by conducting thorough, documented risk assessments that consider potential misuse and edge cases. The lack of standardized testing for digital products means that compliance often relies on the subjective judgment of individual market surveillance authorities.[1][2]

Ultimately, the GPSR represents a structural change in how the EU manages consumer risk. It forces a convergence between the physical and digital economies, applying the rigorous safety standards of tangible goods to the software that increasingly powers them. For businesses, the mandate is clear: safety and compliance must be embedded in the product lifecycle from the initial design phase through to the end of the 10-year documentation tail. Those who treat the regulation as a mere registration hurdle will find themselves systematically excluded from the European market.[1][2]