GPSR risk assessment: what manufacturers must document
9 min readRepresenta GmbH
The GPSR risk assessment under Article 9(2): what it must cover, a template with the legal basis for each section, and what your EU partners check.
Before a consumer product covered by the General Product Safety Regulation (EU) 2023/988 reaches the EU market, its manufacturer must carry out a GPSR risk assessment. Article 9(2) calls it an internal risk analysis and requires it to be recorded in the technical documentation, without prescribing a form. Here is what it must cover, a template with legal basis and what your EU partners check.
What a GPSR risk assessment is and when it applies
Under Article 9(2) GPSR (opens in a new tab), manufacturers must carry out an internal risk analysis and draw up technical documentation before placing a product on the market.
The depth is proportionate to the product's complexity and risks (recital 33): at minimum a general description and the safety-relevant characteristics; where the risks call for it, also the risk analysis with the solutions adopted, test reports and the standards applied (Article 9(2)(a) and (b)).
For CE-marked products, Article 9 does not apply (Article 2(1)(b) GPSR); the sector act governs the risk analysis (Blue Guide 2022, section 4.1.1).
What the analysis must cover: the aspects of Article 6
Article 6(1) GPSR lists the aspects to assess. The list is not exhaustive, but it makes a good backbone:
- Characteristics: design, technical features, composition, packaging and instructions (point (a)).
- Other products used with yours, in both directions, including interconnection (points (b) and (c)). The guidelines cite a software update that overheats a device.
- Presentation: labeling, age suitability, warnings and instructions for safe use and disposal (point (d)).
- Consumer categories, in particular children, older people and persons with disabilities, and gender differences (point (e)).
- Appearance that invites other uses, for example products that look like food or appeal to children (point (f)).
- Cybersecurity and evolving, learning or predictive functions, where the nature of the product requires it (points (g) and (h)).
The guidelines add mental health and environmental risks that affect consumers. Assess the product over its actual duration of use (Article 3(2)).
Standards and the presumption of safety
A product is presumed safe if it conforms to European standards whose references are published in the Official Journal, but only for the risks those standards cover (Article 7(1)(a) GPSR). The current list is Commission Implementing Decision (EU) 2026/901 (opens in a new tab) of 17 April 2026, covering products such as high chairs, baby carriers, bicycles and gym equipment.
For risks without such a standard, use the elements of Article 8, such as international standards, the state of the art and reasonable consumer expectations. List what you applied and, for standards applied only in part, which parts (Article 9(2)).
Safety should come primarily from design; warnings and instructions address the remaining risks (recital 22). An analysis that answers every hazard with a warning label reverses that order.
A GPSR risk assessment template, section by section
The GPSR guidelines offer an optional model template for the technical documentation. This version adds the legal basis to each section:
| Section | What to record | Basis |
|---|---|---|
| 1. Identification | Brand, name, type, batch or serial number, pictures of product and packaging | Art. 9(2) and (5); template, point 1 |
| 2. Characteristics | Materials, composition, safety-relevant features | Art. 9(2); template, point 2 |
| 3. Users and use | Target users, vulnerable groups, foreseeable use, duration of use | Art. 3(2), Art. 6(1)(e) and (f) |
| 4. Risks | Each possible risk separately, whatever its level | Art. 9(2)(a); guidelines, point 3.1.1 |
| 5. Measures | Per risk: design solution, standard or other element applied, test report | Art. 9(2)(a); template, point 3 |
| 6. Warnings | Which remaining risk each warning addresses; languages | Art. 6(1)(d), Art. 9(7) |
| 7. Standards | References with version; parts applied | Art. 9(2)(b) |
| 8. Updates | Version, date and reason for each change | Art. 9(3) |
Keep one file per product model; for variants, see our article on the GPSR guidelines.
How authorities rate risk
When notifying dangerous products through the Safety Gate Rapid Alert System, authorities rate the risk with Annex II to Commission Delegated Regulation (EU) 2024/3173 (opens in a new tab), applicable since 13 December 2024. The method is addressed to member states, not manufacturers, but it shows how your file will be read:
- A harm scenario for each hazard: defect or dangerous situation, accident, harm (point 3.2).
- The severity on four levels, from minor to life-threatening (point 3.3).
- A probability for each step, multiplied over the product's foreseeable lifetime (point 3.4).
- The combination gives a serious, high, medium or low risk; the highest scenario counts (points 3.6 and 3.7).
A serious risk is presumed, for example, for small parts in childcare articles for children under 36 months, or where severe harm is likely and consumers are not adequately informed how to avoid it (point 4.1). A risk assessment you submit through the Safety Business Gateway is only indicative for the authority (GPSR guidelines, point 3.4.3).
Keeping the analysis current over the product's life
The technical documentation must stay up to date and available to authorities for 10 years after the product was placed on the market (Article 9(3) GPSR). Update the analysis when:
- the design, composition or a safety-relevant component changes;
- complaints or accidents, which you must investigate and register (Article 9(12)), reveal a new risk;
- a standard is revised: Implementing Decision (EU) 2026/901 published EN 14988:2017+A2:2024 for high chairs, and the previous version loses its reference on 27 October 2027;
- a software update substantially modifies the product and affects its safety (recital 25, Article 13(3)).
What importers and your Responsible Person check
The law makes your EU partners check the analysis.
| Role | What it checks | Basis |
|---|---|---|
| Importer | Before placing on the market: that the risk analysis and technical documentation exist; keeps a copy for 10 years | Art. 11(1) and (6) GPSR |
| Responsible Person | That the documentation exists and reaches authorities on request, in a language they easily understand | Art. 4(3)(a) and (b) Regulation (EU) 2019/1020, Art. 16(1) GPSR |
| Responsible Person | Regularly, where the risks call for it: that the product matches the documentation; evidence of these checks on request | Art. 16(2) GPSR |
Matching means, according to the guidelines, that the risks were eliminated or mitigated as described. In Germany, an incomplete risk analysis is an administrative offence in itself (§ 28(2) no. 1 ProdSG; see GPSR penalties).
Practical example: a Canadian high chair maker
A Canadian maker sells a convertible wooden high chair to EU consumers through its own online shop; its EU Authorized Representative acts as Responsible Person. The guidelines name childcare articles and furniture as fully covered by the GPSR (point 2.2).
| Risk | Measure | Record in the file |
|---|---|---|
| Child falls out or the chair tips over | Restraint system, wide base; tested against EN 14988:2017+A2:2024 | Test report; presumption only for risks the standard covers |
| Fingers trapped when converting the chair | Covered hinge, illustrated conversion steps | Own test and drawings if the standard does not cover the conversion |
| Adult stands on the chair | Warning on the chair and in the manual, in each target language | Warning linked to this scenario (Art. 6(1)(d)) |
When the tray supplier changes, the maker updates the file its Responsible Person uses for regular checks.
Gaps that surface when an authority asks
- A test report instead of an analysis. It shows one standard was met, not which risks you identified.
- Warnings without a reason. Each warning on the product and in the listing (Article 19(d) GPSR) should trace back to a risk in the file.
- Vulnerable users left out, although Article 6(1)(e) names them.
- A file frozen at launch that ignores changes, complaints and revised standards (Article 9(3)).
- Documents nobody in the EU can produce, kept at the factory in a language the authority cannot read.
Conclusion: a file the authorities can follow
A GPSR risk assessment is short where the product is simple and detailed where the risks are real. What counts: every risk has a measure, every measure has evidence, every warning has a reason, and the file stays current and reachable in the EU for 10 years.
The analysis remains your responsibility as manufacturer. As your GPSR Responsible Person, Representa keeps your compliance files ready for inspections, reviews labeling, packaging and manuals, and handles communication with authorities. Our compliance consulting reviews your technical documentation and prioritizes the fixes.
Frequently asked questions
Is a GPSR risk assessment mandatory?
Yes. Article 9(2) GPSR requires manufacturers to carry out an internal risk analysis and draw up technical documentation before placing a product on the market. For CE-marked products, the risk analysis follows the applicable sector legislation instead (Article 2(1) GPSR).
Is there an official GPSR risk assessment template?
There is no mandatory one. The Commission's GPSR guidelines (C/2025/6233) offer an optional model template for the technical documentation, with product identification, characteristics, and a separate entry for each risk and the measures taken against it.
How long must the risk assessment be kept?
The technical documentation, including the risk analysis, must be kept up to date and available to market surveillance authorities for 10 years after the product was placed on the market (Article 9(3) GPSR). Importers keep a copy for the same period (Article 11(6)).
Does my Responsible Person write the risk assessment?
No. The manufacturer carries out the analysis. The Responsible Person verifies that the technical documentation exists, ensures it can be made available to authorities and regularly checks that the product matches it (Article 16 GPSR, Article 4(3) of Regulation (EU) 2019/1020).
Does complying with a European standard replace the risk assessment?
No. A European standard published in the Official Journal gives a presumption of safety only for the risks it covers (Article 7(1)(a) GPSR). Other risks need their own assessment, and the standards applied must be listed in the technical documentation (Article 9(2)(b)).