GPSR Risk Assessment: What It Means for You

If you sell products on the EU market and started exporting after 13 December 2024, GPSR Article 9 requires you to prepare a written risk assessment for your product. To many manufacturers this looks like "just paperwork" — but it isn't. If your risk assessment isn't available in the technical file, your product will be questioned during market surveillance; in cases of serious non-compliance, sales can be halted or an EU-wide recall process initiated.

This article covers: what the regulator (the European Commission and member-state authorities) expects from you, what your responsibilities are, how a risk category is determined, and which products carry higher risk — explained with concrete examples.

What Does the Regulator Expect From You?

According to the text of GPSR Article 9 and the European Commission's explanatory guidance, a manufacturer's risk assessment is expected to evidence four core elements:

Foreseeable use conditions of the product. Not just "use as instructed"; also reasonably predictable consumer misuse. For example, for a child's toy the assumption "used under adult supervision" is insufficient — unsupervised access by a child must also be considered.

Physical, chemical and electrical risks. All hazard categories that can arise from the product must be explicitly listed and assessed — cutting, swallowing, choking, burning, chemical migration, electric shock, tipping over, and so on.

Target user group. The likely user of the product must be clearly defined: infant, child, adult, professional. If the same product is marketed to more than one age group, the most vulnerable group drives the risk interpretation.

Past Safety Gate records of similar products. Notifications recorded recently on the EU's Safety Gate (formerly RAPEX) for the same category or comparable manufacturers must be considered.

When the market surveillance authority (BAFA and state-level authorities in Germany, equivalent bodies in other member states) requests your technical file, it expects to see the written documentation of these four elements.

Your Concrete Responsibilities

Let us state plainly what risk assessment means on the manufacturer's side:

• A written document is mandatory. "We performed a mental risk assessment" does not pass an audit. The document must be present as part of the technical file.
• The document must be retained for at least 10 years from the date the product is placed on the EU market. It must be immediately available to market surveillance.
• Risk assessment is not static. New Safety Gate notifications, product modifications, new sales channels, or marketing to a new age group — any of these change the interpretation; the document must be updated.
• The Responsible Person (Article 16 RP) must have access to this document. Your EU-established RP is obliged to produce the document within 3 business days upon authority request.
• Quarterly review has become a sector norm. A single annual assessment doesn't keep pace with the flow of Safety Gate notifications.

The European Commission does not impose a single template for the document; but it expects the document to be structured, traceable and readable during an audit.

What Is a Risk Category, and Where Does Your Product Fit?

The risk category is the resultant of your product's hazard potential combined with market conditions. It cannot be reduced to a single heading; but the easiest way to understand it is with concrete examples:

High-risk group. Toys and children's products, cosmetics, small electrical appliances (chargers, lithium-battery-powered products), baby textiles and accessories, chemical-content cleaning products. In these categories, serious hazard scenarios such as swallowing, choking, burning and chemical migration are normal; legislation often accompanies GPSR with additional specific regulations (Toy Directive, Cosmetics Regulation).

Medium-risk group. Adult textiles and apparel, furniture and home textiles, kitchenware (knives, glass, porcelain), garden equipment, small hand tools. Hazard scenarios (cutting, tipping, breaking) are concrete but differ from urgent risks such as swallowing or choking.

Low-risk group. Stationery, gift items, jewellery and decorative items, promotional products, decorative accessories. Serious hazard scenarios are limited; nevertheless, GPSR still requires a risk assessment document.

Your product can fall into more than one category — in which case the highest risk level applies. The sales channel matters too: a product reaching the EU consumer directly via non-EU marketplaces (through cross-border e-commerce platforms) is evaluated one category higher than the same product sold through an EU physical retailer.

Compliance Intensity by Risk Level

The risk category is not just a label on paper; it defines the operational workload you carry.

For the high-risk group: a more comprehensive technical file, more frequent (monthly or quarterly) Safety Gate record scans, faster notification flow (the manufacturer being alerted when new risk records emerge), additional documents in parallel with possible specific sector legislation. In some cases an independent test certificate is required.

For the medium-risk group: standard technical file scope, quarterly review, main-category-based Safety Gate monitoring. Your documentation stack is not as broad as the high-risk group, but the core elements (age-suitability, chemical migration, durability) are kept complete.

For the low-risk group: the basic requirements of GPSR Article 9 (written document, target user, use conditions, past records) are met; annual review is usually sufficient. However, when you expand your sales channel to online marketplaces, your category shifts upward; this change must be reflected in your document.

The 4 Most Common Mistakes Manufacturers Make

Typical breakdowns we see in practice:

1. Thinking "I did it once, it's done". Risk assessment is not static. A document prepared 12 months ago does not contain new Safety Gate records or changes in sales channel; it gets flagged as "not current" during an audit.

2. Focusing on only one hazard category. If a textile product has "chemical safety" prepared but "choking risk" (baby textile scenario) is not documented, it's an incomplete analysis.

3. Ignoring past Safety Gate records. Notifications made in the same category or for the same country of origin require you to update your risk interpretation retroactively. The assumption "my product is different" is questioned during audits.

4. Not reflecting sales channel changes in the document. When you shift from sales through an EU-based distributor to direct sales through Amazon EU / Etsy / your own site, the risk profile changes. If the document doesn't reflect this, a gap between reality and the file opens up — and this is questioned during audits.

How We Help

As Grüner Baum GmbH — established in Germany — we run Article 9 risk assessment and Article 16 Responsible Person obligations together for manufacturers placing products on the EU market: we examine your product portfolio, document the category-based risk interpretation, filter the Safety Gate stream against your portfolio, and keep the document deliverable within 3 business days upon authority request.

If your risk assessment isn't ready or you're unsure whether it's current, you can reach us through our assessment request form — we'll review your product portfolio and prepare specific feedback for you.