GPSR Risk Assessment Method: EU Guide and Template
A GPSR risk assessment is your written record of how a product could hurt someone, how serious that harm could be, how likely it is and what you do to reduce the risk. If you are the manufacturer, the GPSR requires it before you place the product on the EU market. The EU's official risk method, the same one used for Safety Gate risk levels, gives you the scale for severity and probability.
Does GPSR require a risk assessment?
Yes. If you manufacture a product that falls under the GPSR, you must carry out an internal risk analysis and draw up technical documentation before you place it on the market. The duty is tied to placing the product on the market, not to the date your company first started exporting.
At a minimum, the file describes the product and its safety-relevant features. Where the possible risks call for it, it also records the risks, how you removed or reduced them, relevant test reports and the standards or other safety references you applied. Keep the technical documentation for 10 years after the product is placed on the market.
Which factors must a GPSR risk assessment cover?
The GPSR lists eight safety factors. Your product file should show which factors apply, which do not and the evidence behind that decision.
| GPSR safety factor | Question for the product file |
|---|---|
| Product characteristics | Do design, composition, technical features, packaging, assembly, installation, use or maintenance create a hazard? |
| Interaction with other products | Can foreseeable connection or joint use create a hazard? |
| Effect of other items on the product | Can accessories, software or non-embedded items change how the product works or fails? |
| Presentation and safety information | Do appearance, labelling, age grading, warnings or instructions influence safe use and disposal? |
| Consumer groups | Are children, older people, persons with disabilities or other vulnerable consumers exposed to different harm? |
| Misleading appearance | Could the product be mistaken for food, placed in the mouth or treated as a children's product? |
| Cybersecurity | Could an external or malicious influence create a safety hazard or loss of safe interconnection? |
| Evolving functions | Can learning, predictive or changing functions alter the product's safety behaviour? |
If your product meets a relevant European standard, it is presumed safe for the risks that standard covers. Where that does not settle the question, the GPSR points to further evidence: European or international standards, Commission guidance, scientific opinions, the state of the art, sector codes and reasonable consumer expectations.
How do you complete a GPSR risk assessment step by step?
The following 10-step structure is a practical GPSR risk assessment template. It is not an official one-size-fits-all form.
| Step | Record in the technical file | Output |
|---|---|---|
| 1. Identify the exact product | Model, version, batch family, materials, components, software and intended purpose | Unambiguous assessment scope |
| 2. Map applicable law and standards | GPSR plus product-specific EU legislation, standards and test methods | Legal and evidence baseline |
| 3. Define users and use | Intended users, vulnerable groups, intended use and reasonably foreseeable misuse | Exposure assumptions |
| 4. Identify hazards | Mechanical, physical, chemical, electrical, thermal, hygiene, ergonomic, cyber and functional hazards as applicable | Hazard register |
| 5. Write harm scenarios | The shortest credible sequence from defect or dangerous situation to accident and harm | One scenario per distinct harm path |
| 6. Rate severity | Level 1 minor, 2 moderate, 3 severe or 4 life-threatening | Severity for each scenario |
| 7. Estimate probability | Probability of every event in the scenario, based on test data, complaints, Safety Gate records or justified assumptions | Compound probability band |
| 8. Determine the risk level | Combine severity and probability; assess every scenario separately | Serious, high, medium or low risk |
| 9. Select and verify controls | Design changes, protective measures, production controls and safety information, with evidence of effectiveness | Controlled design and residual risk |
| 10. Approve and maintain the file | Decision owner, date, version, evidence references and change triggers | Traceable risk assessment record |
How are EU product risk levels calculated?
The EU's official risk method defines a harm scenario as the sequence of events that leads to harm. Each scenario starts with a product defect or dangerous situation, continues through an accident or adverse effect and ends with a specific injury or other harm. Write a separate scenario for each hazard.
The method uses four severity levels: level 1 is minor and normally reversible after basic treatment; level 2 is moderate; level 3 is severe and may require hospitalisation or cause long-term loss of function; level 4 is life-threatening or can cause severe permanent consequences. Probability is assessed over the product's foreseeable lifetime.
| Probability of the harm scenario | EU probability description |
|---|---|
| At least 50% | Very frequent |
| Below 50% to 1 in 10 | Frequent |
| Below 1 in 10 to 1 in 100 | Common |
| Below 1 in 100 to 1 in 1,000 | Occasional |
| Below 1 in 1,000 to 1 in 10,000 | Unlikely |
| Below 1 in 10,000 to 1 in 100,000 | Unusual |
| Below 1 in 100,000 to 1 in 1,000,000 | Rare |
| At or below 1 in 1,000,000 | Extremely rare |
The official EU risk-level grid combines the probability band with severity level 1 to 4. If several scenarios produce different results, the highest identified level represents the product for the Safety Gate assessment. A product type is therefore not automatically “low risk” or “high risk”; the evidence and harm scenarios decide the level.
What does a GPSR risk assessment example look like?
This simplified example shows the structure of one scenario row. The final rating cannot be copied to another mug or product because probability and control evidence are product-specific.
| Field | Illustrative record |
|---|---|
| Product | 350 ml ceramic mug, defined model and production version |
| Hazard | Handle fracture while the mug contains hot liquid |
| Harm scenario | Hidden crack develops, the handle breaks during lifting, hot liquid spills and the user suffers a burn |
| Exposed users | Adult consumers, including users with reduced grip strength |
| Severity evidence | Burn location, liquid temperature, fill volume and likely medical treatment |
| Probability evidence | Handle-load tests, production defect rate, complaints and comparable Safety Gate cases |
| Controls | Handle redesign, acceptance test, supplier specification, production sampling and clear use limits where justified |
| Residual-risk decision | Recalculate severity and probability after verified controls; approve only if the remaining risk is acceptable under the applicable law |
Warnings do not repair an unsafe design. The file should show why a design or production control was feasible, what it changed and which residual risk remains after the control.
When must a GPSR risk assessment be updated?
GPSR does not prescribe a universal quarterly or annual review interval. Update the assessment whenever evidence or product conditions change, including:
- design, material, component, supplier, software or production changes;
- new intended uses, sales claims, consumer groups or foreseeable misuse;
- revised standards, scientific knowledge or product-specific legislation;
- complaints, accidents, test failures or corrective actions;
- relevant Safety Gate alerts or evidence that a control is ineffective.
A sales channel does not automatically raise the formal risk level. Online presentation, direct consumer access, missing instructions or different user behaviour can, however, change a specific scenario and must be documented.
What belongs in the technical documentation?
A defensible GPSR risk assessment links each conclusion to evidence. Keep the product description, hazard register, harm scenarios, severity and probability rationale, standards, test reports where appropriate, controls, residual-risk decision, approver, version history and update triggers in the technical file.
The GPSR technical documentation guide explains the wider file. The GPSR compliance checklist connects the assessment to labelling, traceability, online offers and post-market duties.
Who remains responsible for the GPSR risk assessment?
The manufacturer stays responsible for the internal risk analysis and a safe design. The EU responsible person can check, within its mandate, that the technical documentation exists and can cooperate with authorities. Appointing one does not move the manufacturer's risk-analysis duty to that operator.
Grüner Baum GmbH's GPSR risk assessment service reviews product scope, hazards, evidence and residual-risk records. Where an authorised-representative mandate is appropriate, the EU Responsible Person service is documented separately.
Frequently asked questions about GPSR risk assessment
Does GPSR require a risk assessment?
Yes. The GPSR requires the manufacturer to carry out an internal risk analysis and draw up technical documentation before placing a product on the market. The analysis must fit the specific product and its safety-relevant features.
Is GPSR the General Product Safety Directive or a regulation?
The GPSR is an EU regulation: Regulation (EU) 2023/988. It replaced the General Product Safety Directive 2001/95/EC from 13 December 2024. Older searches still use the phrase “General Product Safety Directive risk assessment.”
Is there an official GPSR risk assessment template?
No single template fits every product. The GPSR sets what the assessment must cover. The EU's official risk method, used for Safety Gate risk levels, gives you the harm-scenario, severity and probability scale.
What are the four EU product risk levels?
The four levels are serious, high, medium and low. The level comes from the combination of harm severity and the probability of that harm, not from a fixed list that labels whole product categories in advance.
Does selling a product online automatically increase its risk level?
No. GPSR does not automatically move a product up one risk level because it is sold online. The sales channel may change foreseeable use, consumer exposure or the information presented, and those facts must be assessed in the relevant harm scenarios.
Does every GPSR risk assessment require laboratory testing?
No. The GPSR refers to test reports where they are appropriate for the product's possible risks. Product-specific EU law, the hazard you identified or the evidence behind a safety claim may still make testing necessary.
Official sources
| Topic | Legal basis | Official text |
|---|---|---|
| Only safe products may be placed on the market | GPSR Article 5 | Regulation (EU) 2023/988 on EUR-Lex |
| The eight safety factors in the table above | GPSR Article 6(1) | Regulation (EU) 2023/988 on EUR-Lex |
| Presumption of safety through European standards; further evidence where it does not apply | GPSR Article 7(1) and Article 8(1) | Regulation (EU) 2023/988 on EUR-Lex |
| Internal risk analysis before placing on the market; minimum content of the technical documentation; test reports where appropriate | GPSR Article 9(2) | Regulation (EU) 2023/988 on EUR-Lex |
| Keeping the technical documentation up to date and for 10 years | GPSR Article 9(3) | Regulation (EU) 2023/988 on EUR-Lex |
| The EU responsible person checks the documentation; the manufacturer keeps its own duties | GPSR Article 16(1) and (2); manufacturer duties: GPSR Article 9 | Regulation (EU) 2023/988 on EUR-Lex |
| The GPSR replaced Directive 2001/95/EC from 13 December 2024 | GPSR Article 50(1) and Article 52 | Regulation (EU) 2023/988 on EUR-Lex |
| Harm scenarios, four severity levels, probability bands and the risk grid; the highest level represents the product | Commission Delegated Regulation (EU) 2024/3173, Annex II | Delegated Regulation (EU) 2024/3173 on EUR-Lex |
| Published product alerts and their risk levels | European Commission alert database (not a legal text) | European Commission Safety Gate |
| Overview of EU product safety rules and guidance | European Commission information page | European Commission product safety portal |
This article is general information, not legal advice.
30-Minute GPSR Assessment
Whether your brand is entering the EU market or already selling, eugpsr.de supports you with GPSR gap assessment, documentation preparation, labelling and warning reviews, traceability structure and Responsible Person services.