# GPSR Risk Assessment Method: EU Guide and Template

> Build a GPSR risk assessment with a 10-step method, Article 6 hazard checks, EU severity and probability bands, a worked template and common mistakes.

Published: 2026-06-22
Updated: 2026-09-01

Canonical page: [https://eugpsr.de/en/blog/gpsr-risk-assessment-methodology](https://eugpsr.de/en/blog/gpsr-risk-assessment-methodology)

As of 1 September 2026, a **GPSR risk assessment** is the manufacturer's product-specific record of how hazards can lead to harm, how severe that harm could be, how likely it is and which controls reduce the risk. GPSR Article 9(2) requires the internal risk analysis before the product is placed on the EU market; Annex II to Delegated Regulation (EU) 2024/3173 supplies the current EU severity-and-probability method for Safety Gate risk levels.

## What changed in this GPSR risk assessment guide?

- **September 2026:** Replaced the older RAPEX method with the current criteria in Delegated Regulation (EU) 2024/3173.
- **September 2026:** Removed unsupported rules about automatic product categories, online-sales uplifts, quarterly reviews and a three-business-day deadline.
- **September 2026:** Added a 10-step GPSR risk assessment template, the official probability bands and direct answers for General Product Safety Directive searches.

## Does GPSR require a risk assessment?

Yes. [GPSR Article 9(2)](https://eur-lex.europa.eu/eli/reg/2023/988/oj) requires every manufacturer within scope to carry out an internal risk analysis before placing the product on the market and to draw up technical documentation. The rule is tied to placing a product on the market, not to the date on which a company first started exporting.

The technical documentation must contain at least a general product description and the safety-relevant characteristics. Where the possible risks make it appropriate, it must also record the risks, the solutions adopted to eliminate or mitigate them, relevant test reports and the standards or other safety elements applied. The manufacturer keeps the technical documentation for **10 years** after the product is placed on the market.

## Which factors must a GPSR risk assessment cover?

GPSR Article 6 sets eight safety factors. A product file should show which factors apply, which do not and the evidence for that decision.

| Article 6 factor | Question for the product file |
| --- | --- |
| Product characteristics | Do design, composition, technical features, packaging, assembly, installation, use or maintenance create a hazard? |
| Interaction with other products | Can foreseeable connection or joint use create a hazard? |
| Effect of other items on the product | Can accessories, software or non-embedded items change how the product works or fails? |
| Presentation and safety information | Do appearance, labelling, age grading, warnings or instructions influence safe use and disposal? |
| Consumer groups | Are children, older people, persons with disabilities or other vulnerable consumers exposed to different harm? |
| Misleading appearance | Could the product be mistaken for food, placed in the mouth or treated as a children's product? |
| Cybersecurity | Could an external or malicious influence create a safety hazard or loss of safe interconnection? |
| Evolving functions | Can learning, predictive or changing functions alter the product's safety behaviour? |

When the presumption of safety in Article 7 does not resolve the question, Article 8 points to further evidence such as European or international standards, Commission guidance, scientific opinions, the state of the art, sector codes and reasonable consumer expectations.

## How do you complete a GPSR risk assessment step by step?

The following 10-step structure is a practical GPSR risk assessment template. It is not an official one-size-fits-all form.

| Step | Record in the technical file | Output |
| --- | --- | --- |
| 1. Identify the exact product | Model, version, batch family, materials, components, software and intended purpose | Unambiguous assessment scope |
| 2. Map applicable law and standards | GPSR plus product-specific EU legislation, standards and test methods | Legal and evidence baseline |
| 3. Define users and use | Intended users, vulnerable groups, intended use and reasonably foreseeable misuse | Exposure assumptions |
| 4. Identify hazards | Mechanical, physical, chemical, electrical, thermal, hygiene, ergonomic, cyber and functional hazards as applicable | Hazard register |
| 5. Write harm scenarios | The shortest credible sequence from defect or dangerous situation to accident and harm | One scenario per distinct harm path |
| 6. Rate severity | Level 1 minor, 2 moderate, 3 severe or 4 life-threatening | Severity for each scenario |
| 7. Estimate probability | Probability of every event in the scenario, based on test data, complaints, Safety Gate records or justified assumptions | Compound probability band |
| 8. Determine the risk level | Combine severity and probability; assess every scenario separately | Serious, high, medium or low risk |
| 9. Select and verify controls | Design changes, protective measures, production controls and safety information, with evidence of effectiveness | Controlled design and residual risk |
| 10. Approve and maintain the file | Decision owner, date, version, evidence references and change triggers | Traceable risk assessment record |

## How are EU product risk levels calculated?

Delegated Regulation (EU) 2024/3173 defines a **harm scenario** as the sequence of events that leads to harm. Each scenario begins with a product defect or dangerous situation, continues through an accident or adverse effect and ends with a specified injury or other harm. Separate hazards require separate scenarios.

The method uses four severity levels: level 1 is minor and normally reversible after basic treatment; level 2 is moderate; level 3 is severe and may require hospitalisation or cause long-term loss of function; level 4 is life-threatening or can cause severe permanent consequences. Probability is assessed over the product's foreseeable lifetime.

| Probability of the harm scenario | EU probability description |
| --- | --- |
| At least 50% | Very frequent |
| Below 50% to 1 in 10 | Frequent |
| Below 1 in 10 to 1 in 100 | Common |
| Below 1 in 100 to 1 in 1,000 | Occasional |
| Below 1 in 1,000 to 1 in 10,000 | Unlikely |
| Below 1 in 10,000 to 1 in 100,000 | Unusual |
| Below 1 in 100,000 to 1 in 1,000,000 | Rare |
| At or below 1 in 1,000,000 | Extremely rare |

The [official EU risk-level grid](https://eur-lex.europa.eu/eli/reg_del/2024/3173/oj) combines the probability band with severity level 1 to 4. If several scenarios produce different results, the highest identified level represents the product for the Safety Gate assessment. A product type is therefore not automatically “low risk” or “high risk”; the evidence and harm scenarios decide the level.

## What does a GPSR risk assessment example look like?

This simplified example shows the structure of one scenario row. The final rating cannot be copied to another mug or product because probability and control evidence are product-specific.

| Field | Illustrative record |
| --- | --- |
| Product | 350 ml ceramic mug, defined model and production version |
| Hazard | Handle fracture while the mug contains hot liquid |
| Harm scenario | Hidden crack develops, the handle breaks during lifting, hot liquid spills and the user suffers a burn |
| Exposed users | Adult consumers, including users with reduced grip strength |
| Severity evidence | Burn location, liquid temperature, fill volume and likely medical treatment |
| Probability evidence | Handle-load tests, production defect rate, complaints and comparable Safety Gate cases |
| Controls | Handle redesign, acceptance test, supplier specification, production sampling and clear use limits where justified |
| Residual-risk decision | Recalculate severity and probability after verified controls; approve only if the remaining risk is acceptable under the applicable law |

Warnings do not repair an unsafe design. The file should show why a design or production control was feasible, what it changed and which residual risk remains after the control.

## When must a GPSR risk assessment be updated?

GPSR does not prescribe a universal quarterly or annual review interval. Update the assessment whenever evidence or product conditions change, including:

- design, material, component, supplier, software or production changes;
- new intended uses, sales claims, consumer groups or foreseeable misuse;
- revised standards, scientific knowledge or product-specific legislation;
- complaints, accidents, test failures or corrective actions;
- relevant Safety Gate alerts or evidence that a control is ineffective.

A sales channel does not automatically raise the formal risk level. Online presentation, direct consumer access, missing instructions or different user behaviour can, however, change a specific scenario and must be documented.

## What belongs in the technical documentation?

A defensible GPSR risk assessment links each conclusion to evidence. Keep the product description, hazard register, harm scenarios, severity and probability rationale, standards, test reports where appropriate, controls, residual-risk decision, approver, version history and update triggers in the technical file.

The [GPSR technical documentation guide](https://eugpsr.de/en/documentation) explains the wider file. The [GPSR compliance checklist](https://eugpsr.de/en/blog/gpsr-compliance-checklist-13-items) connects the assessment to labelling, traceability, online offers and post-market duties.

## Who remains responsible for the GPSR risk assessment?

The manufacturer remains responsible for the internal risk analysis and safe product design. An EU-established economic operator under Article 16 may check that the technical documentation exists and cooperate with authorities within the applicable mandate, but appointing that operator does not transfer the manufacturer's Article 9 duty.

[Grüner Baum GmbH's GPSR risk assessment service](https://eugpsr.de/en/risk-assessment) reviews product scope, hazards, evidence and residual-risk records. Where an authorised-representative mandate is appropriate, the [EU Responsible Person service](https://eugpsr.de/en/responsible-person) is documented separately.

## Frequently asked questions about GPSR risk assessment

### Does GPSR require a risk assessment?

Yes. GPSR Article 9(2) requires the manufacturer to carry out an internal risk analysis before placing a product on the market and to draw up technical documentation. The analysis must be specific to the product and its safety-relevant characteristics.

### Is GPSR the General Product Safety Directive or a regulation?

GPSR is Regulation (EU) 2023/988. It replaced the General Product Safety Directive 2001/95/EC from 13 December 2024, although older searches still use the phrase “General Product Safety Directive risk assessment.”

### Is there an official GPSR risk assessment template?

There is no single manufacturer template for every product. Articles 6, 8 and 9 define the required substance, while Annex II to Delegated Regulation (EU) 2024/3173 provides the current EU harm-scenario, severity and probability method used for Safety Gate risk levels.

### What are the four EU product risk levels?

The four levels are serious, high, medium and low. The level comes from the combination of harm severity and the probability of that harm, not from a fixed list that labels whole product categories in advance.

### Does selling a product online automatically increase its risk level?

No. GPSR does not automatically move a product up one risk level because it is sold online. The sales channel may change foreseeable use, consumer exposure or the information presented, and those facts must be assessed in the relevant harm scenarios.

### Does every GPSR risk assessment require laboratory testing?

No. GPSR Article 9(2) refers to test reports where appropriate for the product's possible risks. Product-specific EU legislation, the identified hazard or the evidence needed to support a safety claim may nevertheless make testing necessary.

## Official sources

- [Regulation (EU) 2023/988, Articles 5-9 and 51](https://eur-lex.europa.eu/eli/reg/2023/988/oj)
- [Delegated Regulation (EU) 2024/3173, Annex II risk-level criteria](https://eur-lex.europa.eu/eli/reg_del/2024/3173/oj)
- [European Commission Safety Gate](https://ec.europa.eu/safety-gate/)
- [European Commission product safety portal](https://commission.europa.eu/topics/business-and-industry/product-safety_en)