GPSR (EU 2023/988): the General Product Safety Regulation and the DPP

The GPSR is the EU rule that decides which consumer products may enter the EU market at all — and what identification and contact details a product must carry so it stays traceable. It has applied since 13 December 2024, replacing the old 2001 product safety directive. Unlike a labelling rule, it does not prescribe a specific mark; it prescribes an unbroken chain of responsibility: no safe, traceable product, no market access.

This article explains what the GPSR requires, how it differs from CE marking, what new duties it creates for online sales and marketplaces, and where its data overlaps with the Digital Product Passport under the ESPR.

---

Key takeaways

• The GPSR (“General Product Safety Regulation”, Regulation (EU) 2023/988) has applied since 13 December 2024 and replaces the General Product Safety Directive 2001/95/EC.
• It covers all non-food consumer products and acts as a safety net: for products under sector-specific EU law, it applies only to safety aspects those rules do not cover.
• Core duties: a general safety requirement, traceability (type/batch/serial number plus manufacturer and importer details), internal risk analysis and technical documentation, and warnings in a language consumers easily understand.
• A product may be placed on the market only if there is a responsible economic operator established in the EU — decisive for imports and online sales from third countries.
• New duties apply to online marketplaces (registration on the Safety Gate Portal, a contact point, notice-and-action processes) and a harmonised recall procedure gives consumers a right to repair, replacement, or refund.
• myDPP does not perform safety assessments, is not the responsible economic operator, and does not issue recalls. myDPP stores, versions and communicates the verified product and traceability data.

What is the GPSR?

GPSR stands for General Product Safety Regulation — Regulation (EU) 2023/988. It was published in the Official Journal on 23 May 2023, entered into force on 12 June 2023, and has applied since 13 December 2024. On that date the old General Product Safety Directive (2001/95/EC) and the food-imitating products directive (87/357/EEC) were repealed.

Moving from a directive to a regulation is more than a formality: a regulation applies directly and uniformly across all member states with no national transposition. The GPSR modernises the rules above all for online commerce, for products from outside the EU, and for the risks of new technologies.

Which products does the GPSR cover?

The GPSR covers non-food consumer products — new, used, repaired or reconditioned — made available on the EU market. It works as a safety net: for products already covered by sector-specific EU harmonisation law (toys, electrical equipment, machinery, and so on), those specialised rules apply first; the GPSR steps in only for safety aspects and risks they do not address.

Excluded are, among others, medicinal products, food and feed, living plants and animals, plant protection products, and antiques. For everything else in the consumer sphere that lacks its own safety regime, the GPSR is the governing rule.

The core obligations

The GPSR distributes duties across manufacturers, importers and distributors. For product companies these matter most:

• General safety requirement — only safe products may be placed on or made available on the market; the safety assessment must also account for new risks (connectivity, safety-relevant cybersecurity, learning functions, and the effect of software updates).
• Traceability — each product carries a type, batch or serial number (or another identification element) plus the manufacturer’s name, registered trade mark, and postal and email address; importers add their own details.
• Internal risk analysis and technical documentation — before placing a product on the market, manufacturers carry out a risk analysis and draw up technical documentation describing the product and its safety-relevant characteristics; this must be kept for ten years.
• Warnings and safety information — clear warnings and instructions in a language easily understood by consumers in the member state where the product is made available.
• Corrective measures — where a product is unsafe, immediate action, and notification of authorities and consumers.

The responsible economic operator in the EU

One of the most consequential changes: a product may be placed on the market only if there is an economic operator established in the Union responsible for a set of compliance tasks (an EU manufacturer, importer, authorised representative or fulfilment service provider). Their name and contact details must accompany the product.

In practice this closes the gap on direct sales from third countries: without a reachable responsible party in the EU, a product may not be offered. For brands, importers and online sellers, this operator’s identity becomes a mandatory product data point — precisely the kind of detail a product passport already carries.

Online sales, marketplaces and recalls

The GPSR markedly modernises the rules for digital commerce:

• Distance selling — an online offer must clearly show, before purchase, the manufacturer or responsible-person details, the product identification, and any warnings.
• Online marketplaces — they must register on the Safety Gate Portal, designate a single contact point, act on notices about dangerous products within short deadlines, and maintain internal “notice and action” processes.
• Recalls and notifications — there is a harmonised recall notice; consumers are entitled to a remedy (repair, replacement, or refund). Serious accidents caused by a product must be reported through the Safety Business Gateway; since the GPSR the rapid alert system is called Safety Gate (formerly RAPEX).

GPSR and CE marking — not the same thing

The GPSR does not introduce a CE marking. CE marking applies to harmonised product groups that have their own EU legal acts (machinery, toys, electrical goods, radio equipment, medical devices, and more). The GPSR is the rule for everything that has no such sector-specific regime — and it complements the harmonised rules where those leave a safety risk uncovered.

In short: a CE-marked product follows its sector-specific law first; a product with no regime of its own follows the GPSR. Both share the same logic of traceability and clear responsibility.

Timeline at a glance

Date	Milestone
23 May 2023	Regulation (EU) 2023/988 published in the Official Journal
12 June 2023	Entry into force
13 December 2024	Applies — Directive 2001/95/EC repealed, GPSR in effect

GPSR and the Digital Product Passport

The GPSR and the DPP are different instruments. The GPSR is a safety regime; the DPP is a product data carrier under the ESPR. The GPSR does not mandate a DPP. But its traceability and information duties rely on the same identity data a DPP already holds:

• Product identification (type, batch, serial number) → the same unique identifier through which a DPP is accessed.
• Manufacturer and responsible-person details → the economic-operator data a DPP carries as a mandatory field.
• Warnings, use and safety information → content that can be surfaced through the same QR code or GS1 Digital Link.

The QR code that opens a DPP is therefore also a natural access point for GPSR-relevant information: scan the product and you see who stands behind it, how to use it safely and — in the event of a recall — its status. Structure this data once, at product level and machine-readable, and it serves both the mandatory DPP content and the GPSR’s traceability goals.

An important clarification: the DPP does not replace GPSR compliance. It does not make a product safe and does not stand in for a risk analysis. And to be clear about myDPP’s role: myDPP does not perform safety assessments, is not the responsible economic operator in the EU, does not issue recalls, and does not report to the Safety Business Gateway. Those tasks belong to manufacturers, importers and the designated responsible operators. myDPP stores, versions and communicates the verified product and traceability data — product identity, responsible-operator details, warnings, documentation references — so the facts travel with the product in its passport.

What companies should do now

1. Review the product portfolio

For each consumer product, determine whether it falls under sector-specific law (with CE) or under the GPSR — and which safety aspects the GPSR may additionally cover.

2. Ensure traceability

Confirm that every product carries a type, batch or serial number plus complete manufacturer and, where relevant, importer details.

3. Name the responsible EU operator

Make sure each product has an economic operator established in the EU and that their contact details are visibly provided.

4. Prepare risk analysis and technical documentation

Document the internal risk analysis and technical documentation, and keep them for ten years.

5. Use a single product data source

Maintain identification, responsible-operator and safety data from one structured source, so the same details are reused in distance-selling listings, on the product, and in a future DPP.

Frequently asked questions (FAQ)

Since when does the GPSR apply?

Since 13 December 2024. On that date the old General Product Safety Directive 2001/95/EC was repealed and Regulation (EU) 2023/988 became directly applicable.

Which products does the GPSR cover?

Non-food consumer products with no sector-specific safety regime of their own. For harmonised products (for example those with CE marking) it applies additionally to safety aspects the specialised rules do not cover.

Does a GPSR product need CE marking?

No. The GPSR does not introduce a CE marking. CE applies to harmonised product groups with their own legal acts; the GPSR is precisely the rule for products outside those groups.

What is the responsible economic operator?

An operator established in the EU (an EU manufacturer, importer, authorised representative or fulfilment service provider) without whom a product may not be placed on the market. Their contact details must accompany the product.

Does a DPP replace GPSR obligations?

No. A DPP does not make a product safe and replaces neither the risk analysis nor the responsible operator. It can, however, carry the same identity, responsible-operator and safety data and make it accessible through a QR code.

Read more

• CE marking and the Digital Product Passport
• Digital Product Passport in 15 minutes
• ESPR — the Ecodesign for Sustainable Products Regulation
• Right to Repair — the EU directive
• Digital Product Passport: data requirements — the complete list
• How to implement a DPP — the practical checklist

Sources

• Regulation (EU) 2023/988 on general product safety (GPSR) — EUR-Lex
• Directive 2001/95/EC on general product safety — EUR-Lex
• Regulation (EU) 2019/1020 on market surveillance and compliance of products — EUR-Lex
• European Commission — Safety Gate and product safety