TL;DR
- GPSR importer obligations have applied since 13 December 2024: before placing a non-food consumer product on the EU market, the importer must check it is safe, identifiable and labelled with the manufacturer's details, and add its own name and contact details.
- Traceability under the GPSR is mostly a matter of markings and records today: a type, batch or serial number on the product, both operators' addresses, and supplier and customer records kept for six years.
- A QR code can carry extra safety information, register customers for recalls and link a scan to the exact batch, but it cannot replace the details the Regulation requires on the product, its packaging or an accompanying document.
Regulation (EU) 2023/988, the General Product Safety Regulation or GPSR, sets the GPSR importer obligations for any business that brings consumer products from outside the EU and places them on the EU market. It replaced the General Product Safety Directive 2001/95/EC and, because it is a regulation, the same text applies directly in every Member State. For importers, the practical core is traceability: knowing what the product is, who made it, who is responsible for it in the EU, and where each unit went.
This guide covers who counts as the responsible economic operator, what an importer must check and print, what the law asks of online listings, accidents and recalls, and where a GS1 Digital Link QR code is useful and where it is not. Everything below is stated as of October 2026.
When did the GPSR start to apply?
The GPSR was adopted on 10 May 2023 and published in the Official Journal on 23 May 2023. It entered into force twenty days later and has applied since 13 December 2024.
| Date | What happens |
|---|---|
| 10 May 2023 | Regulation (EU) 2023/988 adopted |
| 23 May 2023 | Published in the Official Journal |
| 12 June 2023 | Entry into force; the Commission's power to adopt delegated acts runs from this date |
| 24 May 2024 | Implementing Regulation (EU) 2024/1435 sets the template for recall notices |
| 13 December 2024 | GPSR applies; Directive 2001/95/EC is repealed; Member States notify their penalty rules |
| 21 November 2025 | Commission guidelines on applying the GPSR by businesses published in the Official Journal |
| October 2026 | No delegated act setting up a traceability system under Article 18 has been adopted |
Under Article 51, products that complied with the old Directive and were placed on the market before 13 December 2024 can still be sold. The Commission's guidelines add that "placing on the market" is judged unit by unit, so stock that first entered the EU market on or after that date has to comply in full. The only amendment so far, Regulation (EU) 2024/2748 on internal market emergencies, does not touch the provisions discussed here.
Which products does the GPSR cover?
The GPSR covers consumer products, new, used, repaired or reconditioned, sold through any channel. Medicines, food, feed, living plants and animals, plant protection products and antiques are among the exclusions in Article 2(2).
Products covered by sector-specific EU harmonisation legislation, such as toys or electrical equipment, are a special case. For them, Article 2(1) switches off the general safety requirement for the risks that sector law covers, and the whole of Chapter III, Section 1, which contains Articles 9 to 18. Their importer duties come from the sector law and, where it applies, Article 4 of the Market Surveillance Regulation. The GPSR rules on distance sales (Article 19), accidents (Article 20) and recalls (Articles 35 to 37) still apply to them.
Who is the "economic operator responsible" for a product?
Article 16 says a product covered by the GPSR cannot be placed on the market unless there is an economic operator established in the EU responsible for the tasks in Article 4(3) of Regulation (EU) 2019/1020, the Market Surveillance Regulation. Article 4(2) of that Regulation lists who that can be.
| Who can be the responsible person | When |
|---|---|
| Manufacturer | Established in the EU |
| Importer | The manufacturer is not established in the EU |
| Authorised representative | Holds a written mandate from the manufacturer to perform these tasks |
| Fulfilment service provider | For the products it handles, where none of the above is established in the EU |
The tasks are about being reachable and cooperative: keeping documentation available, answering authorities' requests, reporting risks and making sure corrective action is taken. Article 16(2) adds regular checks, where the risk warrants them, that the product matches its technical documentation and carries the required identifier, contact details and instructions. The responsible person's name, trade name or trade mark, postal and electronic address must appear on the product, its packaging, the parcel or an accompanying document (Article 16(3)).
For an importer buying from a manufacturer outside the EU with no authorised representative, the importer is the responsible person. The same logic applies under the ESPR, which we cover in who is responsible for the Digital Product Passport. A business that sells under its own name or trade mark becomes the manufacturer in law under Article 13, with all of Article 9's obligations.
What does Article 11 require of importers?
Article 11 sets out what the importer must do before and after placing a product on the market.
| Duty | What it means in practice | Article |
|---|---|---|
| Check before placing on the market | The product meets the general safety requirement, and the manufacturer has drawn up technical documentation and applied the identifier and contact details | 11(1) |
| Hold back non-conforming products | Do not place the product on the market until it is brought into conformity; if it is dangerous, inform the manufacturer and the authorities through the Safety Business Gateway | 11(2) |
| Add the importer's details | Name, trade name or trade mark, postal and electronic address, and any separate single contact point, on the product or, where not possible, its packaging or accompanying document, without obscuring the manufacturer's label | 11(3) |
| Instructions and safety information | In a language easily understood by consumers, as determined by each Member State of sale | 11(4) |
| Storage and transport | Conditions must not compromise safety, the identifier or the contact details | 11(5) |
| Technical documentation | Keep a copy available to authorities for 10 years after placing on the market | 11(6) |
| Dangerous products already sold | Inform the manufacturer, ensure corrective action including withdrawal or recall, inform consumers and the authorities | 11(8) |
| Complaint channels | Verify the manufacturer's public channels exist; if not, provide them | 11(9) |
| Complaints register | Investigate safety complaints and record them, with recalls and corrective measures; personal data kept no longer than five years | 11(10), 11(11) |
Because Article 11(1) refers back to Article 9(2), (5) and (6), the importer has to confirm, before the goods leave the warehouse, that the manufacturer did its part.
What has to be printed on the product?
Three sets of information have to be physically present. For each, the order of preference is the same: on the product; where that is not possible, on the packaging; otherwise in a document accompanying the product.
- A product identifier. Article 9(5) requires a type, batch or serial number or other element that identifies the product and is easily visible and legible for consumers.
- The manufacturer's details. Article 9(6) requires the name, registered trade name or trade mark, postal and electronic address, and the single contact point where it is different.
- The importer's details. Article 11(3) requires the same set of details for the importer.
Where the importer is also the responsible person under Article 16, its details serve both purposes.
The Commission's guidelines for businesses add a point importers often miss. Only the size of the product can justify moving required information from the product to the packaging or an accompanying document. Aesthetic or similar reasons do not, and the operator should be able to justify its choice if challenged.
What traceability does the GPSR require today?
There are three layers, and only two of them apply now.
Markings on the product. The identifier and contact details above.
Records in the supply chain. Under Article 15(3), every economic operator must be able, on request, to identify any operator that supplied it with the product, or with a part, component or embedded software, and any operator it supplied the product to. That information must be available for six years (Article 15(5)). Information on risks, complaints, known accidents and corrective measures must be available for 10 years (Article 15(4)).
A dedicated traceability system, for some products only. Article 18 allows the Commission to set up a traceability system for products, categories or components likely to present a serious risk to consumers' health and safety, based on accident and Safety Gate data. It would store data identifying the product, its components or the operators in its supply chain, and could require a data carrier on the product, its packaging or accompanying documents. Delegated acts would set the details, taking account of cost for SMEs, preparation time and compatibility with existing EU and international traceability systems.
As of October 2026, no delegated act under Article 18 has been adopted. The only GPSR delegated act so far, Delegated Regulation (EU) 2024/3173, concerns the Safety Gate Rapid Alert System.
What must an online listing show?
Article 4 treats an offer as made available on the EU market whenever it targets consumers in one or more Member States. Article 19 then requires every distance-sales offer to show, clearly and visibly:
- the manufacturer's name, registered trade name or trade mark, and postal and electronic address;
- where the manufacturer is not established in the EU, the name, postal and electronic address of the responsible person under Article 16(1) or Article 4(1) of the Market Surveillance Regulation;
- information identifying the product, including a picture, its type and any other product identifier;
- any warning or safety information required on the product or its packaging, in a language consumers in the Member State can easily understand.
This information belongs in the listing itself, and marketplaces will ask importers for it at listing stage.
What happens when there is an accident?
Article 20 requires the manufacturer to notify, through the Commission's Safety Business Gateway and without undue delay, any accident caused by its product to the authorities of the Member State where it happened. This covers occurrences resulting in death or serious adverse effects on a person's health and safety, and the notification includes the product's type and identification number.
An importer that learns of such an accident must inform the manufacturer without undue delay. The manufacturer then notifies, or instructs the importer to do it. Where the manufacturer is outside the EU, the responsible person who knows of the accident must ensure the notification is made.
The Safety Gate has three parts: the Rapid Alert System where authorities exchange alerts (Article 25), the Safety Business Gateway for businesses (Article 27), and the public Safety Gate Portal (Article 34).
What does a recall involve?
Reaching consumers (Article 35). In a recall or safety warning, operators must notify all affected consumers they can identify, directly and without undue delay, and must use the customer data they already hold to do so. Product registration and loyalty schemes must let customers give separate contact details for safety use only. Where not everyone can be reached directly, the recall must be spread through the website, social media, newsletters, shops and, where appropriate, mass media.
The recall notice (Article 36). A written recall notice must be headed "Product safety recall" and include a picture, name and brand of the product, product identification numbers such as batch or serial number and where to find them on the product, a clear description of the hazard, what consumers should do, the remedies on offer, and a free phone number or interactive online service. Words that downplay the risk, such as "voluntary" or "precautionary", are not allowed. The template is set by Implementing Regulation (EU) 2024/1435.
Remedies (Article 37). The consumer must be offered an effective, cost-free and timely remedy, with a choice of at least two of repair, replacement or a refund of at least the price paid, unless the other options are impossible or disproportionate. Consumers do not pay for returning the product.
Where a QR code helps, and where it does not
The GPSR refers to digital solutions in two places, and neither lets a code stand in for the printed information.
Where the law requires physical marking
Article 21 lets operators make the identifier, contact details and safety information additionally available in a digital format, through an electronic solution clearly visible on the product. The word "additionally" settles the point: the batch or serial number, the manufacturer's and importer's details and the safety warnings must still be readable on the product, the packaging or the accompanying document. A QR code in place of the importer's address does not meet Article 11(3), and the same goes for Article 19 information hidden behind a link in an online listing.
Where a QR code genuinely helps
- Identifying the exact unit. A GS1 Digital Link QR code can encode the GTIN together with the batch or serial number that Article 9(5) already requires in print. A scan then identifies the exact lot, which is what a recall notice and an accident notification both need.
- Supplementary safety information under Article 21. Translations, accessible formats and the full safety leaflet can sit behind the code, alongside the printed version.
- Product registration for recalls. A scan-to-register page collecting contact details for safety use only, as Article 35(2) describes, builds the list a direct recall needs.
- Recall and complaint pages. A code can resolve to the current recall notice for an affected batch, and to the complaint and accident-reporting channel Article 9(11) requires.
- Readiness for Article 18. Any future Article 18 system must be compatible with existing international traceability systems. A standards-based identifier on pack is a sensible starting point, without assuming what a delegated act will specify.
The same code can later carry Digital Product Passport data under the ESPR for the product groups it covers. We explain how one link can serve several regulations in our guide to digital links for product compliance.
What importers should do now
The GPSR already applies, so this is a compliance check rather than a preparation plan.
- Confirm your role for each product line. If the manufacturer is outside the EU and has no authorised representative, you are the responsible person under Article 16. If the product carries your brand, you are the manufacturer.
- Check every inbound product before release: safety, technical documentation available, a visible type, batch or serial number, and the manufacturer's full details.
- Add your own details on the product, or on the packaging only where the size of the product genuinely prevents it, without covering the manufacturer's label.
- Fix your records. Keep supplier and customer traceability information for six years, and technical documentation, complaints, accidents and corrective measures for 10 years.
- Audit your listings against Article 19 on your own shop and every marketplace: manufacturer, responsible person, picture, identifier and warnings.
- Register with the Safety Business Gateway and agree in writing with the manufacturer who notifies accidents and who runs recalls.
- Prepare the recall path: a complaints register, a way to reach customers directly, the recall notice template and the remedies you will offer.
Digital Link is a GS1 solution partner, and our platform puts a standards-based GS1 Digital Link QR code on each product with a page behind it that can be updated without reprinting packaging. Under the GPSR, that means the printed batch number and a scannable code point to the same lot, and the safety information, registration form or recall notice behind the code can change the day it needs to. If you want to check your products against the GPSR importer obligations, get in touch and our legal team will review your case.
Frequently asked questions
When did the GPSR start to apply?
On 13 December 2024. It entered into force on 12 June 2023 and replaced the General Product Safety Directive 2001/95/EC. Products that complied with the old Directive and were placed on the market before 13 December 2024 can still be sold.
Is the importer always the responsible person under Article 16?
No. The responsible person is the manufacturer if it is established in the EU, otherwise the importer, unless the manufacturer has given an authorised representative a written mandate for these tasks. A fulfilment service provider takes the role only where none of the others is established in the EU.
Can I put the importer's address in a QR code instead of on the product?
No. Article 11(3) requires the details on the product or, where that is not possible, on the packaging or an accompanying document. Article 21 allows a digital format only in addition to that information.
Has the Commission set up a GPSR traceability system?
Not as of October 2026. Article 18 allows it to do so by delegated act for products likely to present a serious risk, possibly with a data carrier on the product, but no such act has been adopted.
How long must importers keep traceability records?
Six years for information on who supplied the product and to whom it was supplied. Ten years for technical documentation and for information on risks, complaints, known accidents and corrective measures.
