The General Product Safety Regulation spends exactly one sentence on it. Before placing a product on the market, manufacturers "shall carry out an internal risk analysis and draw up technical documentation" (Article 9(2)). There is no form, no required method and no list of headings. That leaves the obvious question: what does a GPSR risk assessment actually have to look like?
That question matters more than it seems. When you sell from outside the EU, the risk analysis is the core of the technical file you send to your EU Responsible Person, and a market surveillance authority can ask for it at any time. A product only counts as covered by our EU Responsible Person service once we have received its technical documentation, so the file is the first thing we ask for. A one-page table with three generic hazards is easy to make. It is also easy to see through.
This article explains what the law asks for, which aspects you have to consider, how EU authorities themselves score a risk, and how that works on a real product. At the end you will find a checklist you can run through before your next listing.
- What the GPSR requires from an internal risk analysis
- Who has to carry out the risk analysis
- The aspects your GPSR risk assessment must consider
- How EU authorities score a product risk
- Worked example: a ceramic coffee mug
- From risk to measure: design first and warnings last
- Checklist for your internal risk analysis
What the GPSR requires from an internal risk analysis
Article 9(2) requires two things before the product reaches the market: an internal risk analysis, and technical documentation with at least a general description of the product and its essential characteristics relevant for assessing its safety. Where the possible risks call for it, the documentation also contains an analysis of those risks and the solutions you adopted to eliminate or reduce them, including the outcome of any test reports, plus a list of the European standards or other references you applied.
The European Commission is blunter in its guidelines for businesses. The internal risk analysis "means a proper risk assessment of the product", and the technical documentation should "highlight all the identified possible risks of the product, irrespective of their risk level" (source: Commission Notice C/2025/6233, section 3.1.1). So a hazard you consider unlikely still goes in the file, with your reasoning.
The amount of detail may be proportionate. Recital 33 of the GPSR says the information should match the complexity of the product and its possible risks, so a plain cotton tote bag needs less than a children's high chair. Two rules apply however simple the product is: the documentation must be kept up to date, and you must keep it available for market surveillance authorities for 10 years after the product was placed on the market (Article 9(3)). The risk analysis is one part of that file; our guide on how to create a GPSR technical file covers the other parts.
Who has to carry out the risk analysis
The duty sits with the manufacturer. That includes a seller who markets a product under its own name or trademark, even if a factory in China or Vietnam made it (Article 3(8) and Article 13). If you sell your own brand on Amazon or Etsy, the risk analysis is yours, not your supplier's. A supplier's documents can support it, but they were written for the supplier's purposes and rarely for your exact model, packaging and market.
Other operators check rather than write. An importer must make sure the manufacturer has done the internal risk analysis and drawn up the technical documentation (C/2025/6233, section 3.1.3). The responsible person in the EU must, where appropriate, regularly check that the product complies with the technical documentation, and give documented evidence of those checks to the authorities on request (Article 16(2)). This is why an EU Responsible Person asks for your file; without it there is nothing to check against. Our article on the EU Authorised Representative under GPSR explains the rest of that role.
Two practical points decide how many analyses you need. First, the documentation is drawn up per product model, not per unit, but variants with different features that may affect safety, such as a different composition or functionality, count as separate products (C/2025/6233, section 3.1.1). We accept one technical file for a product family where that is logical, for example a polyester T-shirt sold in several colours and sizes.
Second, products covered by EU harmonisation legislation, such as toys or electrical equipment, follow the risk assessment rules of that legislation. The Toy Safety Directive has its own safety assessment (Article 18 of Directive 2009/48/EC), and the Low Voltage Directive requires "an adequate analysis and assessment of the risk(s)" in the technical documentation (Annex III of Directive 2014/35/EU). For those products, the GPSR obligations for manufacturers, including Article 9, do not apply at all; the manufacturer follows the obligations of its own legislation, and the GPSR safety requirement only covers risks that legislation leaves open (Article 2(1) GPSR; C/2025/6233, section 2.2).
Not sure whether your product falls under the GPSR alone or under other EU product legislation as well? Our EU product compliance check maps the legislation that applies to your product before you start writing.
The aspects your GPSR risk assessment must consider
Article 6(1) lists the aspects that must be taken into account when deciding whether a product is safe. It is a non-exhaustive list, but it is the best structure for your analysis, because an authority will read your file with the same list in mind. Turn each aspect into a question about your product:
| Aspect in Article 6(1) | Question to ask about your product |
|---|---|
| (a) Characteristics | What can go wrong with the design, materials, composition, packaging, assembly or maintenance? |
| (b) Effect on other products | Is it used together with something else, such as a charger, a stand or an app, and can it harm that product? |
| (c) Effect of other products on it | Can another product, or a software update, make it unsafe? The Commission's example is an update that makes a device overheat. |
| (d) Presentation | Are the label, age indication, warnings and instructions clear, and do they cover safe disposal? |
| (e) Consumers | Who will really use it? Think of children, older people and people with disabilities, and of differences in body size between men and women. |
| (f) Appearance | Does it look like food, or does it appeal to children even though it is not meant for them? The Commission mentions decorative fruit and a soap that looks like a cupcake. |
| (g) Cybersecurity | If it is connected, can outside interference affect its safety, including a lost connection? |
| (h) Learning functions | If it changes its behaviour over time, does it stay safe? |
Two more points shape the analysis. You assess the product in its normal and reasonably foreseeable use, and the guidelines ask every business to take the precautionary principle into account when carrying out the internal risk analysis (C/2025/6233, section 1.2). On the other hand, the existence of a safer design or a less risky competing product does not by itself make your product dangerous (Article 6(2)). The aim is a safe product, not the safest product on the market.
If your product conforms to a European standard whose reference is published in the Official Journal, it is presumed safe for the risks that standard covers (Article 7(1)). List that standard in your file, and name the parts you applied if you only applied some of it (Article 9(2)). Where that presumption does not apply, Article 8 points to other references, such as international standards, national standards, codes of good practice and reasonable consumer expectations.
How EU authorities score a product risk
The GPSR defines risk as "the combination of the probability of an occurrence of a hazard causing harm and the degree of severity of that harm" (Article 3(4)). How authorities turn that into a risk level is set out in Annex II of Delegated Regulation (EU) 2024/3173, which applies since 13 December 2024 and continues the method of the old RAPEX guidelines. The annex is written for national authorities, not for businesses. It is still the most useful yardstick you have, because it is how your product will be judged if something goes wrong.
The method has three parts. First you describe a harm scenario: the product has a defect or leads to a dangerous situation, that leads to an accident, and the accident causes harm. You may split this into up to five steps, starting with an intended user in foreseeable use, and you make one scenario for each hazard. Then you classify how severe the harm is, in four levels:
| Level | Severity of the harm |
|---|---|
| 1 Minor | First aid is enough, the injury does not substantially hamper functioning and is usually completely reversible |
| 2 Moderate | A hospital visit may be needed, but usually no admission; functioning affected for no more than six months |
| 3 Severe | Hospital admission, functioning affected for more than six months or a permanent loss of function |
| 4 Life-threatening | Fatal or possibly fatal, effects on reproduction, or more than about 10% disability |
Finally you give each step of the scenario a probability, multiply them, and look up the combination with the severity level in the grid. The highest level from all your scenarios is the risk level of the product.
| Probability over the product's lifetime | Severity 1 | Severity 2 | Severity 3 | Severity 4 |
|---|---|---|---|---|
| More than 50% | High | Serious | Serious | Serious |
| More than 1 in 10 | Medium | Serious | Serious | Serious |
| More than 1 in 100 | Medium | Serious | Serious | Serious |
| More than 1 in 1,000 | Low | High | Serious | Serious |
| More than 1 in 10,000 | Low | Medium | High | Serious |
| More than 1 in 100,000 | Low | Low | Medium | High |
| More than 1 in 1,000,000 | Low | Low | Low | Medium |
| 1 in 1,000,000 or less | Low | Low | Low | Low |
Many templates, including our own mug example, use a simpler score: likelihood times severity on a scale of 1 to 5. That works well for ranking hazards against each other, as long as you know its weak spot: it can make a severe hazard look harmless. A rare event with a fatal outcome scores 1 times 5, which is 5 out of 25 and usually labelled low. On the EU grid, a life-threatening harm with a probability above 1 in 10,000 is already a serious risk. So whatever scoring you use, check every hazard of severity 3 or 4 against the grid above.
The annex also lists situations that authorities presume to be a serious risk, which they may notify without an individual risk assessment (Annex II, points 4.1 and 4.2). They include small parts in toys or childcare products for children under 36 months, highly flammable children's costumes and nightwear, drawstrings around the head or neck on clothing for young children, electrical products with defective components that can cause a shock or fire, and a banned chemical substance or one above its legal limit. If your product touches one of these, the risk analysis should show exactly how you ruled it out.
Worked example: a ceramic coffee mug
Our free GPSR technical file example uses a 300 ml glazed ceramic mug. A mug is about as simple as a consumer product gets, which makes it a good way to see the method at work. The calculation below is made for this article and is not part of the example file. The probabilities are illustrative estimates; in your own file you base them on your production data, inspection results and complaints.
Take the hazard that the handle breaks off while the mug is full of a hot drink. The harm scenario has three steps. A mug leaves the factory with a weak joint between handle and body, say 1 in 100 mugs if the factory has no pull test. During its lifetime, the weak handle gives way while being lifted full, say 1 in 10. The hot drink then scalds the user's hand or lap badly enough to need a doctor, say 1 in 2. Multiplied, that is 1 in 2,000.
That result falls in the row "more than 1 in 10,000". A scald on an adult's hand is usually moderate, severity 2, so the result is a medium risk. If the same mug is used by an older person with less grip, or the drink lands on a small child, the harm can be severe. With a lower probability for that scenario, it can still come out as medium or high, and the highest outcome is the one that counts.
The useful part is what the calculation tells you to fix. The step you control is the first one, the weak joint, so the measure belongs there: a handle pull test on samples from every batch, recorded in the file. A warning label would not change that first step at all.
The glaze is a different kind of hazard. What may migrate from a ceramic glaze into food or drink is governed by the EU rules on food contact materials (Regulation (EC) No 1935/2004 and, for lead and cadmium in ceramics, Directive 84/500/EEC). Your risk analysis does not try to score that with a guess; it refers to the migration test report for your specific glaze and colour.
Want to see how this looks as a finished document? Download our free GPSR technical file template and the completed mug example, and use them side by side.
From risk to measure: design first and warnings last
For every risk you identify, the file describes what you did about it (Article 9(2), point (a)). The Commission's model template asks you to describe each potential risk separately, followed by the measures taken, such as compliance of all substances, conformity with a named European standard, or warnings and instructions (C/2025/6233, section 3.1.1).
In practice, measures that remove the hazard or make the dangerous situation less likely are stronger than measures that ask the consumer to be careful. A rounded edge beats a sticker about sharp edges, and a batch test beats a line in the manual.
Warnings still have a place, but they should follow from the risk analysis rather than replace it. Our template puts it this way: warnings placed on the label should be a result of your risk assessment's risk mitigation. In the mug example, the label warns that rapid temperature changes may cause the mug to crack, because that risk remains after the design choices were made.
Warnings and instructions also have to reach the consumer in a language they can easily understand, as decided by the EU country where the product is sold (Article 9(7)). A good risk analysis with an English-only warning on a product sold in Germany or Spain still leaves a gap.
Finally, the risk analysis is not a one-off document. Article 9(12) requires you to investigate safety complaints and keep an internal register of complaints, recalls and corrective measures. When a complaint reveals a scenario you had not foreseen, it belongs in the next version of your risk analysis, and if the product turns out to be dangerous, Article 9(8) requires corrective action and a report through the Safety Business Gateway.
Prefer to have the analysis done for you? Our internal risk analysis for the GPSR is listed at 30 euros (excluding VAT) and gives you a documented report with identified risks, their classification and suggested measures, ready for your technical file. It does not include laboratory testing.
Checklist for your internal risk analysis
- Identify the product exactly: brand, model, type or batch number, photos of product and packaging.
- Check whether EU harmonisation legislation applies, such as the toy or low voltage rules; if so, follow its risk assessment rules instead of Article 9.
- Decide which variants can share one analysis and which differ in a way that affects safety.
- Go through all eight aspects of Article 6(1) and write down why an aspect does not apply, rather than skipping it.
- Write a harm scenario per hazard, starting with the intended user, then add foreseeable misuse and vulnerable users.
- Classify severity in four levels and check every severity 3 or 4 hazard against the EU grid.
- Check the presumed serious risks in Annex II, point 4.1 of Delegated Regulation (EU) 2024/3173.
- Link each risk to a measure, and each measure to evidence: a test report, an inspection record or the label text.
- List the European standards you applied, and which parts if you applied only some of them.
- Put a date and version on the analysis, update it after complaints or design changes, and keep it for 10 years.
Selling from outside the EU and need an EU Responsible Person? Our EU Authorised Representative service for the GPSR costs 150 euros a year (excluding VAT) for an unlimited number of products.
Sources
- Regulation (EU) 2023/988 on general product safety (GPSR), recital 33 and Articles 2(1), 3(4), 3(8), 6, 7, 8, 9(2), 9(3), 9(7), 9(8), 9(12), 13 and 16(2). EUR-Lex
- European Commission, Guidelines on the application of the EU general product safety legislative framework by businesses, C/2025/6233, sections 1.2, 2.2, 3.1.1 and 3.1.3. EUR-Lex
- Commission Delegated Regulation (EU) 2024/3173 on the Safety Gate Rapid Alert System, Annex II (criteria for assessment of the level of risk), applicable from 13 December 2024. EUR-Lex
- Commission Implementing Decision (EU) 2019/417 laying down guidelines for the management of RAPEX, the predecessor of the method in Annex II of Delegated Regulation (EU) 2024/3173, Annex, risk assessment guidelines for consumer products. EUR-Lex
- Directive 2009/48/EC on the safety of toys, Article 18, and Directive 2014/35/EU (Low Voltage Directive), Annex III. EUR-Lex and EUR-Lex
- Regulation (EC) No 1935/2004 on food contact materials and Council Directive 84/500/EEC on ceramic articles intended to come into contact with foodstuffs.
- Consulted October 2026.
