GPSR Risk Assessment (Internal Risk Analysis)

Before a manufacturer puts a consumer product on the EU market, the General Product Safety Regulation requires an internal risk analysis, written up as technical documentation. Here is what the text actually asks for, and what it does not.

▶ Watch: What Goes in a GPSR Technical File? Article 9 Explained for Sellers (2026)

What Article 9(2) requires

Article 9(2) of Regulation (EU) 2023/988 says that before placing their products on the market, manufacturers shall carry out an internal risk analysis and draw up technical documentation. Recital 33 adds that the documentation should be based on that internal risk analysis and should contain the information needed to prove the product is safe.

The European Commission's 2025 guidelines for businesses describe the internal risk analysis as "a proper risk assessment of the product", and say the documentation is prepared per product model, not per unit. Where units of a model differ in ways that may affect safety, such as colour, composition or functions, each is a specific product needing its own documentation.

This is the manufacturer's duty. If a product is made for you and sold under your own name or trademark, you are the manufacturer (Article 3(8)).

What the technical documentation contains

At a minimum, Article 9(2) requires:

• A general description of the product.
• Its essential characteristics relevant for assessing its safety.
• Where appropriate with regard to possible risks, as applicable: an analysis of the possible risks and the solutions adopted to eliminate or mitigate them, including the outcome of any test reports by the manufacturer or another party on its behalf (Article 9(2)(a)).
• Where appropriate, as applicable: the list of any relevant European standards, or the national requirements or other elements under Article 7(1)(b) or Article 8, applied to meet the general safety requirement (Article 9(2)(b)).
• Where a standard or element has been only partly applied, the parts that were applied.

When less is needed

The regulation does not use the word "simplified". What it does say is that the risk analysis and standards content is required "where appropriate with regard to possible risks related to the product" and "as applicable" (Article 9(2)).

Recital 33 says the amount of information should be proportionate to the complexity of the product and the possible risks identified by the manufacturer, and that complex products or products presenting possible risks might need a more extensive description. The Commission's guidelines repeat the proportionality point, but also say the documentation should highlight all identified possible risks, irrespective of their risk level.

The Article 6 aspects to assess

Article 6(1) lists aspects that in particular must be taken into account when assessing whether a product is safe:

• The product's characteristics: design, technical features, composition, packaging, and instructions for assembly, installation, use and maintenance.
• Its effect on other products it is reasonably foreseeable to be used with, and the effect other products might have on it.
• Its presentation and labelling, including age suitability for children, warnings, and instructions for safe use and disposal.
• The consumers who will use it, in particular vulnerable consumers such as children, older people and persons with disabilities, and the impact of gender differences.
• Appearance likely to lead to misuse, such as resembling food or appealing to children.
• Where the nature of the product requires it, cybersecurity features and evolving, learning and predictive functions.

Conforming to European standards published in the Official Journal gives a presumption of safety for the risks they cover (Article 7). Where it does not apply, Article 8 lists further elements to consider, such as international standards and the state of the art.

Keeping it, and who else relies on it

• Keep the documentation up to date, at the disposal of market surveillance authorities for 10 years after the product has been placed on the market, and make it available on request (Article 9(3)).
• Importers keep a copy for 10 years after they placed the product on the market (Article 11(6)), and must check the manufacturer has complied with Article 9(2) before placing it on the market (Article 11(1)).
• The EU Responsible Person regularly checks, where appropriate, that the product complies with the technical documentation (Article 16(2)).
• The Commission's guidelines say the documentation can be electronic and can be a file made up of different documents.

What the regulation does not require

• No set format. The Commission's guidelines include a model template (product identification, characteristics and composition, then each potential risk with the measures taken) and say it is not compulsory.
• No certificate. A full-text search of Regulation 2023/988 finds no mention of a certificate, a notified body, a declaration of conformity or CE marking.
• No mandatory testing. Test reports are included in the documentation where there are any, and may come from the manufacturer or another party on its behalf (Article 9(2)(a)).
• No advance filing. Article 9(3) requires the documentation to be kept and made available to authorities on request.

Free template

The free GPSR templates at /gpsr/templates give you a technical documentation template following Article 9(2) and a risk assessment template with a row for every Article 6(1) aspect. Every judgement cell is left blank: whether a product is safe is the manufacturer's assessment, and Instilus does not make it.

Common questions

Is there an official GPSR risk assessment template?

The European Commission's 2025 guidelines (Notice C/2025/6233) include a model template for technical documentation and say it is not compulsory. The regulation itself sets no format.

How long must I keep the GPSR technical documentation?

10 years after the product has been placed on the market, kept up to date and made available to market surveillance authorities on request (Article 9(3)).

Do I need laboratory testing for a GPSR risk assessment?

The regulation does not require it. Where tests have been done, by the manufacturer or another party on its behalf, their outcome goes into the risk analysis (Article 9(2)(a)).

Does a distributor have to do a risk assessment?

The Article 9(2) duty is the manufacturer's. Before making a product available, a distributor verifies the labelling, manufacturer, importer and instruction requirements in Article 9(5) to (7) and Article 11(3) and (4) (Article 12(1)). Selling under your own name or trademark makes you the manufacturer.

Do I need one risk assessment per product or per variant?

The Commission's guidelines say documentation is prepared per product model; variants with different features that may affect safety, such as colour or composition, are specific products needing their own documentation.

Sources

• Regulation (EU) 2023/988, Articles 3, 6, 7, 8, 9, 11, 12 and 16, recital 33
• European Commission Notice C/2025/6233: Guidelines on the application of the EU general product safety legislative framework by businesses (section 3.1.1 and model template)