Security update: The recent PHP vulnerabilities don’t affect us. None of our products or infrastructure use PHP. We’ve also reviewed our app after the recent Shopify checkout phishing attack and ran Shopify’s new security check. No issues were found.

GPSR Compliance Guide

The EU responsible person under GPSR: who your Shopify store needs

If you sell consumer products to shoppers in the EU, each product needs a business established in the EU that answers for it. The General Product Safety Regulation (GPSR), Regulation (EU) 2023/988, calls it the responsible person. The rule applies since 13 December 2024 (Article 52), wherever your Shopify store sits.

Updated
Reading time
9 min
Source
Regulation (EU) 2023/988 + Commission Notice C/2025/6233

If you sell consumer products to shoppers in the EU, each product needs a business established in the EU that answers for it. The General Product Safety Regulation (GPSR), Regulation (EU) 2023/988, calls it the responsible person. The rule applies since 13 December 2024 (Article 52), wherever your Shopify store sits.

The rule in one sentence

Article 16(1) GPSR: a product covered by the regulation shall not be placed on the market unless there is an economic operator established in the Union who is responsible for the tasks in Article 4(3) of Regulation (EU) 2019/1020 for that product. Source: Regulation (EU) 2023/988, Article 16.

Three terms from Article 3 matter. Placing on the market is the first making available of a product on the Union market (point 7). Making available is any supply of a product on the Union market in the course of a commercial activity (point 6). An economic operator is the manufacturer, authorised representative, importer, distributor or fulfilment service provider (point 13).

Article 4 GPSR catches online stores: a product offered online is deemed made available on the market if the offer is targeted at consumers in the Union, and it is targeted if the economic operator directs its activities, by any means, to one or more Member States. A Shopify market for Germany with euro prices is such an offer.

Who can be the responsible person

Article 16(1) GPSR uses the list in Article 4(2) of the Market Surveillance Regulation (EU) 2019/1020. Source: Regulation (EU) 2019/1020, Article 4.

  1. A manufacturer established in the Union.
  2. An importer, where the manufacturer is not established in the Union.
  3. An authorised representative with a written mandate from the manufacturer to perform the responsible-person tasks on its behalf.
  4. A fulfilment service provider established in the Union, for the products it handles, where none of the above is established in the Union.

An authorised representative is a person established in the Union with a written mandate from a manufacturer (Article 3(9) GPSR); a service company is not your representative until you sign it. A fulfilment service provider offers at least two of warehousing, packaging, addressing and dispatching without owning the products (Article 3(12)). The Commission's guidelines spell out the consequence: a fulfilment service provider can automatically become the responsible person for the products it handles if there is no EU manufacturer, importer or mandated authorised representative. Source: Commission Notice C/2025/6233, points 3.1.5 and 3.2.

Not on the list: a marketplace or a shop platform. Shopify hosts your store; it does not import, hold a mandate or handle your goods, so it cannot be your responsible person.

What the responsible person has to do

Article 16(1) imports the tasks of Article 4(3) of Regulation (EU) 2019/1020: verify that the technical documentation has been drawn up and can be given to market surveillance authorities on request; on a reasoned request, provide the documentation that shows conformity in a language the authority understands; inform the authorities when a product may present a risk; and cooperate with them, including on corrective action.

Article 16(2) GPSR adds regular checks, where appropriate for the risks, that the product matches the manufacturer's technical documentation (Article 9(2)) and carries the identifiers, manufacturer details and safety instructions of Article 9(5) to (7). Authorities can ask for documented evidence of these checks. A responsible person is not a mailbox. It needs your technical file and has to answer a German or French authority about your product.

Where the details go

On the product. Article 16(3) GPSR: the name, registered trade name or trade mark, and contact details including the postal and electronic address of the responsible person go on the product, its packaging, the parcel or an accompanying document. An electronic address is an email address or a dedicated section of a website through which consumers can contact the business directly and easily; a bare website address is not enough (C/2025/6233, point 3.1.1, "What does 'electronic address' mean?").

On the product page. Article 19 GPSR covers products made available online or by other distance sales. The offer has to show clearly and visibly at least:

  • (a) the manufacturer's name, registered trade name or trade mark, and its postal and electronic address;
  • (b) where the manufacturer is not established in the Union, the name, postal and electronic address of the responsible person under Article 16(1) GPSR or Article 4(1) of Regulation (EU) 2019/1020;
  • (c) information identifying the product, including a picture, its type and any other identifier;
  • (d) any warning or safety information required on the product or packaging, in a language the shopper easily understands.

So the responsible person appears online when the manufacturer is outside the EU; the manufacturer's details appear every time. More in GPSR for Shopify: the full guide and the GPSR regulation overview.

GPSR versus the authorised representative of CE product law

If you sell toys or electronics, you may already have an EU authorised representative under Article 4 of Regulation (EU) 2019/1020, which applies to the CE-marked product laws listed in its paragraph 5. Article 16 GPSR applies the same operators and tasks to products covered by the GPSR, including goods with no CE rule of their own: candles, furniture, textiles, kitchenware. Article 19(b) refers to both routes, so the product page shows the responsible person whichever law gave you one. One difference: Article 4(4) of Regulation (EU) 2019/1020 asks for a postal address on the product, Article 16(3) GPSR for a postal and an electronic address.

What a Shopify store outside the EU does

  • An EU company buys your products and resells them: that importer is the responsible person for its stock. Parcels you ship direct from outside the EU have no importer.
  • You appoint an authorised representative in the EU with a written mandate: the usual route for a UK, US or Asian brand shipping from its own warehouse. Service companies offer the role for a yearly fee.
  • You use a fulfilment centre inside the EU and nobody else on the list is established there: the fulfilment service provider becomes the responsible person for the products it handles, planned or not. Check your contract.

Our GPSR responsible person template lists the fields to collect from whoever takes the role.

Private label: you are the manufacturer

Article 3(8) GPSR defines the manufacturer as any person who manufactures a product, or has it designed or manufactured, and markets it under their own name or trade mark. A Shopify brand that orders candles from a factory and sells them under its own label is the manufacturer; the Commission's guidelines confirm this for own-brand goods (C/2025/6233). So your name and addresses go on the product and the product page as manufacturer (Articles 9(6) and 19(a)), and if your brand is established outside the EU, your products need an EU responsible person.

Enforcement and penalties

Enforcement is national. Article 23 GPSR applies the market surveillance rules of Regulation (EU) 2019/1020 to GPSR products. Dangerous products reported by one country appear in the Safety Gate Rapid Alert System (Article 25) for all the others. Article 44 GPSR leaves penalties to each Member State, effective, proportionate and dissuasive. Amounts differ by country.

Checklist for your store

  1. For every product, decide who the manufacturer is. Own label means you.
  2. If the manufacturer is outside the EU, name the responsible person in the Article 4(2) order.
  3. Put the responsible person's name, trade name or trade mark, postal and electronic address on the product, packaging, parcel or an accompanying document.
  4. Store the manufacturer and responsible person details once per supplier, not per product.
  5. Show the manufacturer on every product page, and the responsible person where the manufacturer is outside the EU.
  6. Keep the technical documentation where the responsible person can reach it.

Complimus covers points 4 and 5. In the GPSR module you create one profile per manufacturer (name, address, email, phone), add an EU responsible person profile where the manufacturer is outside the EU, assign products one by one or in bulk, and link the conformity declaration and the manual per product. A "Product safety information" block on the product page shows these details, translated, in your style, to EU visitors if you choose, as a theme app extension. Free and unlimited on every plan. It does not generate warnings or batch numbers; those go into your product description. See Features.

Worked example: a UK candle brand selling to Germany and France

Brightwick Ltd in Manchester sells scented candles on Shopify with markets for Germany and France. A contract factory in Poland pours the candles; they sell under the Brightwick name.

  • Manufacturer: Brightwick Ltd, because it has the product made and markets it under its own trade mark (Article 3(8)). The Polish factory is not.
  • Established in the EU? No. Importer? None, Brightwick ships parcels straight to consumers from the UK.
  • Responsible person: Brightwick signs a written mandate with an authorised representative in Dublin (Article 4(2)(c) of Regulation (EU) 2019/1020). Had it stocked a fulfilment centre near Leipzig with no representative, the centre would have taken the role by default.
  • On the product: the candle box carries Brightwick's name and addresses as manufacturer (Article 9(6)), the Dublin firm's name, postal and electronic address (Article 16(3)), the batch number and safety instructions in German and French (Article 9(5) and (7)).
  • On the product page: Brightwick as manufacturer, the Dublin firm as responsible person, the picture and type, and the safety information in German or French (Article 19).
  • Behind the scenes: the Dublin firm holds Brightwick's technical documentation and answers when a French authority asks.

Selling the same candles in the UK alone needs none of this. The German twin of this guide is Verantwortliche Person nach GPSR für Shopify.

Frequently asked questions

Does my UK or US Shopify store need an EU responsible person?

Yes, if the manufacturer is not established in the EU and you ship to EU consumers (Article 16(1) GPSR). For a brand outside the EU the usual answer is an authorised representative with a written mandate.

Can Shopify, Amazon or my payment provider be my responsible person?

No. Article 4(2) of Regulation (EU) 2019/1020 names four candidates: an EU manufacturer, an importer, a mandated authorised representative and an EU fulfilment service provider. A platform that neither imports nor holds a mandate nor handles your goods is none of these.

Where exactly must the responsible person appear?

On the product, its packaging, the parcel or an accompanying document (Article 16(3) GPSR), and in the online offer where the manufacturer is not established in the EU (Article 19(b)). The manufacturer's details always appear on the page (Article 19(a)).

I sell private-label products. Who is the manufacturer?

You are. Article 3(8) GPSR treats anyone who has a product made and markets it under their own name or trade mark as the manufacturer. If your company is outside the EU, you also need an EU responsible person.

Sources

Last checked: 4 November 2026. This guide is general information, not legal advice.

GPSR details on every product, free.
Install Complimus, create a profile per manufacturer, assign products in bulk and add the product safety block. No code.
Install from Shopify