The General Product Safety Regulation, Regulation (EU) 2023/988, has applied since 13 December 2024. Most writing about it covers what a store must do. This guide covers the other side: who checks, what powers they have, how a case against an online store usually starts, and what a product withdrawal or a recall means for a Shopify store selling to EU customers. It ends with the preparation that keeps a request for information from turning into an order.
For the duties themselves (roles, the EU responsible person, what a listing must show), start with the GPSR explained for Shopify stores. For the product page details in practice, see GPSR on Shopify.
1. Who enforces the GPSR
There is no single EU product safety police. Each EU country designates its own market surveillance authorities, and those authorities enforce the GPSR on its territory (Article 23). Rather than build a separate system, the regulation applies most of the Market Surveillance Regulation (EU) 2019/1020 to the products it covers, so the same toolkit that authorities use for electrical goods or toys now applies to candles, cushions and kitchen tools. In several countries more than one authority shares the work, for example by region or by product type, so the authority that writes to you depends on where your customer is and what you sell.
Customs are the second line. Products arriving from outside the EU can be held at the border, and customs suspend their release when they suspect a product is unsafe or lacks the required information, until market surveillance decides (Articles 25 to 28 of Regulation 2019/1020). For a store shipping parcels from a non-EU warehouse, a missing responsible person or missing labelling can stop goods before they reach the customer.
2. What an authority can do
Articles 14 to 16 of Regulation 2019/1020 set out what every authority can do. The powers that matter most to an online store:
| Power | What it means for your store |
|---|---|
| Ask for documents and information | Technical documentation, test reports, the supplier you bought from and the business customers you sold to. Have the supplier trail ready, because the deadline is set by the authority, not by you. |
| Buy your product as a shopper | Authorities may order samples, including under a cover identity, so a test purchase from your store is a normal way for a case to start. |
| Inspect premises and products | Unannounced on-site inspections and physical checks, including of stock held by a fulfilment service provider. |
| Require corrective action | Bring the product into compliance, stop selling it (withdrawal), take it back from customers (recall), or destroy it, within a period the authority sets. |
| Act on the listing itself | Where a product presents a serious risk and no other effective means exist, require content to be removed from an online interface or a warning to be shown to users, and, if that is not done, require service providers to restrict access to the site. |
| Impose penalties and recover costs | Fines under national law and, where national law allows, the costs of testing, storage and other work on a product found to be non-compliant. |
3. How a case usually starts
- A test purchase or an online check. Authorities browse online stores and marketplaces for listings without the Article 19 details (manufacturer, EU responsible person, product identifier, warnings) and buy products for testing.
- A Safety Gate alert. When one country finds a dangerous product, it notifies the EU rapid alert system, Safety Gate, and the other countries look for the same product on their own market. Alerts are published on the public Safety Gate website, where anyone can search them by product, brand or type.
- A consumer complaint or an accident. Customers can report a product to the authority directly. Manufacturers must report accidents caused by their products through the Safety Business Gateway without undue delay (Article 20). Importers and distributors who learn of an accident must tell the manufacturer without undue delay.
- A coordinated sweep. The Commission and national authorities run joint checks on a product type or a sales channel at the same time across several countries.
The first contact is usually a request for information sent to the details on your listing or your parcel. That is one reason the email address in your product safety information has to be one someone reads.
4. Withdrawal and recall: the difference
The regulation uses two words that are often mixed up (Article 3). A withdrawal keeps a product in the supply chain from being made available: you stop selling it, unpublish the listing and hold the stock. A recallbrings back a product that consumers already have. The regulation asks for a withdrawal or a recall “as appropriate” (Article 9). A withdrawal may be enough for a formal problem such as missing information, while a dangerous product already in consumers' hands will usually need a recall, and an authority can order one.
A recall has a set form. The recall notice uses the heading “Product safety recall”, describes the product and the hazard clearly and tells the consumer what to do, without words that play the risk down (Article 36). The consumer normally gets a choice of at least two of repair, replacement or a refund of at least the price paid, free of charge and with no return shipping cost (Article 37). Where you hold the buyers' contact details, as every Shopify store does through its orders, you notify the affected customers directly (Article 35).
Economic operators are expected to act on their own once they know a product is unsafe, without waiting for an order: take corrective action, inform affected consumers, and tell the market surveillance authorities of every country where the product was sold through the Safety Business Gateway. A store that is only a distributor must also tell the manufacturer or importer straight away (Articles 9, 11 and 12). Acting first usually gives you more say over how the recall runs.
5. If you also sell on a marketplace
A Shopify store selling its own products is not an online marketplace under the GPSR, but many Shopify merchants also sell on Amazon, eBay, Etsy or similar platforms. Those platforms have their own duties (Article 22): they register with Safety Gate, give authorities a single point of contact, and must act on an authority's order to remove a dangerous product listing within two working days. In practice a marketplace can take your listing down faster than an authority could, and the same product on your own store will then be easy to find.
6. Penalties
Penalties are set nationally (Article 44). The regulation only requires them to be effective, proportionate and dissuasive, and its recitals ask that the nature, gravity and duration of the infringement be taken into account. The level varies widely: Ireland, for example, made a breach of the Article 19 listing duty a criminal offence (S.I. No. 726/2024) with a fine of up to EUR 500,000 or two years' imprisonment on indictment. Fines are rarely the first step. An order to withdraw stock, the cost of a recall and a public Safety Gate entry under your brand usually cost a small store more.
7. Preparing your store before anyone asks
- Show the Article 19 details on every product page: manufacturer, EU responsible person where the manufacturer is outside the EU, a product identifier and the warnings in the shopper's language.
- Make sure the email address in that information reaches someone who answers within days.
- Keep the supplier trail: who supplied each product and which business customers you sold it to, for six years (Article 15), and the technical documentation the manufacturer must keep for ten.
- Search the Safety Gate website for your product types and suppliers now and then; an alert on an identical product is your cue to act.
- Write down a one-page recall plan: who decides, how you unpublish, which order export gives you the buyers, and the notice text you would send.
Our free GPSR responsible person template has the product page block, the parcel line and a mandate outline.
Frequently asked questions
Who checks GPSR compliance?
Can an authority act against a store based outside the EU?
What is the difference between a product withdrawal and a recall?
Is this guide legal advice?