The General Product Safety Regulation, Regulation (EU) 2023/988, is the EU's safety net for consumer products that no sector law covers in full: toys with their own rules aside, think furniture, textiles, candles, kitchenware, decoration, sports goods and most of what a typical Shopify store sells. It has applied since 13 December 2024 in every EU country, directly and without national transposition, and it reaches a store outside the EU as soon as the store sells to EU consumers. This page covers the regulation as a whole: who answers for a product, what a listing must show, what a recall involves and how penalties work. For the product page itself, read the GPSR product page guide.
In short
- The law: Regulation (EU) 2023/988, applicable since 13 December 2024 (Article 52). It replaced the General Product Safety Directive 2001/95/EC.
- What it asks: only safe products on the market (Article 5), a named economic operator in the EU for every product (Article 16), and manufacturer, EU contact and warning details on the product and on every online listing (Articles 9 and 19).
- Who: manufacturers, importers, distributors, fulfilment providers and online marketplaces, including businesses outside the EU that target EU consumers (Article 4).
- Recalls: a recall notice in a set format and a choice of at least two remedies for the consumer: repair, replacement or refund (Articles 36 and 37).
- Penalties: set by each EU country, and they must be effective, proportionate and dissuasive (Article 44).
1. Which products and which sellers
The regulation applies to every product intended for consumers, or likely to be used by them, that is placed or made available on the EU market, new, used, repaired or reconditioned (Article 2). Where a product falls under specific EU safety rules, those rules come first and the GPSR fills the gaps they leave. Medicines, food, feed, plants, animals and a few other categories are outside it altogether.
Distance sales count. Under Article 4 a product offered online is deemed made available on the EU market when the offer targets consumers in the EU, that is when the seller directs its activities by any means to one or more member states; recital 21 names the signs: the areas you ship to, the languages offered, the means of payment, the currency and a domain registered in a member state. A store that is merely reachable from the EU is not targeting it; a store that ships there is.
2. Who is responsible for a product
The regulation assigns duties by role rather than by company size. One Shopify store often holds two of these roles at once.
| Role | Main duties under the GPSR | Who that is in a Shopify store |
|---|---|---|
| Manufacturer (Article 9) | Places only safe products on the market, runs an internal risk analysis and keeps technical documentation for ten years. Marks the product with a type, batch or serial number and with its name, postal address and electronic address. | You, if you sell under your own brand or have products made to your specification. |
| Importer (Article 11) | Checks that the manufacturer has done its part before placing a non-EU product on the EU market, adds its own name, postal address and electronic address, and keeps a copy of the technical documentation available for ten years. | You, if you buy from a non-EU supplier and sell in the EU. |
| Distributor (Article 12) | Checks that the manufacturer and importer details and the required markings are present before making the product available, and acts when it learns that a product is unsafe. | You, if you resell EU-made or already imported products. |
| Responsible person in the EU (Article 16) | A product may be placed on the EU market only if an economic operator established in the EU is responsible for it: the manufacturer, an importer, an authorised representative with a written mandate or an EU fulfilment service provider. Its name and contact details go on the product or its packaging and on the listing. | Needed for every product whose manufacturer is outside the EU. |
Online marketplaces have their own chapter (Article 22): a single contact point for authorities and consumers, registration with the Safety Gate portal, and removal of dangerous listings within two working days of an order. A Shopify store selling only its own products is not a marketplace.
3. What every online listing must show
Article 19 is the part of the regulation a store meets every day. Any offer made at a distance must clearly and visibly show, at least:
- the manufacturer's name, registered trade name or trade mark, postal address and electronic address;
- if the manufacturer is not established in the EU, the name, postal address and electronic address of the responsible person under Article 16;
- information that identifies the product, including a picture of it, its type and any other product identifier;
- any warning or safety information that must be on the product or its packaging, in a language consumers in that country can easily understand.
The details belong on the listing itself, so a product page, not a page linked from the footer. Shopify has no dedicated fields for them; the product page guide walks through descriptions, metafields and the Disclosures field, and the Complimus GPSR module adds a safety block to every product page from one record per supplier.
4. Accidents, recalls and remedies
A manufacturer that learns of an accident caused by its product must report it through the Safety Business Gateway without undue delay (Article 20), and importers and distributors pass on what they know. Where a product has to be recalled, the recall notice follows the format in Article 36: the heading “Product safety recall”, a clear description of the product and the hazard, and what the consumer should do, without language that plays the risk down.
Article 37 sets the consumer's remedies: the economic operator responsible for the recall offers a choice of at least two of repair, replacement or a refund of at least the price paid, cost-free and timely, and a refund is always due if repair or replacement is not completed within a reasonable time. One remedy alone is allowed only where the others would be impossible or disproportionate. Keeping customer contact details on your orders lets you reach the people who bought the product directly, which Article 35 expects where you can.
5. Enforcement and penalties
National market surveillance authorities enforce the regulation (Article 23). They can order a listing taken down: Article 23 applies the Market Surveillance Regulation (EU) 2019/1020 to these products, including its Article 14 powers to order content that refers to a dangerous product removed from an online interface. Penalties are national (Article 44): each country sets its own, and the regulation only requires them to be effective, proportionate and dissuasive. Ireland, for example, made a breach of the Article 19 listing duty a criminal offence (S.I. No. 726/2024) with a fine of up to EUR 500,000 or two years' imprisonment on indictment. Check the market surveillance law of each country you sell to.
6. First steps for a Shopify store
- List your products by role: your own brand (manufacturer), bought from outside the EU (importer), bought inside the EU (distributor).
- For every product with a non-EU manufacturer, name the responsible person in the EU and keep the written mandate where one is needed. Our free GPSR responsible person template has the product page block, the parcel line and a mandate outline.
- Collect one record per supplier: legal name, postal address, email, and the warnings from the label or leaflet.
- Put those details on each product page in the shopper's language, and on the product or its packaging.
- Keep technical documentation and the supplier trail for ten years, and write down how you would run a recall before you need one.
Frequently asked questions
Does the GPSR apply to a Shopify store outside the EU?
Is the GPSR the same as CE marking?
What is the difference between the GPSR and the old directive?
Which products are outside the GPSR?