EU GPSR penalties and enforcement exposure

Article 44 requires Member States to lay down penalty rules for infringements of GPSR obligations imposed on economic operators and providers of online marketplaces. Those Member State penalties must be effective, proportionate, and dissuasive, and Member States must take the measures needed to implement them under national law.

Member States had to notify those rules and measures to the Commission by 13 December 2024 and must notify later amendments without delay. That notification duty does not create a complete public EU tariff: current maximum amounts, sanction types, limitation periods, procedure, and appeal rights still have to be checked in the law of the Member State handling the case.

An enforcement file may start with an authority request, unsafe-product signal, accident or complaint, marketplace notice, or recall decision. First identify the specific GPSR obligation and responsible actor, then assemble the dated product-safety, traceability, notification, and corrective-action evidence.

Manufacturers must carry out an internal risk analysis and draw up technical documentation before placing products on the market. That documentation must stay up to date and be available to market surveillance authorities for 10 years after the product is placed on the market. Importers also have a 10-year duty to keep the manufacturer's technical documentation copy available to authorities.

GPSR enforcement uses the market surveillance framework in Regulation (EU) 2019/1020. Authorities can require documents, technical specifications, data, supply-chain information, distribution details, product quantities, and website-ownership information. They can also inspect products, enter business premises under the applicable safeguards, start investigations, obtain samples including under a cover identity, and use information in any format as evidence.

When risk or non-compliance persists, authorities can require corrective action and can prohibit, restrict, withdraw, or recall products. For serious-risk products, authorities must ensure withdrawal or recall where there is no other effective way to eliminate the risk, or prohibit the product being made available on the market.

Article 22 creates product-safety duties for online marketplace providers. They must register in the Safety Gate Portal, maintain product-safety contact points, keep internal product-safety processes, process safety notices within the GPSR timeframe, and design listings so traders can provide required product safety and traceability information.

Market surveillance authorities can order marketplaces to remove content for dangerous-product offers, disable access to it, or display an explicit warning. Providers must act without undue delay and in any event within two working days after receiving such an order. They must also process product-safety notices received under the Digital Services Act notice route without undue delay and in any event within three working days.

Corrective-action records show what the business did, when it acted, and whether the action reduced the safety risk before or after an authority intervened. Under the GPSR, a dangerous-product response can include bringing the product into conformity, withdrawal, recall, consumer notification, marketplace cooperation, and Safety Business Gateway notification.

Where a product safety recall or safety warning must reach consumers, GPSR requires direct notification of identifiable affected consumers without undue delay. If not all affected consumers can be contacted directly, economic operators and marketplace providers must disseminate a clear and visible recall notice or safety warning through appropriate channels with the widest possible reach.

Evidence does not determine or erase penalty exposure. It lets the authority and the business trace the alleged infringement to dated facts, the responsible role, the safety assessment, distribution, notifications, corrective measures, and consumer communications.

For Safety Business Gateway cases, retain the countries concerned, notifier details, description of the accident or safety issue, risk assessment or Unknown selection, corrective actions taken or planned, translations where needed, submission confirmation, Case ID, and submission number. A submitted notification cannot be edited. When later information becomes available, the Commission user manual instructs the notifier to create another notification, identify it as an update, and link it to the earlier Case ID.