EU GPSR Traceability Records

Start each record with the identifiers a market surveillance authority, marketplace, distributor, or consumer would need to distinguish the affected product from similar products. GPSR Article 9 requires manufacturers to use a type, batch or serial number, or another element enabling identification of the product, with the information visible and legible for consumers or provided on packaging or accompanying documents when the product itself cannot carry it.

Keep the identifier model operational: product name, brand, model, SKU, type, batch, serial number, variant, colour or size, firmware or app version where safety-relevant, product photographs, label artwork, packaging artwork, instructions, warnings, and the location where the identifier appears on the product or packaging.

The traceability record should identify every operator that can be asked for product safety information: manufacturer, authorised representative where appointed, importer, distributor, fulfilment service provider where relevant, online marketplace, and the EU responsible person when the manufacturer is not established in the Union.

GPSR Article 15 requires economic operators, on request, to identify any operator that supplied them with the product, part, component, or embedded software, and any operator to whom they supplied the product. Article 16 also requires a responsible economic operator established in the Union for products covered by the Regulation, with documented checks where appropriate.

For each EU-facing online offer, keep a dated listing snapshot that shows the information GPSR requires consumers to see before purchase. The record should show the manufacturer name or mark and postal and electronic address, the EU responsible person when the manufacturer is outside the Union, product identification including picture and type, and required warnings or safety information in the relevant consumer language.

Where a marketplace hosts the offer, also retain trader self-certification, marketplace notice IDs, product-safety notices received under the platform process, authority removal or warning orders, listing takedown timestamps, and evidence that identical dangerous-product offers were searched using the identifiers in the order when that was required.

Traceability records need a safety-evidence spine, not just commercial shipment data. Connect the product identifiers to the internal risk analysis, test reports, standards or other safety elements applied, instructions, warnings, complaint investigations, accident information, corrective measures, withdrawals, recalls, and any Safety Business Gateway submission.

When an accident is known, GPSR Article 20 requires notification through the Safety Business Gateway without undue delay by the manufacturer, or by the responsible person when the manufacturer is not established in the Union. The notification record should include the product type, identification number, accident circumstances if known, Member State, submitter, submission reference, and follow-up correspondence.

Set retention by record type. Technical documentation must remain available to market surveillance authorities for 10 years after the product is placed on the market. Importers must keep the relevant technical documentation copy for 10 years after placing the product on the market. Article 15 risk and corrective-measure information must be presentable for 10 years after supply, while Article 15 supply-chain traceability information must be presentable for six years after supply.

Complaint registers should avoid over-retaining personal data: GPSR limits personal data in manufacturer and importer complaint registers to what is necessary for investigating the alleged dangerous product and, in any event, no longer than five years after entry. Keep non-personal product, batch, operator, notice, submission, and recall evidence separately so product-safety history remains usable without unnecessary personal data.