EU GPSR Traceability Records

Confirm scope before building the record. The GPSR covers consumer products, including products intended for professional use that are likely to be used by consumers under reasonably foreseeable conditions. It covers new, used, repaired, and reconditioned products, but Article 2 excludes listed categories and products clearly marked for repair or reconditioning before use. Where another EU law regulates the same safety objective, record which GPSR provisions still apply rather than assuming the whole Regulation applies or disappears.

Start each record with the identifiers a market surveillance authority, marketplace, distributor, or consumer would need to distinguish the affected product from similar products. GPSR Article 9 requires manufacturers to use a type, batch or serial number, or another element enabling identification of the product, with the information visible and legible for consumers or provided on packaging or accompanying documents when the product itself cannot carry it.

Keep the identifier model operational: product name, brand, model, SKU, type, batch, serial number, variant, colour or size, firmware or app version where safety-relevant, product photographs, label artwork, packaging artwork, instructions, warnings, and the location where the identifier appears on the product or packaging.

The traceability record should identify every operator that can be asked for product safety information: manufacturer, authorised representative where appointed, importer, distributor, fulfilment service provider where relevant, online marketplace, and the EU responsible person when the manufacturer is not established in the Union.

Where GPSR Article 15 applies, it requires economic operators, on request, to identify any operator that supplied them with the product, part, component, or embedded software, and any operator to whom they supplied the product. Where Article 16 applies, it also requires a responsible economic operator established in the Union, with documented checks where appropriate.

For each EU-facing online offer, keep a dated listing snapshot that shows the information GPSR requires consumers to see before purchase. The record should show the manufacturer name or mark and postal and electronic address, the EU responsible person when the manufacturer is outside the Union, product identification including picture and type, and required warnings or safety information in the relevant consumer language.

Where a marketplace hosts the offer, also retain trader self-certification, marketplace notice IDs, product-safety notices received under the platform process, authority removal or warning orders, listing takedown timestamps, and evidence that identical dangerous-product offers were searched using the identifiers in the order when that was required.

Traceability records need a safety-evidence spine, not just commercial shipment data. Connect the product identifiers to the internal risk analysis, test reports, standards or other safety elements applied, instructions, warnings, complaint investigations, accident information, corrective measures, withdrawals, recalls, and any Safety Business Gateway submission.

When the manufacturer learns of a qualifying accident, GPSR Article 20 requires it to ensure notification through the Safety Business Gateway without undue delay. If the manufacturer is not established in the Union, the Article 16 responsible person that knows of the accident must ensure the notification is made. Importers and distributors must inform the manufacturer without undue delay; the manufacturer may instruct one of them to submit. The record should include the product type, identification number, accident circumstances if known, Member State, submitter, submission reference, and follow-up correspondence.

Set retention by record type. Technical documentation must remain available to market surveillance authorities for 10 years after the product is placed on the market. Importers must keep the relevant technical documentation copy for 10 years after placing the product on the market. Article 15 risk and corrective-measure information must be presentable for 10 years after supply, while Article 15 supply-chain traceability information must be presentable for six years after supply.

Complaint registers should avoid over-retaining personal data: GPSR limits personal data in manufacturer and importer complaint registers to what is necessary for investigating the alleged dangerous product and, in any event, no longer than five years after entry. Keep non-personal product, batch, operator, notice, submission, and recall evidence separately so product-safety history remains usable without unnecessary personal data.

These periods come from binding GPSR provisions and are not interchangeable. The suggested product-family map, release record, listing snapshot, and review log are Sorena's practical record structure; a market surveillance authority may request the underlying information in another form, and product-specific EU or national rules may require additional records.

Article 18 permits the Commission to impose a separate traceability system by delegated act for products, categories, or groups likely to present a serious risk. The act must define the covered products, the data to collect and store, how the data is displayed or accessed, and the actors with access.

This power does not itself impose a universal QR code or central registration requirement on every GPSR product. Check whether a delegated act covers the product before adding a product-specific identifier, data carrier, or access workflow.