EU Market Surveillance Regulation authority request triage workflow

Open one case file for the request and preserve the original message, attachments, envelope data, sender domain, authority name, Member State, case number, cited legal basis, requested products, requested records, and requested response channel. Do not send technical files, supply-chain data, or personal data until the request is tied to an identifiable market surveillance authority or a channel the authority controls.

Classify the request type before assigning work: information or documentation, Article 4 responsible economic operator contact, product sample or testing support, online-interface issue, serious-risk concern, border-control hold, corrective-action follow-up, or cross-border authority cooperation.

After intake, decide whether the request concerns a product covered by Union harmonisation legislation and whether Article 4 applies to the product category. Article 4 applies to the legislation listed in Article 4(5), including the Batteries Regulation and specified Critical Raw Materials Act duties in the consolidated text dated 23 May 2024, or where another product act expressly applies Article 4. Other sector rules may add separate duties, so Article 4 should not be treated as a universal responsible-person rule.

If Article 4 applies, test each role against the supply chain: an EU-established manufacturer; an importer where the manufacturer is outside the Union; an authorised representative whose written mandate designates it for the Article 4 tasks; or an EU fulfilment service provider for products it handles only where none of the first three operators is established in the Union. Confirm that the name, trade name or trade mark, and postal contact details appear on the product, packaging, parcel, or accompanying document as Article 4 requires.

Where GPSR Article 16 supplies the responsible-person requirement, it imports MSR Article 4(2) and (3), rather than every paragraph of MSR Article 4. Apply GPSR Article 2 exclusions first and use GPSR Article 16(3) for the contact-information requirement, which includes both a postal and an electronic address.

Build the first evidence pack around what the authority actually asked for. Depending on the request, the pack may include the request log, authenticity check, product identifiers, supply-chain and distribution facts, Article 4 contact details, EU declaration, technical documentation index, labels and instructions, test reports, standards rationale, marketplace or online listing captures, risk assessment, prior complaints or incidents, and open assumptions.

Treat sample and testing requests as controlled evidence handling. Article 14 allows authorities to acquire product samples, inspect samples, and reverse-engineer them to identify non-compliance and obtain evidence. Keep chain-of-custody records, sample source, sample condition, batch and serial identifiers, shipment records, and any authority testing references.

Escalate immediately when the request says the product may compromise health or safety, fail Union harmonisation requirements, present a risk, present a serious risk, require rapid intervention, or require withdrawal, recall, prohibition, restriction, warning, content removal, or public alert. Serious-risk classification must be based on a risk assessment that considers the hazard, probability and severity of harm, and normal and foreseeable use, not commercial impact, the feasibility of higher safety, or the availability of lower-risk products.

When non-compliance or risk is confirmed, prepare a corrective-action proposal that fits Article 16: bring the product into compliance, prevent further availability, withdraw or recall it, destroy or render it inoperable, add warnings, set prior conditions for availability, or alert end users. Track whether action is voluntary, requested by the authority, or required because the authority found persistent risk or non-compliance.

Close the triage only after the response record shows what was requested, who validated the authority, what product and legislation were in scope, who acted as the Article 4 contact, what evidence was provided, what was withheld or pending, whether samples or testing were involved, whether risk or non-compliance was found, what corrective action was taken, and where future authority follow-up should land.

Keep an ICSMS-aware case summary even though the company does not create the authority record. For products that have undergone an in-depth compliance check, Article 34 requires authorities to enter specified information on measures, testing reports, corrective action, injuries, objections, and certain Article 5 failures, so the company record should reconcile with authority references if the case reappears in another Member State.