GPSR for marketplace sellers: what 18 months of enforcement has taught us

By Operator One Editorial — 2026-06-14

Key takeaways

• The EU General Product Safety Regulation, Regulation (EU) 2023/988 (GPSR), has applied since 13 December 2024 and repealed Directive 2001/95/EC; its Article 16(1) bars placing a product on the EU market unless an economic operator established in the Union is responsible for it.
• Under Article 4(2) of Regulation (EU) 2019/1020, which GPSR Article 16 applies, that operator is an EU manufacturer, an importer, an authorised representative appointed by written mandate or, only where none of those is established in the EU, a fulfilment service provider.
• GPSR Article 19 requires every online offer to EU consumers to show the manufacturer's name with postal and electronic address, the Responsible Person's details where the manufacturer is outside the EU, product identification including a picture and type, and warnings in a language set by the Member State of sale.
• bol.com made manufacturer data mandatory for new products from 5 March 2026 and responsible economic operator data from 1 April 2026, and has removed existing products lacking manufacturer data in phases since 1 April 2026.
• The European Commission's Safety Gate report of 5 March 2026 recorded 4,671 alerts in 2025, the highest since 2003, 5,794 follow-up actions (up 35 percent) and more than 1,200 online marketplaces registered on the Safety Gate Portal.
• GPSR Article 44 leaves penalties to Member States; in Germany, section 28 of the revised Produktsicherheitsgesetz (ProdSG) sets fines of up to EUR 100,000 for specified breaches and up to EUR 10,000 for other offences.

The General Product Safety Regulation, Regulation (EU) 2023/988, known as GPSR, has applied since 13 December 2024 (Article 52). It replaced the General Product Safety Directive 2001/95/EC and sets the safety framework for non-food consumer products in all 27 EU Member States. By mid-2026 the regime has reshaped what it means to sell physical goods into the European Union through online marketplaces. In Operator One's experience, brands that treated GPSR as a paperwork exercise have seen listings deactivated on marketplaces with little notice.

This piece looks at where GPSR obligations bite for marketplace sellers in 2026, what the Regulation requires on the listing and behind it, and the documentation gaps that most often surface when a deactivation notice arrives.

The Responsible Person requirement, in plain terms

GPSR's central operational rule is Article 16(1) of Regulation (EU) 2023/988: a product covered by the Regulation shall not be placed on the market unless there is an economic operator established in the Union who is responsible for the tasks in Article 4(3) of Regulation (EU) 2019/1020. In practice this operator is called the Responsible Person. For products already covered by EU harmonisation legislation (for example toys, electrical equipment or radio equipment), the same duty already existed under Article 4 of Regulation (EU) 2019/1020; GPSR extended it to all consumer products in its scope.

The role is not symbolic. Under Article 4(3) of Regulation (EU) 2019/1020 and Article 16 of Regulation (EU) 2023/988, the Responsible Person:

• Must be established in an EU Member State.
• Keeps the technical documentation (and, for harmonised products, the EU Declaration of Conformity) available to market surveillance authorities and provides compliance information on reasoned request.
• Informs market surveillance authorities where it has reason to believe a product presents a risk, and cooperates with them on corrective action.
• Regularly checks, where appropriate to the risk, that the product matches the manufacturer's technical documentation and carries the identification, contact and safety information required by GPSR Article 9(5), (6) and (7), and provides documented evidence of those checks on request (Article 16(2)).
• Has its name, registered trade name or trade mark, and postal and electronic address indicated on the product, its packaging, the parcel or an accompanying document (Article 16(3)).

The Responsible Person is one of four operator types listed in Article 4(2) of Regulation (EU) 2019/1020: a manufacturer established in the EU; an importer, where the manufacturer is not established in the EU; an authorised representative appointed by the manufacturer by written mandate; or a fulfilment service provider established in the EU, but only where none of the other three is established in the Union. A freight forwarder or a VAT fiscal representative is not on that list, and neither is a warehouse that does not meet the definition of a fulfilment service provider.

GPSR does not introduce CE marking. CE marking, the conformity assessment and the EU Declaration of Conformity arise only under specific harmonisation legislation and stay with the manufacturer (Regulation (EC) 765/2008, Article 30(1)). The Responsible Person verifies that the documentation exists; it does not create it.

What marketplaces are actually verifying in 2026

GPSR places duties directly on marketplaces. Article 22(9) of Regulation (EU) 2023/988 requires providers of online marketplaces to design their interface so that traders can enter, and consumers can see on the listing, the manufacturer's details, the Responsible Person's details where the manufacturer is outside the EU, product identification including a picture, and warnings or safety information. Article 22(1) requires each marketplace to register on the Safety Gate Portal with a single point of contact, and Article 22(4) and (8) set deadlines of two working days to act on an authority order and three working days to process a product safety notice.

• bol.com (Netherlands and Belgium) publishes hard dates on its partner platform: manufacturer name, postal address and electronic address are mandatory for new products from 5 March 2026; the responsible economic operator's name and postal and electronic contact details are mandatory from 1 April 2026; and from 1 April 2026 bol.com removes existing products lacking manufacturer data in phases. bol.com also states that responsible economic operator details supplied earlier do not automatically meet GPSR: manufacturer and responsible operator details must be entered for each individual product.
• Amazon, eBay, Zalando and Kaufland each collect manufacturer and Responsible Person data in their seller tools to meet Article 22(9). In Operator One's experience, missing or inconsistent data on these platforms leads to listing deactivation rather than a prolonged warning cycle, and category-specific documentation requests are common for toys, electricals, cosmetics and children's products. The exact enforcement rules are set in each platform's seller terms and are not published as a single public standard.

The common thread is legal, not commercial: under GPSR Article 22 and Article 31 of the Digital Services Act, Regulation (EU) 2022/2065, marketplaces must build product safety information into the listing flow and act on authority orders within fixed deadlines, so incomplete seller data is a compliance risk for the platform itself.

What brands typically miss

The Responsible Person on the listing is the visible half of GPSR. The half that catches brands out is the documentation behind it. In Operator One's experience, the recurring gaps fall into three buckets.

1. The technical documentation. Article 9(2) of Regulation (EU) 2023/988 requires the manufacturer, before placing a product on the market, to carry out an internal risk analysis and draw up technical documentation containing at least a general description of the product and its safety-relevant characteristics. Where appropriate to the risk, it must also contain a risk analysis with the solutions adopted, including test reports, and the list of European standards or other elements applied. Article 9(3) requires the manufacturer to keep it up to date and available to authorities for 10 years after the product is placed on the market. A frequent gap is a brand with labels and marketing claims but no underlying risk analysis or test reports, for example an apparel range without the textile fibre composition and REACH evidence behind its labels.

2. The EU Declaration of Conformity (DoC), for harmonised products. A DoC exists only where EU harmonisation legislation requires one (for example the Toy Safety, Low Voltage, EMC or Radio Equipment rules). It is drawn up and signed under the manufacturer's responsibility, identifies the product and the legislation and standards applied, and must exist before the product is placed on the market. Where the sector law requires it, the importer keeps a copy for 10 years. In Operator One's experience, a common problem is a generic DoC that does not clearly identify the specific models being sold, which makes it hard to match the document to the listing.

3. Traceability. Article 9(5) of Regulation (EU) 2023/988 requires products to bear a type, batch or serial number or other identifying element that is easily visible and legible for consumers or, where size or nature prevent it, on the packaging or an accompanying document. Article 9(6) and Article 11(3) require the manufacturer's and importer's name and postal and electronic address on the product or, where not possible, the packaging or accompanying document. For brands that historically printed only an EAN, this means a labelling change and a change to how lot data is recorded. In Operator One's experience, retro-labelling stock already in an EU warehouse is slow and costly.

Related shortfalls include instructions and safety information not provided in a language that can be easily understood by consumers, as determined by each Member State of sale (GPSR Articles 9(7) and 11(4)); warnings missing from packaging; importer details that point to a non-EU group entity; and Responsible Person entries that give a Great Britain address, which does not satisfy Article 16 for the EU market. Northern Ireland is the exception: UK government guidance states that GPSR applies directly in respect of Northern Ireland from 13 December 2024, and an operator established in the EU or Northern Ireland is valid for that market.

The cost of getting caught

Enforcement is measurable in 2026. The European Commission's Safety Gate report, published on 5 March 2026, recorded 4,671 alerts in 2025, the highest number since the system launched in 2003 and 13 percent more than in 2024. National authorities notified 5,794 follow-up actions, a 35 percent increase, including withdrawals, border blocks, orders to online marketplaces to remove listings, and recalls. Cosmetics (36 percent), toys (16 percent) and electrical appliances (11 percent) were the most reported categories. The consequences sellers face include:

• Listing and offer deactivation by marketplaces, including bol.com's phased removal of existing products without manufacturer data since 1 April 2026, and removals ordered by authorities under GPSR Article 22(4). In Operator One's experience, reinstatement requires a full documentation review and can take several weeks per affected product.
• Inventory removals from marketplace fulfilment networks when products are flagged, with the seller bearing the cost of return or disposal (an Operator One observation, not a regulatory rule).
• National fines. Regulation (EU) 2023/988 sets no EU-wide fine; Article 44 requires each Member State to lay down penalties. In Germany, section 28 of the revised Produktsicherheitsgesetz (ProdSG), which now sanctions breaches of Regulation (EU) 2023/988, provides fines of up to EUR 100,000 for specified breaches and up to EUR 10,000 for all other offences.
• Recalls with mandatory remedies. Article 37 of Regulation (EU) 2023/988 requires the operator responsible for a recall to offer an effective, cost-free and timely remedy, with a choice of at least two of repair, replacement or a refund at least equal to the price paid.
• Safety Gate publication. Measures against dangerous products are notified through the Safety Gate Rapid Alert System and shared with authorities across the EU and EEA, so action in one Member State is visible in all of them.

Other 2026 rules that land on the same listing

GPSR is not the only EU rule that changed what a cross-border marketplace seller needs in 2026.

• Packaging (PPWR). The Packaging and Packaging Waste Regulation, Regulation (EU) 2025/40, applies from 12 August 2026 (Article 71). Article 45(3) requires a producer that makes packaging or packaged products available for the first time directly to end users in a Member State where it is not established, whether it is based in another Member State or outside the EU, to appoint an authorised representative for extended producer responsibility by written mandate in each such Member State. This is a packaging EPR role, separate from the GPSR Responsible Person.
• Customs on low-value parcels. From 1 July 2026, the EUR 150 customs duty exemption for low-value e-commerce consignments no longer applies. Council Regulation (EU) 2026/382 introduces a temporary flat customs duty of EUR 3 per item on distance sales consignments valued up to EUR 150 until 1 July 2028, according to the European Commission.

What "good" looks like

In Operator One's experience, brands that have come through GPSR cleanly share a few operational habits. They confirmed which EU-established operator is responsible under Article 16 for each product before listing, and put any authorised representative appointment in writing. The manufacturer maintains technical documentation per product with a risk analysis, the standards applied and dated test reports. For harmonised products, their DoCs identify the specific models sold. Their labels and instructions meet the language rules of every Member State they ship to. And they keep a log of complaints, accidents and corrective actions, because GPSR Article 20 requires accidents to be notified through the Safety Business Gateway and Article 16(2) requires documented evidence of checks.

How to set up GPSR compliance for a marketplace listing, step by step

1. Classify the product. Check whether the product is a consumer product in scope of Regulation (EU) 2023/988 and whether EU harmonisation legislation (for example toys, electrical or radio equipment) also applies, which adds CE marking and an EU Declaration of Conformity held by the manufacturer.
2. Identify the responsible economic operator. Determine which of the four Article 4(2) Regulation (EU) 2019/1020 operator types is established in the EU for the product: EU manufacturer, importer, authorised representative with written mandate, or fulfilment service provider as last resort.
3. Confirm the technical documentation. Make sure the manufacturer has carried out the internal risk analysis and drawn up technical documentation under GPSR Article 9(2), kept up to date and available for 10 years.
4. Label the product. Put a type, batch or serial number on the product (Article 9(5)), the manufacturer's and, where relevant, importer's name and postal and electronic address (Articles 9(6) and 11(3)), the responsible operator's details (Article 16(3)), and safety information in the required languages.
5. Complete the marketplace listing. Enter the Article 19 data in each marketplace's seller tools: manufacturer details, Responsible Person details where the manufacturer is outside the EU, product identification with a picture, and warnings. On bol.com, both manufacturer and responsible operator fields are mandatory since 1 April 2026.
6. Set up incident and recall handling. Register for the Safety Business Gateway to notify accidents and dangerous products (Articles 11(2) and 20), and prepare a recall procedure offering at least two remedies under Article 37.

Frequently asked questions

Do I need an EU Responsible Person to sell on Amazon or bol.com in 2026?

Yes. Article 16(1) of the EU General Product Safety Regulation, Regulation (EU) 2023/988, applicable since 13 December 2024, prohibits placing a product on the EU market unless an economic operator established in the Union is responsible for it. bol.com made manufacturer data mandatory for new products on 5 March 2026 and responsible economic operator data on 1 April 2026, so a new offer without those details is not published.

Who can act as a GPSR Responsible Person?

Article 16 of Regulation (EU) 2023/988 applies Article 4(2) of Regulation (EU) 2019/1020, which allows four operator types: a manufacturer established in the EU, an importer, an authorised representative appointed by written mandate, or a fulfilment service provider established in the EU, but only where none of the other three is established in the Union. A freight forwarder or VAT fiscal representative is not on that list.

What information must appear on the product listing itself under GPSR?

Article 19 of Regulation (EU) 2023/988 requires every online offer to EU consumers to show: the manufacturer name or trade mark with a postal and an electronic address; where the manufacturer is outside the EU, the name, postal and electronic address of the Responsible Person; product identification including a picture and its type; and warnings or safety information in a language the Member State of sale determines.

What happens if I do nothing about GPSR compliance?

Regulation (EU) 2023/988 leaves penalties to each Member State under Article 44. In Germany, section 28 of the revised Produktsicherheitsgesetz (ProdSG) allows fines of up to EUR 100,000 for specified breaches and up to EUR 10,000 for other offences. Marketplaces act on their own terms as well: bol.com has removed existing products lacking manufacturer data in phases since 1 April 2026, and authorities can order listings removed.

Who carries the GPSR obligation when a Merchant of Record is the seller?

The obligation follows the legal role. Where a Merchant of Record imports the goods into the EU, it is the importer under Article 11 of Regulation (EU) 2023/988 and, where the manufacturer is not established in the EU, the responsible economic operator under Article 16, and that cannot be contracted away. The manufacturer still draws up the technical documentation under Article 9(2) and, for harmonised products, keeps CE marking, conformity assessment and the EU Declaration of Conformity.

How fast must an online marketplace act on a dangerous product listing in the EU?

Under Article 22(4) of Regulation (EU) 2023/988, a provider of an online marketplace must act on a market surveillance authority order without undue delay and in any event within two working days. Under Article 22(8), it must process product safety notices within three working days. Marketplaces must also register on the Safety Gate Portal; the European Commission reported more than 1,200 registrations by the end of 2025.

Does GPSR require a CE mark on the product?

No. Regulation (EU) 2023/988 does not introduce CE marking; CE marking applies only where specific EU harmonisation legislation covers the product, such as toys, electrical equipment or radio equipment. GPSR Article 9(5) does require a type, batch or serial number visible to consumers, and Article 9(3) requires the manufacturer to keep technical documentation available to authorities for 10 years after the product is placed on the market.

What must a GPSR recall offer consumers?

Article 37 of Regulation (EU) 2023/988 requires the economic operator responsible for a recall to offer an effective, cost-free and timely remedy, with a choice of at least two of: repair, replacement with a safe product of the same type and at least the same value and quality, or a refund at least equal to the price paid. Only one remedy may be offered where the others are impossible or disproportionate.

Can a UK address still be used as a GPSR Responsible Person?

Not for sales into the EU. Article 16 of Regulation (EU) 2023/988 requires a Responsible Person established in the Union, so a Great Britain address does not qualify. Northern Ireland is different: UK government guidance states that the GPSR applies directly in respect of Northern Ireland from 13 December 2024 and that the responsible operator for that market must be established in the EU or Northern Ireland.

Where a Merchant of Record carries the GPSR obligation

Operator One acts as the legal seller, the Merchant of Record, for the brands it works with. Listings show the client as the Brand and Operator One as the seller. Where Operator One imports goods into the EU, it is the importer as a legal consequence, which makes it the responsible economic operator under Article 4(2) of Regulation (EU) 2019/1020 and Article 16 of Regulation (EU) 2023/988; for harmonised electronics the sector importer duties also apply (for example Article 12 of the Radio Equipment Directive 2014/53/EU). That role cannot be outsourced away. As importer, Operator One verifies that the manufacturer's technical documentation and, where required, the EU Declaration of Conformity exist, adds its own name and postal and electronic address to the product, packaging or accompanying document, keeps the documentation available to authorities for 10 years, and runs corrective action and recalls. The manufacturer keeps CE marking, the conformity assessment, the technical file and the Declaration of Conformity. Where the manufacturer itself is established in the EU, it is the responsible operator. See the compliance glossary for the underlying terms.

Sources: Regulation (EU) 2023/988 (GPSR), EUR-Lex; Regulation (EU) 2019/1020, EUR-Lex; Commission Notice C/2025/6233, GPSR guidelines for businesses, EUR-Lex; European Commission press release IP/26/537, Safety Gate report 2025; bol.com partner platform, GPSR; Produktsicherheitsgesetz section 28, gesetze-im-internet.de; UK government guidance on EU Regulation 2023/988 in Northern Ireland; Regulation (EU) 2025/40 (PPWR), EUR-Lex; European Commission, temporary flat fee on low-value imports.