What to Tell Your EU Importer to Stay GPSR Compliant

You Made the Product. They Put It on the Market.

As a non-EU manufacturer, your GPSR obligations end at the factory gate — in the sense that you are responsible for the product’s safety, its documentation, its labelling, and designating an EU Responsible Person. But the moment your product enters the European distribution chain, other operators take on their own legal responsibilities under the same regulation.

Your importer is one of them. And in most cases, your importer does not know what those responsibilities are, has never read the GPSR, and is operating under the assumption that compliance is entirely your problem.

This post gives you the tools to change that — briefly, clearly, and in a format you can send directly.

Economic Operators Under GPSR: Who Is Responsible for What

The GPSR defines a chain of responsibility across all economic operators involved in placing a product on the EU market. Each role carries specific obligations.

The manufacturer is responsible for ensuring the product is safe, conducting the risk assessment, preparing technical documentation, and complying with labelling requirements. Non-EU manufacturers must also designate an EU-based Responsible Person.

The importer — any company established in the EU that places a product from outside the EU on the EU market — takes on the role of EU Responsible Person for the products they import. This is a significant legal position: the importer becomes the primary point of contact for market surveillance authorities, and is responsible for verifying that the manufacturer has met their obligations before the product enters the market.

The distributor — any company in the supply chain that makes the product available on the EU market, other than the manufacturer or importer — must verify that the product bears the required markings, is accompanied by required documentation, and does not present an obvious safety risk before distributing it.

Online marketplaces have their own separate set of obligations under Article 22 of the GPSR, including registration with the EU Safety Gate portal and cooperation with authorities.

One distinction that creates frequent confusion: the Responsible Person under GPSR and the Authorised Representative under CE marking legislation are different roles with different legal definitions and tasks. An importer acting as Responsible Person under GPSR is not automatically an Authorised Representative for CE marking purposes, and vice versa. If your product carries CE marking and is also subject to GPSR, both roles may need to be addressed separately.

For a full overview of how the GPSR works and which products it covers — including products without CE marking — see our previous post and the General Product Safety Regulation page.

The Importer’s Traceability Obligations — What the Law Requires

One of the most operationally demanding aspects of GPSR compliance for importers and distributors is traceability. The regulation requires economic operators to maintain records that allow the full distribution chain to be reconstructed — so that in the event of a safety issue, the product can be located, its distribution tracked, and corrective action taken rapidly.

The underlying logic is straightforward: a recall or market withdrawal is only effective if you can identify which products are affected, where they went, and how to reach the people who have them. Without traceability records, this becomes impossible.

The GPSR requires economic operators to retain records covering the product itself, the chain of suppliers and customers, and — for those selling directly to consumers — limited consumer data consistent with GDPR requirements. The retention period must be adequate for the product’s lifecycle and the applicable legal obligations.

What this means in practice is that your importer needs a system — even a simple one — for capturing and storing this information at the time of each transaction, not retroactively.

Ready to Copy-Paste: What to Send Your Importer

The block below is designed to be sent directly to your EU importer. It explains their GPSR traceability obligations in plain language, without requiring them to read the regulation themselves. You can adapt the introduction and add your company’s name, but the substance should remain intact.

---

[To: your EU importer / distributor]

Subject: GPSR Traceability — What You Need to Do

As the EU importer of our products, you act as EU Responsible Person under the General Product Safety Regulation (EU) 2023/988 (GPSR), which has been fully applicable since 13 December 2024. This means you have specific traceability obligations that apply to every product you receive from us and place on the EU market.

Please read the following carefully and implement these practices in your operations.

Why traceability matters

Traceability allows unsafe or non-compliant products to be identified quickly, located in the supply chain, and removed from the market when necessary. It protects consumers, limits your commercial and legal exposure, and significantly reduces the impact of a recall. In the event of a market surveillance investigation or a product safety issue, authorities will expect you to provide this information promptly.

What records you must retain — for every product you receive from us

For each product or batch you receive, you must be able to identify and document:

• Product identification: model name, SKU, batch number and/or serial number where available
• Supplier: our company name, address, and contact details (i.e. us, as your supplier)
• Date and quantity of each purchase from us
• Any safety-related information, warnings, or instructions provided with the product

What records you must retain — for each onward sale or transfer

For every sale or transfer of our products to another business (retailer, sub-distributor, or other operator), you must retain:

• The name, address, and contact details of the customer / next operator in the chain
• The product identification (model, SKU, batch/serial)
• The date and quantity of each sale
• Any safety-related complaints or incidents you become aware of in connection with the product

Records must be organised, accessible, and available for inspection by market surveillance authorities upon request. They must be retained for the period required by law — in practice, this means for as long as the product is on the market and for a reasonable period after, consistent with your legal obligations and any sector-specific retention periods that apply.

If you sell directly to final consumers

If you sell our products directly to end consumers (through your own retail channel, e-commerce platform, or otherwise), you may also need to retain limited consumer-related records to support traceability in the event of a recall. This must always be done in compliance with GDPR.

Specifically, and only where relevant for product safety, recall management, or legal obligations, you may need to retain:

• Proof of purchase: invoice date, product description, model/batch/serial number
• Contact details strictly necessary to notify consumers in the event of a recall
• Records of any safety-related complaints or incidents reported by consumers

This data must be minimised — retain only what is strictly necessary for the purposes above. Store it securely, limit access to those who need it, and delete or anonymise it once it is no longer required for these purposes.

What to do if a safety issue arises

If you become aware of a safety risk associated with our products — whether through a consumer complaint, an incident, a regulatory enquiry, or any other source — you must:

1. Notify us immediately with full details
2. Cooperate with any market surveillance authority investigation
3. If required, notify the relevant national authority and, for serious risks, the EU Safety Gate portal within two working days

Do not wait for instructions from us before notifying authorities if a serious risk has been identified. The obligation to report is yours as EU Responsible Person, and the two-working-day deadline is strict.

A note on GDPR

All customer-related data retained for traceability purposes must comply with GDPR. Retain only what is necessary, for no longer than necessary, with appropriate security measures in place. Do not use traceability data for commercial purposes beyond the product safety and legal obligations it was collected for.

If you have questions about any of the above, please contact us at [your contact details].

---

What This Does Not Cover

The instructions above cover your importer’s traceability obligations under GPSR.

They do not cover the manufacturer’s obligations — product safety by design, risk assessment, technical documentation, labelling, and EU Responsible Person designation. Those are your responsibilities as manufacturer, not your importer’s.

If you have not yet addressed your own GPSR compliance as a manufacturer, or if you are unsure whether your product requires CE marking in addition to GPSR compliance, the previous post in this series covers those topics in detail.

How GetReady Compliance Can Help

If your distribution chain is more complex — multiple importers across different EU member states, mixed online and offline channels, products that sit at the intersection of GPSR and sector-specific legislation — a generic set of instructions may not be sufficient. We can help you develop compliance instructions tailored to your specific chain, review your existing importer agreements, and structure your EU Responsible Person arrangements correctly.

We also offer EU Responsible Person services directly, for manufacturers who want a single, reliable point of regulatory contact in the EU rather than relying on their commercial importers for this role.

To discuss your situation, request a quote.