The answer depends on which directive governs your product. There is no single EU risk assessment methodology that applies to everything. A connected industrial machine, a wireless consumer device, and a children’s toy all require CE marking, but the risk assessment process looks completely different for each one.
This guide covers what a risk assessment involves under EU law, which methodology applies to which product category, and how the CRA and GPSR each handle risk in their own way.
What Is a Risk Assessment?
A risk assessment is a structured process for identifying hazards, estimating the probability and severity of harm, evaluating whether the resulting risk is acceptable, and documenting the measures taken to reduce it. The output feeds directly into the technical documentation required for CE marking.
The risk assessment precedes design decisions, it does not justify them after the fact. EU regulators expect to see a document that shows how hazards were identified during development and how the design responded to them.
Two distinct logics operate across CE marking directives:
In machinery, the risk assessment is an explicit, standalone document following a defined methodology.
In most other product categories, conformity is demonstrated through testing against harmonized standards, and the risk analysis is embedded in that process rather than produced as a separate document. Understanding which logic applies to your product is the first practical step.
ISO 12100: The Reference Methodology for Machinery
ISO 12100 (“Safety of Machinery — General Principles for Design — Risk Assessment and Risk Reduction”) defines the methodology that applies under the Machinery Regulation (EU) 2023/1230, which replaced the former Machinery Directive 2006/42/EC.
The standard walks manufacturers through a three-step process: define the limits of the machinery across its full lifecycle, identify and analyze all hazards, and apply risk reduction in a defined hierarchy. That hierarchy runs from inherently safe design, to technical safeguards, to user information. Each step must be documented.
ISO 12100 is a Type A standard, meaning it sets general principles. Type B standards (like EN ISO 13849-1 for safety-related control systems) and Type C standards (product-specific) build on it. When a Type C standard exists for your machine category, it takes precedence, but ISO 12100 remains the baseline methodology.
The risk assessment document becomes part of the technical file and is a prerequisite for the Declaration of Conformity. Without it, the machine cannot legally be placed on the EU market.
When Testing Against Standards Substitutes IS the Risk Assessment
Outside machinery, the compliance logic shifts. Most product directives require manufacturers to apply harmonized standards and pass the tests those standards define. The standards themselves were developed through a process that incorporated risk analysis; the manufacturer does not replicate that analysis from scratch. The test report, in effect, becomes the documented proof of risk management.
This matters for manufacturers accustomed to separating safety analysis from lab testing. Under these directives, the two are inseparable.
Low Voltage Directive (LVD, 2014/35/EU) covers electrical equipment operating between 50V and 1000V AC. The risks to address are electrical, thermal, and mechanical. EN 62368-1 is the dominant harmonized standard for audio/video and ICT equipment. Passing its tests, documented in a full test report, constitutes the conformity demonstration.
Radio Equipment Directive (RED, 2014/53/EU) adds radio frequency and interference requirements on top of the LVD safety base. EN 62368-1 remains the electrical safety reference; RF performance and EMC are tested and documented separately under the applicable EN 301 489 and product-specific radio standards.
Toy Safety Regulation (EU) 2023/988 addresses physical, mechanical, chemical, electrical, and flammability hazards. The EN 71 series defines the test methods. The risk evaluation is the test report.
Pressure Equipment Directive (PED, 2014/68/EU) covers vessels, piping, and fittings above certain pressure thresholds. The conformity assessment route depends on the category of the equipment (I through IV), with higher-category products requiring Notified Body involvement. Risk is managed through design calculations, materials selection, and inspection procedures, all documented in the technical file.
ATEX Directive (2014/34/EU) applies to equipment intended for use in potentially explosive atmospheres. The hazard is ignition risk in explosive environments, and conformity relies on a combination of design controls and, for higher categories, Notified Body type examination.
Construction Products Regulation (CPR, 305/2011) operates under a different logic entirely. Manufacturers declare the performance of their products against essential characteristics rather than conformity to safety requirements. Risk analysis is embedded in the performance assessment process, not produced as a standalone document.
Risk Assessment Under the Cyber Resilience Act
The Cyber Resilience Actintroduces a mandatory cybersecurity risk assessment for any product with digital elements placed on the EU market. The obligation sits in Article 13 and applies to manufacturers regardless of where they are based.
The CRA risk assessment differs from a machinery-style document in scope. It covers the full software and firmware lifecycle, including development, delivery, and maintenance phases. Manufacturers must assess threats based on the intended purpose, reasonably foreseeable use, and the operational environment. Third-party components, including open-source ones, must be evaluated for the risks they introduce.
The output informs how the essential cybersecurity requirements of Annex I apply to the specific product, and how the manufacturer will handle vulnerability reporting and patching over the support period. It goes into the technical documentation alongside the SBOM where applicable.
When a product falls under both the CRA and another directive (a connected machine covered by both the Machinery Regulation and the CRA, for example), the cybersecurity risk assessment can be integrated into the broader risk assessment required by those frameworks rather than produced as a completely separate document.
Non-compliance with the CRA’s essential cybersecurity requirements carries fines of up to €15 million or 2.5% of global annual turnover.
Risk Assessment Under the GPSR
The General Product Safety Regulation (GPSR, EU) 2023/988 applies to consumer products that fall outside the scope of sector-specific CE marking directives, or to aspects of those products that directives do not cover.
The GPSR does not mandate a specific standard or methodology. It requires the responsible person (manufacturer, importer, or EU-based responsible person) to evaluate the safety of the product taking into account its physical and chemical characteristics, its reasonably foreseeable use including misuse, the categories of users likely to be exposed, and the product’s interaction with other products.
Where harmonized standards exist and are applied, the product benefits from a presumption of conformity. When no harmonized standard covers the specific risk, the manufacturer must document the evaluation against the general safety requirement using available technical knowledge.
For products sold on the EU market without CE marking, the GPSR is the primary safety obligation. A documented safety assessment is part of the technical documentation the responsible person must hold and make available to market surveillance authorities on request.
The directive determines the methodology. Before starting any risk assessment work, you need to know which directives apply to your product and whether harmonized standards exist for your specific category.
The CE marking technical file must reflect whichever approach applies: a standalone risk assessment document for machinery, test reports plus compliance documentation for LVD, RED, Toy Safety, PED, or ATEX, a cybersecurity risk assessment for CRA-covered products, or a product safety evaluation for GPSR.
If your product spans multiple directives, the risk assessments should be designed to complement each other from the start. Getting the methodology wrong means reworking both the documentation and potentially the product design.
Start With the Right Framework
Identifying which risk assessment methodology applies is the first technical decision in any EU compliance project. It shapes the documentation structure, the testing program, and the timeline.
If you are bringing a product to the EU market and need clarity on which directives apply and what the risk assessment process looks like for your product category, get a quote and we can map it out from there.
