GPSR Risk Assessment: What It Must Contain (+ Free Template Structure)

Under Article 9(2) of the General Product Safety Regulation (EU) 2023/988 (GPSR), every manufacturer must carry out an internal risk analysis and draw up technical documentation before placing a product on the EU market. In plain terms: you must systematically list what could go wrong with your product, judge how likely and how severe each hazard is, describe what you did to reduce those risks, and keep it all in writing for 10 years. This applies since 13 December 2024 to nearly all consumer products — including handmade and small-batch goods sold on Etsy or Amazon.

What does GPSR Article 9(2) actually require?

Article 9(2) sets out two linked obligations for manufacturers ("manufacturer" includes anyone who makes a product, or has it made and sells it under their own name):

1. Carry out an internal risk analysis before placing the product on the market.
2. Draw up technical documentation containing at least:
   • a general description of the product, and
   • its essential characteristics relevant for assessing its safety.

Where the product's possible risks make it appropriate, the technical documentation must also contain:

• an analysis of the possible risks and the solutions adopted to eliminate or mitigate them, including the outcome of any test reports;
• a list of any relevant European standards or other elements (health and safety requirements, voluntary certification schemes) applied to meet the general safety requirement.

The documentation must be kept up to date, retained for 10 years after the product is placed on the market, and made available to authorities on request. If you appoint an EU Responsible Person, they will ask to see it before accepting your product — verifying it exists is literally their job.

Does a small Etsy or Amazon seller really need one?

Yes. The GPSR has no exemption for small businesses, handmade goods, or low volumes. If you make candles, jewelry, toys, ceramics, or textiles and sell them to EU consumers, you are a "manufacturer" and Article 9(2) applies to you. The good news: for a simple, low-risk product, a proportionate risk assessment can be a few pages — the regulation demands a documented, honest analysis, not a laboratory dossier.

How do you identify the hazards in your product?

Start from Article 6 GPSR, which lists the aspects that determine whether a product is safe. Work through them as a checklist:

• The product itself — design, materials, technical features, composition, packaging, and instructions for assembly, installation, use, and maintenance
• Its effect on other products — if it will foreseeably be used together with them (e.g., a phone case and the phone's heat)
• Presentation and labeling — warnings, age markings, disposal instructions, and whether they are in languages EU consumers understand
• Vulnerable consumers — especially children and the elderly; ask not "who is this for?" but "who will foreseeably get hold of it?"
• Appearance — especially products that look like food (a strawberry-shaped soap is a classic recall trigger)

Then translate those aspects into concrete hazard types. Typical categories for marketplace products:

Hazard type	Example questions
Mechanical	Sharp edges or points? Small parts that detach (choking)? Pinch or crush points? Can it tip or break under load?
Chemical	Do dyes, glazes, adhesives, or fragrances contain restricted substances (REACH)? Skin contact? Migration into food?
Thermal / fire	Open flame (candles)? Flammable textiles? Surfaces that get hot?
Electrical	Battery safety, chargers, short circuits (usually also triggers CE-marked legislation beyond GPSR)
Strangulation / entanglement	Cords, ribbons, drawstrings — critical for children's products
Hygiene / microbiological	Cosmetics, food-contact items, stuffed toys

For each hazard, note foreseeable use and misuse: a baby chewing a wooden toy is foreseeable; so is a child reaching a decorative magnet.

How do you score risk? (probability × severity matrix)

The standard EU approach — used in the official Safety Gate/RAPEX risk assessment guidelines, Commission Implementing Decision (EU) 2019/417 — combines severity of the possible injury with the probability that it occurs. For an internal risk assessment, a simplified matrix is enough:

Probability ↓ / Severity →	Minor (recovers fully)	Serious (medical treatment)	Very serious (permanent / fatal)
Low (rare, needs unusual misuse)	Low risk	Low–medium risk	Medium risk
Medium (possible in foreseeable use)	Low–medium risk	Medium risk	High risk
High (likely over product lifetime)	Medium risk	High risk	High risk

How to use it:

1. Rate each hazard before mitigation (inherent risk).
2. Describe your mitigation — design change, safer material, warning label, age recommendation, instruction sheet, testing to a standard (e.g., EN 71 for toys, EN 15493 for candles).
3. Rate the residual risk after mitigation. Residual risks should land in the low/medium zone; a remaining high risk means the product is not ready to sell.
4. Remember the hierarchy: design it out first, guard against it second, warn about it last. A warning label does not fix a hazard that could be removed by design.

What does a complete GPSR risk assessment contain? (free template structure)

A proportionate risk assessment for a typical marketplace product can follow this structure:

1. Product identification — name, SKU/model, batch or serial reference, photo, your business name and address
2. Product description — materials, dimensions, components, how it is made, packaging
3. Intended users and foreseeable use — target group, age range, use environment; explicitly state if not intended for children under 3, and whether children could foreseeably access it anyway
4. Applicable legislation and standards — GPSR always; plus anything product-specific (Toy Safety Directive, REACH restrictions, relevant EN standards) and which ones you applied
5. Hazard identification — the checklist exercise above, one row per hazard
6. Risk evaluation — probability × severity for each hazard, before and after mitigation
7. Mitigation measures — design choices, material certificates, test reports, warnings and their exact wording, instructions
8. Residual risk conclusion — a signed, dated statement that the product is safe for its intended and foreseeable use, and who carried out the assessment
9. Review trigger — when you will revisit it (material change, supplier change, complaint, or accident report)

Sections 5–7 work best as a single table: hazard → who is harmed and how → probability → severity → risk level → mitigation → residual risk.

Where does the risk assessment sit in your technical documentation?

The risk assessment is one chapter of your technical file, not a standalone extra. A minimal GPSR technical file for a small seller looks like:

• General product description and essential safety characteristics (Art. 9(2), always required)
• Internal risk analysis (this document)
• List of applied European standards or other safety solutions
• Test reports and material/supplier certificates, where you have them
• Label and packaging artwork, warnings, instructions
• Traceability details: product identification (type/batch/serial per Art. 9(5)) and your — and where relevant, your Responsible Person's — contact details

Keep the file up to date and retain it for 10 years. Market surveillance authorities can request it, your EU Responsible Person must be able to confirm it exists, and marketplaces may ask for extracts when a listing is challenged. If a product turns out to be dangerous, you must notify authorities via the Safety Business Gateway and cooperate on corrective action.

What are the most common mistakes?

• Writing it after the sale — Article 9(2) says before placing on the market; a backdated file is worse than a late one
• Copy-pasting a generic template with no product-specific hazards — an assessment that could describe any product describes none
• Only assessing intended use — the GPSR expects you to consider foreseeable misuse (children, misassembly, aging materials)
• Warnings instead of fixes — using a label to excuse a removable design hazard
• No review process — changing a supplier or material without updating the assessment quietly invalidates it

Get your gap list first

Before writing your risk assessment, it helps to know everything your product needs under the GPSR — labeling, listing information, Responsible Person, and documentation. Paste your Etsy or Amazon product link into our free checker for a plain-English gap list in about a minute: Check your product free.

This guide is general information, not legal advice.