GPSR Risk Assessment: How to Do the Internal Risk Analysis (Steps, Risk Matrix, Example Worksheet)

The legal requirement: Article 9(2) internal risk analysis

Under GPSR Article 9(2), manufacturers must, before placing their products on the market, carry out an internal risk analysis and draw up technical documentation. Where relevant to the product's possible risks, that documentation includes an analysis of the risks and the solutions adopted to eliminate or mitigate them, including the outcome of any tests.

The Commission's GPSR business guidelines (C/2025/6233) add several points:

• the internal risk analysis means a proper risk assessment of the product, so that it is safe by design;
• the file should highlight all identified risks, irrespective of their level;
• the amount of detail should be proportionate to the product's complexity and risks: a cotton towel needs far less than a rechargeable hand warmer;
• manufacturers should take due account of the precautionary principle.

Who does it? Anyone placing a product on the market under their own name or trademark is the manufacturer (Article 13(1)). If a factory makes it and you brand it, the analysis is your obligation; you can use the factory's data, but you must review and sign the conclusions. Importers must check before placing a product on the market that the manufacturer has complied with Article 9(2) (Article 11(1)).

Scope: under Article 2(1)(b), Chapter III Section 1 (Articles 9–18) does not apply to products subject to Union harmonisation legislation. CE products follow their own rules: the Toy Safety Directive 2009/48/EC (Article 18) requires an analysis of chemical, physical, mechanical, electrical, flammability, hygiene and radioactivity hazards, and Annex III of the Low Voltage Directive 2014/35/EU requires the technical file to include “an adequate analysis and assessment of the risk(s)”. How the finished analysis fits into the whole file is covered in our GPSR technical documentation guide; this guide focuses on the analysis itself.

Article 6: the eight aspects you must consider

Article 6(1) lists the aspects that must “in particular” be taken into account when assessing whether a product is safe. Turned into questions, they form the backbone of your analysis:

Article 6(2) adds that the possibility of a higher safety level, or the availability of less risky products, is not in itself a reason to consider a product dangerous. The question is whether the product is safe, not whether it is the safest possible.

Articles 7 and 8: how standards help

Article 7(1) gives two presumptions of safety: (a) conformity with European standards whose references are published in the Official Journal, for the risks and risk categories they cover; or (b) where no such standard exists, conformity with the health and safety requirements of the member state of sale, if compatible with EU law. Implementing Decision (EU) 2026/901, published on 27 April 2026, lists the European standards currently supporting the GPSR, mostly for cots and childcare articles, cords on children's clothing, bicycles, fitness equipment, lighters and internal blinds.

What this means for your analysis:

• if a listed standard applies, the risks it covers can be recorded as “designed and tested to EN xxx, presumption of conformity”, with the report attached;
• risks the standard does not cover still need their own analysis, and Article 7(3) lets authorities act anyway if there is evidence the product is dangerous;
• most consumer products have no listed standard. You then consider the Article 8 elements: other European standards, international standards, voluntary certification, Commission recommendations or guidelines, state of the art, sector codes of practice and reasonable consumer expectations. These inform the assessment but create no presumption.

For what to test and how to read a report, see GPSR testing, European standards and presumption of conformity.

Borrowing the Safety Gate method: severity, probability, risk level

Annex II of Delegated Regulation (EU) 2024/3173 sets the criteria member states use to assess the level of risk for Safety Gate notifications, continuing the former RAPEX risk assessment guidelines (Implementing Decision (EU) 2019/417). It is written for authorities, but using it for your own check puts your analysis in the language they use. The core rules:

1. Harm scenario: one per hazard, with at least three steps: the product has a defect or can lead to a dangerous situation during its foreseeable lifetime; this leads to an accident or adverse effect; the accident causes harm. You may split it into more steps, up to five, showing the shortest path to harm. Start with the intended user using the product in a foreseeable way.
2. Severity on four levels (point 3.3.3, summarised):

3. Probability: give each step a probability and multiply them (e.g. 1/10 × 1/2 × 1/100 = 1/2,000).
4. Read the grid (point 3.6.2; S serious, H high, M medium, L low):

With several scenarios, rate each one and take the highest (point 3.7). Point 4.1 also lists cases presumed to be a serious risk without an individual assessment, including: the operator itself says the product poses a serious risk; the product has been voluntarily recalled or withdrawn; it contains a chemical banned by Union harmonisation legislation or above its limit; and well-documented cases such as small parts detaching from toys or childcare products for under-36-month-olds, highly flammable children's costumes or nightwear, childcare articles posing a drowning risk, drawstrings at the head, neck or upper chest of young children's garments, and electrical products with defective components that can cause shock or fire. If your product falls into one of these, no probability estimate will make it “low risk”.

Six steps to a finished risk analysis

1. Define the product and users: model, materials, intended use, foreseeable misuse, expected lifetime, countries of sale, target users and any vulnerable people likely to come into contact with it.
2. List hazards against the eight Article 6 aspects, then look up Safety Gate alerts for similar products to see what authorities typically find (see how to search Safety Gate alerts).
3. Write harm scenarios: one per hazard, saying who gets hurt, how and when.
4. Rate: severity, probability of each step, multiply, read the grid. Note the basis for each probability (test data, complaints, engineering judgement); without data, be conservative.
5. Control: eliminate hazards by design first, then add guards, and only then rely on warnings and instructions. Where you use a standard, give its number, edition and clauses and attach the report. Re-rate to find the residual risk.
6. Conclude and sign: whether the product can be placed on the market, date, version and owner. Re-assess when materials, factory or design change, or when complaints or accident reports come in (the Article 9(12) register).

If the analysis shows a product already sold is dangerous, Article 9(8) requires immediate corrective action, informing consumers and notifying authorities through the Safety Business Gateway; see accidents, recalls and Safety Gate.

Example worksheet: children's hooded sweatshirt (fictional)

The product, model and figures below are fictional. Probabilities are illustrative values to show the arithmetic, not statistics, and the table is not a complete assessment. Product: a children's cotton hoodie from a fictional brand, model HK-01, sizes 2–6 years, with decorative buttons and a metal zip.

How to read it: in row two, 1/2,000 falls in the “> 1/10,000” row and severity 4 gives S; after reinforcement, 1/200,000 falls in the “> 1/1,000,000” row and gives M, so further reduction is still needed. The last column should state the conclusion and the evidence reference, and the worksheet goes into the technical file with a signed cover page.