GPSR Technical Documentation and Internal Risk Analysis: What to Include and How Long to Keep It

What the regulation says: Article 9(2) and 9(3)

Before placing a product on the market, manufacturers “shall carry out an internal risk analysis and draw up technical documentation” containing at least a general description of the product and its essential characteristics relevant for assessing its safety (GPSR Article 9(2)). Where appropriate given the possible risks, the file must also contain, as applicable:

• (a) an analysis of the possible risks and the solutions adopted to eliminate or mitigate them, including the outcome of any test reports by the manufacturer or a party acting on its behalf; and
• (b) the list of relevant European standards applied under Article 7(1)(a), or the other elements used under Article 7(1)(b) (national requirements) or Article 8.

Where a standard or requirement has only been partly applied, you must identify which parts. Article 9(3) adds that the documentation must be kept up to date, kept at the disposal of market surveillance authorities for 10 years after the product is placed on the market, and provided on request.

Who is responsible?

• Manufacturer: draws it up and keeps it. Under Article 13(1), anyone who places a product on the market under their own name or trademark is treated as the manufacturer. If a factory makes the product and you sell it under your brand, the file is your responsibility, not just the factory's.
• Importer: checks before placing on the market that the manufacturer has drawn it up and keeps a copy for 10 years (Article 11(1) and (6)).
• EU Responsible Person: verifies the file exists and can be provided, and regularly checks the product against it (Article 16(2)).

Scope note: GPSR Article 2(1) disapplies Chapter III Section 1 (which includes Article 9) for products subject to Union harmonisation legislation. For toys, electrical and radio equipment and other CE products, the technical file follows the sector law instead. See GPSR vs CE marking.

Standards and test reports: Article 7 presumption and Article 8 elements

The strongest part of most files is “which standards we used and what the tests showed”. The GPSR gives different references different weight:

Two cautions. First, the presumption covers only the risks the standard addresses, and Article 7(3) lets authorities act anyway if there is evidence the product is dangerous; risks outside the standard still belong in your risk analysis. Second, for general consumer products without sector law, the GPSR does not make third-party testing mandatory, but Article 9(2)(a) requires you to record the outcome of tests you did. In practice, a report from a competent laboratory on the exact model you sell is the most direct evidence of safety.

When relying on a report, check that the product name, model and materials match what you sell, that the standard edition is current, and that the report still applies after any change of material or supplier.

A practical risk analysis for small sellers

The Commission's GPSR business guidelines (C/2025/6233) describe the internal risk analysis as a proper risk assessment. The file should record all identified risks, whatever their level, with detail proportionate to the product's complexity and risks. Six steps:

1. Describe the product and its users: intended use, foreseeable misuse, lifetime, and whether children, older people or persons with disabilities may use it (Article 6(1)(e)).
2. List hazards using Article 6: design and construction (pinching, collapse, sharp edges), composition (chemicals), packaging, instructions and warnings, effects of use with other products, food imitation, appeal to children, and cybersecurity for connected products.
3. Write injury scenarios: who gets hurt, how, and how badly.
4. Rate severity and probability. You can borrow the authorities' Safety Gate method: Annex II of Delegated Regulation (EU) 2024/3173 grades harm on four severity levels and multiplies the probability of each step in the scenario, continuing the approach of the earlier RAPEX guidelines (Implementing Decision (EU) 2019/417). It is an authority tool; for a seller it is a structured self-check, not a verdict.
5. Record controls: design changes, standards applied, test results, warnings and instructions.
6. Assess residual risk and sign off with date, version and owner; repeat when the product, materials or supplier change.

Illustration only, for a folding storage stool (the Commission guidelines name furniture as fully covered by the GPSR). This shows the format, not a complete assessment:

What goes in the file: the Commission's model template

The Commission's GPSR business guidelines (guidance that interprets the regulation, not the law itself) include a non-compulsory model template in three parts:

1. Product identification: brand, product name, model, batch or serial number or other identifier, product description, product picture, packaging description, packaging picture.
2. Characteristics and composition: characteristics, material, composition.
3. Risk analysis and risk mitigation measures: each potential risk described separately, with the measures taken to mitigate or eliminate it, or the presumption of conformity relied on (for example the EU standard used).

Beyond the template, keep these safety-related items in the same product folder so your representative and an authority can get everything at once:

• the standards list, with clauses identified where only partly applied;
• test reports, mapped to models;
• labels, packaging, instructions and warnings in each target language, plus photos showing the identification number and manufacturer details required by Article 9(5) and (6) (see GPSR label requirements);
• procedures that keep series production consistent, such as incoming and pre-shipment inspection (Article 9(4));
• supply chain records: who supplied you, and whom you supplied (Article 15(3));
• the register of complaints, recalls and corrective measures (Article 9(12)), and a copy of your representative's mandate.

The guidelines confirm the documentation may be electronic and may consist of several documents. They also say it is prepared per product model; units with different features that may affect safety (colour, composition, functions) are separate products needing their own documentation.

Retention periods at a glance

The 10-year clock runs from when each product is placed on the market, so for a model you keep selling the file must survive until 10 years after the last unit. The simplest rule: keep files for live models indefinitely and for at least 10 years after a model is discontinued.

Sample folder structure for fast retrieval

When an authority writes, your representative must answer within the authority's deadline or a reasonable period. Good organisation often matters as much as the documents themselves. Use one folder per model:

Practical tips:

• Language: the GPSR does not fix a language for the file, but documents must be supplied in a language the requesting authority understands (Article 10(2)(a)). An English master version is a sensible default; keep originals too.
• Naming and versions: include model, document type and date, e.g. ST-01_risk-analysis_v2_2026-10.pdf; archive old versions rather than overwriting.
• Sharing: give your representative a read-only cloud folder, or hand over at signing and agree an update routine.
• Triggers: update the risk analysis and summary when materials, factory or design change, or when you receive a safety complaint.

Once the file is ready, use the checklist in how to choose an EU Responsible Person to hand it over, or take the 3-step compliance check.