A Ukrainian maker can have a safe product, careful packaging, and an EU customer ready to buy—then lose the sale because the product page cannot answer four basic questions: who made it, who is responsible inside the EU, exactly which product is offered, and which warnings apply. Under the EU General Product Safety Regulation (GPSR), those details are part of the online offer, not paperwork to find after an order.
For an EU-targeted online offer, Article 19 requires four visible information groups: manufacturer contact details; the EU-based responsible person's contact details when the manufacturer is outside the Union; product identity; and applicable warnings or safety information in language consumers can understand. Treat these as structured catalog fields, not a paragraph pasted into every description.
This guide is an implementation playbook for ordinary non-food consumer goods. Product-specific EU law may add or replace requirements for toys, cosmetics, electrical products, machinery, medical devices, chemicals, food, and other categories. It is not legal or conformity-assessment advice.
Why product-page compliance matters in 2026
The GPSR has applied since 13 December 2024, but enforcement is becoming more visible. The European Commission's 2025 Safety Gate report, published in March 2026, recorded 4,671 alerts for dangerous non-food products and 5,794 follow-up actions. The Commission also reported that its eSurveillance crawler scanned more than 1.6 million websites in 2025 and found over 20,800 offers for products already notified in Safety Gate. A coordinated 2026 sweep is being prepared to check GPSR compliance online.
Those figures do not mean that every missing field is a dangerous product or that an enforcement action is inevitable. They do show the direction of travel: product safety is increasingly searchable, cross-border, and connected to the listing itself. A generic “contact us for safety information” footer is not a robust product record.
This also explains the business case. A clean safety-data layer can feed your own store, marketplaces, labels, support team, and recall process. The work is not merely defensive. It reduces listing rework and gives the team one answer when a marketplace, importer, or authority asks for evidence.
Check whether GPSR applies before editing the catalog
The official GPSR text covers products placed or made available on the EU market when no more specific EU safety law displaces its relevant provisions. An online offer is treated as made available in the Union when it targets EU consumers. Delivery destinations, currencies, languages, advertising, domain choices, and other evidence may all matter; simply running a site outside the EU is not an exemption.
Start with a scope register, one row per product family:
| Question | Record | Decision owner |
|---|---|---|
| Is it a consumer product offered into the EU? | Countries, channels, first EU availability date | Commercial lead |
| Does sector-specific law apply? | Product category, applicable acts, standards | Compliance specialist |
| Who is the manufacturer? | Legal name, trademark, postal and electronic address | Product owner |
| Is the manufacturer established in the EU? | Yes/no plus supporting entity record | Legal or operations |
| Which languages and markets are targeted? | Destination countries and approved warning versions | Market owner |
Do not turn “GPSR applies” into “GPSR is the only rule.” A CE mark is not a universal GPSR certificate, and GPSR does not create a general certificate that every seller can buy. Determine the product law first, then the evidence, operator, labelling, listing, traceability, and incident duties that follow.
Name the economic operators correctly
A common non-EU seller mistake is to buy an address and label it “EU representative” before mapping the supply chain. Article 16 requires an economic operator established in the Union to be responsible for specified tasks. Depending on the actual chain and applicable law, that can be the EU manufacturer, importer, authorised representative with a written mandate, or in defined circumstances a fulfilment service provider. These roles are not interchangeable marketing labels.
- Identify the manufacturer: the entity that makes the product or has it made and markets it under its name or trademark.
- Identify the importer: if an EU-established party places a third-country product on the Union market, record that real role.
- Review the mandate: an authorised representative needs a written mandate covering the relevant tasks; an address rental is not enough.
- Resolve each product family: one provider may not cover every category, factory, or marketplace account.
- Verify before publishing: confirm the legal name, postal address, electronic address, covered products, start date, and escalation contact.
The page should expose the responsible person's required contact details, but your internal record needs more: contract or mandate, scope, expiry or termination conditions, product families, documentation access, incident SLA, and a fallback owner. Never copy a service provider's details from another seller's listing.
Build the four-field product-page block
Article 19 is unusually practical. It specifies what an online or other distance-sale offer must clearly and visibly indicate. The best implementation is a reusable “Product safety and traceability” component near the product details—not hidden in terms, an image, a downloadable file, or checkout.
| Information group | What the shopper sees | Catalog source |
|---|---|---|
| Manufacturer | Name or registered trade name/trademark, postal address, electronic address | Verified organisation record |
| EU responsible person | Name, postal address, electronic address when manufacturer is outside the EU | Product-to-operator relationship |
| Product identity | Image, type, model/SKU/batch or another identifier that identifies the product | Product and variant master |
| Warnings and safety | Applicable warnings and safety information in easily understood market language | Approved, versioned safety content |
“Electronic address” should be a monitored contact route, normally an email address, not just a marketing homepage. Keep the postal address complete. Use product identifiers that connect the listing to the physical product and its documentation; an internal title like “Blue lamp” is not durable traceability.
Warnings deserve their own model. Store a warning ID, source requirement, product applicability, approved wording, locale, version, approver, and effective date. A translation should not silently change “not suitable under 36 months” into a vague recommendation. If a warning cannot be supplied confidently for a destination language, pause that market rather than improvising.
product_safety_record
product_family_id
manufacturer_id
responsible_person_id
product_identifier_type + value
warning_set_id
target_market + locale
evidence_status
approved_at + approved_by
next_review_atThis structure also prepares the catalog for future traceability work. Rendframe's Digital Product Passport readiness guide explains the broader identity and data-governance layer; GPSR listing fields are a narrower obligation and should not be confused with a DPP.
Connect the page to the evidence
A compliant-looking block is not proof that the product is safe. The Commission's GPSR business Q&A says covered products require technical documentation. At minimum, it includes a general description and the characteristics relevant to safety; where risks are identified, it also records the risk analysis, mitigation, and relevant standards or other methods. The documentation is kept for at least ten years.
Build a small evidence index instead of a folder named “certificates”:
- product and variant identifiers that match the store, packaging, invoice, and technical file;
- product description, intended use, reasonably foreseeable use, and user groups;
- risk analysis and adopted controls;
- applicable legislation, standards, test reports, declarations, supplier records, and label artwork;
- approved warnings and instructions by language;
- manufacturer and responsible-person records;
- complaints, incidents, corrective actions, and review history.
Show customers what the law requires, but do not publish confidential test files or personal data by default. The storefront should point internally to the evidence record through a stable product ID. Access rights and retention belong in the back office.
Publish consistently across your store and marketplaces
Own-store implementation and marketplace compliance are two renderers of the same verified record. Etsy, for example, added manufacturer, economic-operator, and product-safety fields for listings, and its official GPSR seller FAQ warns that sellers remain responsible for their obligations. Marketplace fields do not repair missing evidence, and a complete Shopify or WooCommerce page does not automatically update Etsy, Amazon, or eBay.
Choose one source of truth and map each destination:
- Store verified organisations, warnings, and product identifiers in the PIM, ERP, or a controlled catalog table.
- Render a visible product-safety block on every EU-targeted product page, including variant-specific differences.
- Map the same fields to each marketplace's native compliance attributes; do not bury them only in the description.
- Block publication when a required market-language warning, operator, or product identifier is missing.
- Run a daily exception report for channel rejection, stale operator data, untranslated warnings, and orphaned SKUs.
Check the rendered result as a shopper in each target country. Product information must remain usable on mobile, with images disabled, and through variant changes. This is also an accessibility issue: safety content should be real text with meaningful headings and labels. The Rendframe ecommerce accessibility checklist covers the wider storefront audit.
Design the correction and recall loop
Product safety does not end at publication. Give support a structured way to record a complaint or accident against the exact product, batch, order, market, and date. Define who decides whether to stop sales, notify the responsible person, investigate, correct the listing, contact customers, or report through the Safety Business Gateway.
Report → identify product and batch → assess risk → pause affected offers → notify the right operator → correct or recall → preserve the decision trail.
The critical technical control is a global stop-sale switch that reaches every channel. Removing one product page while a marketplace feed republishes it is not a stop. Keep order-to-product traceability good enough to identify affected customers without exporting the entire customer database to every operator.
Run a 14-day implementation sprint
Pilot on one representative product family, not the easiest SKU. Include a variant, a real warning, a non-EU manufacturer, and at least two sales channels. The release gate is simple: no EU offer goes live unless its operator, identifier, applicable warning, locale, and evidence status are complete.
Track five operational measures: eligible SKUs with complete records; live pages matching the source record; marketplace field acceptance; time to correct every affected channel; and unresolved safety reports. Do not use “number of certificates uploaded” as the headline metric.
Frequently asked questions
What must an ecommerce product page show under GPSR?
For products within scope and offered through distance sales, Article 19 requires clear and visible manufacturer contact details, EU responsible-person details when the manufacturer is outside the Union, product identification information, and applicable warnings or safety information in language consumers can easily understand.
Does every non-EU seller need to hire an EU authorised representative?
A covered product needs an economic operator established in the EU responsible for specified tasks. The correct operator may be an EU manufacturer, importer, authorised representative, or in defined circumstances a fulfilment service provider. Map the real supply chain and product law before appointing a service.
Is a CE mark enough for GPSR?
No. CE marking applies only where specific harmonisation legislation requires it, and it does not replace GPSR duties that also apply. Equally, GPSR does not create a universal “GPSR certificate.” Determine the rules for the particular product.
Can safety information be placed only in a PDF or product image?
Article 19 says the online offer must clearly and visibly indicate the required information. A collapsed, inaccessible, or undiscoverable file is risky. Render key data as accessible page text and use supporting files only where appropriate.
Do GPSR warnings need translation?
Warnings and safety information must be in a language consumers can easily understand, as determined by the Member State where the product is made available. Maintain approved versions by target market rather than relying on automatic storefront translation.
What should a small seller do first?
Choose one product family and one EU market. Confirm the applicable product law, manufacturer, EU economic operator, product identifier, warnings, and evidence. Then publish the structured block on the store and every active marketplace before expanding.
Make the safety record part of the product system
The durable solution is not a compliance paragraph. It is a verified relationship between a physical product, its evidence, the responsible organisations, the market-language warning, and every place the item is offered. When one fact changes, every channel should change with it.
If your catalog lives across spreadsheets, Shopify or WooCommerce, Etsy, and an ERP, Rendframe can map the product-safety data model, build the storefront component and validation rules, and connect channel publication to one controlled record. Bring one product family and its current listings for a focused GPSR implementation audit.