The EU General Product Safety Regulation (GPSR) — Regulation 2023/988 has applied across the EU since 13 December 2024. It replaces the 2001 General Product Safety Directive (GPSD) and introduces new obligations for traceability, accident notification, and recall management. Twenty months on, the pattern is clear: companies that prepared their ERP are coping. Those that didn’t are running recalls on spreadsheets and discovering that their paper-based traceability collapses under a market surveillance inspection.
This guide covers the concrete obligations introduced by GPSR, the four ERP modules you need to configure, and the real-world pitfalls observed since December 2024.
GPSR: What Changed Compared to the Old GPSD Directive
The 3 Major Changes Introduced by Regulation 2023/988
The 2001 GPSD operated on voluntary reporting: a company that discovered a dangerous product could notify the authorities — or consult its lawyers. The GPSR shifts to an obligation of results.
First change: notification is mandatory and centralised. The Safety Business Gateway is the EU’s single entry point for reporting accidents caused by products or dangerous products. This is no longer optional — it is Article 20 of the regulation. Any company that becomes aware of a death or serious health impact caused by one of its products must notify the competent authorities “without undue delay” through this portal.
Second change: online marketplaces are economic operators. Article 22 requires marketplaces to register on Safety Gate, withdraw any product subject to an authority order within two business days, and process dangerous product notifications from other operators within three business days. Amazon, eBay, Back Market: they have active monitoring obligations and can no longer fully deflect responsibility onto third-party sellers.
Third change: a product safety contact person for non-EU manufacturers. Article 16 requires that an operator established in the EU be designated as the “responsible person” for any product manufactured outside the EU. This person verifies that technical documentation exists, keeps it available for authorities, and takes on notification obligations. This role cannot be a letterbox entity — authorities can demand evidence of genuine involvement.
Who Is Covered: Manufacturers, Importers, Distributors, Marketplaces
GPSR applies across the entire supply chain for non-food consumer goods placed on the EU market:
- Manufacturers (Article 9): technical documentation, internal quality control, traceability, accident notification, recall management
- Importers (Article 11): verification of manufacturer obligations, 10-year document retention, inclusion of their contact details on the product
- Distributors (Article 12): due diligence, verification of required markings, refusal to distribute non-compliant products
- Online marketplace operators (Article 22): Safety Gate registration, listing monitoring, rapid removal of flagged products
Covered products include toys, electrical appliances, cosmetics, sports equipment, furniture, clothing and textiles — essentially the full range of consumer goods. Food products (covered by other regulations) and medicinal products are excluded.
Safety Gate and the Safety Business Gateway: New Notification Tools
Safety Gate is the EU’s rapid alert system for dangerous non-food products. Formerly known as RAPEX, it aggregates notifications from national authorities across 30 countries (EU + EEA).
The numbers speak for themselves: 4,137 alerts were recorded in 2024, up from 3,412 in 2023 (Safety Gate 2024 Report, European Commission, published July 2025). In 2025 — the first full year under GPSR — that figure reached 4,671 alerts, a 13% increase, with 5,794 follow-up actions — the highest level since the system was created in 2003 (Safety Gate 2025 Report, European Commission).
The Safety Business Gateway is the business-facing side of this system: the portal where economic operators submit their notifications. It recorded over 100 notifications in its first year of operation — a lower-than-expected volume that reflects significant under-reporting among operators. National authorities are aware of this, and enforcement intensity is being adjusted accordingly.
What GPSR Concretely Requires from Your ERP
Mandatory Product Traceability Throughout the Supply Chain
Article 9 of GPSR requires manufacturers to maintain product traceability that allows every unit from a potentially defective batch to be identified. This is not a vague obligation: in the event of a recall, the manufacturer must be able to precisely list the affected units, the distributors that received them, and end consumers where identifiable.
The practical rule: 10 years of upstream traceability (from raw material to factory gate), 6 years of downstream traceability (customer deliveries) for importers. These durations represent the reasonable minimum to meet document retention requirements and applicable limitation periods.
What this requires in your ERP:
- Batch management activated on all finished goods and critical components
- Documented link between production batch and incoming raw material batches (upstream traceability)
- Recording of delivery destinations by batch (downstream traceability to distributors)
- Data archiving for regulatory retention periods, with rapid access in the event of an inspection
Rapid Notification Obligation for Serious Accidents
Article 20 of GPSR introduces a notification obligation for product-related accidents. Any manufacturer or importer that becomes aware of an accident attributable to one of its products resulting in death or serious health impact must inform the competent authorities “without undue delay” via the Safety Business Gateway.
“Without undue delay” does not mean “once we have finished the legal analysis.” Authorities expect a notification as soon as the company has a serious cluster of indicators. The documentation of the initial alert — date the complaint was received, date of the notification — will be the first thing checked during an inspection.
For marketplaces, deadlines are explicit: two business days to remove a product subject to an authority order, three business days to process a dangerous product notification received from another operator.
Technical Safety Documentation (TSD) Accessible Online
Article 9 of GPSR requires manufacturers to maintain technical documentation including a general product description, essential safety characteristics, risk analysis, and the remedial measures taken. This documentation must be retained for 10 years and made available to authorities on request.
The change from the GPSD: the TSD must be accessible online for certain product categories, and consumers must be able to access essential safety information before purchase (Article 19 for online offers). The ERP must be able to export or link these documents to the product record — not just archive them in a network folder.
The 4 ERP Modules to Configure or Strengthen for GPSR
Product and Item Data Management: Safety Attributes, Declarations of Conformity
The item record in your ERP must become the GPSR compliance reference for each product. The minimum fields to configure:
- Unique model identifier (type, batch/serial number if applicable)
- GPSR regulatory category
- Manufacturer’s country of origin (determines whether an EU “responsible person” is required)
- Link to the Technical Safety Documentation (TSD)
- Declaration of Conformity (DoC) attached and version-controlled
- Manufacturer and EU responsible person contact details
Without these attributes in the system, the company cannot generate a list of compliant products for a portfolio review, or quickly identify affected products if a supplier recalls a component.
Batch and Serial Number Traceability: From Production to End Consumer
This is the functional core of GPSR for manufacturers and importers. If the ERP does not manage batches with bi-directional traceability, GPSR compliance will remain theoretical.
Bi-directional traceability means:
- Upstream: for a finished goods batch, identify all component and raw material batches used
- Downstream: for a finished goods batch, list all customers (distributors, wholesalers) that received it
The second point is often the weak link. Companies selling through multi-tier distributors have no visibility on the end consumer — which is acceptable — but must at minimum trace to the first distribution tier to enable a targeted recall.
Complaint and Quality Incident Management: Escalation Workflow and Root Cause Analysis
GPSR requires a register of complaints, accidents, and corrective measures. This register cannot be a shared spreadsheet — it is a structured workflow that must demonstrate that a complaint was received, processed, and that remedial actions were documented.
In the ERP, this means a non-conformance management (NCR) or quality management (QM) module capable of:
- Receiving and categorising product incidents by channel (direct customer, after-sales, marketplace, social media)
- Triggering a criticality assessment (serious accident = immediate escalation)
- Linking the incident to the affected batch/serial number
- Tracking corrective actions through to closure
Without this incident-to-batch link, the company cannot detect an emerging problem on a specific batch before it becomes critical.
Recall Management Module: Workflows, Distribution Lists, Customer Communication
Recall management remains the least mature module in mid-market ERP systems. Most solutions offer “returns management” — which is not the same thing. A recall requires:
- Scope identification: which batches, how many units, with which distributors
- Decision workflow: criteria for triggering a voluntary recall versus waiting for an authority order
- Regulatory notification: generating the Safety Business Gateway submission with the minimum required data
- Customer communication: notification templates by channel (email, post, press release)
- Return tracking: return rate by distributor, follow-up reminders, recall closure
This workflow must be tested before it is needed. Companies that discover their recall procedure during an actual recall lose critical hours that the supervisory authority reads as bad faith.
Safety Gate Notification: Connecting Your ERP to the European Portal
The Safety Business Gateway API: Who Can Access It and How
The European Commission published the official guidelines for the Safety Business Gateway in November 2025, including interoperability specifications (Guidelines for the Safety Business Gateway, OJ C 2025/6238). The portal accepts manual submissions via web interface and provides an API for high-volume operators.
For the vast majority of SME and mid-size manufacturers and importers, access is via the web portal. Direct ERP-to-Safety Business Gateway API integration is only relevant for operators generating dozens of notifications per year (large distributors, marketplaces).
The practical ERP-side connection: configure a notification data export (see minimum data below) that operators can prepare in the system and paste into the portal.
Minimum Data Required for a Valid Notification
An accident notification (Article 20) must include:
- Product identification (trade name, reference, batch/serial number if applicable)
- Accident type and description of health effects
- Date of the accident (or date the operator became aware of it)
- Country concerned
- Economic operator contact details
The ERP must be able to pre-populate these fields from the item record and incident file. A structured export (CSV or pre-filled form) reduces the risk of errors and documents the date the notification was prepared.
Real-World Pitfalls Observed After 20 Months of GPSR
Paper-Based Traceability That Fails Inspection
Market surveillance inspections have intensified across EU member states since early 2025, particularly in toys, cosmetics, and electrical equipment. The recurring scenario: the inspector requests traceability for a specific batch. The company knows it has the documentation — somewhere in its physical archives. The search takes two days. The inspector notes “inability to provide traceability within a reasonable timeframe.”
The field lesson: GPSR traceability must be queryable in minutes, not days. A batch number search in the ERP must return the complete thread (suppliers, production, customers) in under five minutes.
Importers That Have Not Updated Their Post-Brexit Obligations
A particularly exposed segment: EU companies importing products manufactured in the United Kingdom who have not updated their understanding since Brexit. A UK manufacturer is now a non-EU manufacturer for GPSR purposes. The obligation to designate a “responsible person” established in the EU (Article 16) applies in full.
Importers must appear on the product with their full contact details. Many still carry packaging with the UK manufacturer’s address and no EU mention — a GPSR non-conformity directly visible on the product.
Online Marketplaces: Who Is Actually Responsible
Article 22 has rebalanced liability for third-party sellers on major platforms. The marketplace must now actively monitor its sellers’ listings, verify the presence of mandatory traceability information (product identifier, EU responsible person), and remove non-compliant offers.
For mid-size companies selling via Amazon or eBay, this means that the compliance of their product listing on the marketplace is a GPSR compliance matter — and the marketplace can remove their offer without notice if it judges the information to be insufficient.
SMEs That Thought They Were Not Covered (But Were)
The last recurring pitfall: confusion between GPSR and sector-specific regulations. A manufacturer of industrial components selling only to professionals may assume it is not subject to “consumer product safety” rules. This is wrong: GPSR applies to any product “made available on the market” in the EU, including B2B, unless explicitly excluded (medicinal products, medical devices, food). The definition of “consumer” in the regulation is broad.
GPSR Compliance Checklist by Economic Operator Type
Manufacturer (8 points)
- Technical Safety Documentation (TSD) compiled and retained for 10 years
- Product risk analysis documented in the system
- Manufacturer contact details readable on the product or its packaging
- Batch number or serial number affixed to the product
- Safety Business Gateway account opened and tested
- Recall procedure documented, workflow defined, team designated
- Incident and complaint register maintained up to date
- Safety instructions available in the language of the target market
Importer (8 points)
- Verification of manufacturer obligations before placing on the market
- Importer contact details affixed to the product (in addition to manufacturer)
- Copy of TSD retained for 10 years
- Incoming product verification procedure (sampling or audit)
- Safety Business Gateway account operational
- Recall procedure adapted to the importer role
- Incident register maintained
- Verification that an EU responsible person is designated if manufacturer is non-EU
Distributor (8 points)
- Verification of required markings on received products
- Procedure for refusing to distribute non-compliant products
- Cooperation with manufacturers and importers in the event of a recall
- Retention of downstream traceability information (who received each batch)
- Customer communication procedure in the event of a recall
- Register of products withdrawn from the market or recalled
- Commercial team training on product safety warning signals
- Rapid access to supplier contact details for every product distributed
Which ERP Systems Natively Support GPSR Traceability
SAP S/4HANA with Product Compliance and EHS Modules
SAP offers two relevant modules: SAP S/4HANA for Product Compliance (substance management, REACH, RoHS, product compliance) and SAP EHS (Environment, Health & Safety) for incident management and safety. The Quality Management (QM) module provides batch-to-batch traceability and links to quality incidents. The convergence of these modules in S/4HANA can, in theory, cover all GPSR requirements — but this requires specific configuration that most standard implementations do not cover out of the box.
Oracle Fusion with the Quality Management Module
Oracle Fusion Cloud includes an integrated Quality Management module within the SCM suite. Batch traceability is native. Corrective and preventive action (CAPA) management and inspections are available. Integration with an external portal such as the Safety Business Gateway requires a development or middleware layer.
Odoo: Batch and Serial Number Traceability Options
Odoo enables batch or serial number traceability at the item category level (the “tracking” parameter). Upstream traceability (components to finished goods) and downstream traceability (finished goods to customers) are native in the Manufacturing and Inventory modules. Recall management requires a third-party module or custom development — Odoo Community core does not natively handle recall workflows with regulatory notification.
Mid-Market Solutions: IFS, Infor, Dynamics 365 SCM
IFS has invested in quality management and traceability features in its Quality Management module. Recall management is covered in recent versions of IFS Cloud. Infor M3 and Infor LN offer batch traceability features suited to manufacturing and distribution. Microsoft Dynamics 365 Supply Chain Management covers batch traceability through Inventory Management and non-conformance management through Quality Management — with no native Safety Business Gateway integration to date.
GPSR is not another compliance checkbox. It represents a doctrine shift: product safety becomes an obligation of results, verifiable by authorities, with notification deadlines that leave no room for deliberation. The 4,671 Safety Gate alerts in 2025 signal that authorities have the tools to detect dangerous products. The question is whether your ERP has the tools to let you respond in hours rather than weeks.
For further reading, see our guide on the EU Product Liability Directive (PLD) 2024/2853 and ERP obligations for manufacturers (product liability, complementary to GPSR) and our ERP and circular economy guide covering ESPR, PPWR, and WEEE (eco-design and end-of-life obligations). For after-sales and returns management, see our ERP warranty and after-sales service guide.
