EU Sellers, Compliance Teams: Fix GPSR vs GPSD Listing Gaps in 90 Days

GPSR replaced GPSD outright on December 13, 2024, and it did not just update definitions. It converted product safety from a directive that each EU country translated into local law into a regulation that applies directly, the same way, everywhere. The practical fallout: online listings, marketplaces, and cross-border sellers now need a named EU Responsible Person plus real traceability data. If you sell into the EU and haven't audited your listings against this yet, that's the one task to move to the top of the queue this week.

TL;DR:

• Listings must now include a clearly visible Responsible Person with an EU address on product packaging and online pages to avoid automatic delisting or customs holds.
• Businesses need documented, retrievable traceability records, such as batch and serial data, retained for 10 years to facilitate targeted recalls and comply with supply chain transparency requirements.
• Marketplaces and platforms are enforcing stricter safety and traceability checks before listings go live, with response times within 2 to 3 days for safety notices.
• Conducting a comprehensive 90-day readiness plan involves auditing listings, assigning Responsible Persons, automating safety monitoring, and practicing recall drills to ensure ongoing compliance.
• Using structured digital product passports that automatically populate required fields can streamline compliance, improve traceability, and reduce operational burdens across multiple sales channels.

• GPSR vs GPSD: The Key Differences at a Glance
• What Actually Changed: Responsible Person, Listings, and Recalls
• What This Means for Your Business and Your Channels
• How to Prepare: A 90-Day GPSR Readiness Plan
• Where Digital Product Passports Fit Into GPSR Readiness
• The Gap Between Regulatory Text and Operational Reality
• A Practical Way to Keep Listings and Records GPSR-Ready
• Primary Sources Worth Bookmarking
• Sources
• FAQ

The legal form is the whole story here. GPSD was a directive, meaning each of the 27 member states wrote its own version into national law, with gaps, delays, and inconsistent enforcement depending on where a product landed. GPSR is a regulation, directly applicable across the EU the moment it took effect, with no translation lag and no room for a country to soften a requirement.

The scope shift matters just as much as the legal mechanics:

• GPSD was written before e-commerce dominated retail and largely ignored online marketplaces and non-EU sellers shipping directly to EU consumers.
• GPSR explicitly covers online sales, third-party marketplaces, and sellers based outside the EU who reach EU customers.
• New obligations under GPSR that GPSD never required: a designated Responsible Person, specific listing data fields, formal traceability documentation, and fixed marketplace response timelines.

That last point is where most compliance gaps actually surface, because listing pages were never built with a legal contact requirement in mind.

Break the regulation into five operational pieces, because that's how enforcement teams and marketplaces are treating it.

1. Responsible Person. Every product needs a named entity with an EU address, visible on the product, its packaging, and its online listing. This is the single most common compliance failure teams find during an audit.
2. Listing data. Product images, a clear identifier, safety and warning information, and Responsible Person contact details must all appear on the listing itself, not buried in a linked PDF.
3. Marketplace obligations. Platforms now run "compliance by design" checks, and Baker McKenzie's analysis notes marketplaces must verify minimum safety and traceability data before a listing goes live, then respond to safety notices within 2 to 3 working days.
4. Traceability. Sellers need documented risk analysis, technical documentation, and batch or serial identifiers, retained for 10 years under the regulation's text.
5. Recall readiness. Consumers need a clear, working channel to report a defect and receive a remedy, and authorities expect a business to act on that channel fast.

Pro Tip: Check whether your current listings show a Responsible Person's postal address and email, not just a general "contact us" link. Marketplace field checks increasingly flag anything short of that as incomplete.

The traceability requirement deserves its own attention because it's the one most businesses underestimate. GPSD asked for general safety diligence. GPSR asks for a documented, retrievable paper trail tied to a specific batch, so if a defect surfaces, you can trace exactly which units are affected without recalling your entire catalog.

The enforcement mechanics have teeth now. A missing Responsible Person address or an incomplete safety field can trigger automatic delisting, a customs hold at the border, or, in repeated cases, loss of a marketplace account entirely. None of that requires a human regulator to manually flag your listing first.

Most enforcement actions trace back to a small set of recurring failures:

• Listings copied from a pre-2024 template that never included RP contact fields.
• Fulfillment partners who assumed "someone else" was handling EU compliance.
• Supplier documentation that exists somewhere in an email thread but isn't retrievable on demand.
• No process for updating listing data when a product's manufacturing location or supplier changes.

Ownership needs to be explicit, not assumed. Product data accuracy usually sits with operations or product management. Responsible Person designation and contract terms belong with legal. Ongoing Safety Gate monitoring and listing audits work best as a shared operations and compliance function, checked on a recurring schedule rather than once a year.

Pro Tip: If you sell through a fulfillment partner or third-party marketplace, get their GPSR responsibilities in writing. "Compliant by default" is rarely true, and the liability defaults back to you if it isn't documented.

Channel matters too. Marketplaces enforce field-level checks automatically. Direct-to-consumer sites give you more control but also full responsibility for getting every field right yourself.

Work through this in order. Each step depends on the one before it.

1. Audit every listing and packaging item now. Log every gap, missing RP contact, absent safety text, unclear identifiers, in a single tracked sheet.
2. Assign or contract a Responsible Person. Publish their EU address and contact details on every listing and every product package before you fix anything else.
3. Build or upgrade traceability records. Get technical documentation and batch or serial data into a system you can retrieve on demand, not scattered across supplier emails.
4. Automate Safety Gate and listing monitoring. Manual spot checks don't scale once you're managing more than a handful of SKUs across multiple marketplaces.
5. Run a recall drill. Test whether your business can identify affected units, contact the Responsible Person, and issue a consumer notice within days, not weeks. Update supplier contracts to require prompt safety reporting.

Taylor Wessing's guidance on the updated product safety regime recommends this audit-first sequence specifically because retrofitting traceability after an enforcement action is far more expensive than building it now.

A product passport is essentially a structured record built for exactly the fields GPSR asks for: manufacturer details, Responsible Person contact, product identifiers, and the safety evidence behind them. Done well, it becomes the single source that populates your marketplace listing fields and gives a market surveillance authority or a recall team a stable, retrievable record instead of a scavenger hunt through supplier emails.

DDP Grid's workflow reflects that structure: import products from Shopify, CSV, or API, collect supplier evidence, use AI-assisted extraction with a human reviewer approving every field before it's published, then generate a passport page with a QR code and machine-readable record. It's infrastructure, not a legal opinion. Correct compliance still depends on your processes and, where it matters, actual legal advice.

Most GPSR failures I've seen described in compliance write-ups don't come from ignorance of the rule. They come from treating it as a one-time fix instead of a system. A business patches its listings once, ticks a box, and moves on, then a supplier changes six months later and nobody updates the record. That's where the automated suppression teams describe catches you.

Three numbers are worth tracking if you want to know whether you're actually ready rather than assuming it: your listing audit pass rate, your average Safety Gate response time, and whether your last recall drill actually produced a traceable batch list inside a day. If you can't measure those three, you don't have a compliance program. You have a policy document.

— Vytautas

Manually chasing supplier documents, updating listing fields across marketplaces, and keeping a decade of technical records retrievable is a real operational burden, especially once your catalog spans hundreds of SKUs across multiple channels. DDP Grid centralizes that work: import your product catalog from Shopify, CSV, or API, collect supplier evidence in one place, and let AI-assisted extraction pull structured data for a human reviewer to approve before anything goes public.

Once approved, each product gets a permanent passport page and QR code that can carry manufacturer details, Responsible Person contact, batch identifiers, and safety evidence, the same fields marketplaces and surveillance authorities are checking for. That record stays retrievable years later if a recall or an audit ever requires it. DDP Grid doesn't provide legal certification and doesn't make a product compliant on its own; it's readiness infrastructure that keeps your evidence organized and your listings consistent. If your team is still tracking supplier documents across spreadsheets and email threads, take a look at the Digital Product Passport for fashion brands guide and start a trial to see how your own catalog maps to it.

The regulation's full text lives on EUR-Lex, the definitive legal wording behind every obligation discussed here. The Safety Gate portal is where dangerous-product alerts get published and tracked. The Safety Business Gateway is where businesses file the notifications GPSR requires. Bookmark all three before you need them in an emergency.

• EU's General Product Safety Regulation (GPSR): A New Era of Consumer Protection
• Regulation (EU) 2023/988 (GPSR) — EUR-Lex
• Baker McKenzie commentary on GPSR marketplace and e-commerce obligations

GPSR covers virtually all consumer products sold in the EU that aren't already regulated by product-specific safety legislation (like toys or medical devices), including products sold online by non-EU sellers and through marketplaces.

Small businesses face the same Responsible Person, listing data, and traceability obligations as larger sellers, with no exemption based on company size, so a solo Shopify merchant selling into the EU has the same listing requirements as a large retailer.

No. GPSR fully repealed and replaced GPSD as of December 13, 2024, and it applies directly across every member state without further national legislation.

Technical documentation and traceability records must be retained for 10 years under the regulation's text, tied to batch or serial identifiers where applicable.

Marketplaces increasingly run automated field checks and can suppress or delist a product missing RP contact information, and customs authorities can flag shipments for the same reason before they ever reach a warehouse.

• GPSR Safety Information for Manufacturers and Sellers
• Map GPSR to Shopify Product Safety: Metafields and Audit