EU Product Recall and Withdrawal Procedures: GPSR Notices and Remedies

Under the EU’s General Product Safety Regulation (Regulation 2023/988), a business that discovers a dangerous consumer product must either withdraw it from the supply chain or recall it from consumers, depending on where the affected units are. Both routes require a documented risk assessment, a notification to national authorities through the Safety Business Gateway without undue delay, and, for recalls, direct communication with consumers and a cost-free remedy. The regulation has applied since 13 December 2024 and binds manufacturers, importers, distributors, and online marketplaces.¹

Recall or Withdrawal: Which Action You Are Taking

The first question is not how to act but which action the situation calls for. The GPSR treats these as distinct procedures.

A withdrawal is any measure that prevents a product still in the supply chain from reaching consumers: pulling stock from warehouses, halting shipments, or telling distributors to stop selling. A recall is any measure aimed at getting a product back from consumers who already own it.

The distinction sets the procedure. A withdrawal can often be handled through supply-chain communications. A recall pulls in public notices, consumer remedies, and ongoing reporting to authorities on the recovery rate. Treating what should be a recall as a quiet withdrawal is where market surveillance authorities tend to step in aggressively.

When Corrective Action Is Legally Required

The GPSR does not wait for an injury. If a product could cause harm under normal or reasonably foreseeable use, it fails the general safety requirement and triggers the obligation to act.

The manufacturer assesses risk by looking at the product’s composition, packaging, labelling, instructions, and the categories of consumers who are likely to use it, with heightened attention to vulnerable groups such as children and the elderly. That assessment determines severity, and severity determines urgency. A serious risk triggers the fastest obligations: the operator must act immediately, and the notification is flagged for rapid alert across the EU through the Safety Gate system.² A lower-tier risk still requires corrective measures, but the cross-border escalation is less intense.

One boundary worth flagging: the GPSR does not apply to food, animal feed, medicinal products, living plants and animals, animal by-products, plant protection products, equipment operated directly by a transport service provider, aircraft, or antiques. Everything else sold to EU consumers is in scope, and where sector-specific rules exist, the GPSR fills any gaps they leave open.³

Building the Risk and Product Dossier

Before notifying anyone, you need an evidence file. Companies that build this under time pressure tend to make errors that resurface as compliance problems, so internal templates should exist before a safety issue ever surfaces.

The dossier needs:

Precise product identification: brand, model, and the specific batch or serial numbers affected.
High-resolution photographs of the product from multiple angles, its packaging, and any warning labels.
A description of the hazard in plain language, covering the technical defect and the realistic consequences for a consumer.
The risk assessment itself, documenting the methodology used to weigh severity and probability of harm. This is what determines whether the issue qualifies as a serious risk.
Distribution figures: units sold, member states affected, and channels used.

Accuracy on distribution matters. Underreporting geographic spread or unit counts becomes a compliance issue when authorities compare the notification against customs and sales records.

Notifying Authorities Through the Safety Business Gateway

The Safety Business Gateway is the centralised digital portal for submitting safety notifications to national market surveillance authorities. The GPSR requires submission “without undue delay.” The moment you confirm that a product presents a risk, the clock is running.⁴

Through the portal, you upload the risk assessment, product identification, and distribution data in a structured format that routes the notification to the relevant national authority. The system returns an automated confirmation of receipt. Keep it: it is your legal record that the notification obligation was met. Authorities may follow up with requests for more information, and delays in responding to those requests are themselves treated as a compliance failure.

Information submitted through the gateway feeds into the Safety Gate public portal (formerly RAPEX), which makes it visible to consumers and authorities across the EU and participating countries.⁵ Serious-risk notifications are distributed rapidly so that a product pulled from shelves in one country does not remain available in another.

Writing the Public Recall Notice

Where a recall is initiated, the operator must communicate directly with affected consumers. If sales records, loyalty programmes, or product registration data can identify purchasers, those consumers must be contacted individually. Where not all buyers can be reached that way, the GPSR requires a clear and visible public notice disseminated through the widest possible range of channels: the company’s website, social media, newsletters, retail outlets, and mass media where appropriate.²

Language is tightly regulated. The GPSR prohibits phrasing that could soften a consumer’s perception of risk. The following terms are banned from recall notices:

“voluntary”
“precautionary”
“discretionary”
“in rare situations”
“in specific situations”

Statements that no accidents have been reported are also prohibited.⁶ Companies have historically used these phrases to reassure consumers into inaction, which defeats the purpose of a recall. The notice must describe the hazard plainly and tell the consumer exactly what to do. It must also be accessible to persons with disabilities.

What You Must Offer Consumers

When a product is recalled, the responsible operator must provide an effective, cost-free, and timely remedy. The GPSR is specific about what that means.

The operator has to offer the consumer a choice between at least two of the following three options:²

Repair of the recalled product.
Replacement with a safe product of the same type and at least equal value and quality.
Refund of at least the price the consumer originally paid.

Only one remedy may be offered where the alternatives would be impossible or disproportionately costly compared to the proposed option, and only where the single remedy does not cause significant inconvenience. Whichever option is chosen, the consumer is always entitled to a refund if a repair or replacement is not completed within a reasonable time. Consumer-performed repairs are allowed only where they can be done easily and safely, and the operator has to supply any necessary parts, instructions, or software updates at no charge.

The consumer never bears the cost of returning the product. For items that are not easily portable, the operator arranges collection. These remedy obligations sit alongside, and do not replace, existing consumer rights under EU consumer sales law, including guarantees under Directives 2019/770 and 2019/771.

If You Sell Through an Online Marketplace

The GPSR pulls online marketplaces into the compliance chain. When a national authority issues an order about a dangerous product, the marketplace has to act within two working days, whether that means removing the listing, disabling access to it, or displaying an explicit warning. It then has to confirm what it did, using contact details published on the Safety Gate Portal.²

The platform may also be required to remove all identical content referring to the dangerous product across its interface, provided the search can be done proportionately using automated tools. In a recall, the marketplace must directly notify every consumer who bought the product through its platform and publish the recall information on its interface. Cooperation with authorities and with the relevant economic operators is mandatory throughout.

Ongoing Reporting, Records, and Penalties

Submitting a notification and publishing a notice does not close the file. National authorities require periodic updates on the corrective action’s progress, including units recovered and the percentage of affected products accounted for. If a recall is not achieving adequate results, authorities can order additional measures, expand its scope, or take enforcement action directly.

Keep thorough records throughout: notification timestamps, consumer communications, units recovered, remedies provided, and correspondence with authorities. These are your evidence of compliance if the adequacy of the response is later questioned.

Penalties are set nationally. The GPSR requires each member state to adopt penalties that are effective, proportionate, and dissuasive, so specific fines vary by country.² Some member states have set fixed monetary caps reported in the range of tens of thousands to hundreds of thousands of euros; others tie penalties to company revenue. Beyond fines, authorities can order an EU-wide sales ban through the Safety Gate system, and repeated or flagrant violations can bring enhanced scrutiny of a company’s entire product range rather than just the item that triggered the initial problem.

1
European Commission. EU General Product Safety Regulation (GPSR): A New Era of Consumer Protection
2
EUR-Lex. Regulation (EU) 2023/988 on General Product Safety
3
EU-OSHA. Regulation 2023/988/EU – General Product Safety
4
Federal Institute for Occupational Safety and Health. Reporting Recalls Correctly
5
Federal Institute for Occupational Safety and Health. Safety Gate – EU Rapid Alert System
6
European Commission. Questions and Answers on Implementing and Delegated Regulations Under the GPSR