EU Authorised Representative under GPSR: what €49 a year actually buys you, and what it doesn't.

What GPSR actually changed

Regulation (EU) 2023/988, the General Product Safety Regulation (GPSR), has applied across the European Union (EU) since 13 December 2024. It replaced Directive 2001/95/EC — the old General Product Safety Directive (GPSD) — with no transition period for newly placed products. Stock placed on the market before 13 December 2024 can be sold through under the old regime if it complied at the time. Anything first placed on the EU market on or after that date falls under GPSR.

The headline change for non-EU sellers is the responsible person requirement. The mechanics of it actually live in two regulations sitting on top of each other: Article 4 of Regulation (EU) 2019/1020 (the Market Surveillance Regulation) sets out the basic principle, and Article 16 of GPSR extends it to consumer products covered by GPSR. Together: every product placed on the EU market needs an economic operator established in the EU who is responsible for compliance.

There are four legal roles that can fill this slot — manufacturer (if EU-established), importer, authorised representative (AR), or fulfilment service provider. For non-EU sellers without an EU subsidiary, an AR is usually the only practical option. The contact details of whichever role is filling the responsible-person slot must appear on the product, on its packaging, on the parcel, or on an accompanying document such as a delivery note. Distance- selling listings on Amazon, eBay, and other marketplaces also have to display the same details under Article 19 of GPSR.

This is the part most sellers understand. The thousand-plus AR-as-a-service businesses that sprang up between mid-2024 and the end of 2025 do this part. They put their name and address on your label.

The rest of the regulation is what the rest of this article is about.

GPSR — the articles you actually have to know

The two-regulation stack matters. AR-as-a-service marketing copy frequently cites only Article 16. The substantive obligations also come from Regulation (EU) 2019/1020.

What an AR actually does

The duties of an authorised representative are defined by the written mandate the manufacturer gives them, but the floor is set by Article 4(3) of Regulation (EU) 2019/1020 and Article 16(3) GPSR. Reading those two together, the AR must, at minimum:

• Hold the technical file. This is the document that proves the product is safe — risk assessment, applicable harmonised standards, test reports, declaration of conformity. It must be available to a market surveillance authority (MSA) on request, in a language the authority can understand, for 10 years after the last unit is placed on the market.
• Verify documentation. Before signing the mandate and at appropriate intervals afterwards, the AR is supposed to verify that the manufacturer has actually drawn up the technical file. Most AR-as-a-service contracts at the lower price points do not actually do this verification — they accept whatever the manufacturer claims.
• Cooperate with market surveillance authorities. If an MSA writes asking for the file, sample units, or evidence of corrective action, the AR has to respond within the deadline set by the MSA — typically 10 working days, sometimes shorter for serious risks.
• Notify dangerous products. If the AR has reason to believe a product covered by their mandate is dangerous, they must notify the relevant MSA via the Safety Business Gateway without undue delay. They must also notify the manufacturer.
• Coordinate corrective action. If a product is recalled or withdrawn, the AR is the EU-resident party who manages the regulatory side of that — Safety Gate notifications, MSA correspondence, recall notice submissions.

What the AR does not do is take consumer-facing product liability. Liability for damage caused by a defective product is governed by the Product Liability Directive 85/374/EEC, now being modernised. Under that regime, the AR is not the producer and is not the importer — they are a regulatory contact and documentation holder. The economic exposure for consumer compensation sits with the manufacturer (if reachable) and the importer of record (if there is one). This is genuinely a comfort, but it is also the reason a €49-per- year AR can offer the price they do: their financial exposure is bounded.

The exposure that isn'tbounded is the operational exposure on the seller's side — the seller still has to actually do the work, the AR is just the contact point. Treating the AR as the compliance department is the single most common and most expensive mistake non-EU sellers make.

Recall management — the bit nobody buys upfront

The recall provisions of GPSR (Articles 35 to 37) are stricter than the old GPSD in three specific ways that matter operationally.

The notice content is now legislated, not guidance. Recall notices must contain the product identification, a description of the hazard, the action consumers should take, and the available remedies. Three terms are explicitly prohibited: “voluntary,” “precautionary,” and “discretionary.” Phrases that downplay the risk — “in rare situations,” “no reported accidents” — are also prohibited where they would mislead. The Commission has published a template for the recall notice in Implementing Regulation (EU) 2024/1435, with corrections issued in July 2024. The template is recommended but not mandatory.

The remedies are floored. Under Article 37 GPSR, an economic operator carrying out a recall must offer the consumer a choice between at least twoof the following: repair (if safety can be ensured), replacement with a product of at least the same value and quality, or adequate refund. The single-remedy-only recall — “send it back, we'll send you another one whether you wanted it or not” — is no longer compliant.

Direct consumer notification is required. If you can identify affected consumers — and if you sold the product through a marketplace, you usually can — you must notify them directly. Posting a notice on your website is not enough. Affected marketplaces must also notify their buyers and publish recall information on the listing.

When a recall happens, the AR is the operator the MSA contacts. The AR is the operator who files the Safety Gate notification through the Safety Business Gateway. The AR is the operator whose name appears in the official record. If the AR-as-a-service contract you signed last year does not include language about recall coordination, you do not have a recall plan. You have a name on a label.

The continuous monitoring duties most sellers miss

Here is the part that catches non-EU sellers six to eighteen months after they sign their first AR contract. GPSR imposes a continuous obligation on manufacturers — and by extension on the AR who holds the file and the seller who placed the product — to monitor product safety after the product is on the market. Specifically:

Complaint handling and the 5-year register. Article 9(2) GPSR requires manufacturers to investigate complaints and to keep a register of complaints, non-conforming products, and product recalls. The register must be kept for 5 yearsand must be made available to MSAs on request. “We don't get many complaints” is not a defence; what is required is documented evidence of an investigation process. This applies regardless of how many units the seller actually moves.

Accident reporting. Article 20 GPSR requires economic operators to notify the relevant MSA, via the Safety Business Gateway, of any accident caused by a product that resulted in serious risk or actual damage to a consumer's health or safety, without undue delay. The threshold for “serious risk or actual damage” is lower than most sellers realise. A consumer hospital visit, even briefly, generally meets the threshold.

Periodic risk re-assessment. Risk assessments are not one-shot documents. When new information emerges — a complaint pattern, an accident report, a Safety Gate alert about a similar product — the manufacturer must re-evaluate the risk and update the technical file. This is not optional, and it is not something an AR-as-a-service can do without input from the seller and the underlying factory.

Cooperation with the new post-market methodology. Commission Delegated Regulation (EU) 2024/3173 sets a new post-market risk assessment methodology that MSAs use when assessing notifications. The list of cases that can be deemed “serious risk” without a full national risk assessment has expanded. For sellers, this means: the bar for an MSA to act fast on your product is lower than it was under the old GPSD.

The effect of all this is that the AR is, properly, supposed to be in continuous correspondence with the seller. If the AR you bought sends you nothing between January and December other than a renewal invoice, you are not running a compliant operation.

The AR-as-a-service market — pricing, signals, red flags

The AR-as-a-service market in the year following 13 December 2024 grew from a few dozen specialist providers to upwards of a thousand. Pricing now spans roughly €49 per year for the cheapest “name on a label” packages to €5,000+ per year for full-service compliance management with file review and active recall coordination. The €49 tier exists because Amazon, eBay, and the major marketplaces accept any registered AR with a valid EU address — they do not, in practice, audit the substantive coverage of the AR mandate.

Signals that the AR is real:

• The AR asks to see your technical file before signing the mandate and reviews it.
• The AR can tell you which harmonised standards apply to your product without you naming them.
• The contract specifies response times for MSA inquiries and identifies the named individual who will handle them.
• The AR maintains, or asks you to maintain, a complaint register, and audits it.
• The AR is registered in the Safety Gate Business Gateway themselves and can submit notifications on your behalf.

Red flags:

• Mandate signed in 24 hours with no technical file review.
• Annual fee under €100 with “unlimited products” coverage.
• AR's address resolves to a virtual office shared with hundreds of other companies (registry searches will show this).
• Contract excludes recall coordination “as a separate service.”
• AR cannot tell you which member states they are registered to liaise with.

The economics of the cheap end of this market are simple: at €49 a year per seller, the AR cannot afford to actually read your file. They are pricing on the basis that almost no MSA inquiry will land — which is roughly accurate, the inquiry rate per seller per year is in the low single-digit percent — and accepting that when an inquiry does land, they will fail it and lose that customer. The customer, in those cases, loses considerably more than the AR does.

Where this overlaps with what you're already filing

This article and the DPP article on this site describe two different EU-resident responsible-person requirements. They are not the same requirement, but they are operationally adjacent. The Battery Passport will require an EU-resident operator who is responsible for the digital record. The Toy Safety Regulation 2025/279, applying from August 2030, requires both a GPSR-style responsible person and a DPP. For sellers with multi-category catalogues, the same AR firm can usually fill all of these roles — but the substance of each role is different and the AR contract has to specify which roles it covers.

For customs filings — see the HS classification article — the AR's address will appear as the EU-resident contact on the import documentation, regardless of who is the importer of record. Mismatches between the AR address on the product label, the AR address in the customs filing, and the AR address registered with the relevant MSA are a routine source of confusion and a routine reason for shipments to be held at the border.

How Bindu handles it

Bindu's compliance agent treats the AR mandate as a structured artifact: the regulations covered (GPSR, sector-specific where applicable, DPP), the products covered, the response times, the register-maintenance schedule, the renewal date. The agent generates the recall notice in the Implementing Regulation (EU) 2024/1435 template format when triggered, files the Safety Gate notification, and produces the MSA-response packet from the same shipment data that feeds the customs filing and the DPP record. The complaint register lives in the same product record. When the next regulation lands — and another one always lands — the existing data structure picks up the new fields and the next year's renewal is the same conversation, not a new one. If you want to see how it works on an actual catalogue, book a 30-minute demo.

Marcus Hollowayruns customs operations at Bindu. He spent twelve years as a licensed customs broker before deciding the spreadsheet was the bottleneck. He has now answered the question “is GPSR like CE marking” enough times to consider getting it printed on a t-shirt.