GPSR Certification Explained: What Online Sellers Actually Need

If you sell into the EU, you have probably seen the panic. Forums fill with the same question over and over: where do I get my GPSR certificate so I can upload it to Amazon? One seller put it plainly: "forgive me brother, I'm not sure I understood well; if the supplier gives me the gpsr certificate am I in order?"

Here is the short answer. There is no GPSR certificate. The EU does not issue one. No agency can hand you an official one. The European Union's General Product Safety Regulation, Regulation (EU) 2023/988, runs on self-declared conformity, not third-party certification. Once you understand that, the fear and most of the upsell pressure go away.

This guide explains what GPSR actually requires, where the certificate myth comes from, and what to hold instead. If you want the wider picture first, start with /blog/what-is-gpsr.

GPSR is self-declared, not certified

The foundation of GPSR is not a certification scheme. It is a framework of internal documentation and traceability that you build and keep.

Article 9 of Regulation (EU) 2023/988, which covers manufacturer obligations, says that before placing a product on the market, the manufacturer must "carry out an internal risk analysis and draw up technical documentation containing at least a general description of the product and its essential characteristics relevant for assessing its safety."

Read that again. The law does not tell you to submit anything to a government agency for approval. It does not require a Notified Body, a third-party testing lab, to stamp general consumer goods before they sell. It tells you to do the analysis and keep the documentation.

That is self-declaration. You (or the private-label brand owner) evaluate the product, compile the technical file, get the labeling right including your EU Responsible Person's details, and assert that the product is safe. If your product also falls under specific harmonised legislation such as toys or electronics, you draw up a Declaration of Conformity. Even that DoC is a self-declaration you sign, not a certificate the EU grants.

So when authorities check, they are not asking for a certificate number. They want to see your file. As one seller worried: "but what if the authorities ask me for the technical file that lists every aspect of production?" That file is the thing. You hold it and produce it on request.

Where the certificate myth comes from

If the law only asks for an internal risk analysis and a technical file, why are thousands of sellers hunting for a certificate? Three things feed the confusion.

Platform wording. Marketplaces use simplified language in their seller portals. When Amazon or Etsy prompts you to upload a "safety certificate" or "compliance document," it sounds like an official government license. In reality the platform wants your self-drafted technical file or DoC, plus your Responsible Person details. Amazon is checking that the responsible economic operator is clearly defined, not validating a license. One seller noticed the shift: "A lot of sellers assume a CE PDF from the supplier is enough (I did too at first), but Amazon is really checking whether the responsible economic operator is clearly defined."

Agency marketing. Compliance agencies monetise the confusion. They bundle risk assessment templates, label reviews, and EU Responsible Person representation and sell the package as "GPSR Certification Services." Sellers pay €400 to €500 believing they are buying an official EU certificate. What they actually buy is a consultant's time to format their self-declaration and, often, the rental of an EU address. The work can be legitimate. The label "certificate" is not.

Mixing up CE marking. Sellers conflate general GPSR duties with the CE mark. CE applies to specific categories like toys and electronics, and a few of those require lab testing. But the CE mark is itself a manufacturer's self-declaration. A PDF of a CE mark from a Chinese supplier is not a universal GPSR certificate. As one seller put it: "CE shows conformity, while GPSR is more about who is responsible for the product in the EU and whether the info is traceable if something goes wrong." For the full split, see GPSR vs CE marking.

Three beliefs that cost sellers money

Belief 1: the EU issues a formal GPSR certificate. It does not. There is no central database that mints a "GPSR Certificate." You prove compliance by holding a technical file you or your agency created and presenting it to market surveillance authorities if they ask. That is the whole mechanism.

Belief 2: a supplier's CE certificate makes you compliant. If you private-label, your supplier's CE document is not enough on its own. GPSR demands traceability to the brand owner. As the economic operator placing the product on the market, you draw up your own Declaration of Conformity and technical file listing your company and your EU Responsible Person. One private-label seller asked the right question: "As the brand owner placing the product on the market, would we be considered the 'manufacturer' in the sense of the EU regulations, and thus required to hold our own technical documentation and issue our own Declaration of Conformity?" The answer is usually yes.

Belief 3: you need a laboratory to get GPSR compliance. Unless your product falls under harmonised standards that legally require third-party testing by a Notified Body, such as certain medical devices or high-risk machinery, the risk assessment under Article 9 is an internal process. For benign items like basic apparel or printed posters, an internal review of the materials is enough. You can use a supplier's lab reports to support your file without re-testing, and without their brand name appearing on your final DoC.

What you actually need to hold

Strip away the marketing and the real checklist is short. For a general consumer product without specific harmonised legislation, you need:

• An internal risk analysis that identifies the physical and chemical hazards of the product and how you mitigate them.
• A technical file with a general description of the product, its essential safety characteristics, and the risk analysis.
• Correct labeling and traceability: manufacturer name and address, a model or batch identifier, and your EU Responsible Person's contact details on the product or packaging.
• A named EU Responsible Person established in the EU who holds your documentation and is the contact for authorities. EUProof generates the documents you need; it does not act as your Responsible Person, so you appoint that separately.
• If your product is covered by harmonised legislation (toys, electronics, PPE and similar), a Declaration of Conformity you sign, plus the relevant test reports.

Notice what is not on the list: an EU-issued certificate, a government approval number, or a Notified Body stamp for ordinary goods. You compile, you keep, you produce on request.

The private-label bridge

Private-label and dropshipping sellers hit the hardest version of this. You buy from a factory that has its own CE documents in its own name, and you need documentation in yours. You do not have to re-run the lab tests.

The approach is a self-declaration bridge. You use the factory's lab reports as supporting evidence and reference them in your own technical file and DoC, which carry your brand and your EU Responsible Person. The factory's test data backs your claims; your name sits on the legal documents. One seller described it as "a 3-step document alignment process that Customs expects for Private Label." Ask your factory whether it provides a proper technical construction file or only a basic certificate, because the file is what you build from. For platform-specific steps, see GPSR for dropshipping and GPSR for print on demand.

Stop paying for a word

There is a real education gap here. Small sellers see the phrase "internal risk analysis," get intimidated, and pay an agency €500 for a "GPSR Certificate." What they receive is a consultant formatting their self-declared technical file and renting them an EU address. Both can be worth paying for. Neither is a certificate, and you are not legally required to buy a package labelled as one.

You can produce the same documents yourself. The risk analysis follows a standard structure. The technical file follows a standard structure. The DoC follows a fixed template tied to the directives your product touches. EUProof generates these GPSR documents from your product details in minutes, so you hold a properly formatted self-declaration without the certificate markup. See how that works in generate GPSR documents in 5 minutes, or check the templates directly.

If you are not even sure GPSR applies to what you sell, run the am I affected check first. If it does apply, the path is clear: do the risk analysis, build the file, appoint your Responsible Person, label correctly, and keep everything ready. No certificate required, because none exists.

This article is general guidance, not legal advice. Confirm your obligations with a qualified advisor or your Responsible Person.