GPSR and Digital Products: What Actually Applies

If you sell ebooks, printables, or an app, you have probably read two flatly contradictory things about GPSR. One source says digital products are out of scope. Another says software is squarely covered. Both are quoting real guidance. The confusion is real, and it comes down to which kind of "digital" you actually sell.

This article splits digital products into three buckets: pure digital files, standalone software, and hybrid products. The rules treat each one differently, and where you land decides whether you need to do anything at all. For the full picture of what the regulation covers, start with the pillar: what is GPSR.

The short version

• Pure digital files (ebooks, PDF patterns, MP3s): generally out of scope.
• Standalone software (apps, games, chatbots): contested. The Commission says it is in. The regulation's text does not say so outright.
• Hybrid products (a doll with an app, a smart thermostat): in scope, on the physical side at minimum, and the digital part has to be assessed too.

If you only sell the first kind, you can likely stop reading after the next section. If you touch the second or third, keep going.

Pure digital files: ebooks, patterns, music

A product under GPSR is something a consumer can be harmed by. An ebook does not have a button battery, a sharp edge, or a flammable seam. So the people who run digital storefronts have been clear about this.

Ingram IQ, a publishing platform blog, put it plainly: "Does the GPSR apply to ebooks? No, it only applies to physical products." A PDF sewing pattern follows the same logic. It is a file, not a garment. You are not placing a physical product on the EU market, so the labeling, traceability, and Responsible Person duties do not attach.

The catch is the word "pure." The moment a physical version enters the picture, GPSR applies to that version. Sell a downloadable pattern and you are fine. Print it, bind it, and ship it, and now you have a physical book in the post, which is a product. Same for a digital album versus a pressed vinyl record. The file is out; the object you mail is in. If you sell printables on Etsy, the Etsy GPSR guide covers where the platform draws that line.

So if your shop is download-only, you are most likely outside GPSR entirely. Keep your listings honest about what the buyer receives, and you are done.

Standalone software: the contested middle

This is where it gets messy, and where you should not take comfort too quickly.

The regulation's definition of "product" does not mention software. Lawyers noticed. Cooley's read is that software clearly counts when it is "a component of a tangible device (i.e., embedded), which can impact the safety performance of that device." That is the uncontroversial part. Embedded software has always been pulled in through the device it runs.

The fight is over software that stands alone, with no device attached. Here the European Commission took a position that surprised a lot of people. In its November 2024 Q&A, it stated that GPSR "applies to all types of products (physical or digital products too, including software) that are placed or made available on the EU Single Market, as long as there are no specific provisions with the same objective under Union law." The Commission's 2025 guidelines went further, saying the product definition is "wide enough to cover 'any item', whether tangible or non-tangible or of a mixed nature," and that it "includes apps and software products, including for example chatbots."

That is the Commission's strongest signal yet that standalone software is in scope, even though, as Lexology noted, "this is not expressly stated in the relevant laws." Read those two facts together and you get the honest summary: the text is silent, the regulator says yes, and the question has not been settled by a court.

A few specifics follow from the Commission's reading, if it holds:

• Free does not mean exempt. "Free products (e.g., free apps) are still 'products' under GPSR." Price is not the test.
• Safety includes mental health. GPSR explicitly references mental health risks. That matters most for apps and games aimed at children, where design choices can be treated as safety choices.
• B2B-only is a genuine exit. Software made exclusively for professional use, "not reasonably likely to be used by consumers," is out of scope. If your tool is genuinely B2B and consumers cannot realistically pick it up, that is your cleanest argument.

What should a small software developer actually do right now? Most are not facing enforcement on standalone apps today. But the Commission has told you where it stands, so the sensible move is to monitor the guidance rather than assume you are clear, and to keep your B2B-versus-consumer story straight. If consumers can use your app, the Commission's position points at the same duties a physical seller faces: a Responsible Person in the EU, a documented risk assessment, and a way for users to report safety problems.

Hybrid products: the part most sellers miss

A hybrid product is a physical item with a digital component. A doll that pairs with an app. A smart thermostat. A fitness band that syncs to your phone. These are not edge cases anymore. They are ordinary consumer goods.

For hybrids the answer is not contested. The physical product follows GPSR like any other physical product. You owe the warnings, the traceability information, the technical documentation, and a Responsible Person established in the EU. None of that goes away because there is an app involved.

What sellers miss is the second half: the digital component's safety has to be assessed too. The Commission's own framing covers items "of a mixed nature." A connected doll is not just a doll. If the app can expose a child to harmful content, or the connection can be misused, that is part of the product's safety profile and belongs in your risk assessment. You cannot file the app under "not my problem" and only think about the plastic.

The practical test: if a consumer's safety depends in any way on the software behaving correctly, the software is in scope through the device. Embedded firmware in a smart appliance is the clearest case, but a companion app that controls the physical product behaves the same way for assessment purposes.

How specific EU laws change the answer

One more rule cuts across all three buckets. GPSR is the safety net, not the first line. As the Finnish authority Tukes puts it, the regulation "is only complementarily applicable to consumer products whose safety is covered by specific legislation. It only applies to the aspects, risks and risk categories that are not covered by the specific legislation."

So if your product already falls under a dedicated EU law, that law leads, and GPSR fills the gaps it leaves. A connected medical device is governed first by medical device rules. GPSR then covers only the safety angles those rules do not reach. This is why two similar-looking gadgets can have very different obligations. The question is never only "is it digital." It is "which specific EU law already applies, and what does it leave uncovered." For the relationship between GPSR and conformity marking, see GPSR vs CE marking.

Where this leaves you

Match your product to a bucket and act on it.

• Download-only files: most likely outside GPSR. Keep selling, keep listings honest.
• Standalone consumer software: contested but trending toward in scope. Watch the guidance, hold your B2B line if you have one, and be ready to act if enforcement reaches apps.
• Hybrid products: in scope on the physical side, with the digital part folded into your risk assessment.

If you sell a physical product, with or without an app attached, the document side is the part you can settle now. EUProof generates the GPSR paperwork the physical item needs: warnings, traceability, the technical file, and, where required, a declaration of conformity. A formal Declaration of Conformity is only mandatory for products covered by specific EU harmonisation legislation, such as CE-marked toys or electronics. For GPSR-only goods it is a self-declaration that marketplaces often request, not a statutory requirement. See the compliance checklist for the full list, or check am I affected to confirm which bucket your product lands in before you spend a euro.

This article is general guidance, not legal advice. Confirm your obligations with a qualified advisor or your Responsible Person.