How Long Must You Keep GPSR Documents? The 10-Year Rule Explained

Ten years. That is the headline number, and almost every source that has written about GPSR record-keeping lands on the same figure. Eurofins puts it plainly: "Technical documentation shall be kept for a period of 10 years." British Marine says the same thing with the detail that matters most, that you keep records "for a period of 10 years from the date the product is placed on the market."

So the answer to "how long" is settled. The harder questions are when does the clock start, what exactly do you have to keep, and what happens if a market surveillance authority asks and you have nothing to show them. Those are where sellers get caught. Let's work through each one.

The rule, in one sentence

Article 9(7) of the General Product Safety Regulation requires manufacturers to keep technical documentation for a minimum of 10 years from the date the product is placed on the market. That obligation extends, by the structure of the regulation, to importers and authorised representatives too. As one compliance summary from AKF Czech put it: "Technical documentation: Mandatory records including the safety assessment and other information must be kept for at least 10 years."

"Minimum" is the word to notice. Other rules can stretch the period further. If your product falls under sector-specific legislation with its own longer retention requirement, that longer period wins. GPSR sets the floor, not the ceiling.

When the 10-year clock actually starts

This is the single most misread part of the rule. The clock does not start when you manufactured the product. It does not start when the product was designed. It starts on the date the product is placed on the market, which means the first time that unit or model is made available for sale in the EU.

The practical consequences are easy to underestimate:

• You produce a batch in 2024 but only list it for sale in 2025. Your 10 years run from 2025.
• You sell a product for two years and then discontinue it. You still hold the file for the full 10 years from the original placement date. Pulling the listing changes nothing.
• A Shopify Community post gets the framing right: "Manufacturers or importers must keep technical documentation for 10 years after the product is placed on the market."

The discontinued-product case is the one that bites. Sellers assume that once a product is gone, the obligation goes with it. It doesn't. The file outlives the listing by years.

What counts as "technical documentation"

The 10-year rule covers your technical documentation, so you need to know what sits inside that folder. Under GPSR, technical documentation includes:

• A product description and identification (model, batch, what it is)
• The risk assessment and analysis of the product's safety characteristics
• A list of the relevant European standards you applied
• Test reports and conformity assessment records
• Information on complaints received and any corrective measures you took

That last point matters. Complaint logs and corrective-action records are not a separate filing exercise you can skip. They are part of the documentation you are expected to retain. If a customer reported a problem and you fixed it, that exchange belongs in the file.

If you are assembling this set for the first time, our technical documentation template walks through each section, and the broader compliance checklist shows where document retention fits among your other GPSR duties.

The 6-year traceability footnote

You will see a second number floating around, and it is worth clearing up so it doesn't confuse you. Some sources mention a 6-year period for traceability records. Amasty, for example, writes: "You have to store product-related data for up to 10 years and traceability records for 6 years. This includes product risk assessments and information about any complaints or corrective measures taken."

Treat these as two separate buckets. Technical documentation runs for 10 years. Traceability records, meaning records of where products were distributed and who you supplied, are referenced at 6 years. The simplest safe approach is to keep everything for the full 10. There is no penalty for over-retaining, and trying to remember which document carries which clock is how things get thrown out too early.

What format do the records need to be in?

Any format. Paper or electronic, originals or scans, it does not matter. The only requirement is that the records are accessible to market surveillance authorities on request.

In practice "accessible on request" is the real test. A box of paper in a warehouse you no longer rent does not meet it. A folder of PDFs you can search and email within a day or two does. Because the obligation can run for a decade and outlast staff, office moves, and platform changes, electronic storage that travels with the business is usually the sounder choice. Keep it organised by product, and keep a copy somewhere that survives a laptop dying.

What happens if you can't produce the documents

Here is the part that turns retention from a filing chore into a real risk. The penalty is not only for selling unsafe products. It is for failing to produce the documentation when asked.

Failure to produce the required records on request can result in enforcement action, including fines and product bans, even if the product itself is safe. That is the trap. You could be selling a genuinely safe item, pass any physical test, and still face a penalty because the paperwork that proves you did your homework is gone or was never kept. The missing file is its own violation.

This is why the discontinued-product scenario and the "I moved the files and lost them" scenario both matter so much. The authority does not need to find a defect. They only need to ask, and you need to answer.

For more on who can ask and what an investigation looks like, see who enforces GPSR and what happens if you don't comply.

If you use a Responsible Person

When you sell into the EU from outside it, you need an EU Responsible Person, and retention duties overlap. Both you and your representative may be responsible for holding documentation. Your contract should set out who keeps what and for how long. But putting it in the contract does not move your liability somewhere else. As the manufacturer, you remain ultimately responsible. If the representative loses the file, the authority still looks to you.

A clean arrangement is to keep your own master copy regardless of what the representative holds. Redundancy is cheap. Reconstructing a risk assessment for a product you stopped selling six years ago is not.

A simple way to stay covered

The whole obligation comes down to three habits. Keep the full technical file for every product. Log the start date, meaning the day it was first placed on the market, so you know when year 10 actually arrives. Store it somewhere you can still reach in a decade.

That is the part document generation makes lighter. When you generate your GPSR documents in one place, the risk assessment, the standards list, and the supporting records sit together from day one, dated and exportable, instead of scattered across email threads and spreadsheets you will have forgotten by year three. You can see what EUProof produces or check whether GPSR applies to you before you commit to anything.

This article is general guidance, not legal advice. Confirm your obligations with a qualified advisor or your Responsible Person.