Who Enforces GPSR? The Authorities That Can Pull Your Listings

Short answer: not the European Commission, and not one single EU agency. The General Product Safety Regulation (EU) 2023/988 is enforced country by country, by national bodies called market surveillance authorities. They are the ones who can fine you, order a recall, and tell Amazon to delete your listing.

If you sell into the EU and you have been picturing one Brussels office that polices everyone, the real picture is more decentralized and, frankly, harder to predict. The authority that comes after you depends on where your problem product turns up.

The people who actually enforce GPSR

The EU's own language is blunt about this. As EUR-Lex puts it, "National market surveillance authorities enforce the obligations laid down by the GPSR. They check that products on the EU market comply with safety requirements and take appropriate measures when they identify a potential risk for consumers."

Each of the 27 Member States designates its own market surveillance authority (MSA). These are the boots-on-the-ground enforcers. The European Council describes their job plainly: MSAs "check the compliance of products on their market with EU health safety requirements and take appropriate measures (recalls, sanctions, warning messages)."

So enforcement is not abstract. It is a specific national agency with a specific name and specific powers:

• France runs enforcement through the DGCCRF, supported by Customs and the Labor Inspectorate. As one Paris law firm noted, these bodies "have expanded powers to enforce compliance. They can recall dangerous products, impose stricter penalties, and coordinate at the EU level."
• Germany routes federal product safety oversight through the BAuA (the Federal Institute for Occupational Safety and Health), alongside the regional authorities of each Bundesland.
• Every other Member State has its own equivalent. Same regulation, different office, sometimes very different appetite for enforcement.

This is the part sellers underestimate. There is no central "GPSR police." There are 27 national systems applying one rulebook, and any of them can act against a product that reaches their market.

Where does the European Commission fit in?

The Commission supervises, it does not fine. The European Parliament's own answer to a formal question spells out the relationship: "The GPSR is implemented by national market surveillance authorities. When the Commission identifies potential shortcomings in a Member State's implementation of EU legislation, it engages in a structured dialogue to assess compliance."

In other words, the Commission watches the watchers. It can lean on a Member State that is enforcing too loosely. And under Article 28 of the GPSR, it can take Union-level action against a product that poses a serious risk, including prohibiting or restricting its sale across the entire EU.

But the invoice for your penalty does not arrive from Brussels. It arrives from a national authority. If you want the bigger picture of how the regulation is structured, the /blog/eu-regulation-2023-988-summary walks through the article-by-article framework, and the pillar /blog/what-is-gpsr covers the basics.

How enforcement crosses borders

Here is the trap. You might think a French MSA only matters if you sell in France. It does not work that way.

When one MSA finds a dangerous or non-compliant product, it logs it in the Safety Gate Rapid Alert System. Every other national authority sees that alert. The Consumer Safety Network under Article 30 then coordinates the response across countries. A single bad finding in Lyon can become a pan-EU problem within days.

That is why a violation detected in one Member State can lead to cross-border enforcement that affects listings across all your EU markets at once. You do not get 27 separate chances to slip through. One alert can close the whole door.

Marketplaces are enforcers too

This is the part that bites most online sellers, because it is faster and more brutal than any government action.

GPSR puts direct obligations on online marketplaces. Per Global Compliance News, "online marketplace providers must comply by cooperating with EU market surveillance authorities (e.g., processing notices within three working days) and taking immediate mitigation actions." When an MSA sends a takedown notice, the platform has three working days to act.

In practice, platforms do not wait to be told. They pre-empt risk by pushing the compliance burden straight onto you. One Amazon seller put it bluntly in the Seller Central forum: "Most of the issues stem from Amazon having set things up so that the entire burden of proof for European GPSR regulations is entirely on the seller."

So you face two layers of enforcement at once:

1. Government enforcement — fines, recalls, sanctions from national MSAs.
2. Platform enforcement — listing deactivation, suppressed offers, account suspension when your GPSR data is missing or wrong.

The platform layer usually hits first and hits hardest, because a marketplace can deactivate a listing in minutes, no investigation required. Each platform handles this differently, so it is worth reading the specifics for /blog/gpsr-amazon, /blog/gpsr-etsy, and /blog/gpsr-ebay.

The contact point authorities actually call: your Responsible Person

When an MSA wants to investigate a product, they need someone inside the EU to talk to. That is the whole reason the regulation requires a Responsible Person. As Baker McKenzie described it, the GPSR "contains a requirement for a 'responsible person' to be established within the EU before products can be placed on the EU market, likely with a view to ensuring that there is always an EU entity that can be held accountable."

A small seller summed up the practical effect on Reddit: "The EU regulation requires the contact information of the responsible person within the EU to communicate with authorities and customers." If you are a non-EU seller, this matters even more, because without an EU-based contact, your products cannot legally be placed on the market at all.

EUProof generates the GPSR compliance documents that name and reference your Responsible Person. We do not act as your Responsible Person. If you need to understand the role itself and who can fill it, see /blog/gpsr-responsible-person.

What enforcers ask for first

When an authority or a marketplace comes knocking, they want documentation, and they want it fast. The first things they request are usually your risk assessment and your technical file. A documented /blog/gpsr-risk-assessment shows you identified the hazards and addressed them. Your /blog/gpsr-technical-documentation-template backs it up with the supporting evidence.

If you cannot produce these on demand, "we'll sort it later" is not a defense an MSA accepts, and it is certainly not one Amazon waits around for. The point of having the paperwork ready is that enforcement stops being a scramble.

What to do before an authority finds you

The cheapest enforcement is the kind that never starts. A few concrete moves:

• Find out who your enforcer is. Use the Safety Gate portal to identify your Member State's designated MSA. If you are a non-EU seller, the relevant authority is usually wherever your goods enter the EU.
• Get your Responsible Person and contact details in order. Authorities and customers both need a reachable EU contact.
• Have your documents generated and stored. Risk assessment, technical file, Declaration of Conformity where required, and clear labeling. You can generate these in minutes with /blog/generate-gpsr-documents-5-minutes.
• Check whether you are even in scope. Run the quick /tools/am-i-affected check before you spend a euro.

Enforcement under GPSR is real, it is decentralized, and it moves through both governments and platforms. The good news is that the same paperwork satisfies both. Get it right once, store it, and you are ready whichever door knocks first.

This article is general guidance, not legal advice. Confirm your obligations with a qualified advisor or your Responsible Person.