GPSR Online Marketplaces

Skip key takeaways

Updated September 16, 2026

• Four listing blocks, one of them conditional Article 22(9) makes the provider capture the manufacturer's name and postal and electronic address, product identification with a picture and identifiers and the warnings in the language each Member State of sale determines, while the responsible person block is required only where the manufacturer is not established in the Union.
• The responsible person is a validation rule, not a field Article 22(9)(b) requires the responsible person's details on the listing whenever the manufacturer is not established in the Union, and Article 16(1) is why such a person must exist, so the onboarding flow makes the responsible-person block mandatory whenever the manufacturer is established outside the Union and blocks the listing until it is filled.
• Two clocks, both running from receipt An authority order under Article 22(4) is actioned without undue delay and in any event within two working days from receipt, a product-safety notice under Article 22(8) within three working days from receipt, and the regulation leaves working day undefined, so the calendar is configuration and the timestamps are the evidence.
• A recall notice is a form with fixed elements, some conditional Article 36(2) fixes the headline, the product description with identifiers, a hazard description without minimizing terms, the action to take, the remedies, a free phone number or online service and, if appropriate, the encouragement to share, per language of each market of sale, which is a form plus a validator rather than free text.
• The evidence log is derived, because Article 22 names no register The regulation imposes no explicit record-keeping duty or retention period on providers, so the log is justified by the duties to inform authorities of the effect given to orders, the action taken on notifications and the information exchanged on removed offers, and the explicit registers bind economic operators only.

Copy takeaways

A marketplace that lets consumers in the Union buy products from third-party traders carries duties of its own under Regulation (EU) 2023/988, the General Product Safety Regulation, separate from what its sellers owe. For GPSR online marketplaces the operative text reads like a product specification: four information blocks on every listing, one of them conditional, two contact points, two clocks with working-day outer bounds, a recall pipeline to identifiable buyers and a notification channel to the authorities. Each duty below becomes a validation rule, a workflow or a log entry, marked wherever the reading is ours rather than the regulation's.

In short: Article 22 is the marketplace article. It requires a contact point for market surveillance authorities registered on the Safety Gate Portal and one for consumers, a listing interface that captures the four information blocks of Article 22(9), action on an authority order without undue delay and in any event within two working days from receipt and processing of a product-safety notice on the same standard within three, use of Safety Gate notifications for voluntary detection, direct notification of affected buyers on a recall, notification of known dangerous products through the Safety Business Gateway and suspension of traders that frequently offer non-compliant products. It prescribes no data model, queue or retention period, so those parts below are editorial and labeled as such.

Who counts as a provider of an online marketplace

Traders selling to consumers at a distance are economic operators with the listing duties of Article 19. The platform is a provider of an online marketplace, and under Article 3 of Regulation (EU) 2023/988 that term "‘provider of an online marketplace’ means a provider of an intermediary service using an online interface which allows consumers to conclude distance contracts with traders for the sale of products;" An online interface is any software, including a website, part of a website or an application, mobile apps included, so a native app with a checkout is in scope.

A platform that also sells stock of its own is a trader for those offers and, depending on how the goods reach it, an importer or a distributor, so on its first-party listings the Article 19 information duties and the Article 16(1) responsible-person requirement bind it directly rather than through Article 22(9). The quoted definition speaks of distance contracts with traders, so private or second-hand sellers need a seller-type classification before the Article 22(9) blocks apply per listing, a legal reading the platform records as configuration.

Under Article 52 the regulation has applied since 13 December 2024, and the amending Regulation (EU) 2024/2748 touched only the internal market emergency provisions, so every provision quoted here is unamended text.

The listing data model behind every product offer

Under Article 22(9) providers must "design and organise their online interface in a way that enables traders offering the product to provide at least the following information for each product offered" and must ensure that it is displayed or otherwise made easily accessible on the product listing. Traders owe the same four items for their own offers under Article 19, so one capture at listing creation serves both duties.

The manufacturer block comes first, under point (a) the "name, registered trade name or registered trade mark of the manufacturer, as well as the postal and electronic address at which the manufacturer can be contacted;" Identification follows under point (c), "information allowing the identification of the product, including a picture of it, its type and any other product identifier;" (Article 22(9)).

A single-language listing model breaks on point (d). Warnings and safety information must be "in a language which can be easily understood by consumers as determined by the Member State in which the product is made available on the market." (Article 22(9)). In a headless commerce stack the four blocks belong in the product information layer, read by every storefront.

Collected as a schema, the four points yield the fields below, field and article from the text quoted here, required-when and validation editorial.

Field	Article	Required when (editorial)	Validation (editorial)
Manufacturer name, registered trade name or registered trade mark	22(9)(a)	Every listing	Non-empty, form used recorded
Manufacturer postal and electronic address	22(9)(a)	Every listing	Both non-empty, postal country drives the responsible-person rule
Responsible person name, postal and electronic address	22(9)(b), 16(1)	Manufacturer country outside the Union	All three non-empty when triggered, listing offline until then
Product picture and type	22(9)(c)	Every listing	At least one image, type non-empty
Other product identifiers such as batch or serial number	22(9)(c)	Where the product carries one	Repeatable field, each value typed
Warnings and safety information	22(9)(d)	Where the product carries any	One variant per language each target Member State determines
Target Member States	derived from 22(9)(d)	Every listing	At least one, each mapped to a language

Responsible person checks at seller onboarding

The responsible person is the conditional block. Point (b) applies "where the manufacturer is not established in the Union, the name, postal and electronic address of the responsible person within the meaning of Article 16(1) of this Regulation or Article 4(1) of Regulation (EU) 2019/1020;" (Article 22(9)). The trigger is the manufacturer's establishment, so the validation rule reads: a manufacturer address under point (a) outside the Union makes the responsible-person block mandatory and holds the listing until it is filled.

Article 16(1) is why the field exists: "A product covered by this Regulation shall not be placed on the market unless there is an economic operator established in the Union who is responsible for the tasks set out in Article 4(3) of Regulation (EU) 2019/1020 in respect to that product." Article 16(3) puts that person's details on the product, its packaging, the parcel or an accompanying document, so onboarding data should match what a buyer finds in the box.

The internal processes of Article 22(3) must include mechanisms for traders to provide the Article 22(9) information, including the Union manufacturer or the responsible person, and under Article 22(10) "their self-certification committing to offer only products that comply with this Regulation and additional identification information, in accordance with Article 30(1) of Regulation (EU) 2022/2065, where applicable." Storing the accepted text version, timestamp and accepting account and re-capturing the attestation when the text changes is an engineering choice, not a requirement of the text.

That attestation is one of several points where Article 22 leans on the Digital Services Act: the contact points sit alongside its Article 11 and 12 duties, orders follow the minimum conditions of its Article 9(2), the three-working-day rule covers notices under its Article 16, suspension serves its Article 23, the Safety Gate Portal is the minimum source for its Article 31(3) checks and the attestation carries the identification information of its Article 30(1).

Contact points and Safety Gate Portal registration

Under Article 22(1) providers "designate a single point of contact allowing for direct communication, by electronic means, with Member States’ market surveillance authorities in relation to product safety issues" and its second sentence adds a registration step: "Providers of online marketplaces shall register with the Safety Gate Portal and shall indicate on the Safety Gate Portal the information concerning their single contact point." The Safety Gate Portal is the Commission's public portal of notified dangerous products under Article 34 and publishes the authority contact details the provider replies to. Article 22(2) adds a second contact point that lets consumers communicate directly and rapidly with the provider on product safety issues.

Authority orders and notices, stated as rules

Market surveillance authorities may order a provider under Article 22(4) to remove specific content referring to an offer of a dangerous product, to disable access to it or to display an explicit warning. The provider's side is a rule with a party and a start event: providers take the measures needed to receive and process such orders and under Article 22(4) "they shall act without undue delay, and in any event within two working days from receipt of the order." Undue delay is the primary standard and the two working days the outer bound, so the clock in the case queue marks a limit, not a target.

The regulation leaves working day undefined, so by design the platform holds a calendar per issuing authority as configuration and records receipt and action timestamps against it. Article 22(4) also requires a reply to the issuing authority on the effect given, electronically, through the contact details published in the Safety Gate Portal, so the reply is generated from the case and doubles as the evidence.

An order may extend under Article 22(5) to all identical content for the period it prescribes, provided the search is limited to the information identified in the order, needs no independent assessment by the provider and can be done proportionately by reliable automated tools, which is a matcher specification with a stop date. Article 22(8) is the second clock. Under Article 22(8) providers "shall, without undue delay and in any event within three working days from the receipt of the notice, process the notices related to product safety issues with regard to the product offered for sale online through their services" and the notices are the DSA notices cross-referenced above, so notice intake mirrors order intake with a different bound.

Safety Gate checks and the interoperable interface hook

Article 22(6) adds a duty that feeds catalog monitoring: providers take into account the regular information on dangerous products that authorities notify and that reaches them through the Safety Gate Portal "for the purpose of applying their voluntary measures aimed at detecting, identifying, removing or disabling access to the content referring to offers of dangerous products on their online marketplace" (Article 22(6)), including through the interoperable interface to the portal that Article 34(5) tasks the Commission with developing, and they inform the notifying authority of any action taken through the contact details published in the portal.

The engineering reading is an ingest adapter, a matcher and an action path. The adapter reads Safety Gate information the way Article 22(6) foresees, from the portal or, where the Article 34(5) interface is used, through it, that interface being a design target rather than a channel the regulation describes as in service. A match on the identifiers a notification carries goes to a reviewer or a rule that removes or disables the offer and the reply to the notifying authority comes from the same case.

Notifying sellers, buyers and the Safety Business Gateway

Article 22(12) is the cooperation paragraph, and four of its points are outbound notifications. Point (b) is the seller notification: the provider informs the relevant economic operator of the decision to remove or disable access to the content referring to an offer of a dangerous product.

Point (a) is the buyer notification, under Article 22(12) "directly notifying all affected consumers who bought through their interfaces the relevant product in the event of a product safety recall of which they have actual knowledge" or where a safety warning has to reach them, together with publishing recall information on the interface. Article 35(1) adds that providers which collect their customers' personal data make use of it for recalls and safety warnings, so the purchaser lookup draws on data the regulation itself directs to that purpose.

Point (d) is the authority notification. Providers immediately inform, through the Safety Business Gateway, the market surveillance authorities of the Member States where the product was made available about dangerous products offered on their interfaces of which they have actual knowledge, giving the details available to them of the risk, "of the quantity by Member State of products still circulating on the market, if available, and of any corrective measure that, to their knowledge, has already been taken;" (Article 22(12)). Point (e) adds accidents: information received about them goes to the relevant traders and economic operators without delay, and an accident causing a serious risk or actual damage to a consumer is notified through the gateway without undue delay, with the manufacturer informed.

The gateway is the Commission web portal of Article 27, and its user manual for economic operators and providers of online marketplaces states the entry condition: "To access the Safety Business Gateway system, you need an EU Login account." Each notifier is identified by name and contact details with a contact person, so the workflow runs under a named account holder and stores the gateway's submission number and case ID on its own case.

The recall notice pipeline and its mandatory content

When information on a product safety recall reaches consumers in writing, Article 36 fixes the format. Under Article 36(1), "Where information on a product safety recall is provided to consumers in a written form, in accordance with Article 35(1) and (4), it shall take the form of a recall notice." Under Article 36(2) the notice must be easily understood, available in the language or languages of each Member State where the product was made available and carry the seven elements it lists, some of them conditional. It opens with "a headline consisting of the words ‘Product safety recall’;" and continues with a clear description of the product, its picture, name and brand, its identification numbers such as batch or serial number with, if applicable, a graphical indication of where to find them on the product and, if available, when, where and by whom it was sold. Element (c) is the hazard description, written "avoiding any elements that may decrease consumers’ perception of risk, such as by using terms and expressions such as ‘voluntary’, ‘precautionary’, ‘discretionary’, ‘in rare situations’ or ‘in specific situations’ or by indicating that there have been no reported accidents;" after which come the action consumers should take, including an instruction to stop using the product immediately, the remedies under Article 37, a free phone number or interactive online service and, if appropriate, encouragement to share the notice.

Read as a specification, that is a form with one field per element and one instance per language of each market of sale, plus a validator that rejects the listed minimizing words in the hazard field and refuses to publish a notice with an empty element, the conditional ones excepted (graphical indication if applicable, sale details if available, encouragement to share if appropriate). The remedies element belongs to the economic operator responsible for the recall, who under Article 37 offers an effective, cost-free and timely remedy and, as a rule, a choice between at least two of repair, replacement and a refund of at least the price paid. Article 35(4) covers buyers the platform cannot identify: the notice goes through other appropriate channels with the widest possible reach, and the information must be accessible to persons with disabilities, which is where the recall page meets the European Accessibility Act, covered in its own guide.

Repeat-offender suspension and the evidence log

Article 22(11) is the sanction the platform itself applies, serving the DSA provision cross-referenced above. As regards product safety, providers under Article 22(11) "suspend, for a reasonable period of time and after having issued a prior warning, the provision of their services to traders that frequently offer products which are non-compliant with this Regulation." The regulation defines neither frequently nor reasonable period, so both are policy parameters the platform sets and documents. The mechanism is a per-trader non-compliance counter, a warning step that completes before suspension and a suspension record with start and review dates. A suspension without a prior warning on file is outside the text. Penalties are a separate layer: Article 44 leaves the rules on penalties for infringements by economic operators and providers of online marketplaces to the Member States, penalties that must be effective, proportionate and dissuasive.

Nothing in Article 22 imposes an explicit record-keeping duty on providers of online marketplaces or sets a retention period for their logs. The evidence log in the table below is editorial, derived from the duties to inform: the effect given to an order, the action taken on a Safety Gate notification, the quantities and corrective measures in a gateway notification and, under point (f) of Article 22(12), the duty to "cooperate with law enforcement agencies at Union and national level, including the European Anti-Fraud Office (OLAF), through regular and structured exchange of information on offers that have been removed on the basis of this Article by providers of online marketplaces;" A platform that cannot show what it did and when cannot discharge those duties. The explicit registers in the regulation, the manufacturer's complaints register under Article 9(12) and the ten-year retention of technical documentation, bind manufacturers and other economic operators rather than providers as such, so they reach a marketplace only where it also sells, imports or distributes.

Duties mapped to software behavior

Duty and article come from Regulation (EU) 2023/988 and reuse its wording. Software behavior is our engineering reading and evidence log is derived from the informing duties above. Neither editorial column is what the regulation requires the system to do.

Duty	Article	Software behavior (editorial)	Evidence log (editorial)
Single points of contact for market surveillance authorities, registered on the Safety Gate Portal, and for consumers	22(1), 22(2)	Monitored channel owned by a named team, portal registration on the launch checklist, product-safety tickets routed to the safety queue	Registration confirmation, contact-point change history, ticket log
Internal processes for product safety, with mechanisms for traders to provide the listing information and their self-certification	22(3), 22(10)	Versioned workflow per row, onboarding flow capturing the four listing blocks and the attestation	Process versions, attestation records with text version and timestamp
Listing shows the manufacturer's name and postal and electronic address, the responsible person where the manufacturer is not established in the Union, product identification with a picture and identifiers and warnings in the language each Member State of sale determines	22(9), 16(1)	The listing schema above, validated at listing creation	Listing versions with field-level history, validation outcomes per seller
Receive and process authority orders, act without undue delay and in any event within two working days from receipt, inform the issuing authority of the effect given and the relevant economic operator of the decision to remove or disable access	22(4), 22(12)(b)	Order intake at the contact point opens a case, working-day clock from receipt, action, authority reply and seller notification generated from the case	Receipt timestamp, action timestamp, clock outcome, reply and notification sent
Orders extending to identical content for the prescribed period, provided the search is limited to the information identified in the order, needs no independent assessment and can be done proportionately by reliable automated tools	22(5)	Matcher keyed to the information identified in the order, no independent assessment, period and stop date	Search parameters, matched listings, period
Take Safety Gate notifications into account for voluntary detection and removal, inform the notifying authority of any action taken	22(6), 22(7), 34(5)	Notification ingest behind one adapter, catalog matching, removal or disabling, reply through the published contact details	Ingest runs, matches, actions, replies
Process product-safety notices (the DSA notices cross-referenced above) without undue delay and in any event within three working days from receipt	22(8)	Notice intake with a working-day clock from receipt, decision and outcome recorded	Notice received, decided, outcome
Suspend traders that frequently offer non-compliant products, for a reasonable period, after a prior warning	22(11)	Per-trader non-compliance counter, mandatory warning step, suspension with start and review dates	Warning sent, suspension start and end
Directly notify affected buyers on a recall or safety warning, publish recall information on the interface, reach the rest through other channels accessible to persons with disabilities	22(12)(a), 35(1), 35(4)	Purchaser lookup by product, listing and order, direct message to each identifiable buyer, public recall page, accessible fallback broadcast	Send log per purchaser, published notice versions, channels used
Cooperate with market surveillance authorities and relevant economic operators to ensure effective product recalls, including by abstaining from obstructing them	22(12)(c)	Seller and purchaser data served to the recalling operator on request	Requests served
Written recall information takes the form of a recall notice carrying the seven elements Article 36(2) lists, some of them conditional, while registration or loyalty programs offer customers the possibility to give separate contact details for safety purposes only	36(1), 36(2), 35(2)	Form with one field per element per language of each market of sale, validator rejecting the listed minimizing words and allowing empty conditional items, safety-only contact field with its own purpose flag	Notice versions per language, validator results, purpose flag per contact record
Immediately inform the authorities of the Member States concerned through the Safety Business Gateway about known dangerous products, with risk details, quantity by Member State if available and corrective measures already taken	22(12)(d), 27(1)	Gateway notification workflow under a named EU Login account, order data queryable by product and buyer Member State	Submission number and case ID stored on the case
Accidents: inform the relevant traders and economic operators without delay, notify serious-risk or actual-damage accidents through the gateway without undue delay, inform the manufacturer	22(12)(e)	Accident intake channel, routing to the seller and the manufacturer, gateway accident notification	Accident case log
Structured exchange with law enforcement including OLAF on removed offers, access for authority tools, supply-chain data requests and scraping on reasoned request	22(12)(f) to (i)	Removed-offers register with a structured export, allow-listed authority tools, a data-request procedure, a scraping exemption keyed to the request parameters	The register itself, access log, request log

How Pharos Production helps

Most of the duties above land in the listing schema, the seller onboarding flow and the case-management layer. The first two are settled first, since a change to either touches every live trader, while the case layer grows one queue at a time.

Our e-commerce software development team builds the listing schema and the onboarding validation, the order and notice intake with their clocks, the Safety Gate ingest, the recall pipeline from purchaser lookup to validated notice and the evidence log behind each, mapped to the paragraph of Article 22 it answers.

Sources: Regulation (EU) 2023/988 on general product safety, Articles 3, 9, 16, 19, 22, 27, 34, 35, 36, 37, 44 and 52, base text on EUR-Lex, whose marketplace, distance-sales, responsible-person and recall provisions are unamended by Regulation (EU) 2024/2748; the Safety Business Gateway user manual for economic operators and providers of online marketplaces, version 5.0.0, published by the European Commission. Read on 16 September 2026. Engineering guidance, not legal advice.

FAQ

Last updated: September 16, 2026

Quick answers to common questions about custom software development, pricing, process and technology.

Expand all Collapse all

Search FAQs

Popular

Type to filter questions and answers. Use Topic to narrow the list.

Showing all 6

• What does the GPSR require an online marketplace to show on a product listing?

  Featured question. Copy link Copies a direct link to this answer to your clipboard.

  Four blocks per listing, one of them conditional: the manufacturer's name or registered trade name or trade mark with a postal and an electronic address, the responsible person's name and addresses only where the manufacturer is not established in the Union, product identification with a picture, the type and any other identifier and the warnings in the language the Member State of sale determines. Article 22(9) puts the duty on the provider to design the interface so traders can supply them and to display them or make them easily accessible on the listing.

  Article 19 puts the same items on the trader for its own offer, which is why one capture at listing creation covers both parties.

• How quickly must a marketplace act on a takedown order from a market surveillance authority?

  Copy link Copies a direct link to this answer to your clipboard.

  Article 22(4) states the rule with a party and a start event: the provider acts without undue delay and in any event within two working days from receipt of the order, whether the order requires removal of the content, disabling of access to it or display of an explicit warning. The provider then informs the issuing authority of the effect given, electronically, using the contact details published in the Safety Gate Portal.

  The regulation does not define a working day, so the calendar behind the clock is a configuration decision, and undue delay remains the primary standard with the two days as the outer bound.

• Does a marketplace have to register anywhere under the GPSR?

  Copy link Copies a direct link to this answer to your clipboard.

  Yes, with the Safety Gate Portal. Article 22(1) makes the provider designate a single point of contact for direct electronic communication with market surveillance authorities on product safety and register it there, and Article 22(2) adds a contact point for consumers.

  Notifications about dangerous products and accidents go out through a different Commission system, the Safety Business Gateway, which needs an EU Login account and a named contact person per notification.

• What must a marketplace do when a product sold through it is recalled?

  Copy link Copies a direct link to this answer to your clipboard.

  Notify every buyer it can identify, directly and without undue delay, once it has actual knowledge of the recall, using the customer data it already holds, and publish the recall information on its interface, under Article 22(12) and Article 35. In writing, that information takes the form of an Article 36 recall notice, with the fixed headline, a product description with identifiers, a hazard description free of minimizing terms, the action to take, the remedies, a free phone number or online service and, if appropriate, an encouragement to share.

  Buyers it cannot identify are reached through other channels with the widest possible reach, accessible to persons with disabilities.

• Does the GPSR require an online marketplace to keep records or logs?

  Copy link Copies a direct link to this answer to your clipboard.

  Article 22 imposes no explicit record-keeping duty on providers of online marketplaces and sets no retention period for their logs. What it does impose is a set of duties to inform: the effect given to an order, the action taken on a Safety Gate notification, the quantity by Member State and corrective measures in a gateway notification and a structured exchange with law enforcement on removed offers.

  An evidence log is the engineering consequence of those duties rather than a requirement of the text. The explicit registers in the regulation, the manufacturer's complaints register and the ten-year retention of technical documentation, bind economic operators and reach a marketplace only where it also sells, imports or distributes.

• When does the GPSR require a marketplace to suspend a seller?

  Copy link Copies a direct link to this answer to your clipboard.

  Only under Article 22(11): a trader that frequently offers non-compliant products is suspended for a reasonable period, and only after a prior warning has been issued. Neither frequently nor reasonable period is defined, so the threshold and the duration are policy parameters the platform documents, and a suspension with no warning on record falls outside the text.

  The paragraph's DSA cross-reference is covered with the others in the onboarding section.

I work with startup founders who need a dedicated software development team but don’t want to gamble on hiring, random outsourcing, or opaque delivery.
Most founders face the same problem sooner or later.
Early technical and team decisions lock the product into tech debt, slow delivery, missed milestones and constant re-hiring. By the time this becomes visible, fixing it is already expensive.

As a CTO and software architect, I help founders design, build and run dedicated development teams that work as a true extension of the startup. Not as a black-box vendor.

My focus is on complex products where mistakes are costly:

• Web3 and blockchain platforms
• FinTech and regulated products
• High-load startup systems
• MVP → scale transitions

We don’t do body-shopping.
We don’t sell generic outsourcing.

Instead, we help founders:

• build the right team structure from day one
• keep technical ownership and transparency
• scale delivery without losing control
• avoid vendor lock-in and hidden risks

Teams are aligned with the product roadmap, business goals and long-term architecture. Not just short-term velocity.