The GPSR for e-commerce: when are you responsible for the safety of your products?

Buying a product online, building an attractive product page and launching advertisements can nowadays be set up within a matter of days. With AI, even an entire webshop catalogue can be provided with product descriptions, instructions, images and marketing claims in a single afternoon.

But precisely there, a dangerous misconception arises.

Publishing faster does not mean that legal responsibility disappears faster.

Anyone who sells consumer products in Europe must not only know what they are selling, but also be able to demonstrate that the product is safe, who is responsible for it and which information belongs to the product. Since the General Product Safety Regulation, better known as the GPSR, explicit requirements regarding product information and traceability also apply to online sales.

The GPSR has been applicable since 13 December 2024 and was specifically designed to better protect consumers, including in online sales and with new technology.

For e-commerce companies, this means that product safety is no longer something that can be left solely to the manufacturer or supplier.

“My supplier says it is compliant”

That is one of the most common assumptions in e-commerce.

A supplier sends a certificate, a report or a declaration. The entrepreneur saves the file somewhere and assumes that the legal part has been handled.

But the real question is not:

Have you received a document?

The question is:

Does that document actually belong to the product you are selling, is it relevant to the applicable regulations, and can you substantiate the entire chain?

Particularly when importing from outside the EU, the position of the webshop can be much more important than entrepreneurs realise. Anyone who has products manufactured under their own brand or imports them themselves can also acquire different legal responsibilities than a webshop that only resells products from a European manufacturer.

Therefore, product compliance must begin before a product goes live.

Not after the first claim comes in.

The product page is also part of product safety

The GPSR makes this particularly relevant for webshops.

In distance selling, the online offer must clearly and visibly display certain information. This includes the identity and contact details of the manufacturer. If the manufacturer is established outside the EU, information about the responsible person in the EU must also be displayed. In addition, data must be available with which the product can be identified, and applicable warnings and safety information must be visible.

This means that product compliance does not end in a folder with certificates.

Your product page is part of your compliance.

A webshop can have an excellent internal file, but still create problems when necessary safety information is not displayed with the online offer.

The reverse is also true. A neat product page does not compensate for a missing technical file.

Both must be correct.

And here AI makes the problem bigger

More and more e-commerce companies are using generative AI to create product descriptions.

This is efficient, but from a legal perspective, it creates a new control point.

For example, an AI system can add a product feature that was never confirmed by the manufacturer. It can summarise safety information and thereby omit an essential warning. It can formulate a commercial claim that is stronger than what the available documentation supports.

Or it turns a Chinese supplier description into a convincing Dutch text that suddenly states that a product is “completely safe”, “CE certified” or “suitable for children”.

The text sounds professional.

But that does not make it correct.

And as soon as that text is on your website, your business is selling the product with that information.

“The product description was generated by AI” does not change what the consumer saw on your product page.

AI may support, but not replace your proof

AI can actually be enormously valuable within product compliance.

Think of structuring supplier documentation, comparing article numbers, flagging missing fields, categorising safety information or supporting the management of large product catalogues.

But there is an essential difference between:

Using AI to process compliance information

and

Using AI to invent compliance information.

The former can make processes more efficient.

The latter creates risk.

A good AI workflow should therefore never independently publish legal or safety-related information without it being clear on which source that information is based.

Product safety is also supplier management

Many compliance problems do not start on the website, but with the supplier.

Suppose you sell 500 products and only have a product photo and an invoice from the supplier for each product.

Then you do not have a scalable compliance process.

You have 500 potential questions to which you might not be able to provide an answer later.

A professional structure maps out, for each product, who the manufacturer is, which party is responsible within the EU, which legislation applies to the product, what documentation must be present, what safety information is required, and how product and batch information can be retrieved.

That does not mean that every webshop must become a laboratory itself.

It does mean that you must know what role you legally play and what proof belongs to that role.

AI products make it even more interesting

The subject becomes more complex when AI is not only used to sell a product, but is part of the product itself.

Think of smart devices, toys with AI functionality or products that change through software updates.

European product safety rules explicitly take into account risks that can arise from new technology and software during the lifecycle of a product. At the same time, the AI Act contains separate rules for AI systems, with longer transitional periods applying to certain AI embedded in regulated products.

This increasingly creates a combination of:

product safety, software, cybersecurity, AI governance and consumer law.

For entrepreneurs, it is therefore dangerous to treat these subjects as five separate files.

What happens if the product turns out not to be safe?

Then documentation suddenly becomes important.

Not theoretically.

But practically.

Which product was sold?

Which batch?

From which manufacturer?

Which documents were available?

Which warnings were given?

When did you discover the problem?

Which customers received the product?

What action did you take next?

The EU uses Safety Gate to share information about dangerous non-food products between authorities, and the GPSR contains further obligations regarding product safety and corrective actions.

A business that has set this up properly in advance can act much faster than a webshop that only tries to find out where products came from after an incident.

The combination of AI and compliance requires control

AI is going to make e-commerce companies much more efficient.

But precisely because of this, governance becomes more important.

When one employee used to write twenty product descriptions a week, the scale of an error was limited.

When AI can modify twenty thousand of them, that same error scales almost immediately.

Therefore, the question should not be:

“Can we automate this with AI?”

But:

“Can we automate this with AI without losing control over our legal obligations?”

That is a much more interesting question.

The AI Act also underlines that organisations that deploy AI professionally must pay attention to the AI literacy of employees and other persons working with AI systems on their behalf. That obligation has already been in force since February 2025.

Conclusion

Product safety in e-commerce is not a certificate lying somewhere on a server.

It is a chain.

From manufacturer to supplier.

From supplier to documentation.

From documentation to product page.

From product page to consumer.

And ultimately from sale to traceability and any corrective actions.

AI can make that chain much more efficient.

But only if the business first knows which information must be correct.

Automating without a legal foundation only makes a bad process faster.

Ecompliance

Do you sell or import physical products and want to know whether your product files, supplier information and online product pages legally align with the GPSR?

Ecompliance can analyse your current structure, map out missing risks and set up a scalable compliance process — including how AI can be used responsibly within that process.