General Product Safety Regulation, Cybersecurity Features and Software Changes in Assessing a Consumer Product's Safety

Article 5 of the General Product Safety Regulation provides that economic operators shall place or make available on the market only safe products. Article 3, point (8), defines a manufacturer as any natural or legal person who manufactures a product or has a product designed or manufactured, and markets that product under that person's name or trademark.

Under Article 9(1), a manufacturer placing a product on the market must ensure that it has been designed and manufactured in accordance with that general safety requirement. Article 3, point (1), defines a product as any item, whether or not interconnected to other items, supplied or made available whether for consideration or not, which is intended for consumers or is likely, under reasonably foreseeable conditions, to be used by consumers even if not intended for them.

Article 6(1) lists the aspects to be taken into account in assessing whether a product is safe, and point (g) names, when required by the nature of the product, the appropriate cybersecurity features necessary to protect the product against external influences, including malicious third parties, where such an influence might have an impact on the safety of the product, including the possible loss of interconnection.

Point (h) names, when required by the nature of the product, the evolving, learning and predictive functionalities of the product. Point (c) names the effect that other products might have on the product, including the effect of non-embedded items that are meant to determine, change or complete the way the product works.

Under Article 13(2), a person other than the manufacturer that substantially modifies a product is deemed to be a manufacturer, subject to the obligations of Article 9 for the part of the product affected by the modification, or for the entire product if the substantial modification has an impact on its safety. Article 13(3) provides that a modification of a product, by physical or digital means, is substantial where it has an impact on the safety of the product and three criteria are met.

The criteria are that the modification changes the product in a manner not foreseen in the initial risk assessment, that the nature of the hazard has changed, a new hazard has been created or the level of risk has increased, and that the modification was not made by the consumers themselves or on their behalf for their own use.

Article 2(1) applies the Regulation to products that are placed or made available on the market insofar as there are no specific provisions with the same objective under Union law which regulate the safety of the products concerned. Where products are subject to specific safety requirements imposed by Union law, the Regulation applies only to those aspects and risks or categories of risks which are not covered by those requirements.

For products subject to specific requirements imposed by Union harmonisation legislation, Chapter II, which holds Articles 5 and 6, does not apply insofar as the risks or categories of risks covered by that legislation are concerned.

Recital 26 states that specific cybersecurity risks affecting the safety of consumers can be dealt with by sectoral legislation, and that where such legislation does not apply the relevant economic operators and national authorities should take into consideration risks linked to new technologies, when designing the products and assessing them respectively. Article 52 provides that the Regulation applies from 13 December 2024.

Article 23(1) applies provisions of Regulation (EU) 2019/1020 on market surveillance, including Article 10, Article 11(1) to (7), Articles 12 to 15 and Articles 21 to 24 of that Regulation, to products covered by the General Product Safety Regulation. Article 44 leaves the rules on penalties for infringements of the Regulation to the Member States, which the Article requires to be effective, proportionate and dissuasive.

Article 39 applies Directive (EU) 2020/1828 to representative actions brought against infringements by economic operators and providers of online marketplaces of provisions of the Regulation that harm, or may harm, the collective interests of consumers.