1) Technical documentation (mandatory for all products)

The Commission states every product under GPSR must have technical documentation. At minimum it includes:

• A general description and the essential characteristics relevant to safety;
  
  
• A risk analysis and the solutions adopted to eliminate or mitigate risks;
  
  
• A list of relevant standards (or, in their absence, national requirements or other methods used).
  You must retain this documentation for at least 10 years and keep it available for market‑surveillance authorities. The responsible person must regularly check ongoing compliance with the tech documentation.

2) Risk assessment (mandatory)

Manufacturers must assess the safety of every product, document the essential safety characteristics and list all identified risks (even low‑level ones) in the technical documentation. The Regulation gives minimum aspects to consider when assessing safety; format is up to you, as long as it’s complete.

Digital‑product‑specific hazards to consider (practical list):

• Functional safety: incorrect outputs that could lead to unsafe actions by users or by connected devices (e.g., an app that configures a home device in an unsafe way).
  
  
• Information presentation & human factors: misleading or missing warnings; dark patterns that could drive unsafe usage; accessibility barriers that prevent users from seeing/understanding safety‑critical instructions. (The Commission links listing accessibility to “easily accessible” information.)
  
  
• Cyber‑triggered safety issues: vulnerabilities enabling behaviours that create safety risk (e.g., spoofed alerts that cause panic or actions with physical consequences via connected ecosystems).
  
  
• Age‑appropriate design: foreseeable child use/misuse (e.g., in “family” devices or shared accounts).
  
  
• Update/rollback behaviour: updates that change safety‑relevant behaviour or remove warnings.
  
  
• Interoperability limits: unsafe outcomes when combined with popular OS/browser versions or devices that you know users will pair with your product.
  
  
• Mental‑health risk vectors: features that could credibly cause severe stress or harm in ordinary use (e.g., false alarms, coercive prompts around payments or location sharing).

 3) Labelling & traceability

• Provide product identification, manufacturer name, and postal and electronic address (the latter must be a direct digital contact such as an email or contact form; a static website or a phone number alone is not enough).
  
  
• If someone else is the EU “responsible person”, include their name and postal/electronic address too (this must also appear in distance‑sale listings / app‑store pages).
  
  
• Digital‑only products can’t rely on “digital labelling” alone. While there’s no package to print on, the GPSR requires the information on the product, or (if not possible) in accompanying material — and distance‑sale listings must show it. In practice: put it inside the app (e.g., an “About & Safety Info” screen) and on the store listing / download page.

4) Accident reporting & recalls

• If an accident caused by your product leads to death or serious health impact, manufacturers must notify via the Safety Business Gateway without undue delay (responsible person ensures this if the manufacturer is outside the EU).
  
  
• In a recall, there is no time limit for consumers to claim a remedy under GPSR. 

Note on CE/DoC: GPSR itself doesn’t introduce CE marking. If your digital product also falls under a harmonised law (e.g., it’s software embedded in or controlling radio equipment), follow that law (including CE & Declaration of Conformity) and use GPSR as the safety net for any risks not covered there.