The EU Safety Gate logged 4,137 product safety alerts in 2024 — the highest annual total since the system launched in 2003. Behind each of those alerts is a business that shipped products it believed to be compliant, often without a single compliance review having been conducted. The pattern is consistent: successful previous shipments, no prior enforcement action, and the gradual build-up of an assumption that if no one has raised a flag, the product must be acceptable. The flag, when it comes, arrives quickly and without warning.
This case study reconstructs one such scenario: a manufacturer of soft vinyl children's bath toys, produced outside the EU and distributed into the German, French, Dutch, and Belgian markets through a European wholesale intermediary. Three compliance failures — a missing EU Responsible Person under the new GPSR, restricted phthalate substances above the REACH threshold in the toy's soft components, and the absence of a complete CE technical file and Declaration of Conformity — combined to produce a Safety Gate notification, a full voluntary market withdrawal, and over €220,000 in losses. Each failure was preventable at low cost before the first pallet left the warehouse.
The Product and the Market Entry
The product range was a set of six soft vinyl bath toys for children under 36 months — squeezable figures moulded from plasticised PVC, sold in retail multipacks. The manufacturer had been producing the range for domestic markets for several years and had entered the EU through a Netherlands-based wholesale distributor in early 2025. The distributor placed the products with four major EU retail chains across Germany, France, the Netherlands, and Belgium. The product carried a CE mark applied by the manufacturer on the basis of an internal conformity assessment conducted against EU Toy Safety Directive 2009/48/EC.
The first full shipment — approximately 14,000 units across four SKUs — had cleared customs without issue. Market surveillance inspection was triggered not by port authorities but by a routine product sampling exercise conducted by a German state consumer protection agency (Verbraucherzentrale) in the third month of retail availability. Laboratory analysis of a retail sample identified two failures simultaneously.
The Three Failures
Failure 1: No EU Responsible Person Under GPSR
The General Product Safety Regulation (EU) 2023/988 — GPSR — became binding on 13 December 2024, replacing the General Product Safety Directive and introducing a mandatory EU Responsible Person requirement for all consumer products not covered by more specific product safety legislation. Every product placed on the EU market must display the full name and physical postal address of a designated EU Responsible Person who serves as the point of contact for compliance queries, product safety issues, and market surveillance authorities.
The manufacturer's product labelling identified only the manufacturer's name and address — a non-EU address. The Netherlands distributor's details appeared on import documentation but not on the product or packaging in any capacity that satisfied the GPSR Responsible Person obligation. When the market surveillance authority requested confirmation of the EU Responsible Person, neither the manufacturer nor the distributor could identify a formally designated entity. The distributor had not been informed of the requirement and had not assumed the legal role. The product was therefore non-compliant with GPSR Article 11 — a fundamental market access requirement that had been in force for over four months at the time of inspection.
Failure 2: REACH SVHC Phthalates Above the 0.1% Threshold
Laboratory analysis of the soft vinyl body of the toys identified the presence of DEHP (bis(2-ethylhexyl) phthalate) at concentrations ranging from 0.8% to 1.4% by weight — significantly above the 0.1% SVHC threshold under REACH Regulation (EC) 1907/2006. DEHP has been on the REACH SVHC Candidate List since 2008. It is also subject to a separate restriction under REACH Annex XVII, Entry 51, which limits phthalates including DEHP, DBP, BBP, and DIBP to a maximum concentration of 0.1% by weight in toys and childcare articles — a restriction that has been in force since 2015.
The manufacturer's internal conformity assessment had referenced the Toy Safety Directive's chemical requirements, but the phthalate restriction under REACH Annex XVII is a separate and additional obligation that applies independently of the Toy Safety Directive. The CE marking was therefore technically misleading: it implied conformity with applicable EU legislation, including REACH restrictions, when the product demonstrably failed to meet them. Under REACH Article 34, downstream users and distributors who receive goods that breach a restriction are themselves exposed to enforcement risk.
Failure 3: Incomplete Technical File and Non-Compliant Declaration of Conformity
When the market surveillance authority requested the CE technical documentation for the product range, the distributor forwarded what the manufacturer had provided: a one-page Declaration of Conformity listing the Toy Safety Directive (2009/48/EC) as the sole applicable legislation, with a conformity assessment methodology described only as "internal review." The technical file contained no third-party test reports from an accredited laboratory, no risk assessment for chemical substances, no reference to REACH Annex XVII phthalate restriction compliance, and no reference to GPSR — the regulation that had been in force since December 2024 and which the DoC should have addressed.
Under EU Toy Safety Directive Article 21, toys subject to third-party conformity assessment (including those with chemical substance compliance obligations) require type-examination by a notified body or, at minimum, comprehensive internal production control documentation. Soft vinyl toys containing plasticisers fall within the scope of chemical substance testing requirements that require laboratory verification — not internal review alone. The DoC was therefore not legally valid, and the CE marking was being applied without the technical basis required by EU law.
The Sequence of Events
The Cost Breakdown
| Cost category | Approximate cost (€) |
|---|---|
| Physical withdrawal logistics — four markets, four retail chains | €18,500 |
| Destroyed and unsaleable withdrawn stock (14,000 units) | €32,000 |
| Reformulation — new plasticiser compound, production retooling | €24,000 |
| Third-party laboratory testing — REACH, Toy Safety Directive, GPSR | €11,200 |
| CE technical file preparation and DoC revision by specialist consultant | €7,400 |
| EU Responsible Person appointment and GPSR labelling update | €3,800 |
| New packaging artwork and print run | €9,600 |
| Regulatory legal representation — authority correspondence, four jurisdictions | €22,000 |
| Administrative fines — REACH Annex XVII violation and GPSR non-compliance | €19,500 |
| Lost sales — five-month gap in EU market availability | €58,000 |
| Retailer relationship costs — penalty clauses and re-listing fees | €14,000 |
| Internal management time — estimated | €9,000 |
| Total estimated loss | ≈ €229,000 |
What Made This Preventable
All three failures share the same root cause: the manufacturer's conformity assessment was conducted in isolation from the current EU regulatory framework, and the distributor assumed the CE mark on the packaging meant the manufacturer had addressed everything. Neither assumption was valid.
The GPSR Responsible Person requirement had been publicly announced, widely covered in trade compliance publications, and was in force from 13 December 2024 — more than three months before this shipment was inspected. The phthalate restriction under REACH Annex XVII has been in force since 2015. DEHP's presence on the SVHC Candidate List has been established since 2008. Third-party chemical testing for toys containing soft PVC components is a standard expectation under EU market surveillance — not an edge case triggered by unusual product characteristics. None of these were novel or recently introduced obligations at the time the product was shipped.
A pre-market consumer goods compliance review covering GPSR obligations, REACH SVHC and Annex XVII phthalate screening, Toy Safety Directive third-party testing requirements, and CE technical file verification would have identified all three failures before the first unit reached a retail shelf. The cost of such a review — including laboratory testing, EU Responsible Person appointment, and technical file preparation — would have been in the range of €8,000 to €14,000. Against a total loss of over €229,000, the return on a pre-launch compliance investment in this case was between 16 and 29 times cost.
Key Regulatory Facts
GPSR (EU) 2023/988, Article 11 — Every consumer product placed on the EU market must display the name, registered trade name or trademark and postal address of an EU Responsible Person — the manufacturer (if EU-based), their authorised representative, the importer, a distributor, or a fulfilment service provider. The Responsible Person takes legal responsibility for product safety compliance and acts as the point of contact for market surveillance authorities. Non-compliance with the Responsible Person requirement is a standalone grounds for market withdrawal independent of any physical product safety concern.
REACH Annex XVII, Entry 51 — DEHP, DBP, BBP, and DIBP shall not be used in toys and childcare articles at concentrations greater than 0.1% by weight of the plasticised material. This restriction applies regardless of whether the toy is also subject to the Toy Safety Directive — REACH Annex XVII restrictions operate as additional and parallel obligations. DEHP is also listed on the SVHC Candidate List, triggering supply chain communication obligations when present above 0.1% by weight in any article.
Toy Safety Directive 2009/48/EC, Article 21 and Annex II — Toys must meet the chemical safety requirements of Annex II, which specifies maximum migration limits and concentration limits for hazardous substances including phthalates. Compliance with chemical requirements must be demonstrated through test reports from accredited laboratories — internal review is not sufficient where third-party testing standards apply. The Declaration of Conformity must reference all applicable EU legislation, including GPSR from 13 December 2024 onwards.
GPSR Article 9 and the EU Safety Gate — Market surveillance authorities are required to notify the Safety Gate portal when a product that presents a risk to consumer safety is identified. A Safety Gate notification is visible across all EU member states and triggers parallel scrutiny from national authorities in every market where the product is sold. A single Safety Gate notification effectively initiates market surveillance action in all four, fourteen, or twenty-seven EU member states simultaneously.
What a Pre-Launch Consumer Goods Compliance Review Would Have Identified
A standard pre-market consumer goods compliance review for a children's toy entering the EU would have identified all three failures before a single unit was placed with a retailer. The GPSR Responsible Person gap would have been caught as a first-line market access check — it is now a standard item on any EU consumer goods compliance checklist. The REACH phthalate issue would have been identified by chemical substance screening against the SVHC Candidate List and REACH Annex XVII restricted substance list, followed by laboratory testing of soft vinyl components. The DoC and technical file deficiencies would have been identified by comparing the manufacturer's documentation against the requirements of the Toy Safety Directive's conformity assessment procedures and the updated GPSR obligations.
Each of these checks is routine. None required specialist investigation or unusual technical expertise. They were missed because the compliance assessment was conducted internally, in isolation from the current EU regulatory framework, without third-party verification.
What to check before your next consumer goods shipment to the EU
- Confirm that a designated EU Responsible Person is in place under GPSR Article 11 — with their full name and postal address on the product or packaging — before the first unit enters an EU market
- Screen all product materials against the REACH SVHC Candidate List (currently 253 substances) and all applicable REACH Annex XVII restrictions — including phthalate restrictions for any product containing soft PVC or plasticised polymer components
- Commission third-party laboratory testing from an accredited test house for chemical substance compliance where product-specific requirements apply — internal review is not a substitute for physical testing where EU legislation requires it
- Ensure the Declaration of Conformity references all applicable EU legislation currently in force, including GPSR, and is updated whenever new legislation comes into effect that covers the product category
- Verify that the CE technical file is complete and includes the risk assessment, test reports, conformity assessment methodology, and product specifications required by each applicable directive or regulation — not just the directive considered most relevant by the manufacturer
- Brief your EU distributor or importer on their obligations under GPSR — including their potential role as Responsible Person if no other entity has been formally designated — so that responsibility is clearly assigned and documented before products reach retailers
Don't let the first Safety Gate notification be the first compliance review
TGC's expedited consumer goods audit covers GPSR Responsible Person requirements, REACH SVHC and Annex XVII substance screening, CE technical file verification, third-party testing coordination, and multi-market compliance gap assessment — delivered before your products reach the shelf.
Talk to an expert → Book an audit