DSARs in the age of AI — why you should resist the siren call of simplicity

Our data protection team examines the risks of relying on oversimplified legal arguments in DSAR disputes and highlights key lessons for data controllers.
Talk to us: 0333 004 4488 | hello@brabners.com | Contact us
6 min read
Regulatory & Professional Conduct, Retail, Manufacturing & Supply Chain, Technology, Media & Telecoms

The new General Product Safety Regulation (Regulation (EU) 2023/988 - GPSR) aims to address the risks posed by digital technology and to close regulatory gaps in the EU's fragmented product safety regime.
Here, our regulatory team explores the impact of the GPSR for manufacturers, providers of online marketplaces and consumers.
The GPSR entered into force on 12 June 2023 and is applicable to businesses and national market surveillance authorities from 13 December 2024. It’s set to enhance the protection of EU consumers against hazardous non-food products sold both offline and online. Given that the regulation applies to all non-food products and all sales channels, it provides a safety net for products or risks not covered by other EU legislation as well as new products that might be placed on the market in the future. It also modernises the EU general product safety framework to address new challenges posed by tech.
While the GPSR applies to certain consumer products, in practice it doesn’t introduce substantive new obligations where there is product-specific regulation already in place. It includes a series of exemptions such as human and veterinary medicines, food and feed and antiques.
That said, the GPSR marks a significant step towards enhancing product safety and ensuring consistent enforcement across the EU, benefiting both consumers and businesses. It’s particularly significant for UK companies that sell products to consumers in the EU and Northern Ireland.
The GPSR introduces several key provisions to enhance product safety.
Economic operators — including those outside the EU — must appoint a ‘responsible person’ based in the EU to ensure that technical information, instructions for use and safety information are available.
The regulation expands the definitions of "product" and "safety" to include emerging digital technologies. It considers the interconnectivity of products, cybersecurity features and a product's evolving, learning and predictive functionalities. There is an ongoing debate about whether standalone AI software is included in the definition of "product", but the regulations do apply to AI systems integrated within consumer products.
The GPSR also addresses safety challenges associated with evolving technologies, ensuring products remain safe throughout their lifespan — including through software updates.
The regulation takes into account the vulnerabilities of certain consumer categories such as children, by addressing safety issues related to food-imitating and child-appealing products.
Businesses are also encouraged to consider precautionary measures when scientific evidence shows high stakes, even if the human health hazard is uncertain.
The regulation establishes specific product safety requirements for providers of online marketplaces so that consumers are protected whether they shop online or in physical stores.
Providers of online marketplaces have new duties to prevent the sale of dangerous products — including cooperating with market surveillance authorities (MSAs) if a dangerous product is found on their platform — and establishing a single point of contact for product safety. MSAs can require online marketplaces to remove dangerous products or disable access to their listings.
Manufacturers must conduct a risk assessment before placing a product on the EU market, considering new criteria such as gender-related differences, risks to vulnerable consumers (e.g. children), interconnection with other products, cybersecurity and the product's evolving functionalities. For complex products, this could involve significant time and expense.
Communication between consumers, businesses, national authorities and the European Commission will improve under the regulation. The GPSR emphasises the importance of reporting accidents, requiring economic operators to notify the relevant authority via the Safety Gate system without undue delay after becoming aware of an accident. If the manufacturer isn’t based in the EU, its ‘responsible person’ must report the accident.
There are also stricter rules for investigating and keeping records of complaints. Economic operators may need to establish a traceability system for products that present serious health and safety risks. The GPSR creates a unified market surveillance regime for all products and aims to improve the effectiveness of product recalls, entitling consumers to a repair, replacement or refund and allowing them to choose between at least two of these remedies.
Finally, the GPSR ensures better enforcement of product safety rules and market surveillance, protecting diligent companies against rogue traders.
Following Brexit, Northern Ireland continues to align with EU product safety rules. This means that there will be differences between product recall requirements in Northern Ireland and Great Britain, which will increase once the GPSR applies. The GPSR will apply to Northern Ireland under the Northern Ireland Protocol, as amended by the Windsor Framework.
In November 2024, the UK Government published its response to its own Product Safety Review. Key priorities include addressing the sale of unsafe goods through online marketplaces and ensuring that emerging hazards across multiple sectors are adequately managed. The Product Regulation and Metrology Bill is progressing through Parliament and the Government has indicated that it will align UK requirements with those of the EU where it makes sense to do so.
As a regulation rather than a directive, the GPSR ensures greater consistency in product safety regulation and enforcement across the EU. It strengthens responsibilities across the supply chain to offer equal conditions for businesses active in the EU, providing more legal certainty for businesses with clearer rules and more even application of product safety rules via the choice of regulation as a legal instrument.
All manufacturers selling products into the EU need to be fully versed in the new obligations —including how the GPSR interacts with product specific regulations — to ensure ongoing compliance when placing products on the EU market. Our product regulatory specialists can help guide you through the new requirements.
Talk to our team by giving us a call on 0333 004 4488 or email us at hello@brabners.com or completing our contact form below.
Loading form...

Our data protection team examines the risks of relying on oversimplified legal arguments in DSAR disputes and highlights key lessons for data controllers.

We examine the key changes introduced by the Digital Omnibus on AI, what remains unchanged and how businesses should respond.

We explore the legal issues under consideration by the ICO and Ofcom and what the case tells us about the UK's future regulation of AI-generated content.

We lay out how the Code will work in practice and what organisations should be wary of when it comes to facilities, participation and verification.

The Government's 'ending one-sided flexibility' consultation signals significant change for hospitality employers. We explore what employers need to know.

Football clubs are facing heightened scrutiny over their commercial partnerships. We explore the risks and steps that they should take to stay compliant.

What can we learn from the BrewDog shareholder emails? We outline key compliance risks and practical steps to consider before sending communications.

We explore the ESPR’s implications for M&A and outline what businesses should be doing in response.

We outline some of the key commercial and legal considerations for parties considering a franchise arrangement.

We explore the allegations against Roblox, wider challenges of protecting children online and steps that platforms are expected to take.

We've announced our largest-ever round of Partner promotions, with six lawyers joining the partnership following another year of sustained growth.

We explore what Stargate UK reveals about the hidden energy cost of AI and break down what this means in practice.

We examine the issues at the heart of the claim and outline what the decision could mean for franchise businesses.

We explore the key insights shaping the future of games, digital creative and tech from this year’s FORMAT Group Summit.

We outline the pivotal role of the NOI in Beauty Bay’s administration and break down the key takeaways for retailers.

Live from Old Trafford, we explored the realities of geopolitical risk, security threats, commercial sustainability and the growing role of technology.

We explore the key changes and outline the practical steps that retailers need to take ahead of 2027.

We explore the tension between AI‑driven optimism and growing fears of an overinflated tech bubble.

We explore how commercial partnerships in motorsport are evolving and outline the practical considerations for sponsors and rights holders.

True North co-chair Michael Hayman breaks down how mood, behaviour and local leadership are influencing the economy.

We explore what the HFSS regime means in practice, break down how the ASA is applying the rules and outlines the steps that retailers should take now.

We explore four recent food VAT decisions — from KFC dip pots to poppadom snacks — highlighting the key takeaways and practical steps for businesses.

We explore how financial distress is likely to impact the construction industry in the years ahead — and why early, strategic legal advice will be critical.

We explore the decision, its legal context and its implications for selective distribution and online sales controls.

We explain why uncontrolled use of public AI tools creates real confidentiality and data protection risks and outline how you can manage them safely.