EU GPSR for IPL Devices: Who Signs, What Goes on the Label, What the Factory Hands Over

Short answer: since 13 December 2024 a home IPL device can only be placed on the EU market if an operator established inside the EU is named as the responsible person, with a postal and electronic address, on the product or its packaging. A factory outside the EU cannot be that operator. What the factory can do is hand the seller the data pack that makes the appointment work.

The date, and why it keeps coming up

13 December 2024 is when Regulation (EU) 2023/988 took over from the General Product Safety Directive that had been in place since 2001. Nearly two years on, the practical effect has less to do with customs than with paperwork arriving at the wrong moment.

Here is the pattern. A brand owner gets a listing live, orders the first production run, and then a marketplace review or a distributor’s compliance questionnaire asks one question: who is the EU responsible person for this product, and where is the address on the packaging? If the answer is a Chinese factory address, the listing stops. Not because the device is unsafe. Because the label names nobody who can be held responsible inside the EU.

In our experience the paperwork stage stops more shipments than the technical stage does.

The responsible person is your buyer’s legal duty, and your documentation duty

Under the regulation, the operator named on the product must be established in the EU. For a manufacturer outside the EU, the route is a written mandate appointing an importer, an authorised representative, or a fulfilment service provider.

That appointment is signed by your customer. The factory cannot sign it, cannot be named in it, and should never let its own address be printed where the responsible person’s address belongs. What the factory controls is whether the appointment can be completed at all.

What the written mandate needs before anyone signs

An EU operator will not accept the role on a promise. Expect them to ask for the technical file, a risk analysis, the declaration of conformity with the standards actually applied, and evidence that units can be traced back to a batch. If those four things do not exist, the mandate does not get signed, and the order does not ship.

The data pack: six items, and who produces each

Item	What it contains	Who produces it	Why the EU operator needs it
Technical file	Design and construction information, schematics, component list, photos of markings	Factory	Kept for ten years; produced on request to market surveillance
Risk analysis	Hazards identified for intended use and foreseeable misuse, with the measures taken	Factory	The regulation asks for an internal risk analysis, not a generic safety statement
Declaration of conformity	Regulation and standards applied, model identification, signatory	Factory or the legal manufacturer named on the DoC	Must match the standards in the test reports, and must match the model on the carton
Test report list	Which standards were tested, by which body, on which model, with dates	Factory	The operator needs to know what is covered, and what is not
Traceability coding	Batch or serial number, and where it sits on the unit and the carton	Factory	Without it, a recall cannot be scoped
Label artwork	The full label block, including the EU operator’s name and address	Factory drafts, operator confirms	The address that goes on the box belongs to the operator, not the factory

Two of those items are the ones that most often arrive late. The risk analysis, because factories tend to treat it as a formality, and the label artwork, because the EU operator’s details are only known at the end of the project. Both can be drafted early with placeholders. Neither can be improvised at the port.

Two doors, and the factory only gets to walk through one

Home IPL devices reach the EU by one of two routes, and the paperwork is different for each. The choice belongs to the brand, not to the factory, but the factory has to say clearly which route it can support.

	Consumer electrical route	Medical device route
Legal basis	Low Voltage Directive, EMC Directive, RoHS, with a Declaration of Conformity	MDR 2017/745; home IPL sits under Annex XVI, class IIa
Who assesses	Self-declaration, backed by test reports from an accredited lab	Notified body, with a certificate issued to a named manufacturer
GPSR	Applies, since no sector legislation covers general product safety for these risks	Applies only where MDR does not cover the same risks
Typical timeline	Weeks, once the design is frozen	Months, and the certificate is held by one legal entity only
What the buyer must arrange	EU responsible person, plus importer details on the label	Everything above, plus the certificate holder relationship

We wrote separately about which route applies to which device and why the MDR certificate question is usually aimed at the wrong party. Worth reading before a European buyer asks you for an MDR certificate on a device you place as consumer electronics.

Four mismatches that stop shipments

Not safety failures. Paperwork that does not agree with itself.

The DoC names a standard the report does not cover. A declaration citing an older edition of a standard while the report tests the current one is the most common version of this. Customs rarely reads it. The EU operator’s compliance consultant does, and rejects it.

The model number on the certificate and the carton disagree. Your product family has a platform name, a model code, and a customer SKU. If the DoC says one and the master carton says another, the responsible person cannot connect the shipment to the file. The fix is a single model identification table agreed with the buyer before the artwork is approved.

No batch code, so a recall cannot be scoped. Traceability is not paperwork for its own sake. If a batch is questioned, the operator has to know which units came from it. A date code printed on the inner box, referenced in the packing list, is enough. Nothing at all is not.

The label names the factory where the responsible person’s address belongs. This happens when a factory template has its own address in the manufacturer block and the customer’s EU address gets added next to it, in the wrong field. The label then states two parties, and the operator is not one of them.

What the label block looks like when it is right

Manufacturer:      <legal entity, country>
EU responsible:    <operator name>, <postal address>, <email>
Model:             <model code as used in the DoC>
Batch / date code: <code as used in the packing list>
Electrical rating: <V, Hz, W>
Warnings:          <the wording the operator's market requires>
CE marking:        <placed per the applicable directive>

The empty field is the point. The factory can print and pre-verify every line except the second one. That line arrives from the customer, and until it does, the artwork is not final.

What we hand over, and what we do not

We produce the technical file, the risk analysis, the declaration of conformity with the test report list, the traceability coding, and label artwork ready for the operator’s details. We do not act as the EU responsible person, we do not appoint one on a customer’s behalf, and we do not put a certificate number on our site that we cannot produce the original of on request.

If you are planning an EU launch and need this data pack assembled before the label goes to print, the private label process we run lists which documents are issued at which stage. For the claims side of the same conversation, how regulators classify home IPL devices shows where claim wording changes the route in each market. And if the device is still at the specification stage, the model range is where to start, because the route you choose shapes the file you will need.