do I need to create a separate product file for each colour or size variant

A separate risk analysis per variant, even if the documentation looks similar

Yes, in most cases every colour or size variant requires its own assessment, even if the base product is identical. This sounds more demanding than it often is: if colour or size does not change the risks — think of a T‑shirt available only in different colours — then much of the risk analysis can be carried over between variants. But as soon as a variant uses a different material, contains different sized small components, or is intended for a different age group (for example children's sizes versus adult sizes of the same toy), the risk profile changes. And that is precisely where a single file for the entire range falls short.

This applies to the manufacturer role, and that role deserves extra attention here: anyone selling a product under their own name or own brand is classed as a manufacturer under GPSR — even if it concerns a purchased base product with only their own logo applied to it. For that role, the risk analysis and technical documentation belong with the product, not with the brand name in general. A distributor — anyone reselling products of another brand without modifying them — does not need to draw up these files themselves; that role checks whether the manufacturer or importer has their part in order, but does not compile the risk analysis themselves. Anyone uncertain which role applies will find the breakdown in whether you are a manufacturer, importer or distributor.

Where that follows from: article 9, assessed per product

Article 9 of Regulation (EU) 2023/988 requires the manufacturer to conduct an internal risk analysis and technical documentation, and that obligation is tied to the product as it is placed on the market — not to a product line in general. A colour or size variant that is factually a different product in terms of material, size or intended user group thereby falls under its own assessment. The traceability obligation in article 18 also extends to the level of the specific product, which in practice means that documentation per variant must be identifiable and traceable. How that risk analysis per product is built up is set out in conducting a risk analysis for a product under GPSR, and how long that documentation per variant must be kept is set out in retention period for product documentation.