what should I do if a customer says a product caused them injury

An injury report from a customer is a signal, not merely a complaint

A notification that a product has caused injury requires two things simultaneously: recording what the customer reports, and assessing whether this is an accident that must be reported to the regulatory authority. What follows depends on the role in the supply chain. Whoever places the product on the market under their own name or brand is considered a manufacturer under GPSR — even if the product was sourced elsewhere and only bears their own logo. This is a surprise for many online retailers who see themselves as intermediaries, but the role of "manufacturer" carries specific obligations that do not apply to someone who is genuinely a distributor. What the precise role of a reader is, is described on the page Am I a manufacturer, importer or distributor under the GPSR?, and the own-brand situation specifically on Am I a manufacturer if I put my own brand on a purchased product?.

For a manufacturer and an importer, an injury report means at minimum: recording the report in the internal register of complaints and incidents, determining whether it concerns an accident that falls under the reporting obligation, and if necessary, reporting to the regulatory authority. A distributor — someone who resells a product of another brand without modifying it — does not have that reporting obligation to the regulatory authority in the same way, but in practice is often the first to receive the signal and then passes it on to the manufacturer or importer. What a distributor must and must not do is set out on What are the obligations of a distributor under the GPSR?. When a reported situation exactly qualifies as an "accident" that must be reported is a separate question addressed on When do I have to report an accident involving my product? is handled.

Where this follows from: Article 20 and Article 9

Article 20 of Regulation (EU) 2023/988 regulates the obligation to report accidents caused by a product and refers to the Safety Business Gateway as the reporting channel. Article 9 of the same regulation requires manufacturers to maintain a register of complaints and non-compliant products, in which an injury report from a customer is recorded. The practical side of reporting itself is described on the Safety Business Gateway of the European Commission.