must I take out product liability insurance as an online shop

GPSR imposes no insurance requirement, but does regulate who is liable

GPSR itself does not mandate insurance. The regulation governs what a market participant must do if a product proves unsafe: notify, recall, and offer the consumer an appropriate remedy. Product liability insurance is thus a separate instrument — it covers financial loss if injury or damage occurs and a claim follows, while GPSR sets out the process that precedes this: alert, intervene, inform.

Whether insurance makes sense depends heavily on your role in the supply chain. Whoever qualifies as a manufacturer bears responsibility for the product itself: the risk analysis, the technical documentation, and in the event of an incident, the notification obligation and any recall action. And here lies the surprise that many online retailers overlook: anyone who places their own brand or logo on a purchased product is deemed a manufacturer under GPSR — even if nothing about the product itself has been changed. An online retailer who misses this and thinks of itself as a distributor may also underestimate the liability risk that comes with that role. A true distributor, who sells products unchanged without their own brand on them, bears significantly lighter responsibility: no risk analysis, no technical documentation, but the obligation to pass on any information about safety concerns. Which obligations a distributor does and does not have is therefore precisely the question that needs to be answered first, before the question about insurance.

What the regulation does regulate: notification, recall, remedy

Article 20 of Regulation (EU) 2023/988 requires market participants to report an accident involving a product; Articles 35 and 37 govern the recall and the remedy available to the consumer. These articles address the process after an incident, not its financial settlement — when an accident must be reported and what a recall entails are separate from the question of whether and how the costs are insured. For the latter, the regulation provides no provision; that is the domain of liability law and the insurance market, not GPSR.