No fixed deadline, but a clear pattern
GPSR does not prescribe a specific number of days or weeks within which a risk analysis must be completed. There is no deadline in the regulation for preparing it, which means you cannot derive a hard deadline from it. What does exist: a fairly predictable pattern in how long it takes in practice, and that pattern depends almost entirely on how much information you already have and how much you still need to obtain.
For a simple product where the supplier already provides test reports and material data, a risk analysis can often be structured within a few hours to a couple of days. Once that information is missing, a product consists of multiple components, or there is uncertainty about which standard applies, the processing time quickly extends to several weeks. The latter says nothing about the safety of the product itself — only about how much investigation is needed before the analysis is complete.
Where processing time typically stalls in practice
Most delays do not occur when writing the analysis, but when waiting for others. A supplier who does not respond to a request for technical documentation, a manufacturer outside the EU who provides test reports in another language, or an importer who only later discovers that a certificate has expired: these are the moments when a process that should take a few days on paper drags on for weeks.
A second bottleneck is the number of variants. The same product in three colours and two sizes does not automatically mean three times as much work, but it does mean you must check for each variant whether the risks remain the same or differ. Those who do not structure this in advance often discover it midway through the process and must go back to the supplier.
A third bottleneck is unclear understanding of your own role. If you do not know whether you qualify as a manufacturer, importer, or distributor, you also do not know exactly which documentation you must prepare yourself and which you only need to request. This is a question that logically should come before the risk analysis, not alongside it. If you have not yet clarified this, have that clarified in a few questions before the rest of the file is built.
What does not wait for the analysis
A common misconception is that other obligations can wait until the risk analysis is complete. This is not so. The information that must be required on a product page, the language of warnings, and the presence of a responsible person in the EU are independent obligations that do not depend on the progress of your risk analysis. Those who delay the analysis until "the file is complete" run the risk that other components remain unnoticed. An overview of what belongs where is structured in the knowledge base by topic.
How processing time is reduced in practice
The steps that save the most time come before writing itself. Request supplier documentation as early as possible, and ask for everything you need in one go instead of in separate emails spread over weeks. Work with a fixed format per product category, so that each product is not built from scratch. And establish who within the organization is responsible for completing the file, so it does not get stuck between departments.
We structure the risk analysis and the associated product file, including a fixed format per product category — without us making a judgment on the outcome ourselves. That judgment, and the ultimate responsibility, remains with you or with the party you designate for it. What the structuring concretely delivers and what it costs is stated on the page with subscription options.
First know where you stand
Before the question "how long does this take" becomes relevant, it is useful to know whether and in what capacity the obligation applies to you. That is precisely what the free role check is for, and the answers to frequently asked practical questions are conveniently compiled at the frequently asked questions pageA half hour is often enough to see where you stand and what still needs to happen, depending on that.