The GPSR Regulation expects manufacturers, importers and those treated as equivalent to retain technical documentation and supporting documents on a product for a period of six years. If that file is missing at the moment a competent authority requests it, the problem is not that somewhere a checkbox is missing, but that you are unable at that moment to demonstrate what your risk analysis was based on at the time. This is a different situation than simply 'not having had time yet'.
What happens in practice depends on the cause. During a spot check, a competent authority typically requests access within a certain period. When a consumer complaint or notification via Safety Gate arrives, the request for documentation comes more quickly. In both cases, it matters not only whether the file ever existed, but whether it can actually be produced at the requested moment.
What is precisely missing if the file is incomplete
It is not a single document but a chain of substantiation: the risk analysis, the technical specifications, test reports or certificates you requested from your supplier, and the correspondence showing that you actually reviewed those documents. If part of that chain is missing, a competent authority cannot verify whether the assessment was made carefully at the time — even if the product itself has never given rise to complaints. The Regulation makes no distinction between 'we had it but lost it' and 'we never had it'; in both cases the evidence is missing at the moment it is requested.
For those uncertain whether this retention obligation even applies to their business, the distinction between manufacturer, importer and mere reseller is decisive. Someone who only resells without their own brand or modifications typically bears less of this documentation obligation than someone who markets a product under their own name. see in five questions which role you have provides an initial indication of this, free of charge and without needing an account right away.
What a competent authority sees during an inspection
A competent authority looks for coherence during an inspection: does the date of the risk analysis match the date the product was placed on the market, is the documentation for the correct version of the product, and is there a logical line between what the supplier provided and what was ultimately placed on the market. Missing documents stand out more than isolated shortcomings in a complete file. This in itself says nothing about the safety of the product — that is a different question than whether the documentation is in order — but it does determine how an inspection proceeds.
Even with a consumer complaint that comes through the internal complaint register, it may later become apparent that the substantiation of the original risk assessment is no longer complete. This makes it harder at that point to demonstrate what considerations were made at the time, precisely when it is most relevant.
Why this usually fails through dispersal, not through unwillingness
In practice, a file rarely becomes incomplete intentionally. Documentation is scattered across emails, a folder with the purchasing department, a supplier portal that is no longer accessible after a year, or a colleague who no longer works at the company. Six years is a long period for files that are not systematically recorded. the knowledge base with retention obligations per situation describes per product category which documents are relevant and how long they must be kept, so you do not have to reconstruct yourself what was ever requested per product.
How to prevent this without making it a full-time task
The key is not that you need to gather more documents, but that the documents you already have can be found in one place, linked to the correct product and the correct date. An internal compliance system that records per item which documents have been requested, when the risk analysis was prepared, and what the complaints register shows, prevents you from having to reconstruct documents during a subsequent inspection. how that recording is structured at gpsria.eu shows where the information comes from and how it is maintained per product.
Whether such a system is necessary for your business depends on how many products you market under your own name or brand and how often your assortment changes. what the subscription with dossier and compliance system includes provides a concrete picture of that, separate from the free role and obligation check that is accessible to everyone.
Do you first want to know whether this retention obligation is relevant to your situation before you invest time in a system? The free quick-scan gives you a first indication of that, and the knowledge base describes the underlying rules per topic without you needing an account right away.