An internal GPSR compliance system does not consist of one document that you prepare once and file away. It is a collection of documents that together demonstrate you maintain product safety systematically: the risk analysis and technical documentation per product, the complaints register, the recall procedure, proof of the six-year retention period, and a record of who in your organization holds which role when something goes wrong. None of these documents stands alone; they reference each other and must be able to do so.
The reason this is approached as a system rather than loose papers is that a supervisor or customer who asks for substantiation does not request one document but a chain: why was this product assessed as safe, what information was used for that, what happens when a customer files a complaint, and how is that complaint traced back to the risk analysis. If that connection is missing, each document may be in order individually, but the whole presents gaps that become visible at precisely the wrong moment.
What components the system consists of
The core of a compliance system is the combination of three layers. The first layer is product-specific: per article the risk analysis, the technical documentation and, where applicable, the declaration and documents you have requested from your supplier. The second layer is process-based: how do you record complaints and reports from users, who assesses them, and at what point is a risk analysis reviewed in response. The third layer is organizational: who in your company is responsible for maintaining files, who makes contact with a responsible person in the EU if needed, and how is it documented that documents are actually retained for six years instead of disappearing into an old folder somewhere.
For anyone still uncertain exactly what role their company plays in the supply chain, that is in fact the starting point before the compliance system itself: a manufacturer needs different documents than a pure reseller. Anyone who wants to clarify that further can do so have that clarified in a few questions.
The detail where things usually go wrong
On this subject one detail occurs more often than all the others: companies have the individual documents but not the connection between them. A risk analysis prepared at the time a product is introduced, for example, is never updated again after three complaints come in about the same component. Or the complaints register exists, but no one has agreed on when a complaint is reason to consult the recall procedure. The system works on paper, but not in practice, because the documents do not reference each other and no one has the task of maintaining that connection.
This is also why a compliance system is better set up as an ongoing process than as a one-time exercise. A file you prepare today and never open again loses its value as soon as something changes in the product, the supplier, or the regulations in a country where you sell. The connection between documents is therefore not only a matter of neatness, but determines whether the system actually works at the moment it is needed.
What you can do yourself and where structure helps
As a business, you can assemble many of the separate components yourself: request information from suppliers, set up a complaints form, keep track of who is responsible for which task. Where things often get stuck is maintaining an overview of how these pieces fit together for each product and in each market, especially as the number of items grows or you sell in multiple EU countries. A fixed structure in which risk analysis, dossier, complaints register and recall procedure remain linked to each other saves you investigative work at the moment when you need it least.
What a compliance system must contain in your specific situation depends on your role in the supply chain and the products you sell. A lawyer or the competent supervisory authority can assess that situation; this article only describes the structure that the regulation presupposes.
On gpsria.eu you will find a short answer per topic and an indication of what is relevant for your situation; the detailed templates and the linking between the components are part of the paid system. Curious where your business stands? Take the free role check or browse through the knowledge base with all GPSR topics listed. You can read more about how the information on this site is produced on the page explaining that process, and the differences between free and paid are clearly shown in the explanation of what each subscription offers exactly.