can I have the risk analysis for my product carried out by an external company

Execution by an external firm is permitted; responsibility remains with the manufacturer

Yes, the performance of the risk analysis can certainly be outsourced to an external firm, a test laboratory, or a consultant. The regulation does not prescribe who must physically prepare the analysis — it prescribes who is accountable for it. And that is the person who acts as the manufacturer. An external firm can do the work, but responsibility for the content and completeness of the product dossier remains with the manufacturer, even if that manufacturer has not written a single line of the analysis itself.

This immediately raises the question of who in this chain acts as the manufacturer, and it is broader than many business owners think. Anyone who sells a product under their own name or own brand acts as a manufacturer — even if the product is entirely purchased from a third party and only their own logo has been placed on it, and also anyone who substantially modifies a purchased product. A webshop that does this and considers itself a distributor is therefore not: the obligation to perform a risk analysis belongs to the manufacturer role, and that role applies more quickly than anticipated. A distributor without its own brand does not need to prepare its own risk analysis; it only checks whether the required information is present. More about this distinction can be found at the role check for manufacturer, importer or distributor.

Where this follows from: Article 9 and the role of the manufacturer

Article 9 of Regulation (EU) 2023/988 places the obligation for internal risk analysis and technical documentation with the manufacturer, without prescribing who actually performs the work. Article 11 confirms this for the importer: the importer checks whether the manufacturer has fulfilled its obligations, but does not prepare its own risk analysis. Article 12 places only an obligation on the distributor to check the presence of the required information — no obligation to conduct its own analysis. How that analysis looks in terms of content is described at the structure of a risk analysis and technical documentation, and which documents can be requested from a supplier at the documents that can be requested from the supplier.