The General Product Safety Regulation, Regulation (EU) 2023/988, is a safety net for consumer products where no specific Union legislation governs the safety of the product concerned, and it applies only to aspects and risks not covered by specific requirements. It does not place a product in Annex I, and it does not by itself make an AI system high risk under Article 6(1). A consumer product with AI functions must therefore be examined in two steps: first, whether specific harmonisation legislation in Annex I covers it, and second, whether the general product safety framework covers the remaining safety aspects. Transparency and prohibited practice provisions of the AI Act may still apply even where the product route does not lead to high risk classification.
What is the general product safety safety net?
Regulation (EU) 2023/988 on general product safety lays down essential rules on the safety of consumer products placed or made available on the market. It applies to products insofar as there are no specific provisions with the same objective under Union law that regulate the safety of the products concerned. Where products are subject to specific safety requirements, the General Product Safety Regulation applies only to those aspects and risks or categories of risks that are not covered by those requirements. For products subject to Union harmonisation legislation, defined provisions of the General Product Safety Regulation do not apply insofar as the risks concerned are covered by that legislation. The Regulation is therefore a safety net, not a general product code. Its safety assessment takes account of the characteristics of the product, including aspects relating to cybersecurity features and evolving, learning and predictive functionalities where relevant. That express attention to evolving functionality makes it relevant to AI functions, but relevance is not the same as classification. The safety net and the AI Act product route answer different questions and must not be merged.
How does the safety net relate to Annex I?
Annex I and the General Product Safety Regulation operate at different levels. Annex I lists the harmonisation legislation that can bring an AI system into high risk classification under Article 6(1). The General Product Safety Regulation is not an Annex I entry, and a product that is covered only by that Regulation does not meet the Article 6(1) product condition on that ground. Conversely, a product that is covered by Annex I legislation may still be subject to the General Product Safety Regulation for aspects not covered by the specific legislation, subject to the disapplication provisions described above. A consumer product team should therefore map the product against both frameworks: the Annex I legislation that may cover it, and the general safety framework for any uncovered aspects. The map should cite the specific provisions relied on for each aspect, rather than stating in general terms that the product is safe or that it complies with product safety law. Where a product is a toy, a medical device or another Annex I product, the sector guide in this cluster should be read alongside this guide, and the sector file should take the lead for the covered aspects.
For the broader regulatory framework, see products, machinery and vehicles overview.
What AI functions in consumer products need attention even without high risk classification?
A consumer product can raise AI Act questions even where it is not high risk. Article 5 prohibited practices must be screened, including practices that exploit vulnerabilities of consumers. Article 50 transparency duties may apply where a consumer interacts with an AI system, where emotion recognition or biometric categorisation is used, or where synthetic content is generated or manipulated. Data protection law applies where personal data is processed, including data from connected products, voice recordings and location data. Consumer protection law applies to claims made about the product, including claims about what the AI function can do, and to the fairness of terms and practices. Product safety duties apply to the physical, electrical and cybersecurity safety of the product. A connected consumer product that learns from use raises a further question about how its behaviour changes over time and how updates are communicated to the consumer. The product record should address each of those areas separately, with the evidence for each, rather than recording a single conclusion that the product is compliant. A clean result on product safety does not answer the transparency question, and a clean result on transparency does not answer the safety question.
How should evolving and learning functions be assessed?
Evolving, learning and predictive functionalities change the safety assessment because the product that is tested before placing on the market may not behave in the same way after a period of use. The assessment should describe the learning mechanism, the data that drives learning, the limits placed on learning, the testing performed on the learning function, and the monitoring of behaviour after placing on the market. It should address what happens when the product encounters data outside its training distribution, when it is used in a way the manufacturer did not foresee, and when an update changes its behaviour. Instructions should tell the consumer, in plain language, what the product does, what it does not do, and what the consumer should do if the product behaves unexpectedly. The manufacturer should also plan for corrective action, including updates, warnings and, where necessary, withdrawal or recall, under the product safety framework. The record should show the version history, the changes made and the safety assessment for each version. A product whose behaviour changes without a recorded assessment for the change will be difficult to defend if a safety issue arises.
What duties do importers, distributors and online marketplaces have?
Consumer product safety duties are not limited to manufacturers. Importers and distributors have duties under the General Product Safety Regulation and under the sector legislation that applies to the product, including duties to verify documentation, to keep traceability records, to cooperate with market surveillance authorities and to take corrective action where a product is dangerous. Providers of online marketplaces have specific duties under the General Product Safety Regulation in relation to the products offered through their interfaces, including cooperation with authorities and action on dangerous products. The AI Act adds operator duties for importers and distributors of AI systems, including verification and cooperation duties that are dealt with in the deployer and operator cluster of this site. A retailer or marketplace that sells a consumer product with AI functions should therefore check both the product safety chain and the AI Act operator chain, and should record the supplier information, the product identification and the corrective action arrangements. A product that is safe in the hands of the manufacturer can become unsafe if the supply chain does not preserve instructions, warnings and update arrangements.
Continue with Annex I Section A and Section B.
What does this guide not decide?
This guide does not decide whether any named consumer product is safe, does not reproduce the General Product Safety Regulation in full, and does not decide whether an AI function in a consumer product is prohibited, high risk or subject to a transparency duty. It does not address the specific safety requirements for any product family, which must be checked in the sector legislation where it exists. A manufacturer, importer, distributor or marketplace with a specific consumer product should confirm the product safety position, the Annex I position and the AI Act screens with a competent authority or legal adviser. General product safety is a safety net, not a substitute for product specific assessment.
Frequently asked questions
Does the General Product Safety Regulation make a product high risk under the AI Act?
No. The General Product Safety Regulation is not listed in Annex I, so coverage by that Regulation alone does not meet the Article 6(1) product condition. High risk classification under Article 6(1) needs Annex I legislation and third party conformity assessment under that legislation. Other AI Act provisions may still apply to the product.
What if a product is covered by both sector law and general product safety law?
The sector law governs the aspects and risks it covers, and the General Product Safety Regulation applies to aspects and risks not covered, subject to its disapplication provisions for harmonised products. The product file should map each aspect to the legislation that governs it, with citations, rather than applying one framework to the whole product.
Do learning products need ongoing monitoring?
Yes, in practical terms. A product whose behaviour can evolve needs a monitoring plan, a change record and corrective action arrangements. The safety assessment should address learning, data, limits, testing and post market behaviour, and instructions should explain the behaviour to the consumer in plain language.
Who else besides the manufacturer has duties?
Importers, distributors and online marketplaces have duties under product safety law, and importers and distributors of AI systems have operator duties under the AI Act. The supply chain record should show who did what, with traceability and corrective action arrangements, and specific questions should be confirmed with a competent authority or legal adviser.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗