A draft of the European Product Act (EPA) has been leaked and, as we anticipated, it is shaping up to be one of the most significant overhauls of EU product law in over a decade, with potentially bigger ramifications than even the General Product Safety Regulation (GPSR).
The European Commission is expected to publish its legislative proposal on 6 October 2026, so the draft text may still change. However, if what is proposed in the leaked draft is agreed during the legislative process, there is no doubt that there are significant changes ahead for manufacturers, importers, distributors, authorised representatives and online marketplaces.
Here’s our take on what we’ve seen and what may happen next.
What is the EPA, and what is it trying to achieve?
The EPA would replace the 2008 New Legislative Framework package of legislation (NLF), which laid out general structures and principles for the marketing of CE-marked products, as well as the later Market Surveillance Regulation (MSR), which strengthened compliance and enforcement rules for products sold in the EU, with a particular focus on online sales.
The EPA forms part of a wider “European Product Package,” alongside a parallel revision of the EU Standardisation Regulation, and is designed to work alongside the GPSR, the revised Union Customs Code (UCC), and the Digital Services Act (DSA).
The Commission’s rationale for bringing forward new regulation is a familiar one, arguing that EU product rules have failed to keep pace with digitalisation, complex supply chains, circular economy models and ecommerce, particularly in relation to distance sales and direct imports.
To address these challenges, the EPA has come out firing with a range of significant proposals. Whilst economic operators may welcome the focus on increasingly digitalising product information, the requirement for all products to be registered with the newly proposed European Product Act Registry risks creating friction and additional burdens for economic operators. Doubling down on the detail of the obligations of economic operators and online marketplaces may be seen as helpful clarity by some, overly prescriptive by others. Stricter market entry requirements are designed to improve the overall safety of consumer products, but will need to be balanced with other impacts – including increased costs for businesses that could be passed on to consumers, as well as a growing perception that there is too much ‘red tape’ in EU product regulation. Some of the most eye-catching proposals involve minimum fines based on global turnover and the Commission taking on a direct role in policing compliance; as enforcement is traditionally a member state competence, it remains to be seen how such proposed bolstering of enforcement will pan out in practice.
What is potentially on the horizon?
The EPA is proposed as a regulation, instead of a directive, meaning it would have direct effect (therefore not requiring national laws to be passed by EU Member States for implementation). This reduces the risk of differences between EU Member States as they individually implement a directive. It usually means the impact is felt more quickly, too, with shorter transposition periods and no risks of delays in national implementation.
Some of the key proposals include:
- A big focus on digital by default, extending the current digital product passport regime and introducing a concept of “product responsibility record” where there is no legislation mandating a digital product passport. Also moving to digital CE marking.
- Essentially a pre-market registration requirement for all in-scope products with the creation of the European Product Act Registry. All products will need to have their digital product passport or product responsibility record registered before being placed on the market or put into service (with no get out for products being manufactured to order; they will need a pre-manufacture digital product passport).
- Complementary measures to the upcoming revised UCC mandating automated verification of the digital product passport and product responsibility record before goods are released for free circulation.
- Significantly strengthened oversight of third-party testing and certification agencies (“notified bodies”), including restructuring of the accreditation process.
- More detailed obligations for the EU-based responsible person, including a risk reporting obligation and specific obligations for fulfilment service providers and refurbishers.
- Greater verification obligations on online marketplaces in relation to product and compliance information before goods are listed for sale – though the draft is clear this can be met through automated search tools rather than independent human assessment, and is not intended to impose a general monitoring obligation.
- Stronger requirements on marketplaces to remove noncompliant products from sale, prevent their reappearance under a different listing and suspend [CS1] traders who repeatedly offer noncompliant products.
- A new market-surveillance fee applicable to products imported from third countries, intended to fund the additional costs of policing imported products.
- Bolstering market surveillance capacity across the Union and giving the Commission direct EU-level investigation and enforcement powers.
- EU Member States can determine their own rules for the penalties they impose. However, there are minimum requirements around which infringements must be subject to penalties, and that the penalties must be between 1% and 6% of global annual turnover – the list of in-scope infringements is extensive and ranges from including incorrect information in the digital product passport through to failure to take corrective action. There are also proposals for separate Union-level penalties of up to 6% of global annual turnover.
Which products and sectors are in scope?
All products currently covered by the NLF and GPSR are in scope – albeit the position on standalone software (e.g., apps and chatbots) reads unclearly to us. Whilst the GPSR does not expressly include standalone software, later statements and guidance made by the Commission clarified that standalone software was considered in scope. Here, the EPA adopts a different definition of “product” not previously seen before. It includes “any tangible or intangible substance or item as determined by the respective provisions governing the material scope of the relevant applicable Union harmonisation legislation, that can lawfully be the object of a transaction, whether interconnected to other substances or items or not”. The GPSR is not “Union harmonisation legislation”, which only adds to the lack of clarity here.
In practice, the EPA would consolidate the common rules currently found across multiple separate sectoral acts into a single horizontal framework covering manufactured products generally. This is no small feat and is likely to mean that there is going to be significant discussion about how the proposals are structured and executed.
Certain product categories are explicitly excluded, including food, feed, medicinal products, living plants and animals, products of human origin, and products relating to future reproduction of plants and animals.
The draft also introduces common rules for refurbished or substantially modified products, though these only apply where the relevant sectoral legislation opts in, and refurbishment itself is not made mandatory for any operator.
Why does this matter?
If adopted in a form similar to the leaked draft, the EPA would represent a broad reset of EU product compliance: a single, digitalised and more tightly enforced framework spanning manufacturers, importers, distributors, refurbishers, and online marketplaces alike, with a particular focus on closing the gaps that are perceived to have opened up around ecommerce and third-country supply chains.
Every business placing products on the EU market should expect closer attention to the identity and accountability of its responsible EU operator and its underlying compliance data, while online marketplaces face the most immediate operational changes.
All potentially affected businesses should start considering how the proposals might affect them and whether to provide stakeholder feedback.
What happens next?
The Commission is expected to publish its formal proposal for the EPA on 6 October 2026. As with any leaked draft, the text may change materially before then – as well as during the subsequent legislative process, where the new rules will need to be negotiated and agreed by the European Parliament and the European Council.
We are monitoring developments with the EPA closely and will publish a further update once the formal proposal is available. If you would like to discuss how these proposals could affect your business, get in touch with the Cooley International Products team.
Authors
Emma Bichet, Fergal Duggan, Rod Freeman, Claire Temple, Ed Turtle
