Spain product safety for non-EU sellers (Consumo and the comunidades autónomas)

Spain has no GPSR act of its own. GPSR: what it is, and who it reaches applies directly, the consumer authorities enforce it, and the fines come from the consumer-protection law, Real Decreto Legislativo 1/2007: EUR 10,001 to 100,000 for a serious infringement and EUR 100,001 to 1,000,000 for a very serious one, or more where the unlawful gain was larger. What Spain sets on top: enforcement by the Ministry of Consumption together with the autonomous communities, Castilian for the safety information, a joint liability for the importer or first distributor in Spain, and a customs notification and SOIVRE clearance before release for a list of products. The overview of every Spanish rule for a non-EU seller is on Selling in Spain as a non-EU company.

Consumo and the autonomous communities enforce GPSR in Spain

The Ministerio de Derechos Sociales, Consumo y Agenda 2030 (Consumo) and the autonomous communities share the work.

Which community acts on you. A community handles infringements committed, even in part, in its territory. An infringement committed over the internet counts as committed where the consumer habitually lives, for a sale or for an offer actively directed at that consumer (RDL 1/2007 art. 52 bis(2), (3)). So the buyer’s community is competent, and a seller with no seat in Spain has no community of its own. The Ministry’s answers tell operators to write to the community where their company has its registered seat (FAQ, introduction).

When the State acts alongside. The State takes the case when the infringement harms consumers in a generalised way across more than one community, so that national market unity may be affected (art. 52 bis(5)). The communities keep their competence, and the State counts their earlier sanctions. The Dirección General de Consumo decides when the sanction does not exceed EUR 100,000 and involves no temporary closure, and the State’s consumer Secretaría General decides in the other cases. That Secretaría General’s competence also extends to infringements committed through the internet when the infringer’s residence or domicile, where it is the place the business is actually run from, is outside the EU. The article ties that rule to the same paragraph and does not say whether the multi-community test must also be met, and the Ministry’s answers do not address a non-EU seller’s case. This is a genuine open edge.

Dangerous products are exchanged between the authorities through the Red de Alerta nacional, which is connected to the EU Safety Gate. The EU side, and how you notify, is in RAPEX (Safety Gate) and Safety Business Gateway.

The Regulation applies, and Real Decreto 1801/2003 is still on the books

The Ministry names no Spanish act that adapts Regulation (EU) 2023/988Regulation (EU) 2023/988, General Product Safety RegulationThe whole regulationClick opens the law on the EU Publications Office.. It says Real Decreto 1801/2003 transposed Directive 2001/95/EC, which the Regulation repealed from 13 December 2024, that the Regulation needs no transposition, and that its duties are the ones to follow, with national rules standing for aspects that do not contradict it (FAQ 1.2).

The BOE still lists the decree as in force. Its only changes are from 2011 and 2018, and none mentions the Regulation. The Ministry does not say which of its articles still apply. What it sets beyond the Regulation:

• The authorities warn and require compliance (art. 9), then prohibit sale, withdraw, recall or destroy the product (art. 10), and take provisional measures while the procedure runs (art. 11(2)).
• The measures can be directed at producers and distributors, in particular the one responsible for the initial distribution in Spain (art. 12(1)).
• The costs of withdrawal, recall, special notices, storage, transport and destruction fall on those whose illegal conduct caused them (art. 12(4)).
• Producers and distributors cooperate with the authorities in the actions taken to avoid risks, and answer a request for information within five days at most, trade secrets included, or sooner if the case is urgent (art. 6(4)), if that rule still applies next to the Regulation.

Fines come from the consumer-protection law

Art. 44 of the Regulation leaves penalties to each country. The Ministry says Spain’s regime is Title IV of Real Decreto Legislativo 1/2007, whose breach types it calls broad enough to cover a breach of the Regulation, without prejudice to other applicable regimes (FAQ 9.1). Failing the safety provisions where they affect or may put consumers at risk is an infringement under art. 47(h).

The bands are in art. 49(1). The gain counts the extra income and the costs saved (art. 49(3)).

Which grade your breach gets.

• A safety breach under art. 47(h) is listed as serious (art. 48(2)(b)). It becomes very serious if an aggravating circumstance of art. 48(3) applies, such as total failure to meet the duties, habitual conduct or being a repeat offender. Art. 48(1) also sends infringements that harm safety to the grading of art. 35 of Ley 14/1986, from minor to very serious. The text does not say whether 47(h) goes there or under 48(2)(b).
• Refusing data to the inspectors (47(i)) is minor. Ignoring an order or a provisional measure of the administration (47(o)) is serious.
• The grade drops by one if, before the procedure starts, you correct the breach diligently with no direct harm done, return the sums charged voluntarily, cooperate actively to avoid or reduce its effects, or behave spontaneously in any other comparable way (art. 48(4)). The reduction is disregarded, and the fine is then set at its maximum degree, for a continued infringement or habitual practice, and for one carrying a risk to health or safety unless the risk is part of the offence. Art. 47(h) is itself written around risk, which on its wording leaves the reduction open; no Spanish text read confirms it.
• A fine that is out of proportion to the offender’s economic capacity can be set in the band of the grade below (art. 49(1)).

On top of the fine.

• The authority can seize the goods, publish minor and serious sanctions once final, with your name, where there is a risk to health or safety, a repeat offence or proven intent, close the business for up to five years for a very serious infringement, and require the breaches to be corrected (art. 50). Final resolutions on very serious infringements are always published on the authority’s website with the infringer’s name (art. 49(7)).
• Each person in the chain answers for its own infringement, and the directors and the technicians responsible for control of a company can be held responsible too (art. 51(2), (5)).
• A safety withdrawal is not a sanction (art. 49(4)). It comes first and apart from any fine, at the expense of whoever caused it (art. 15(1)).
• Infringements lapse after five years (very serious), three (serious) and one (minor). A procedure not resolved nine months after it starts lapses, and a new one can open while the infringement has not lapsed (art. 52(1), (6)).
• An autonomous community can extend these amounts and time limits by law (art. 46(11)).

Ley 21/1992 de Industria, the general industrial-safety law, fines up to EUR 60,000, 6,000,000 and 100,000,000 (art. 34). The Ministry’s answer on penalties names Real Decreto Legislativo 1/2007 and no other act, and no official page read names Ley 21/1992 as a route for a breach of the Regulation, so the page does not treat its EUR 100,000,000 ceiling as a GPSR fine. The other countries’ amounts are in GPSR fines: what each country sets.

Spain’s authorities have asked responsible persons for proof

Two EU-wide sweeps under the Regulation show how Spain checks a seller. The first, in the second quarter of 2025, covered online childcare articles. Spain analysed 100 items of 12 types on 9 platforms, among them Amazon, AliExpress, Shein, Temu, Etsy and eBay, and found 15 types of non-compliance: missing or partial data on the manufacturer, on the EU responsible person and on the product identifier (2025 results).

The second, in 2026, covered childcare articles and sports equipment (2026 report). Spain checked 67 offers on 8 platforms:

• 56% showed some failure in the mandatory information.
• 27 orders went to platforms. Platforms acted within the two working days of Art. 22(4) on 5 of them.
• The authorities emailed the responsible persons and asked for an answer within ten calendar days: confirm you are the responsible person, confirm your contact details are on the physical product, confirm the product is the one in the technical documentation, and give documented evidence of the periodic checks of Art. 16(2).
• Measures were taken or planned in at least 18 offers against the responsible person. The report says proposals for sanction files for not answering requests for information or documents are not ruled out.

The responsible person is in the EU, and Spain adds the importer’s duty

The Regulation asks for an economic operator based in the EU who carries the tasks of Art. 4(3)Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office. of Regulation (EU) 2019/1020Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office. (Art. 16(1)Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office.). The Ministry asks for one established in the EU, not in Spain, and says every product needs one. It describes the role as a cascade, says an operator that is only a distributor is not the responsible operator, and says a marketplace acting only as a marketplace cannot sell a product with no responsible person in the EU (FAQ 3.4, 3.5, 3.7). Who can be yours is in EU Responsible Person: who can be yours, and what it costs.

Spain adds a duty of its own. Importers and those who distribute a consumer product that can affect safety for the first time on the Spanish market must make sure it meets the requirements. They also answer jointly for the sanctions on their suppliers when, within their duty of care, they did not take the measures within reach, information included (RDL 1/2007 art. 51(4)). If you sell through a Spanish importer or distributor, give it the technical documentation and the safety information it needs to show that diligence. Supplying goods without the mandatory safety marks or the minimum data that identify the person responsible for the goods is prohibited, and so is importing products that do not meet the law (art. 13(e), (g)).

Safety information is at least in Castilian

The Regulation leaves the language of instructions and safety information to the country where the product is sold (Art. 9(7), 11(4), 19(d), 21). Spain sets it in RDL 1/2007 art. 18(3): the mandatory indications on the labelling and presentation of goods sold in Spain are at least in Castilian, the official Spanish language of the State. The Ministry applies that to Art. 9(7): an official language easily understood by Spanish consumers, and at least Spanish (FAQ 2.6).

Real Decreto 1468/1988 says the same for industrial products sold to consumers (art. 8.1):

• The minimum data include the instructions, warnings and safety conditions where needed for correct and safe use (art. 7.5).
• The data may sit in a leaflet that goes with a durable product or where space is short (art. 8.3).
• Products with their own labelling rules are excluded (art. 3). The decree is older than GPSR and still speaks of the “Comunidad Económica Europea”.

For the offer, the Ministry says the safety information goes next to the offer, in a language easily understood by consumers, and names no language (FAQ 2.3). Write the warnings in your listing in Spanish too: art. 18(3) covers the presentation of the goods, and Art. 19(d) hands the language to Spain. What to print is in GPSR label: what to print, with examples, and the EU rule on manuals is in EU user manual requirements under GPSR.

Notifying and recalling in Spain

The duty is the EU one: when you consider or have reason to believe a product you placed on the market is dangerous, you take the corrective measure, inform consumers and inform the authorities through the Safety Business Gateway (Art. 9(8), 11(8)). The steps are in product recall under GPSR. The Ministry points operators to the Gateway (FAQ 5.2). The Spanish layer:

• The recall notice template of Implementing Regulation (EU) 2024/1435 is voluntary, but the elements it lists are mandatory (FAQ 6.1).
• When the authority takes the withdrawal, recall or destruction itself, it organises it and you must help, at the cost of whoever caused it (RD 1801/2003 art. 12; RDL 1/2007 art. 15(1)).
• The decree also tells producers and distributors to notify the community authority at once (art. 6). The Ministry does not say whether that applies next to the Gateway.
• When an alert concerns a product from a third country, the alert is passed to the customs authorities (RDL 1/2007 art. 15(3)).
• A marketplace that receives an Art. 22(4) order acts within two working days and reports the effect to Spain’s Safety Gate contact point, reddealerta.dgc@consumo.gob.es (FAQ 5.5). That address is for marketplaces; you notify through the Gateway.

Listed products need SOIVRE clearance before customs release

Real Decreto 330/2008 adds a control at the border. For the products in its Annex I, the SOIVRE inspection service of the Direcciones Territoriales y Provinciales de Comercio checks safety and labelling conformity before release (art. 2). Every listed import is notified, and customs asks for SOIVRE’s customs reference number (NRC) to release it (art. 6(3)). Whether SOIVRE actually checks a given shipment depends on its risk analysis.

• Who notifies. The importer, or its representative, notifies the Dirección Territorial or Provincial de Comercio of the shipment, by telematic route or in writing, with enough notice for a physical check (art. 4). Operations with no commercial character are exempt (art. 4(2)).
• What is checked. SOIVRE decides from a risk analysis whether to check. It can check the documents and the product, with sampling and laboratory tests, and the marking and labelling (art. 5).
• What you get. Unless a non-conformity shows, a customs reference number (NRC) that customs requires for release. A non-conforming product gets no NRC, and the goods go to a customs destination at the importer’s expense (art. 6). Where the failure can be corrected, the goods can be released against a signed undertaking not to market them until it is, which the market authorities then verify (art. 6(5)).
• Which products. Annex I is a list of customs codes. Orden PJC/161/2026, in force from 4 April 2026, replaced it. It lists, among others, children’s clothing and other textiles, footwear, wood boards and furniture, toys, drones, ladders, childcare articles, helmets and other protective equipment, sunglasses and lighters. The electrical items it names include plugs and sockets, Edison lampholders, electric heaters, electric blankets and electric garlands, not electrical goods in general. The order says it adds products that raise safety problems and drops others that now carry less risk.

The decree speaks of importers and shipments destined for import. It does not say how it applies to a parcel you send to a Spanish consumer.

What you do as a seller outside Spain

1. Name a responsible person established in the EU, in any country. Its name and contact details go on the product, the packaging, the parcel or a document in it (Art. 16(3)). See EU Responsible Person.
2. Write the instructions, the safety information and the warnings in your listing in Spanish. Castilian is the minimum (RDL 1/2007 art. 18(3); RD 1468/1988 art. 8.1).
3. Put the manufacturer, the responsible person, a picture and a product identifier in every offer (Art. 19(a) to (c)). See GPSR marketplace requirements.
4. Keep the technical documentation ten years (Art. 9(3)). See GPSR technical documentation. Have it ready for the Spanish importer or distributor you sell through, which answers jointly for the sanctions on your infringements unless it took the diligent measures within its reach (art. 51(4)), and for the responsible person’s checks.
5. If your product’s customs code is in Annex I of RD 330/2008, the importer notifies SOIVRE before the shipment arrives, and customs needs SOIVRE’s NRC to release it.
6. If a Spanish authority asks for information, answer inside the period it sets. If the 2003 decree’s rule still applies (see above), it sets five days at most (art. 6(4)).
7. If you learn a product is dangerous, take the corrective measure at once, inform consumers and notify through the Safety Business Gateway (Art. 9(8)).

If you do nothing

A community authority can warn you and require compliance, then prohibit the sale, withdraw, recall or destroy the product, with provisional measures in the meantime and the costs on you (RD 1801/2003 arts. 9 to 12; RDL 1/2007 art. 15(1)). A marketplace that receives the authority’s order takes your offer down, makes it inaccessible or shows a warning within two working days (Art. 22(4)). A breach of the safety provisions is an infringement fined up to EUR 100,000 as serious and up to EUR 1,000,000 as very serious, or more by a multiple of the unlawful gain (arts. 47(h), 49(1)). The goods can be seized, the sanction published once final with your name where there is a risk (always, for a very serious one), and a company’s directors can answer with it (arts. 49(7), 50, 51(5)). Ignoring an order of the administration is a separate infringement (art. 47(o)), and so is refusing the inspectors the data they ask for (art. 47(i)). The Spanish importer or first distributor you sell through answers jointly for the sanctions on your infringements, unless it took the diligent measures within its reach (art. 51(4)).