PPE - Regulation (EU) 2016/425

What PPE is and why it matters

The PPE Regulation — formally Regulation (EU) 2016/425 on personal protective equipment — is the EU law that governs equipment designed to protect people against health and safety risks. If you make, import or distribute helmets, safety footwear, gloves, respiratory protective devices, fall-protection harnesses, hearing protectors or similar products and place them on the European market, this Regulation almost certainly applies to you. It sets the essential health and safety requirements that PPE must meet before it can carry the CE marking and be sold in the Union.

PPE matters because the products it covers are, by definition, the last line of defence between a user and a real hazard — and the consequences of failure can be serious or fatal. The Regulation reflects that by scaling its conformity assessment to the severity of the risk a product is meant to guard against, requiring more independent scrutiny the higher the stakes. For a brand owner, getting the category and the assessment route right is not paperwork for its own sake; it is what makes lawful, defensible sale possible.

📄 Official text: Regulation (EU) 2016/425 on personal protective equipment — on EUR-Lex →

Who PPE applies to

The Regulation applies across the supply chain rather than to a single actor. The duties scale with your role, but every link is covered:

Manufacturers — anyone who makes PPE, or who has it made and markets it under their own name or trademark. They carry the heaviest obligations, including categorising the product, running conformity assessment, drawing up technical documentation and the EU declaration of conformity, and affixing the CE marking.
Importers — businesses bringing PPE from outside the EU into the Union market. They must verify the manufacturer has carried out the correct conformity assessment, that the documentation exists and that the CE marking is in place before placing the product on the market.
Distributors — wholesalers and retailers further down the chain who must act with due care, check that the CE marking, declaration and required instructions are present, and not supply PPE they know or should presume to be non-compliant.
Authorised representatives — where a manufacturer appoints one in writing to carry out defined tasks on their behalf within the Union.

The Regulation covers PPE for both professional and private use — from industrial fall arrest systems to consumer gardening gloves and ski helmets — while excluding certain categories such as PPE designed specifically for the armed forces or for use in maintaining order, and equipment governed by its own specific regimes.

Key dates and timeline

2016 — Regulation (EU) 2016/425 was adopted and entered into force, starting a transition period for businesses and notified bodies to adapt.
21 April 2018 — the Regulation applies from this date. From this point its obligations are enforceable and PPE placed on the market must conform to it.
On that same date, the Regulation repealed the old PPE Directive 89/686/EEC, replacing the previous framework. Because Regulation (EU) 2016/425 is a regulation, it is directly applicable in all Member States without needing national transposition, which reduces the variation that existed under the old directive.

Core requirements

Risk categories

The Regulation classifies PPE into three risk categories, and the category determines how much independent assessment is required:

Category I covers minimal risks — for example superficial mechanical injury, contact with mild cleaning agents, or handling hot objects below a low temperature threshold. Manufacturers may self-certify: they carry out internal production control without involving a notified body.
Category II covers risks that are neither minimal nor very serious — the broad middle ground, such as general-purpose protective footwear and many gloves and helmets. These require EU type-examination by a notified body before the product can be placed on the market.
Category III covers risks that may cause very serious consequences such as death or irreversible damage to health — for example respiratory protective devices, fall-from-height protection, protection against high-voltage electrical risk, harmful chemicals or extreme temperatures. These require EU type-examination plus ongoing checks on production, either supervised product checks or an approved quality assurance system.

Getting the category right is the first and most consequential decision, because it dictates the entire conformity route.

Conformity assessment and the role of notified bodies

For Category I, the manufacturer assesses conformity itself. For Categories II and III, an independent notified body must carry out the EU type-examination (Module B), assessing a representative sample of the PPE against the applicable essential requirements and issuing a certificate. For Category III, the manufacturer must additionally operate one of two production-phase routes that keep the notified body involved over time: conformity to type based on internal production control plus supervised product checks (Module C2) or conformity to type based on quality assurance of the production process (Module D). This ongoing scrutiny reflects the mortal or irreversible nature of the risks Category III products address.

Technical documentation

For all categories, the manufacturer must compile and keep technical documentation demonstrating that the PPE meets the essential health and safety requirements. This describes the product, its design and manufacture, the risk it protects against, the applicable requirements, and the results of design calculations, examinations and tests. Where harmonised standards have been applied, conformity with the corresponding essential requirements is presumed. The documentation must be retained for ten years after the PPE is placed on the market and produced to authorities on request.

EU declaration of conformity and CE marking

Before placing PPE on the market, the manufacturer draws up an EU declaration of conformity stating that the product meets the applicable requirements, and affixes the CE marking. For Category III products, the CE marking is followed by the identification number of the notified body involved in the production-phase checks. The declaration must accompany the PPE or be made available — including, where the equipment is offered online or sold to consumers, in an accessible form. PPE must also be supplied with clear instructions and information covering storage, use, cleaning, maintenance, the protection performance and, where relevant, the meaning of any markings, in a language easily understood by users in the Member State concerned.

Traceability

Manufacturers must ensure PPE bears a type, batch or serial number or other identifying element, and indicate their name, registered trade name or trademark and a contact address — on the product, or where that is not possible on the packaging or in the accompanying documents. Importers must add their own name and contact address in the same way. This traceability lets authorities and operators trace a non-compliant or dangerous product back through the chain.

Obligations by role

Manufacturers — categorise the PPE, run the correct conformity assessment, compile technical documentation, draw up the EU declaration of conformity, affix CE marking, ensure traceability and supply instructions.
Importers — verify the manufacturer’s conformity assessment and documentation, check CE marking is present, add their own identification, and refuse non-compliant products.
Distributors — check the CE marking, declaration and instructions are present, store and transport products with due care, and stop supply of PPE they believe to be non-compliant.
Authorised representatives — perform the tasks set out in their written mandate, typically keeping the declaration and documentation available and cooperating with authorities.

Enforcement

Each Member State designates market surveillance authorities to enforce the PPE Regulation. In Denmark, the Danish Safety Technology Authority (Sikkerhedsstyrelsen) is the competent authority for PPE. Authorities can require corrective action, restrict or prohibit a product being made available, and order withdrawals and recalls where PPE does not comply or presents a risk.

Dangerous products are shared EU-wide through the Safety Gate rapid alert system, so a problem identified in one country can trigger action across the Union. Consequences for non-compliance are set at national level and can include orders to stop sales, mandatory recalls, fines and reputational damage from public alerts. The qualitative reality for a brand is that a single alert on safety-critical PPE can cascade across markets quickly.

Getting compliant

Confirm your products are PPE under the Regulation and determine the correct risk category (I, II or III).
For Category II and III, engage a notified body for EU type-examination; for Category III, also set up the ongoing production checks (Module C2 or D).
Apply relevant harmonised standards where they exist to benefit from presumption of conformity.
Compile and retain technical documentation for ten years.
Draw up the EU declaration of conformity and affix the CE marking (with the notified body number for Category III).
Apply traceability markings (type/batch/serial, manufacturer and importer details).
Provide instructions and safety information in the right languages.

How Conphora helps

Conphora monitors the PPE Regulation and maps your products against its requirements, flagging gaps in categorisation, conformity assessment, technical documentation, CE marking and traceability before they become enforcement problems. The platform helps you generate and keep the right documentation, and alerts you when obligations change so your compliance stays current.

See how Conphora works · Start free with Conphora

Sources and further reading

This guide is for general information and is not legal advice.

Last updated: 12 June 2026