--- title: "Our supplier contract says nothing about compliance" description: "EU product law places duties on the importer or brand owner whatever the purchase contract says, and a contract cannot move them to the supplier. What a contract can do is secure what you need to meet them: the technical documentation, test reports, notice of changes, traceability data and help in a recall. Add those terms before the next order and leave liability and cost questions to your lawyer." type: "problem" url: "https://www.conphora.com/solutions/problem/contract-compliance-clauses/" markdown: "https://www.conphora.com/solutions/problem/contract-compliance-clauses.md" locale: "en" language: "en" updated: "2026-10-05" author: "Conphora compliance team" publisher: "Conphora" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R0988-20260529" tags: ["GPSR", "suppliers-imports"] license: "Free to quote with attribution and a link to the page" --- # Our supplier contract says nothing about compliance EU product law places duties on the importer or brand owner whatever the purchase contract says, and a contract cannot move them to the supplier. What a contract can do is secure what you need to meet them: the technical documentation, test reports, notice of changes, traceability data and help in a recall. Add those terms before the next order and leave liability and cost questions to your lawyer. ## Why this happens EU product law assigns duties by role, not by contract. Under the General Product Safety Regulation (EU) 2023/988, the importer must ensure before placing a product on the market that the manufacturer has drawn up the risk analysis and technical documentation (Article 11(1)), keep a copy of that documentation for 10 years (Article 11(6)) and act when a product it placed is dangerous (Article 11(8)). A person placing a product on the market under its own name or trademark is deemed the manufacturer and takes on Article 9 in full (Article 13(1)). The Commission's Blue Guide adds that a manufacturer who subcontracts must retain overall control, must receive all the information it needs, and may in no circumstances discharge itself of its responsibilities. [1] [2] Several of these duties depend on information only the supplier has. Every economic operator must, on request, identify who supplied it with the product or with a part, component or embedded software, and keep that information presentable for six years (Article 15(3) and (5)). Manufacturers must keep other economic operators in the chain informed in a timely manner of safety issues they identify (Article 9(10)), keep series production in conformity (Article 9(4)) and keep the documentation up to date (Article 9(3)). The GPSR also requires each economic operator to have internal processes for product safety (Article 14). For products under a product-specific harmonisation act, the sector act carries the equivalent duties (Article 2(1), third subparagraph, point (b)), and for the acts listed in Article 4(5) of Regulation (EU) 2019/1020 the responsible operator in the Union must be able to provide the documentation in a language the authority easily understands (Regulation (EU) 2019/1020, Article 4(3)(b)). [1] [4] A supply contract is where you secure that information. The Commission's Blue Guide calls it good practice for importers to refer to the applicable EU legislation in the contract with the supplier and to secure access to the technical file, or the manufacturer's signed obligation to provide it (footnote 139). The law does not write the clauses and does not settle who pays for testing, withdrawals or recalls between buyer and supplier; that is commercial and national contract law, and the place for legal advice. What the law does settle is that you cannot point to the contract when an authority asks. [1] [2] One newer prohibition belongs in the same terms. Regulation (EU) 2024/3015 prohibits placing or making available on the Union market, or exporting, products made with forced labour at any stage of their supply chain (Articles 2(7) and 3). It applies from 14 December 2027 (Article 39) and creates no additional due diligence obligations beyond existing law (Article 1(3)). [3] ## How to solve it 1. **List the duties you cannot meet without the supplier** Go through your own duties and mark those that depend on the supplier: holding the technical documentation, knowing who supplied parts and components, being told of safety issues, getting changes assessed, and acting together in a withdrawal or recall. Each of those needs a term. 2. **Write a documentation term** The supplier delivers, per model and before the first shipment, the technical documentation with the risk analysis and test reports, and for CE products the declaration of conformity. It keeps the documentation up to date, makes it available for the full retention period and provides the parts an authority asks for in a language that authority understands. 3. **Add change notification and approval** No change to design, materials, components, sub-suppliers or production site ships without written notice, the manufacturer's assessment and your approval. Tie it to batch or serial numbers so that you can tell old and new apart. 4. **Add cooperation on safety issues and recalls** The supplier informs you without delay of any safety issue it identifies, cooperates with you and the authorities on corrective action, and gives you the data a withdrawal or recall needs. The contract can also say who bears which costs; the law does not settle that between you. 5. **Cover labelling, traceability and how the product is made** Agree who puts which name and address on the product and its packaging, that each unit carries a type, batch or serial number, and that the supplier names its own component suppliers on request. From 14 December 2027, products made with forced labour may not be placed on the EU market; ask for the supplier's commitment and the information to support it. 6. **Make purchasing use the terms** Terms that sit in a template help no one. Train the buyers who place orders on what each term is for, and check at each new order that the documents the terms promise have arrived. ## What you need to show - **Supply agreement with documentation, change, traceability and recall terms** — You and the supplier (GPSR Articles 11, 14 and 15) - **Technical documentation received under the agreement** — The manufacturer (GPSR Articles 9(2) and 11(6)) - **Change notices and your approvals** — The supplier and your quality files (GPSR Article 9(4)) ## If you do nothing - **The duty stays with you** — The person placing the product on the market under its own name or trademark is the manufacturer (GPSR Article 13(1)), and the Blue Guide states that a manufacturer who subcontracts may in no circumstances discharge itself of its responsibilities to a subcontractor. - **No file and no trail when the authority asks** — The importer keeps the technical documentation for 10 years (GPSR Article 11(6)) and must identify who supplied the product or its components for six years (Article 15(3) and (5)). Without contractual access, you may not be able to do either. - **A recall without the supplier's help** — An importer that has reason to believe a product it placed is dangerous must ensure that corrective measures, including withdrawal or recall, are taken, and where they have not been taken, take them itself immediately (GPSR Article 11(8)(b)). ## Questions ### Can we make the supplier responsible for compliance in the contract? You can make it responsible to you, for example for costs, but not towards the authorities. The duties in the GPSR attach to the role you have, such as importer or manufacturer (Articles 11 and 13), and a contract between you and the supplier does not change that role. ### Does the law require written contracts with suppliers? The GPSR's articles on economic operators (Articles 9 to 19) contain no requirement for a supply contract; the Blue Guide calls a contract that refers to the EU obligations good practice (footnote 139). The GPSR does require a written mandate where a manufacturer appoints an authorised representative (Article 10(1)), and it requires every economic operator to have internal processes for product safety (Article 14). ### What should a recall term say? At least that the supplier tells you about safety issues it identifies, as manufacturers must tell other operators in the chain (GPSR Article 9(10)), cooperates on corrective action, and supplies batch and quantity data. Who pays for what is a commercial term. ### Does the forced labour ban mean new due diligence for us? Regulation (EU) 2024/3015 says it creates no additional due diligence obligations beyond those already in Union or national law (Article 1(3)). The prohibition in Article 3 still applies from 14 December 2027, so the information to support your sourcing belongs in the contract. ## Regulations involved GPSR ## Sources 1. [Regulation (EU) 2023/988 on general product safety (consolidated text of 29 May 2026)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R0988-20260529) — EUR-Lex, 2026-10-04 2. [The 'Blue Guide' on the implementation of EU product rules 2022 (2022/C 247/01)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629(04)) — European Commission, via EUR-Lex, 2026-10-04 3. [Regulation (EU) 2024/3015 on prohibiting products made with forced labour on the Union market](https://eur-lex.europa.eu/eli/reg/2024/3015/oj) — EUR-Lex, 2026-10-04 4. [Regulation (EU) 2019/1020 on market surveillance and compliance of products (consolidated text of 12 August 2026)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02019R1020-20260812) — EUR-Lex, 2026-10-04