{
  "type": "problem",
  "slug": "retailer-compliance-audit",
  "lang": "en",
  "url": "https://www.conphora.com/solutions/problem/retailer-compliance-audit/",
  "markdown": "https://www.conphora.com/solutions/problem/retailer-compliance-audit.md",
  "title": "A retailer announces a compliance audit of our range",
  "description": "A retailer will audit your products and documents. What the law requires you to have in place, how to prepare the range, and what happens after findings.",
  "answer": "An audit by a retailer is a contract matter, but what it checks comes from the General Product Safety Regulation: up-to-date technical documentation, correct labels, a complaints register, traceability records and internal processes for product safety. Agree the scope in writing, list the range with the file status per product, close the gaps in order of risk, and act yourself if the audit shows a product is dangerous.",
  "theme": {
    "id": "marketplace-retailer",
    "label": "Marketplace and retailer demands"
  },
  "roles": [
    {
      "id": "manufacturer",
      "label": "Manufacturer"
    },
    {
      "id": "importer",
      "label": "Importer"
    }
  ],
  "regulations": [
    "GPSR"
  ],
  "path": [
    "product-validation",
    "compliance-status-links"
  ],
  "trigger": "A retailer writes that it will review your documents, labels or processes on a set date",
  "keep": null,
  "why": [
    {
      "text": "A retailer's audit has no legal basis of its own; it is a term of the supply relationship. Its content, however, follows the General Product Safety Regulation (EU) 2023/988. Every economic operator must have internal processes for product safety in place that allow it to comply with the Regulation (Article 14). Manufacturers draw up technical documentation, keep it up to date and keep it for 10 years after the product is placed on the market (Article 9(2) and (3)), and importers keep a copy for the same period (Article 11(6)).",
      "sources": [
        1
      ]
    },
    {
      "text": "Retailers check because their own duties depend on it. A distributor verifies before selling that the identifier, the manufacturer's and importer's details and the instructions are in place, and must not sell a product it has reason to believe does not conform (Article 12(1) and (3)). Where a product it has already sold is dangerous or lacks those elements, it must inform the manufacturer or importer, ensure corrective measures and ensure the authorities are informed through the Safety Business Gateway (Article 12(4)). The Commission's Blue Guide adds that distributors must be able to show the authorities that they acted with due care (section 3.4). An audit is how a retailer builds that evidence.",
      "sources": [
        1,
        3
      ]
    },
    {
      "text": "The processes matter as much as the files. Manufacturers must provide channels for consumer complaints, investigate complaints about dangerous products and keep an internal register of complaints, recalls and corrective measures (Article 9(11) and (12)); importers file complaints in that register or their own and keep the manufacturer and distributors informed (Article 11(10)). On request, every economic operator identifies its suppliers and customers for the product and can present that information for six years (Article 15(3) and (5)).",
      "sources": [
        1
      ]
    },
    {
      "text": "Findings can trigger legal duties. If an audit shows that a product already placed is dangerous, the manufacturer must immediately take corrective measures, inform consumers and notify the market surveillance authorities through the Safety Business Gateway (Article 9(8)); the importer has a parallel duty (Article 11(8)). Authorities can in turn require documents and supply chain data from any economic operator (Regulation (EU) 2019/1020, Article 14(4)(a) and (b)). For products under CE acts, the GPSR's Chapter III, Section 1 does not apply (Article 2(1), third subparagraph, point (b)) and the sector acts set the corresponding duties.",
      "sources": [
        1,
        2
      ]
    }
  ],
  "steps": [
    {
      "name": "Get the scope in writing",
      "text": "Ask which products, which documents, which processes and which criteria the audit covers, whether it samples products or looks at all of them, and who sees the results. The scope, the timing and the consequences are set by agreement with the retailer."
    },
    {
      "name": "List the range with the file status per product",
      "text": "For every product the retailer buys, record your role, the acts that apply, and whether the technical documentation, labels, instructions and traceability records exist and are current. Use the same list for the audit and for yourself.",
      "item": "product-validation"
    },
    {
      "name": "Close the gaps in order of risk",
      "text": "Start with the products where a defect would hurt someone, such as products for children or electrical products, and with gaps the retailer must check itself: identifier, manufacturer and importer details, and instructions. Do not backdate documents; date what you produce now."
    },
    {
      "name": "Show the processes, not only the files",
      "text": "Prepare evidence that your internal processes work: how complaints are recorded and investigated, how you decide on a withdrawal or recall, how changes to a product trigger a new assessment, and how you trace batches to suppliers and customers."
    },
    {
      "name": "Handle findings as product decisions",
      "text": "Correct each finding and record what you did. Where a finding shows that a product you placed is dangerous, your own duty to act applies straight away. Share the corrected status with the retailer through one current record.",
      "item": "compliance-status-links"
    }
  ],
  "documents": [
    {
      "name": "Technical documentation per product, kept up to date",
      "from": "The manufacturer",
      "ground": "GPSR Article 9(2) and (3); importers Article 11(6)"
    },
    {
      "name": "Internal register of complaints, recalls and corrective measures",
      "from": "Your customer service and quality function",
      "ground": "GPSR Articles 9(12) and 11(10)"
    },
    {
      "name": "Supplier and customer records",
      "from": "Your purchase and sales systems",
      "ground": "GPSR Article 15(3) and (5)"
    },
    {
      "name": "A description of your internal processes for product safety",
      "from": "Your management",
      "ground": "GPSR Article 14"
    }
  ],
  "risks": [
    {
      "title": "The retailer must stop selling and may notify",
      "text": "A distributor that has reason to believe a product it sold is dangerous or lacks the required identifier, details or instructions must inform you, ensure corrective measures and ensure the authorities are informed through the Safety Business Gateway (GPSR Article 12(4)).",
      "source": 1
    },
    {
      "title": "Your own notification duty",
      "text": "A manufacturer that has reason to believe a product it placed is dangerous must take corrective measures, inform consumers and notify the authorities immediately (GPSR Article 9(8)); importers have the same duty (Article 11(8)).",
      "source": 1
    },
    {
      "title": "Authority requests follow",
      "text": "Authorities can require documents, data and supply chain information from any economic operator (Regulation (EU) 2019/1020, Article 14(4)(a) and (b)), and Member States set penalties for GPSR infringements (Article 44).",
      "source": 2
    }
  ],
  "faq": [
    {
      "q": "Do we have to accept an audit?",
      "a": "No law requires you to let a retailer audit you. Whether you do is set by agreement in your supply contract. What the auditor looks for is largely what the GPSR already requires you to have, so the preparation is useful regardless."
    },
    {
      "q": "What will the auditor ask to see?",
      "a": "Usually the technical documentation, the labels and instructions, the complaints register and the traceability records, and evidence of your internal processes for product safety (GPSR Article 14). Retailers often add their own criteria; ask for them in advance."
    },
    {
      "q": "How far back must our records go?",
      "a": "Technical documentation is kept for 10 years after the product is placed on the market (GPSR Article 9(3)). Traceability information must be available for six years (Article 15(5)). Personal data in the complaints register is kept only as long as the investigation needs it, and never longer than five years after it was entered (Articles 9(13) and 11(11))."
    },
    {
      "q": "Can the retailer report us to the authorities?",
      "a": "Where it has reason to believe a product it sold is dangerous, the retailer must ensure the authorities are informed (GPSR Article 12(4)(c)). It does not need your consent. Acting first on your own findings keeps you in control of the corrective measures."
    },
    {
      "q": "Does this apply to our CE-marked products too?",
      "a": "Chapter III, Section 1 of the GPSR (Articles 9 to 18) does not apply to products under CE acts (Article 2(1), third subparagraph, point (b)). Their own acts set similar duties for documentation, traceability and complaints, so the audit covers the same ground."
    }
  ],
  "sources": [
    {
      "title": "Regulation (EU) 2023/988 on general product safety (consolidated text of 29 May 2026)",
      "publisher": "EUR-Lex",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R0988-20260529",
      "accessed": "2026-10-04"
    },
    {
      "title": "Regulation (EU) 2019/1020 on market surveillance and compliance of products (consolidated text of 12 August 2026)",
      "publisher": "EUR-Lex",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02019R1020-20260812",
      "accessed": "2026-10-04"
    },
    {
      "title": "The 'Blue Guide' on the implementation of EU product rules 2022 (2022/C 247/01)",
      "publisher": "European Commission, via EUR-Lex",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629(04)",
      "accessed": "2026-10-04"
    }
  ],
  "related": [
    "retailer-proof",
    "retailer-supplier-portal",
    "complaints-register",
    "documents-scattered",
    "keep-documents-how-long",
    "risk-analysis-missing"
  ],
  "reviewer": "Conphora compliance team",
  "reviewedAt": "2026-10-05",
  "notice": "General information, not legal advice."
}