Leaked draft European Product Act gives the Commission direct enforcement powers and exposes marketplaces to liability as authorised representatives

A draft of the European Product Act (EPA) has been leaked ahead of the Commission's expected formal proposal on 6 October 2026. The EPA will replace Decision 768/2008, Regulation 765/2008 and Regulation 2019/1020, consolidating the New Legislative Framework and market surveillance rules into a single directly applicable regulation. Food and feed fall outside its scope.

The draft confirms the direction of travel for the EU's approach to regulated products. Strategies at a national level in Europe (for example, a focus by the Spanish government on market surveillance of online sales and third-country imports) suggest a Europe-wide commitment to building a safety framework fit for modern cross-border e-commerce and complex global supply chains.

The three most significant changes for online marketplaces, importers and manufacturers are set out below, along with the implications for tech and AI companies under the digital product passport framework.

Online marketplace liability

Under the draft, marketplaces that fail to verify a product's compliance records before allowing it to be listed can become the product's de facto authorised representative. 

Before allowing a product targeting EU end-users onto their platform, a marketplace must verify that the product has a valid digital product passport (DPP) or product responsibility record and that the listing corresponds to it. The check can be carried out using automated tools and is not intended to constitute a general monitoring obligation (language that deliberately echoes the Digital Services Act which similarly imposes more responsibilities on digital intermediaries). 

Where a market surveillance authority orders removal of a listing, the marketplace must act within two working days, report the action taken within a further four, and prevent the product reappearing under a different listing.

If a marketplace fails those verification steps and the product reaches the market without an EU-established economic operator responsible for it, the marketplace will assume the obligations of an authorised representative. For platforms hosting large volumes of third-country sellers without EU-established responsible persons, this is likely to require a significant review of seller onboarding controls, product-identification systems and takedown procedures.

The draft also requires marketplaces to register with the EU Market Surveillance Data Hub, maintain designated compliance contact points, display specified manufacturer and safety information, and cooperate with recalls. Traders that repeatedly offer non-compliant products could face suspension from marketplace services.

The draft is intended to complement the Digital Services Act (DSA), defining compliance-related obligations specific to marketplaces and "operationalising" DSA tools for product compliance. The DSA applies without prejudice to Union law on consumer protection and product safety, including the Market Surveillance Regulation (EU) 2019/1020 that the EPA would replace. 

The DSA already requires marketplaces:

• to obtain traders' identification details and make best efforts to check that they are reliable and complete,
• to design their interfaces so that traders can provide product-compliance and labelling information,
• to make best efforts to check that this information has been provided before allowing the trader to offer its products, and
• to make reasonable efforts to randomly check official databases afterwards.

The draft builds on those duties, proposing that marketplaces have internal processes to comply with the above requirements, but adds a step change: a "best efforts" check of what the trader has submitted will become a hard condition of listings being permitted.

Commission enforcement powers

The EPA would give the Commission direct investigation and enforcement powers over non-compliant products entering the EU from third countries. These powers would apply where the product presents a risk, is likely to be distributed widely across the EU, and no Member State has opened a market surveillance investigation following a Commission notification.

Once non-compliance is confirmed, the Commission can require corrective action, prohibit further distribution, order recalls, require internet service providers to remove content, and impose direct financial penalties. It can also adopt interim measures, including temporarily suspending an economic operator's or marketplace's economic activities, where there have been at least three relevant instances of non-compliance in the preceding eight years. In urgent health and safety cases, interim measures can be imposed immediately.

Evidence gathered by one national authority can be shared with and used by authorities in other Member States. A compliance issue identified in one jurisdiction may therefore escalate across the EU more rapidly than under the current framework. Businesses operating across multiple Member States will be unlikely to limit their exposure to a single jurisdiction when issues arise or investigations are opened.

Penalties 

Member States will be required to set penalties for a defined list of infringements by economic operators, notified bodies and online marketplaces. Financial penalties must fall between 1% and 6% of the operator's annual worldwide turnover in the preceding financial year. A separate minimum applies for supplying incorrect, incomplete or misleading information: at least 1% of annual worldwide turnover or income. Periodic penalty payments must be at least 5% of average daily worldwide turnover or income.

Where the Commission exercises its own direct enforcement powers, it will be able to impose penalties of up to 6% of annual worldwide turnover. Those penalties will sit alongside, rather than being a substitute for, national penalties for infringements. The Commission's power to impose them is subject to a five-year limitation period. Businesses with products distributed across the EU could therefore see significantly escalating levels of financial liability arising from parallel penalties. 

Digital product passport

The EPA creates a horizontal DPP framework that applies wherever sector-specific legislation requires a DPP. Manufacturers must generally create and register the DPP before placing the product on the market and retain both the DPP and technical documentation for 10 years.

Pre-manufacture and configurable products

Where a product is offered online before the specific item or batch is known, sellers must provide a clearly identified reference DPP and ensure access to the final DPP before delivery. 

Post-sale software updates

A substantial modification to a product requires a new, linked DPP. As with other EU legislation such as the AI Act and General Product Safety Regulation, the threshold for what constitutes a "substantial modification" will need careful analysis as sector-specific rules are developed.

Automated enforcement 

The draft contemplates European Commission webcrawlers identifying non-compliant product listings, with automated takedown notices issued to marketplaces and sellers through the Digital Services Act's notice mechanism. Product listing data and DPP records that do not correspond to each other will therefore be a direct enforcement target.

Additional proposals

The draft also includes:

• after a transitional period, during which CE marks will still be permitted to be physically affixed to products, new requirements for digital CE marking within the digital product passport itself, to recognise the significant changes in digitalisation of product-compliance information and the transition towards the circular economy
• a per-item Union market surveillance fee on imports, collected through customs at a lower rate for bulk imports than for individual distance-sale parcels
• a customs suspension-and-referral mechanism for suspected non-compliant imports, with market surveillance authorities given four working days to confirm or lift the suspension, and disposal costs recoverable from the responsible operator if non-compliance is confirmed
• a mandatory professional liability insurance requirement for authorised representatives, breach of which is itself a standalone penalty-triggering infringement, and
• tighter grounds for notifying authorities to reject a notified body's renewal application, including repeated market surveillance flags, substantiated operator complaints or a Commission-identified risk to the single market.

Osborne Clarke comment

The Commission's formal proposal is expected on 6 October 2026. There is limited scope for substantial changes before that date, but the proposal may still change as it passes through the legislative process. Businesses should therefore start to consider how their existing systems and processes will need to change against the anticipated new requirements present in the draft. This will help to highlight the key areas that the business needs to track as the EPA progresses.

Online marketplace operators should note the clear direction of travel by the Commission and audit current seller onboarding controls and product-verification processes against the proposed fallback liability mechanism. Manufacturers and importers of regulated products, including AI systems and consumer devices, should assess whether their infrastructure can support a DPP. All businesses involved in the supply of products to end-users in the EU should identify the EU-established responsible person for their supply chains and consider their potential exposure under the proposed penalty structure.

Please contact the experts below if you would like assistance to understand the implications for your business.