The newly formed Office for Product Safety & Standards (OPSS) has embarked upon its commitment to improve product safety by introducing the first government-backed Code of Practice for product safety recalls PAS7100.

The Code of Practice (the Code) aims to provide producers and distributors with clearer guidance on how to prepare for and deal with product safety issues, and we would advise producers and manufacturers to review their product recall arrangements in line with PAS7100. The Code is split into two parts: the first is intended for manufacturers, importers and distributors; the second is intended for regulators. The Code includes guidance on how to plan for a recall; how to undertake a risk assessment; how to manage a possible recall or other corrective action; how to set up processes to monitor product safety; what businesses should do when investigating a potential product safety issue; and how to review/ develop corrective action plans. It also guides regulators in relation to monitoring incidents, analysing data, supporting businesses and responding to a failure to take proper action.

The Code deals with non-food consumer products and focuses on corrective actions that should be taken on the discovery of an unsafe product. The principle instruction is clear: every business should create and implement a product safety incident plan (PSIP). A successful PSIP will consider product safety issues before they arise and be ready for use at the outset of a safety concern.

Creating a PSIP

OPSS clearly envisages that the PSIP will lie at the heart of a successful product recall and underlines the requirement for senior management to commit to and actively endorse the PSIP. We suggest senior management document any meetings discussing the creation and/or review of the PSIP or relevant risk assessments to demonstrate top-level commitment and active engagement and endorsement.

The Code anticipates that PSIPs will be:

  • Created with input from a wide range of experts both internally and externally
  • Developed in consultation with the regulator (Local Authority Trading Standards) and relevant supply chain partners where possible
  • Made up of a number of "plans", with each plan providing a stepby-step procedure for dealing with the different issues that could arise (see further below)
  • Reviewed and updated, and the company should use benchmarking to establish the effectiveness of the PSIP each time it is used

The Plans

Traceability Plan

The Code emphasises the importance of a product having information on it, which would enable it to be identified and its origins traced (such as product number, origin and batch date). This information should be either on the product itself or on the components of the product. This task should remain part of the design process and this should be reiterated in the PSIP. The PSIP should consider consumer traceability and ensuring that customer contact information is systematically captured. We recommend that the PSIP should, where possible, allocate responsibility for capturing and storing this information to a specific individual or team.

Information gathering should be done at the point of sale, with consumers being asked to provide details for the purposes of contact in the event of product safety. The customer should be informed that records will not be used for marketing, promotions, refunds or warranty purposes, as information collected for these purposes should be made clear. The success of this element of the PSIP, therefore, comes down to the amount of customer information that a business is able to gather, and the effectiveness of the data storage. We have advised clients who have carried out product recalls in collaboration with third parties, and there is a significantly increased product recall success rate, with higher rates of products being returned, for those businesses that obtain customer details at the point of sale. However, businesses will, of course, need to adhere to the General Data Protection Regulation (GDPR) principles on data processing and retention.

Product Safety Monitoring Plan

The Code recognises that producers and distributors under the General Product Safety Regulations 2005 (GPSR) are responsible for risk-based monitoring of their products. The PSIP should not only set out the arrangements for collecting and using that information, but also how this information will be shared between the parties. The Code does not give any further advice on what monitoring and sharing of information should look like, but we would advise periodic random safety testing and inspections should be carried out depending upon the nature of the product (e.g. if it is child product, testing should be carried out more frequently than for a product that is not, given the user of the product will be more vulnerable, and more susceptible to risk).

Legal Notification Plan

The Code aims not only to set out new processes for product recall, but also to emphasise existing legal duties and allocate responsibility for complying with them. The PSIP should, therefore, set out steps to achieve early sharing of information with the relevant regulator in the event that a product is to be recalled, and in the UK, specifically complying with notification duties under Regulation 9 GPSR, and any other relevant regimes that contain requirements to notify, such as the Toys (Safety) Regulations 2011.

Risk Assessment Plan

Once an potential product safety issue is identified, it is important that businesses have a clear process of investigation. The PSIP will need to include a risk-assessment process, including methods of assessing severity of risk, likelihood of its occurrence and whether specialist expertise is required to uncover more information about the risk.

The PSIP will always need to be tailored to the specific product and, more importantly, to the specific risk. A generic process within the PSIP may not address the relevant issues; however, as a general rule of thumb, the Code points to the European RAPEX risk assessment methodology as a starting point. RAPEX is a European-wide platform that regulators can use to register and share information about unsafe products, and the RAPEX risk assessment methodology provides guidance to authorities on when rapid intervention is needed.

Corrective Action Decision Plan

Having identified a risk, the Code states that a corrective action decision plan should be included that takes into account how best to tackle the risk, and the next steps that the business should take. The Code requires that the PSIP identifies "nominated decision makers" and sets out when and how decisions will be made. The Code encourages the decision maker to categorise the risk as low, medium or high and states that the decision maker should keep a record and timeline of key decisions and actions.

Whilst a PSIP will set out the steps a business should consider, the ultimate aim is that unsafe products (those products that do not meet the definition of a "safe product" under the General Product Safety Regulations 2005 ) are removed from the market and that the nature of any corrective action is proportionate and effective. The responsibility will lie with the nominated decision maker to ensure that the PSIP is implemented and that the most effective corrective action is taken. The Code does suggest a number of actions that may be appropriate, some of which include:

  • Product recall
  • Offering consumers the choice to replace or exchange the product
  • Improving the instructions supplied with a product

The Code sets out ways in which a business may deal with an affected product, including arranging collection from distributors and providing consumers with the option of freepost or courier collection. Unfortunately, it does not go so far as to provide guidance on which of these measures would be appropriate where a low risk is identified, or where a product may not be compliant with legislation but does not pose a safety risk.

Communications Plan

One element of corrective action will undoubtedly be communicating the risk to relevant parties. The Code envisages that the PSIP includes a contact list, including internal and external business contacts, with the aim of making the contact process easy and efficient. The Code advises that contacts should include, for example, internal customer services, regulators, trade associations and insurers. It would also be sensible to include contact details for lawyers. Consulting lawyers can be beneficial in the event of a safety issue and/or where legal proceedings are in reasonable contemplation (so that legal privilege can be asserted over communications). In addition, it can be helpful to involve external public relations (PR) advisors, who are able to track and monitor media coverage from the outset. Your recall plans should include details of key legal and PR contacts.

The PSIP should also cover:

  • When to communicate
  • What to communicate
  • How communication will be delivered to customers

What communication channels will be used generally including what information will be placed online

Producing "template" corrective action announcements, for example, recall notices, will achieve this to an extent and these should be included within the PSIP. It is important that these notices are tailored to each case.

The Code gives detailed guidance on what an announcement should include and even the type of grammar and graphics that should be used. For example, the Code suggests incorporating pictures which explain the risk, in case English is not the first language of the some of the target audience, and including specific warning notices, for example, "Important Safety Warning".

To respond to situations quickly, the Code suggests that even where a media release is not considered necessary, a set of messages should still be prepared and a decision on whether to release the information should be kept under constant review.

The Code also tackles situations in which communication might become difficult, stating that the PSIP should set out how staff will be trained and supported through handling customer complaints. The Code suggests actions such as a Q&A document updated throughout the corrective action period, as well as support from a dedicated member of the product safety team. In our experience, some businesses find it useful to engage external PR companies that are able to set up a call centre service following a recall.

Training Plan

The success of the PSIP will depend on the extent to which your business knows about it and practices and uses it. To that end, the Code suggests that all staff should be trained on the PSIP and in particular, the plans for which they may be responsible. We consider scenario based crisis management training is part of this preparation.

Ongoing Review and Monitoring

As stated above, the Codes advises that the PSIP should be reviewed and updated, which will include benchmarking to establish the effectiveness each time the PSIP is used. The Code does not provide specific guidance on how frequently the PSIP should be reviewed. We would envisage a pragmatic approach, depending on the nature of the product being sold and complexity of supply chain (e.g. the number of parties involved), with annual reviews being carried out at a minimum. Product recall rehearsals, using different product safety scenarios, should be carried out.


Ultimately, the Code presupposes that a well-designed PSIP will enhance the effectiveness of a product recall and the majority of the corrective actions will stem from the guidance contained within. Whilst this may be true, creating an effective PSIP could be challenging in practice given the difficulties in tailoring a preplanned PSIP to a specific incident. The Code does accept that a PSIP that has been developed generically should always be adjusted to fit the actual circumstances of the incident, but there is a risk that in doing so, businesses will find themselves moving away from the guidelines within the PSIP altogether. For that reason, care should be taken when drafting the PSIP; businesses will need to carefully consider not just what a successful product recall might look like, but also whether this is actually achievable in the context of their organisation. Practice notifications and recalls can be invaluable in determining this.