A Product You Sell Got Recalled. Nobody Told You

Most small sellers find out that something they stock has been recalled from a customer, or from a supplier email that arrived three weeks after the decision was taken. By then the legal clock has usually been running for a while, and it is shorter than almost anyone selling online realises.

This is one of the few areas where a machine watching a feed genuinely earns its place in a one person business. Not because the reading is hard, but because the watching has to happen every day, forever, on data that is published in a form nobody enjoys reading, about products that will almost never appear. It is exactly the sort of job a human is bad at and cheap software is good at.

What are you actually required to do if something you sell turns out to be unsafe?

Report it, and not only to your supplier. In the United States the obligation to report sits on manufacturers, importers, distributors and retailers alike, which means a shop that merely resells a product is inside the rule.

The Consumer Product Safety Commission is direct about this in its guidance for retailers and their product safety responsibilities. A retailer must report when it obtains information indicating that a product may create a substantial risk of injury or fails to comply with safety regulations, and that includes choking incidents and near misses rather than only injuries that happened. The report has to be immediate and in full detail. Failing to make it can bring substantial civil or criminal penalties.

There is one narrow release. A retailer need not report if it has written confirmation that the manufacturer already reported the issue. Note the word written. A supplier saying on the phone that they have handled it does not discharge your duty, and the agency's own advice for everything else is blunt: when in doubt, report.

How fast is the clock, exactly?

Twenty four hours from obtaining reportable information, with a limited allowance to investigate first. That is the tightest deadline most small merchants will ever be subject to and very few know it exists.

The CPSC duty to report guidance sets out both halves. A company must report within 24 hours of obtaining reportable information. It may investigate before deciding, but that investigation should not exceed 10 working days unless the firm can demonstrate a longer period was reasonable. So the practical shape is two weeks at the absolute outside, and one day once you actually know.

What counts as the moment you obtained the information is the part that should worry you. A customer email describing a near miss, sitting unread in a shared inbox for a fortnight, is not a defence. Neither is a supplier notice filed in a folder nobody opens. The clock starts when the information reaches your business, not when somebody in it gets round to reading the message.

Is this different if you sell into Europe or the UK?

The duties are similar in shape and different in detail, and if you ship across borders you are subject to all of them at once. The common thread is that distributors and sellers carry obligations independently of the manufacturer.

The EU General Product Safety Regulation has applied since 13 December 2024, according to the European Commission's summary of what GPSR changed. It widened the scope to products sold online and to used, repaired and reconditioned goods, and it requires a responsible economic operator established in the EU to be attached to each product. It is a regulation rather than a directive, so it applies directly in every member state without national implementation. The old RAPEX alert system was renamed Safety Gate.

In the UK, the Office for Product Safety and Standards states the seller's position plainly in its product safety advice for businesses: you must not sell products you know, or should have known, are unsafe, you must keep records identifying the suppliers of what you sell so origins can be traced, and if you learn of a safety risk or a consumer incident you have a legal duty to report it to the manufacturer, the supplier or your local Trading Standards service.

The bottom row is the one small merchants fail most often. Every regime assumes you can answer the question of who supplied a given batch. A shop that buys from three wholesalers and keeps the invoices in an email folder can usually reconstruct that, slowly. A shop that dropships from rotating suppliers frequently cannot reconstruct it at all, which is a compliance problem long before it is a recall problem.

Where is recall information actually published?

In structured feeds that are free and updated on a schedule, which is the fact that makes any of this automatable. Safety regulators do not email individual shops, but they do publish.

The United States Food and Drug Administration is the clearest example if you sell food, supplements, cosmetics or devices. Its enforcement report definitions page describes a weekly report plus an application programming interface that returns the same data without the website. Recalls are graded: Class I where there is a reasonable probability of serious adverse health consequences or death, Class II where the effects are temporary or medically reversible, Class III where harm is unlikely. Since June 2017 the report also lists recalls that are not yet classified, so an item appears before the hazard assessment is finished.

That last detail matters more than it looks. The earliest a recall becomes public is often as an unclassified entry, days before anyone decides how serious it is. A watcher that only reacts to Class I notices is systematically late. In the EU, the Safety Gate portal serves the same purpose for non food products, and online marketplaces are expected to check it.

What can AI genuinely do here?

The matching and the drafting, which together are most of the work. What it cannot do is hold the legal duty, and the distinction is worth being strict about.

A recall notice is written from the manufacturer's point of view. It names a model number, a batch range, a date code and a brand. Your catalogue calls the same object something a customer would search for, possibly in a different language, quite possibly without the model number anywhere in the listing. Matching one against the other is a fuzzy text problem across two vocabularies, which is precisely the kind of work a language model handles well and a keyword filter handles badly.

The realistic setup is unglamorous. Pull the relevant feeds daily. For each new entry, ask the model whether anything in your product list could plausibly be the same item, and have it return the candidates with its reasoning rather than a yes or no. Then a person looks at the shortlist, which on most days is empty and occasionally has one line in it. That person still makes the call.

The second job is the customer notice. Once you have established that you sold thirty units of an affected batch, you need to write to those thirty people in plain language that says what the product is, what the risk is, what to do with it now, and what you will do about the money. Drafting that quickly and consistently, at the moment you are least calm, is a good use of a model. It is the same argument we made about using AI to keep listings compliant across a catalogue, where the value is consistent coverage rather than cleverness.

How do you match a recall against a catalogue that was never built for it?

By fixing the catalogue slightly rather than the matching entirely. Three fields carried consistently do more than any amount of clever text comparison afterwards.

The first is the manufacturer's own identifier for the item, stored even when you never show it to a customer. A model number or a manufacturer part number in a hidden field turns a fuzzy matching problem into an exact one. The second is the supplier, recorded per batch rather than per product, because recalls are almost always scoped to a production run. The third is a purchase date or batch reference, which is what lets you narrow thirty affected customers out of four hundred buyers instead of writing to all four hundred.

None of that is exotic, and most shops already collect two of the three somewhere. The problem is usually that they live in different systems: the model number in a supplier spreadsheet, the batch in an invoice PDF, the buyers in the store database. If you are building or rebuilding a store, putting those fields in the product record from the start costs nothing, and our AI ecommerce store builder generates catalogue schemas where supplier and identifier fields are part of the product rather than an afterthought bolted on later.

If you are not rebuilding anything, a single spreadsheet mapping your product names to manufacturer model numbers is a reasonable substitute and takes an afternoon for most catalogues. It is also the file you will be very glad exists on the day you need it.

What paperwork should you already be holding?

Certificates from whoever supplied you, kept as files rather than as a memory of having seen them. In the United States these have names, and a retailer who cannot produce them is in a weak position long before any recall happens.

Manufacturers and importers must provide a Children's Product Certificate for all children's products, certifying compliance with the applicable safety rules, and a General Certificate of Conformity for certain non children's products. Keeping copies is not itself legally mandated for a retailer, and the CPSC still describes reviewing and retaining them as advisable, which is regulator language for the thing you will wish you had done. There are smaller obligations attached to the same duty: registration cards must stay attached to durable infant and toddler products, inspections have to be allowed during business hours, and tracking label requirements apply.

The practical version for a shop of one is a folder per supplier, with the certificate, the contact who sent it, and the date. When a recall lands, the first question you will be asked is which batches you received and from whom, and the second is whether the goods were certified when you bought them. Both are answerable in a minute from that folder and in a bad afternoon from an inbox. If you are already reviewing what your suppliers commit to, the same folder is where the terms belong, which is the argument behind our guide to reading supplier terms with AI before you sign them.

What does the customer notice have to say?

What the product is, what could happen, what to do now, and how the money works. Anything else is decoration and slows the reader down at the moment you most need them to act.

Be concrete about the hazard rather than diplomatic. A notice saying a product may not meet our quality standards tells a customer nothing and will not make them stop using it. A notice saying the handle can detach during use, which has caused burns, will. Regulators in every jurisdiction expect the communication to be effective, not merely sent, and a vague notice is a failed one even if it technically went out.

Say what you will do about payment before the customer asks, because the refund question is the reason people reply. Manufacturers leading a recall may offer a repair, replacement instructions, a modification or a refund on return. As a reseller you may be reimbursed by the supplier later, and you should not make the customer wait on that arrangement. The cost of fronting thirty refunds is smaller than the cost of thirty people concluding you knew and did nothing, which is also the reputational mechanism behind our piece on what happens when your shop makes a promise it cannot keep.

What does this cost to set up?

An afternoon and a few pounds a month, which is the only reason to recommend it to a business of one. The feeds are free, the matching is a small number of model calls per day, and the expensive part is the catalogue tidying you should do anyway.

Be realistic about what you are buying. On the overwhelming majority of days this system will produce nothing, and a process that produces nothing is one people quietly stop maintaining. So make it visible: a short daily message that says checked, nothing matched, with the date, is worth more than a silent job, because a silent job that broke six weeks ago looks exactly like a silent job that is working.

Scope it honestly too. Watching every recall feed in every jurisdiction is not a small business project. Watching the one or two feeds that cover the categories you actually sell, for the twenty suppliers you actually buy from, is. Start there, and widen it only if you add a category that a different regulator covers.

The reason to do any of this is not that a recall is likely. For most shops it is not. It is that the consequences of finding out late are steeply worse than finding out early, the clock is measured in hours rather than weeks, and the work of watching is the kind that software does for almost nothing while a busy owner does it for a while and then forgets.