Selling Connected EVs to EU: GPSR and RED

The bottom line: For anyone selling connected Chinese smart EVs into Europe, the most overlooked gate in 2026 is not the tariff but GPSR full enforcement stacked with the RED cybersecurity assessment: GPSR treats the whole vehicle as a software-bearing consumer product, while RED demands cybersecurity and privacy evaluation for in-vehicle wireless. Together they mean that unless your connected model ships with the right compliance files, the whole batch can be held at the EU border, and demurrage alone can erase a small order's profit.

GPSR (Regulation 2024/1689) replaced the old GPSD at the end of 2024 and entered full enforcement in 2026: it requires the maker to keep a risk analysis and incident response, and the importer must be able to trace the responsible person upstream.

If the cars are stopped at port for missing files, per-unit demurrage and rework cost 800 to 1,500 euros; on a 300-unit order that is 240,000 to 450,000 euros, 4% to 7% of total cost.

The responsibility chain: traders re-exporting to Europe via Turkey or North Africa must name an EU responsible person in the contract, since the final destination recognises only an EU entity.

Do three things: request the RED cyber report and GPSR EU responsible-person details before ordering; write the EU authorised representative and vulnerability-response timeline into the contract; pre-screen the compliance pack 90 days before arrival by model and VIN. Make the three files a pre-order condition; EU checks will only tighten, so do not wait for the border to ask.