Commission Decision of 16 December 2009 laying down guidelines for the management of the Community Rapid Information System ‘RAPEX’ established under Article 12 and of the notification procedure established under Article 11 of Directive 2001/95/EC (the General Product Safety Directive) (notified under document C(2009) 9843) (2010/15/EU) (repealed)

3. Building a risk assessment step by step

This section describes in detail what points have to be taken into account and what questions have to be asked when preparing a risk assessment.

3.1. The product

The product should be identified unambiguously. This includes the product name, the brand, the model name, the type number, a possible production lot number, any certificate that may come with the product, a child-resistant fastening if there is one, the identity of the person who placed it on the market, and the country of origin. A picture of the product, the packaging and the marking plate (if appropriate) and a test report(s) identifying the product hazard(s) can also be considered to be part of the product description.

In particular cases, the hazard may be limited to a distinct part of the product, which can be separate from it and also separately available to consumers. In such cases, it is sufficient only to assess the distinct part of the product. Rechargeable batteries of notebook computers which may overheat are an example of this.

The description of the product includes any label that may be relevant for risk assessment, in particular warning labels. Instructions for use may also contain relevant information on the risk of the product and how to keep it as low as possible, for example by using personal protective equipment or by excluding children from using the product. An example of this is a chain saw.

Products may also need to be self-assembled by consumers before use, such as self-assembled furniture. Are the assembly instructions clear enough for the ready-to-use product to meet all the relevant safety requirements? Or could consumers make mistakes when putting the product together that could lead to unforeseen risks?

A risk assessment should always consider the entire life time of a product. This is particularly important when a new product has been developed and its risks are assessed. Will age and usage change the type or the extent of the hazard? Will new hazards appear with increasing product age or perhaps through reasonably foreseeable inappropriate use? How long is the ‘time to product failure’? What is the product’s lifetime, including shelf life? How long is the product used in practice by the consumer before it becomes waste?

Additional considerations may need to be taken into account when a product becomes unusable after a certain time period, even though it has never been used. Examples are electric blankets or heating pads. The electric cords in the products are usually thin and become fragile after ten years, even if the product has never been used. The heating cords can come into contact with each other, can cause a short-circuit and set the bedclothes on fire.

Finally, the packaging of the product should also be included in any risk assessment.

3.2. The product hazard

Hazard is the intrinsic property of the product that may cause an injury to the consumer who uses the product. It can appear in different forms:

• mechanical hazard, such as sharp edges that can cut fingers, or tight openings in which someone can trap their fingers;

• choking hazard, such as from small parts that come loose from a toy, which may be swallowed by a child and make the child choke;

• suffocation hazard, such as from the drawstrings of an anorak hood which may lead to strangulation;

• electrical hazard, such as from live electrical parts that can cause an electric shock;

• heat or fire hazard, such as a heater fan that overheats, catches fire and causes burns;

• thermal hazard, such as the hot outer surface of an oven that can cause a burn;

• chemical hazard, such as a toxic substance that can poison a consumer immediately upon ingestion, or a carcinogenic substance that can cause cancer in the long term. Some chemicals may damage the consumer only after repeated exposure;

• microbiological hazard, such as a bacteriological contamination of cosmetics which may cause a skin infection;

• noise hazard, such as ring tones from toy mobile phones that are much too loud and can damage children's hearing capacity;

• other hazards, such as explosion, implosion, sonic and ultrasonic pressure, fluid pressure, or radiation from laser sources.

For the purpose of these guidelines, hazards have been grouped, linked to the size, shape and surface of a product, to potential, kinetic or electric energy, to extreme temperatures, and others, as shown in table 2. The table is for guidance only, and any risk assessor should adapt the scenario to the product under consideration. Of course not every type of hazard applies to every product.

Nevertheless, table 2 should help risk assessors to look for and identify all possible hazards in consumer products that are being assessed. Where a product has several hazards, each hazard should be taken separately with its own risk assessment and the highest risk identified as ‘the risk’ of the product. Of course, risks requiring specific risk management measures should also be reported, to ensure that all risks can be reduced.

Note that a single hazard may lead to several injuries in the same scenario. For example, malfunctioning brakes on a motor cycle could cause an accident and result in damage to the driver’s head, hands and legs, and could even cause burns if the petrol bursts into flames in the accident. In this case, all injuries would belong to the same injury scenario, and the severity of all injuries together would have to be estimated. Of course, these injuries together are very serious. Several injuries in different scenarios should, however, not be added.

In the daily practice of market surveillance, it may be sufficient to assess the risk from even a single hazard. If the risk from that hazard provides for risk management action, that action can be taken without further ado. Nevertheless, the risk assessor should be sure that the risk identified is (one of) the highest risk(s), to ensure that the risk management action is sufficiently effective. This is always the case when the risk is serious, since this is the highest possible risk level proposed in these guidelines. In cases of less than serious risk, however, further risk assessments might be necessary and possibly specific risk management at a later stage. In conclusion, experience with risk assessment in market surveillance practice will limit the number of required risk assessments to a minimum.

Hazard identification by tests and standards

Hazards are often identified and quantified by tests. These tests and how to carry them out may be laid down in European or international product standards. Compliance of a product with a ‘harmonised’ European standard (‘EN …’), of which the references have been published in the Official Journal, provides presumption of safety (albeit only for the safety characteristics covered by the value(s) or standard(s)). It can be presumed in such cases that the product presents only a minimum risk and a high level of protection with regard to the specific hazard tested.

Nevertheless, there may be instances where presumption of safety is not the case, and in such cases a particularly well-documented risk assessment will have to be prepared, including a call for amendment to the harmonised standard.

On the other hand, if a product fails the test, a risk can normally be assumed, unless the manufacturer can provide evidence that the product is safe.

Products may still present a risk even though they do not cause injuries

Products may not be hazardous but can nevertheless cause a risk, due to not being fit for their intended use. Examples of this can be observed in the area of personal protective equipment or life saving equipment, such as reflective jackets that car drivers put on after an accident. These jackets are meant to get the attention of oncoming drivers and traffic participants to warn them of the accident, in particular at night. However, they might not be seen if the reflector stripes are too small or do not reflect sufficiently, and do not therefore protect users as they should. These jackets therefore pose a risk even though they are not hazardous in themselves. Another example is a sunscreen product which displays ‘high protection’ (sun protection factor of 30) on the label but provides only ‘low protection’ (factor of 6). This can lead to severe sunburn.

3.3. The consumer

The abilities and behaviour of the consumer using the product may greatly influence the level of risk. It is therefore of prime importance to have a clear idea of the type of consumer pictured in the injury scenario.

It may be necessary to generate injury scenarios with different types of consumers in order to identify the highest risk and thus ‘the risk’ of the product. It is not enough, for example, to consider only the most vulnerable consumers, because the probability of their suffering adverse effects in the scenario may be so low that the risk is lower than in an injury scenario with a non-vulnerable consumer.

Consideration should also be given to people who are not actually using the product, but who may be in the vicinity of the user. For example, a chain saw may cause splinters to fly around and hit a bystander in the eye. Thus, although the risk from the chain saw may be effectively managed by the user him- or herself wearing protective equipment and complying with any other risk management measures specified by the manufacturer, bystanders may be under serious threat. Consequently, warnings should be given, for example in the chain saw instructions for use, about the risks to bystanders and how to minimise such risks.

Thus, when developing an injury scenario, the following aspects should be taken into account regarding the type of consumer and how they use the product. This is not a complete list, but it should encourage risk assessors to describe their injury scenarios with the necessary level of detail. It should be noted that ‘consumer’ also means people who are not actually using the product, but who may be affected by virtue of being nearby:

• Intended/non-intended user: The intended user of a product may use the product with ease because he goes by the instructions or because he is familiar with this kind of product, including its apparent and non-apparent hazard(s). The hazard of the product may not then materialise, and the product risk could be minor.

  The non-intended user may not be familiar with the product and may not recognise the hazard(s). He therefore runs the risk of injury, and the consumer risk is thus higher.

  Thus, the risk may be different for an intended and a non-intended user, depending on the product and the way it is used.

• Vulnerable consumers: Several categories of vulnerable and very vulnerable consumers can be distinguished: children (0 to 36 months, > 36 months to < 8 years, 8 to 14 years) and others such as the elderly (see table 1). They all have less capacity to recognise a hazard, for example children who, when touching a hot surface, notice the heat only after some 8 seconds (and then are already burnt), whereas adults notice heat immediately.

  Vulnerable consumers may also have problems taking account of warning labels, or may have particular problems using a product they have never used before. They may also act in a way that makes them more exposed, for example young children crawling and mouthing. Children may also be attracted to products because of their appeal, which makes them a high risk in the hands of children. On the other hand, supervision by parents or other adults should normally prevent children from running straight into trouble.

  Furthermore, consumers who are not usually vulnerable may become vulnerable in specific situations, for example when the instructions or warnings on a product are in a foreign language that the consumer does not understand.

  Finally, in the particular case of chemicals, children may be more susceptible to the toxicity of chemicals than the average adult. Therefore, children should not be treated as if they were ‘small adults’.

  In conclusion, a product that is normally safe for an average adult may not be safe for vulnerable consumers. This has to be taken into account when determining the severity and probability of an injury (see below) and thus the risk.

• Intended and reasonably foreseeable use: Consumers may use a product for other purposes than the one for which it is intended, although the instructions are clearly understandable, including any warnings. Therefore, as warnings may not be fully effective, other uses than the intended ones also have to be taken into account in a risk assessment. This aspect is particularly important for the manufacturer of a product, since he has to ensure that the product is safe under any reasonably foreseeable conditions of use.

  Reasonably foreseeable use may have to be based on experience, because there may be no information available in official accident statistics or other sources of information. It may then be difficult to draw the line between ‘reasonably foreseeable’ and ‘totally unperceived’ scenarios. Nevertheless, even ‘totally unperceived’ scenarios can be considered under these guidelines, even when they lead to very severe injuries, because such scenarios will always have very low probability. This possibly safeguards against such scenarios having too much of an influence in determining the overall risk of the product.

• Frequency and duration of use: Different consumers may use a product often or not so often, and for longer or shorter periods of time. This depends on the attractiveness of the product and the ease with which it can be used. Daily or long-term use could make a consumer entirely familiar with a product and its specifics, including its hazards, instructions and warning labels, thus making the risk minor. On the other hand, daily or long-term use may make the consumer too used to the product and lead to user fatigue where he recklessly ignores instructions and warnings, thus increasing the risk.

  Finally, daily or long-term use may also accelerate product ageing, and any parts that cannot withstand such frequent use may quickly fail and cause a hazard, and possibly an injury, which also increases the risk.

• Hazard recognition and protective behaviour and equipment: Some products are known for their hazards, such as scissors, knives, do-it-yourself drilling machines, chain saws, roller blades, bicycles, motor bikes and cars. In all these cases, the product hazard is clearly known or readily recognisable, or described in the instructions, which will include risk management measures. The consumer can then act carefully or use personal protective equipment such as gloves, helmets or seat-belts, thereby using the product in a way that minimises the risk.

  In other cases, the product hazard may not be so readily recognisable, such as a short-circuit within an electric iron, warning labels may be overlooked or misunderstood, and consumers will only rarely be able to take preventive measures.

• Consumer behaviour in the event of an incident: Where the hazard impinges on the consumer it may cause injury. It is thus important for a risk assessment to consider how the consumer may react. Will he put the product to one side calmly and take preventive action, such as combating a fire caused by the product, or will he throw it away in a panic? Vulnerable consumers, especially children, may after all not behave the same as other, non-vulnerable consumers.

• The consumer’s cultural background and the way a product is used in his home country may influence the risk of a product. Manufacturers in particular have to take account of these cultural differences when launching a new product on a market. Manufacturers’ experience in this area can thus be a valuable source of information for authorities preparing a risk assessment.

3.4. Injury scenario: Steps leading to injury(ies)

Most injury scenarios consist of the following three main steps:

1.

the product has a ‘defect’ or can lead to a ‘dangerous situation’ during its foreseeable lifetime;

2.

the ‘defect’ or ‘dangerous situation’ results in an accident;

3.

the accident results in an injury.

These three main steps can be divided into further steps to show how the product hazard can lead to injury and the like. Nevertheless, these ‘steps to injury’ have to be clear and concise, and not exaggerate the detail or the number of steps. With experience, it will be increasingly easier to identify the conditions for the occurrence of any given injury and the ‘shortest path to injury’ (or ‘critical path to injury’).

It is probably easiest to start with a scenario with the consumer for whom the product is intended where the consumer uses the product as per the instructions or, if there are none, according to normal handling and use. If this assessment produces the highest risk level, there is normally no need to carry out further assessments, and appropriate risk reduction measures can be taken. Similarly, where an incident is reported in a specific consumer complaint, a single injury scenario may be sufficient to conclude as to appropriate risk reduction measures.

Otherwise, further scenarios could be developed to include vulnerable consumers, in particular children (see table 1), slight or more pronounced deviations from normal use, use under different climate conditions, such as very cold or very hot, unfavourable conditions of use, such as without proper daylight or illumination, use as suggested when the product was sold (for instance, a lamp sold in a toy shop should also be assessed for its risk when used by a child), use over the entire life-time (including wear and tear), etc. Each scenario should be considered through the entire risk assessment procedure.

Where the product displays several hazards, injury and thus risk scenarios should be developed for each of them. Nevertheless, a plausibility check as to whether an injury scenario might lead to a risk requiring action can limit the number of injury scenarios.

From all the scenarios generated, the scenario providing the highest risk (= ‘the risk’ of the product) will normally be decisive for the risk reduction measures to be taken, because action on the highest risk reduces the risk most effectively. An exception to the rule might be a specific, less-than-highest risk stemming from a different hazard, which could be managed by specific measures and should, of course, also cover the highest risk.

As a rule of thumb, injury scenarios can lead to the highest risk level when

• the injury(ies) considered are in the highest severity levels (levels 4 or 3);

• the overall probability of an injury scenario is quite high (at least > 1/100).

Table 4 provides further guidance in this respect. This might help to limit the number of scenarios.

Of course, the number of injury scenarios remains the responsibility of the risk assessor, and it depends on the number of factors that need to be taken into account when determining 'the risk' of the product. It is therefore impossible to give a specific number of injury scenarios that may be necessary in a specific case.

To help develop a suitable number of scenarios, these guidelines provide a table with typical injury scenarios (table 2). These should be adapted to the specific product, consumer type and other circumstances.

3.5. Severity of injury

The injury that a hazard can cause to the consumer can have different degrees of severity. The severity of the injury thus reflects the effect the hazard has on the consumer under the conditions described in the injury scenario.

The severity of the injury can depend on:

• the type of hazard (see list of hazards above and in table 2). A mechanical hazard, such as sharp edges, can cause cuts to the fingers; these are immediately noticed, and the consumer will take action to heal his injuries. On the other hand, a chemical hazard may cause cancer. This normally passes unnoticed, and the illness may appear only after many years, and is considered to be very severe since cancer is very difficult to cure, if at all;

• how powerful the hazard is. For example, a surface heated to 50 °C may cause slight burns, whereas a surface at 180 °C will cause severe burns;

• how long the hazard impinges on the consumer. A short contact time with an abrasion hazard may scratch the consumer’s skin only superficially, whereas a longer time may take off large parts of the skin;

• what body part is injured. For example, penetration by a sharp point into the skin of the arm is painful, but penetration into an eye is a more serious and perhaps a life-affecting injury;

• what impact the hazard has on one or several body parts. An electrical hazard may cause an electric shock with unconsciousness and, subsequently, a fire which may damage the lungs when the unconscious person inhales the smoke;

• the type and behaviour of the consumer. A product labelled with a warning message can be used, without harm, by an adult consumer, because the consumer adjusts to using the product. On the other hand, a child or other vulnerable consumer (see table 1) who cannot read or understand the warning label may be very seriously injured.

To quantify the severity of injury(ies), table 3 in these guidelines shows how to classify injuries into four categories, depending on the reversibility of an injury, i.e. whether recovery from an injury is possible and to what extent. This categorisation is for guidance only, and a risk assessor should change the category if necessary, and report it in the risk assessment.

Where several injury scenarios are considered in the risk assessment, the severity of each injury should be classified separately, and considered throughout the entire risk assessment process.

An example: A consumer uses a hammer to knock a nail into a wall. The hammer head is too weak (due to incorrect material) and it breaks, one of the pieces flying into the eye of the consumer so hard that it causes blindness. The injury is thus an ‘eye injury, foreign body in eye: permanent loss of sight (one eye)’, which is a level 3 injury in table 3.

3.6. Probability of injury

The ‘probability of injury’ is the probability that injury scenario may indeed materialise during the expected lifetime of the product.

This probability is not easy to estimate; but when a scenario is described in distinct steps, each step can be given a certain probability, and multiplying these partial probabilities together gives the overall probability of the scenario. This stepwise approach should make it easier to estimate the overall probability. Of course, where several scenarios are developed, each scenario requires its own overall probability.

Where an injury scenario is nevertheless described in a single step, the probability of the scenario can also only be determined in a single overall step. This would only be a ‘guesstimate’, however, which could be severely criticised and thus call the entire risk assessment into question. A more transparent assignment of probabilities to a several-steps-scenario is therefore preferable, especially as the partial probabilities can be built on undisputable evidence.

These guidelines distinguish between 8 levels of probability to classify overall probability: from < 1/1 000 000 to > 50 % (see left-hand side of table 4). The following example of a hammer head that breaks when the user knocks a nail into a wall should illustrate how to assign a probability to each step, and how to classify overall probability:

Step 1:	The hammer head breaks when the user tries to knock a nail into a wall because the material of the hammer head is too weak. The weakness was determined in a test, and with the reported weakness the probability of the hammer head breaking during the otherwise expected lifetime of the hammer is put at 1/10.
Step 2:	One of the pieces of the hammer hits the user when it breaks. The probability of this happening is put at 1/10, since the area of upper body exposed to the pieces flying off is considered to be 1/10 of the half-sphere in front of the wall. Of course, if the user were standing very close to the wall, his body would take a larger share of the half-sphere, and the probability would be higher.
Step 3:	The piece hits the user on the head. The head is estimated to be about 1/3 of the upper body, and the probability is therefore 1/3.
Step 4:	The piece hits the user in the eye. The eyes are considered to be about 1/20 of the area of the head, and therefore the probability is 1/20.

Multiplying the probabilities of the above steps together gives an overall probability for the scenario of 1/10 * 1/10 * 1/3 * 1/20 = 1/6 000. This translates into > 1/10 000 (see left-hand side of table 4).

Once the overall probability has been calculated for an injury scenario, it should be checked for plausibility. This requires rather a lot of experience, thus suggesting that the assistance of persons experienced in risk assessment should be sought (see above in section ‘Let others check your risk assessment’). As experience is gained with these guidelines estimating probability should become easier, and an increasing number of examples will become available to facilitate this task.

Assigning probabilities to different injury scenarios for the same product may lead to the following:

• When the product is used by more vulnerable consumers in a scenario, the probability may have to be raised in general because more vulnerable consumers can be injured more easily. This applies in particular to children, since children do not normally have the experience to take preventive action, on the contrary (see also ‘Vulnerable consumers’ in section 3.3).

• When the risk is readily recognisable, including through warning labels, the probability may have to be lowered because the user will use the product more carefully in order to avoid injury as far as possible. This may not apply to an injury scenario with a (young) child or other vulnerable user (see table 1) who cannot read.

• When accidents have been reported that fit into the injury scenario, the probability for that scenario could increase. In cases where accidents have only rarely been reported, or are not known at all, it may be useful to ask the manufacturer of the product whether he is aware of any accident or adverse effect caused by the product.

• When a fairly large number of conditions are needed for the injury to occur, the overall probability of the scenario would normally be lower.

• When the conditions needed for the injury to occur are easily met, this may increase the probability.

• When the test results of the product fail by a large margin to come within the limit values required (by the relevant standard or legislation), the probability of the injury (scenario) occurring may be higher than if the product performed close to the limit values.

The ‘probability of injury’ in this instance is the probability that the injury scenario may actually happen. Probability does not therefore describe the general exposure of the population to the product, calculated, for example, by considering the millions of product items sold on the market and then considering that a few of them might fail. Considerations of this kind do, however, play a role when determining the appropriate risk reduction measures (see section 4).

Also, accident statistics, even if product-specific, have to be considered with care when used for to estimate probability. The circumstances of the accident may not be reported in sufficient detail, the product may have changed over time, or the manufacturer may be different, and so on. In addition, light accidents may not have been reported to those collecting the data for the statistics. None the less, accident statistics can shed light on injury scenarios and their probability.

3.7. Determination of risk

Once the severity of the injury and the probability have been determined, if possible for several injury scenarios, the risk level then needs to be looked up in table 4. Table 4 combines both the severity of the injury and the probability, and the highest risk is ‘the risk’ of the product. Risks requiring specific risk management measures should also be reported, to ensure that all risks are reduced to a minimum.

These guidelines distinguish between 4 levels of risk: serious, high, medium and low. The risk level between neighbouring severities of injury or probability normally changes by 1 level. This is consistent with the general experience that risk does not increase incrementally when input factors change gradually. However, where the severity of injury increases from level 1 to level 2 (on the right-hand side of table 4), some risk levels increase by 2 levels, namely from medium to serious and from low to high. This is due to the fact that these guidelines include 4 graduations of severity of injury, whereas the original method (see Introduction) included 5. Nevertheless, 4 graduations are considered normal for consumer products, since they make for a sufficiently robust estimation of severity; 5 levels would be too sophisticated since neither the severity of the injury nor the probability can be determined with very high precision.

At the end of the risk assessment, be it for an individual injury scenario or for the overall risk of the product, the plausibility of the risk level and uncertainties in the estimates should be considered. This may mean verifying that the risk assessor has used the best information available to make his estimations and assumptions. Feedback from colleagues and other experts can also be helpful.

A sensitivity analysis can also be very valuable (see example in section 6.3). How does the risk level change when the severity of injury or probability changes by 1 level up or down? If the risk level does not change at all, it is quite plausible that it has been estimated correctly. If it changes, however, the risk level may be borderline. It is then necessary to reconsider the injury scenarios and the assigned severity of injury(ies) and probability(ies). At the end of the sensitivity analysis the risk assessor should be confident that the risk level is sufficiently plausible and that he can document it and pass the information on.