EU Cosmetic Regulations: CPNP, Labeling, and Ingredient Rules

Selling a cosmetic product in the European Union means complying with Regulation (EC) No 1223/2009, the single set of EU cosmetic regulations that replaced the older patchwork of directives and applies uniformly to every cosmetic placed on the market, whether made in Europe or imported.¹ In practical terms, you need an EU-based Responsible Person, a complete Product Information File including a signed safety report, notification through the Cosmetic Products Notification Portal, compliant labeling, and ongoing monitoring once the product is on shelves.

What the Regulation Covers

A cosmetic product, under the regulation, is any substance or mixture designed to come into contact with the outer parts of the body, the teeth, or the inside of the mouth, for the purpose of cleaning, perfuming, changing appearance, protecting, keeping in good condition, or correcting body odors.¹

The boundary matters. If your product claims to treat eczema, prevent infection, or otherwise act on the body in a medicinal way, it falls under separate rules for medicinal products, medical devices, or biocides. Classification turns on the primary intended purpose and the claims made, not the chemistry alone. A moisturizer containing an antibacterial ingredient is a cosmetic when marketed for skin care; the same formula marketed to kill bacteria on wounds is not.

Who Is Legally Responsible

Every cosmetic on the EU market must be linked to a Responsible Person: a company or individual established inside the EU who takes legal responsibility for compliance. For products made in the EU, the manufacturer is the Responsible Person by default. For imported products, the importer takes the role automatically. Either can also designate a third party inside the EU through a written mandate that the designee accepts in writing.¹

The Responsible Person’s core duties are:

Ensuring the product meets all safety requirements before it reaches consumers.
Maintaining the Product Information File at the address shown on the label, accessible to authorities for ten years after the last batch is placed on the market.
Notifying the product through the Cosmetic Products Notification Portal before sale.
Reporting serious undesirable effects to the competent authority without delay.
Withdrawing or recalling non-compliant products.

This is not a paper role. If a product causes harm and the file is incomplete, the safety assessment is outdated, or adverse events were not reported, the Responsible Person faces enforcement action from national authorities. Penalties are set by each member state, and the regulation requires them to be “effective, proportionate and dissuasive.”²

Distributors, meaning retailers or wholesalers making a cosmetic available on the market, have their own duties under Article 6. Before selling, a distributor must check that labeling includes the Responsible Person’s name and address, batch number, ingredient list, and a durability date that has not passed, and that language requirements for the country of sale are met. If a distributor has reason to believe a product does not comply, they cannot sell it. If a non-compliant product has already been sold and presents a health risk, they must immediately inform the Responsible Person and the competent authority and take corrective steps.²

The Product Information File and Safety Report

The Product Information File is the regulatory backbone of every cosmetic on the EU market. The Responsible Person compiles one file per product and keeps it at the address printed on the label, available to national authorities in a language the local competent authority can understand. Paper or electronic storage is allowed, but the file must sit at a single address inside the EU and be retained for ten years after the last batch is placed on the market.¹

The file must contain a product description, the manufacturing method, evidence supporting any claims, a statement confirming production follows Good Manufacturing Practices, and the Cosmetic Product Safety Report.

The safety report has two parts. Part A collects the raw data: full quantitative and qualitative composition (with chemical names, INCI names, and CAS numbers), physical and chemical properties, microbiological specifications, impurity data, packaging characteristics, exposure calculations, and the toxicological profile of each substance, alongside normal and reasonably foreseeable use conditions and any undesirable effects reported after launch.²

Part B is the safety assessment itself. A qualified assessor holding a university degree in pharmacy, toxicology, medicine, or a similar discipline reviews the Part A data and concludes whether the product is safe for human health, accounting for intended use, exposure routes, and the target population. Without a signed Part B, the product cannot legally be placed on the market.¹

CPNP Notification

Before a product reaches the market, the Responsible Person must register it through the Cosmetic Products Notification Portal, an electronic system run by the European Commission. The notification includes the product category and name, the address where the Product Information File is kept, the country of origin for imports, the member state of first sale, emergency contact details, the frame formulation, the original labeling, and a photograph of the packaging. It must also declare any nanomaterials and identify any category 1A or 1B CMR substances by name and CAS or EC number.³

The submitted information is not public. It is shared with competent authorities for market surveillance and with national poison centers for use in treating adverse reactions. One confirmed notification covers the entire EU; there is no separate registration in each member state. The notification must be updated if the formulation or labeling changes significantly.

Labeling Requirements

Every cosmetic must carry specific information on both its container and outer packaging, printed legibly and indelibly:

The Responsible Person’s name and address.
Nominal content by weight or volume at the time of packaging.
A durability indication: a “best used before” date, or, for products with a shelf life over 30 months, the Period After Opening symbol showing how many months the product remains safe after first use.
Batch number for traceability.
Product function, unless obvious from the presentation.
Precautions for use.
Ingredient list in descending order of weight, using INCI names, preceded by the word “ingredients.”

Most of this information can be standardized across the EU, but warnings, precautions, and usage instructions must be translated into the official language of the member state where the product is sold. Companies launching in multiple markets at once often miss this.

New Fragrance Allergen Rules

Commission Regulation (EU) 2023/1545 added 56 fragrance allergens to Annex III, meaning each must be individually identified on the label when present above specified concentration thresholds. The list includes benzaldehyde, menthol, vanillin, linalyl acetate, and essential oils from lavender, rose, eucalyptus, jasmine, peppermint, and clove. Non-compliant products may be placed on the market until July 31, 2026, and made available on the market until July 31, 2028.⁴

For any brand using natural fragrance blends, this is a real formulation and labeling overhaul. Many essential oils contain several listed allergens, so a single oil can trigger multiple new label entries. Reformulation or relabeling to meet those deadlines should already be underway.

Ingredient Restrictions

The regulation manages ingredient safety through Annexes. Annex II lists substances completely banned from use in cosmetics, expanded through multiple amendments including Commission Regulation (EU) 2025/877, and now containing well over 1,600 prohibited entries. Annex III lists restricted substances usable only within specific concentration limits or conditions. Annexes IV, V, and VI cover approved colorants, preservatives, and UV filters respectively.¹

CMR Substances

Article 15 gives special treatment to substances classified as carcinogenic, mutagenic, or toxic for reproduction. Category 1A and 1B substances are banned outright, with a narrow exception available only when all four conditions are met: the substance complies with food safety requirements, no suitable alternative exists, the application involves a specific product category with known exposure, and the Scientific Committee on Consumer Safety has evaluated and approved its use.²

Category 2 substances are also prohibited unless the SCCS has evaluated them and found them safe. The Commission must re-evaluate any approved CMR substance at least every five years, and amendments in 2023 and 2025 have tightened restrictions on specific CMR-classified ingredients.⁵

Nanomaterials

The regulation defines a nanomaterial as an insoluble or biopersistent material, intentionally manufactured, with at least one external dimension or internal structure between 1 and 100 nanometers. Unlike the broader EU definition, the cosmetics regulation does not set a minimum percentage of particles at nano scale; intentional presence is enough to trigger the rules.

Any cosmetic containing nanomaterials must identify them in the CPNP notification with their foreseeable exposure conditions. For nanomaterials not already covered as approved colorants, preservatives, or UV filters, the Responsible Person must submit a specific notification through the CPNP six months before placing the product on the market, giving the Commission time to request an SCCS risk assessment if it has safety concerns.⁶

Safety assessment for nano-scale ingredients is more demanding than for conventional ones. Updated SCCS guidance published in 2023 added new required data points including dissolution rate, dispersion behavior, uptake into blood cells, reproductive toxicity, and endocrine disruption potential.⁷ On the label, any ingredient present in nano form must be followed by “(nano)” in the ingredient list.

Marketing Claims

Every claim about a cosmetic product, whether on the packaging, a website, social media, or advertising, must satisfy six common criteria set by Commission Regulation (EU) No 655/2013. If a claim fails any one of them, it cannot be made.⁸ The six are legal compliance, truthfulness, evidence, honesty, fairness, and informed decision-making.

Legal compliance means a claim cannot suggest the product was specially approved by EU authorities, and it cannot present compliance with minimum legal requirements as a benefit. Truthfulness means an ingredient advertised as present must be deliberately present, and an ingredient’s properties cannot be attributed to the finished product unless the finished product actually has them. Evidence means every claim, explicit or implied, must be backed by adequate, verifiable data produced with sound methodology. Honesty rules out presenting a feature as unique when competing products share it. Fairness rules out denigrating competitors or legally used ingredients. Informed decision-making means the claim must be clear enough for an average consumer to make a reasonable purchasing decision.

Evidence is where most enforcement issues arise. “Clinically proven” or “dermatologist tested” need actual study data behind them. Extending an ingredient’s standalone properties to the finished product requires showing the ingredient is present at an effective concentration. Vague aspirational language a reasonable consumer would recognize as hyperbole does not need substantiation, but the line between puffery and a concrete claim is thinner than many brands assume.

Animal Testing

The regulation prohibits placing on the EU market any cosmetic whose final formulation was tested on animals, and any product containing ingredients that were animal-tested to meet the requirements of the cosmetics regulation.¹ Safety data for finished products and ingredients must come from alternative validated methods.

One boundary worth naming: the ban covers testing done to satisfy cosmetics safety requirements. It does not cover animal testing required under other EU regulations. A chemical used as a cosmetic ingredient that also has industrial applications may still be tested on animals under REACH, the EU’s chemicals regulation, if testing is needed for worker safety or environmental risk assessment.

Post-Market Duties and Enforcement

Compliance continues after launch. Both the Responsible Person and distributors must monitor for adverse reactions and report serious undesirable effects to the competent authority of the member state where the incident occurred. A serious undesirable effect is one that results in hospitalization, temporary or permanent functional incapacity, disability, congenital anomalies, an immediate vital risk, or death.⁹

Reports must be submitted “without delay,” which EU guidance interprets as within 20 calendar days of any company employee becoming aware of the event. The initial report needs at minimum an identifiable reporter, the nature and onset date of the effect, and the product name, with follow-up detail as it becomes available. Non-serious undesirable effects, such as mild irritation or allergic reactions below the “serious” threshold, must still be recorded in the Product Information File and can trigger reformulation or added warnings if a pattern emerges.

Day-to-day enforcement falls to national market surveillance authorities in each member state, which can inspect the file, order laboratory testing, require corrective action, and mandate withdrawals or recalls. Coordinated EU-wide inspection sweeps targeting specific product categories also occur periodically. The regulation itself sets no specific fine amounts; Article 37 requires each member state to establish penalties that are effective, proportionate, and dissuasive.² Consequences vary significantly across the EU, and can include substantial administrative fines and, for serious violations involving health risks, criminal prosecution. A product sold in multiple member states can face enforcement in any of them under whichever penalty regime that country has enacted.

Selling Into the EU From Outside

A manufacturer based outside the EU cannot act as its own Responsible Person, because the role requires establishment inside the EU. There are two practical routes to market. The first is to sell through an EU-based importer, who automatically becomes the Responsible Person for the imported products. The second is to designate a third-party Responsible Person through a written mandate, which is the more common approach for brands that want to keep control of their compliance strategy across multiple EU markets.

Either way, the product must meet every requirement that applies to cosmetics made in the EU: a complete Product Information File, a Cosmetic Product Safety Report signed by a qualified assessor, compliant labeling in the appropriate languages, CPNP notification, and ongoing adverse event monitoring. The regulation makes no distinction between domestic and imported products on safety standards. Customs authorities at the EU border check whether imported cosmetics have a designated Responsible Person and a valid CPNP notification before allowing them into the market.

1
EUR-Lex. Regulation (EC) No 1223/2009 of the European Parliament and of the Council
2
European Commission. Regulation (EC) No 1223/2009 of the European Parliament and of the Council
3
Internal Market, Industry, Entrepreneurship and SMEs. Cosmetic Product Notification Portal
4
EUR-Lex. Regulation 2023/1545 – EN
5
Internal Market, Industry, Entrepreneurship and SMEs. Legislation
6
Internal Market, Industry, Entrepreneurship and SMEs. Nanomaterials
7
European Commission. SCCS – Guidance on the Safety Assessment of Nanomaterials in Cosmetics – 2nd Revision
8
EUR-Lex. Commission Regulation (EU) No 655/2013
9
European Commission. SUE Reporting Guidelines