EU Cosmetics Regulation: Responsible Person, CPNP, and Labeling

Selling a shampoo, lipstick, sunscreen, or toothpaste in the European Union means complying with Regulation (EC) No 1223/2009, the single law that governs cosmetic products across every member state. The core of EU cosmetics regulation compliance is straightforward in outline even when it is heavy in practice: appoint a Responsible Person established in the EU, build a Product Information File that proves the product is safe, manufacture to good manufacturing practice, label the product correctly in the local language, notify it through the Cosmetic Products Notification Portal before it goes on sale, and report serious adverse effects afterward. The regulation took full effect on July 11, 2013 and has been amended many times since.

The regulation applies to any substance or mixture intended for contact with skin, hair, nails, lips, external genital organs, teeth, or the mucous membranes of the mouth, where the purpose is to clean, perfume, change appearance, protect, keep in good condition, or correct body odors.¹ Products intended to treat or prevent disease are medicinal products under a different legal regime, and items meant to be swallowed, inhaled, injected, or implanted fall outside the regulation entirely. A hand soap is cosmetic; a surface disinfectant is not.

Appoint a Responsible Person Established in the EU

Every cosmetic product placed on the EU market must be linked to a Responsible Person: a legal entity physically established within the EU who takes on the core compliance obligations. For products manufactured inside the EU, the manufacturer holds this role by default. For imported products, the importer becomes the Responsible Person. A manufacturer can also designate someone else through a written agreement, and the designee must accept in writing.¹

This entity bears direct legal accountability for the product’s safety, labeling, and regulatory notifications. When authorities find a problem, they go to the Responsible Person first, not the retailer. A company based outside Europe cannot sell directly into the EU market without either establishing an EU presence or formally appointing an EU-based Responsible Person to carry the legal risk.²

Build the Product Information File

Before a product reaches the market, the Responsible Person must compile a Product Information File (PIF). This is the master dossier that proves the product is safe, and it must be kept at the address given in the notification and made available to national authorities on request. The PIF must be maintained for ten years after the last batch of that product is placed on the market.¹

The centerpiece of the PIF is the Cosmetic Product Safety Report (CPSR), in two parts. Part A gathers the raw safety information: full qualitative and quantitative composition, physical and chemical characteristics, stability, microbiological quality, impurities, packaging interactions, normal and reasonably foreseeable use conditions, and consumer exposure data. Part B is the safety assessment itself, in which a qualified assessor reviews the Part A data and issues a formal conclusion on whether the product is safe, together with the reasoning, any warnings or usage instructions, and the assessor’s credentials and signature.

The safety assessor must hold a university degree in pharmacy, toxicology, medicine, or a closely related scientific discipline. Short courses and online certifications do not qualify.³ Beyond the safety report, the PIF must include a product description, evidence supporting any label or marketing claims, a declaration of compliance with good manufacturing practices, and data on any animal testing performed outside the EU for non-cosmetic regulatory purposes.

Manufacture to Good Manufacturing Practice

Article 8 requires cosmetic products to be manufactured in compliance with good manufacturing practices (GMP). The benchmark standard is ISO 22716, which covers production processes, quality control, storage, and shipping. The PIF must include a GMP compliance declaration, which can come from an external audit, an internal audit, or a self-declaration by the manufacturer, though an external audit carries more weight with regulators.

In practice, GMP means documented procedures for every production stage, clean and controlled manufacturing environments, trained personnel, traceable raw materials, and reliable quality testing of finished products. The requirement applies regardless of production volume, which is often where small independent brands are caught off guard.

Meet the Labeling Requirements

Labeling is the regulation’s primary consumer-facing enforcement mechanism. Article 19 lists the mandatory information that must appear on both the product container and its outer packaging in indelible, legible, and visible lettering:⁴

Name and address of the Responsible Person, plus the country of origin for imported products.
Net content by weight or volume at the time of packaging, with exceptions for items under 5 grams or 5 milliliters, free samples, and single-use packs.
A “best used before” date if shelf life is under 30 months, or a Period After Opening symbol (the open-jar icon) if shelf life exceeds 30 months.
Any precautions for use required by the annexes or needed for safe use.
A batch number for traceability, which can appear on the outer packaging only when the container is too small.
The product function, unless obvious from the presentation.
A full ingredient list using standardized INCI (International Nomenclature of Cosmetic Ingredients) names, in descending order of concentration.

Precautions, function descriptions, and usage instructions must appear in the language of the member state where the product is sold. That translation requirement is non-negotiable and is the single most common compliance stumble for brands entering new EU markets.¹

Small Packaging

Products too small to fit a full ingredient list get some relief. The INCI list can appear on an enclosed leaflet, an attached tag, or a card rather than directly on the container, but the product must display the “hand and book” symbol to alert consumers that additional information is provided separately. For very small items like sample-size soaps, the ingredient list can appear at the point of sale. Nanomaterials are the exception to any deferral: they must always be marked with “(nano)” on the product itself.

Expanded Allergen Labeling

Individual fragrance allergens must be labeled when they exceed concentration thresholds of 0.001% in leave-on products or 0.01% in rinse-off products. A recent amendment significantly expanded the allergen list, replacing 17 entries, deleting 10, and adding 45 new ones. New products placed on the market must comply with the expanded list by July 31, 2026, and existing products already on shelves have until July 31, 2028 to update their labeling.

Follow the Ingredient Rules

Ingredient control runs through the regulation’s annexes, and the distinction between them matters. Annex II lists prohibited substances, which cannot appear in any cosmetic product. Annex III lists restricted substances, allowed only under specific conditions such as maximum concentrations, use in particular product types, or mandatory warning text; this is where formulators spend most of their compliance effort.⁵ Annexes IV, V, and VI are positive lists of permitted colorants, preservatives, and UV filters, respectively: if a substance is not on the relevant list, it cannot be used for that purpose.

Substances classified as carcinogenic, mutagenic, or toxic to reproduction (CMR) are generally banned from cosmetics. Limited exceptions exist under Article 15 when a substance has been evaluated and found safe for use in cosmetics despite its CMR classification, but the conditions for those exceptions are deliberately narrow.¹

Nanomaterials receive dedicated scrutiny. Any nanomaterial in a cosmetic product must be labeled in the ingredient list with “(nano)” immediately following the substance name.⁶ Nanomaterials used as colorants, preservatives, or UV filters follow the standard annex listings. Nanomaterials used for any other purpose that are not otherwise restricted require a separate CPNP notification six months before the product goes on sale, so the Commission and the Scientific Committee on Consumer Safety can evaluate the material’s safety profile.

Keep Product Claims Substantiated

Article 20 prohibits any text, name, trademark, image, or sign in labeling, advertising, or marketing that implies a product has characteristics or functions it does not actually possess. That reach is broader than outright falsehood: it also covers misleading implications.¹

Commission Regulation (EU) No 655/2013 sets six common criteria every cosmetic product claim must satisfy:⁷ legal compliance (a product cannot be “approved” by an EU authority because there is no approval process, only notification, and regulatory compliance itself cannot be marketed as a special benefit); truthfulness (a named ingredient must be present by design, not as a trace contaminant); evidential support (claims must be backed by relevant studies with sound methodology, and any extrapolation from an ingredient’s properties to the finished product requires proof the ingredient is present at an effective concentration); honesty (performance claims cannot exceed what the evidence shows); fairness (claims must not denigrate competitors or disparage legally permitted ingredients); and informed decision-making (claims must be clear enough for an average consumer to make informed choices). Claims are judged from the perspective of a reasonably well-informed and reasonably observant consumer.

Notify Through the CPNP Before Sale

Before placing a cosmetic product on the market, the Responsible Person must submit an electronic notification through the Cosmetic Products Notification Portal (CPNP). Once a product is notified in the CPNP, no additional notification at the national level is required anywhere in the EU.⁸ Access to the portal requires an EU Login account.

Article 13 sets what must be submitted:⁴ the product category, name, and member states of sale; the Responsible Person’s name and address (where the PIF is kept) with an emergency contact; the country of origin for imports; chemical identity, descriptors, and foreseeable exposure conditions for any nanomaterials present; the CAS or EC number of any CMR substances; and a frame formulation, a standardized description of composition that lets poison centers give rapid medical treatment in the event of an adverse reaction. The Commission immediately transmits notification data to all national competent authorities and poison centers, and any substantial changes must be updated in the portal.

Do Not Rely on Animal Testing

The EU bans animal testing of finished cosmetic products and of cosmetic ingredients, and it also bans the marketing of cosmetic products in the EU if the product or its ingredients were tested on animals anywhere in the world.⁹ The marketing ban is absolute regardless of whether validated non-animal alternatives exist. For companies importing into the EU, this means any animal test data generated outside the EU for cosmetic safety cannot be used to support market entry.

Report Serious Adverse Effects

When a cosmetic product causes a serious adverse effect, meaning one that results in hospitalization, disability, a congenital anomaly, an immediate threat to life, or death, the Responsible Person must report it to the competent authority of the member state where the effect occurred. Distributors carry the same duty.¹⁰

The regulation requires reporting “without delay,” which the European Commission’s guidelines interpret as within 20 calendar days from the date any company employee becomes aware of the event. The initial report needs at minimum an identifiable reporter, a description of the adverse effect and when it occurred, and enough product information to identify the specific cosmetic involved. The threshold word is “serious”: a painful rash that resolves on its own is an undesirable effect but not necessarily a serious one, while a rash leading to hospitalization crosses the threshold. After reporting, the Responsible Person must support causality assessment, provide complete information to the authority, and integrate adverse event data into the PIF. Corrective measures such as reformulation or recall must also be reported. Non-serious adverse effects do not trigger mandatory reporting, but must still be documented internally and factored into the ongoing safety assessment.

Distributor Duties

Distributors, meaning any business making a cosmetic available on the market without being the manufacturer or importer, carry their own Article 6 obligations. Before selling a product, a distributor must verify that the labeling shows the Responsible Person’s name and address, a batch number, and a full ingredient list, and must confirm the product has not passed its durability date.¹

Distributors must store and transport products so they remain safe. If a distributor translates a label into a local language, that translation triggers a separate notification obligation through the notification portal. When a distributor has reason to believe a product does not comply, they cannot sell it until the issue is resolved, and they must notify both the Responsible Person and the competent authority if the product poses a health risk. Distributors must keep supply chain records for three years so authorities can trace any product back through the chain.

What Non-Compliance Costs

The regulation sets rules at the EU level; enforcement sits with each member state’s national competent authority. Article 37 requires member states to establish penalties that are effective, proportionate, and dissuasive, but the specific amounts and any criminal provisions vary by country.

Under Article 25, when a competent authority finds non-compliance by the Responsible Person, whether missing safety documentation, unlawful ingredients, inadequate labeling, or failure to notify, the authority can require corrective action within a set deadline. If the Responsible Person fails to act, or if the product poses an immediate serious health risk, authorities can prohibit sale, order withdrawal from distribution channels, or mandate a full consumer recall.² Distributors face parallel enforcement under Article 26.

1
EUR-Lex. Regulation (EC) No 1223/2009 of the European Parliament and of the Council
2
European Commission. Regulation (EC) No 1223/2009 of the European Parliament and of the Council
3
Legislation.gov.uk. Regulation (EC) No 1223/2009 of the European Parliament and of the Council
4
EUR-Lex. Consolidated Text: Regulation (EC) No 1223/2009
5
Legislation.gov.uk. Regulation (EC) No 1223/2009 – Annex III
6
European Commission. Nanomaterials
7
Legislation.gov.uk. Commission Regulation (EU) No 655/2013
8
European Commission. Cosmetic Product Notification Portal
9
European Commission. Ban on Animal Testing
10
European Commission. SUE Reporting Guidelines