Cosmetic regulation is full of abbreviations, and two of them cause the most confusion: CPSR vs PIF. Brands often use the words as if they meant the same thing, or assume that buying one of them covers the other. They are not the same, and one sits inside the other. This guide explains what each document is, how they relate, who needs them and how to keep both in order.
Contents
- The short answer
- What is a CPSR?
- What is a PIF?
- How do the two documents relate?
- Who needs which?
- Is the PIF sent to the authorities?
- What goes into a CPSR but not into a PIF, and the reverse
- Which tests feed into each document?
- Common mistakes
- How to organise your PIF
- What about the SDS?
- Frequently asked questions
- Key takeaways
The short answer
The CPSR (cosmetic product safety report) is the safety assessment of your product, signed by a qualified safety assessor. The PIF (product information file) is the full dossier you keep for each product, and the CPSR is one required part of it. Both come from Regulation (EC) No 1223/2009: the safety report from Article 10 and Annex I, the file from Article 11. You need a CPSR to build a compliant PIF, but a CPSR alone is not a PIF.
What is a CPSR?
The CPSR documents that the finished product is safe for human health under normal or reasonably foreseeable use. It has two parts. Part A collects the safety information: formula, physical and chemical properties, microbiological quality, impurities, packaging, exposure, toxicological profile of the ingredients and undesirable effects. Part B is the assessment itself: the conclusion, labelled warnings, reasoning and the assessor’s credentials and signature. Our CPSR service covers both parts.
Read also How Much Does a CPSR Cost in 2026? Price Factors Explained
What is a PIF?
The PIF is the product file. Under Article 11, it contains:
- A description of the cosmetic product that allows the file to be clearly attributed to it.
- The cosmetic product safety report (the CPSR).
- A description of the method of manufacture and a statement on compliance with good manufacturing practice.
- Proof of the effect claimed, where this is justified by the nature or the effect of the product.
- Data on any animal testing carried out in connection with the development or safety assessment of the product.
It must be kept by the responsible person for ten years after the last batch of the product is placed on the market, and it must be readily accessible to the competent authorities at the address given on the label.
How do the two documents relate?
Think of the PIF as a folder and the CPSR as the most important document in it. The folder also holds manufacturing information, claim evidence and animal testing data, which the CPSR does not replace. Equally, the CPSR needs inputs that normally live in the folder: ingredient specifications, test reports and packaging information. In practice the two grow together, and a gap in one shows up as a gap in the other.
Who needs which?
Every cosmetic product placed on the EU market needs both. The legal obligation sits with the responsible person, not the printer, the laboratory or the contract manufacturer. A small or handmade brand has exactly the same duty as a large company, as our guide to what a CPSR is and when you need one explains. The extent of the content differs, however: a simple soap bar needs a much lighter file than a leave-on baby cream with a fragrance.
Read also What Is a CPSR? Cosmetic Product Safety Report Explained
Is the PIF sent to the authorities?
No. The product is notified in the Cosmetic Products Notification Portal (CPNP) before launch, and that notification is a short record with the product category, formula framework and label information. Neither the PIF nor the CPSR is uploaded. They are kept ready and shown on request, for example during an inspection. This is why authorities can ask for them years after a product has launched, and why the ten-year clock matters. A tidy, complete file lets you answer an inspection within days instead of weeks, and it protects the brand if a retailer asks for proof of compliance before listing your product.
What goes into a CPSR but not into a PIF, and the reverse
The CPSR is a safety document only. The following belong to the PIF but are not part of the CPSR:
- The manufacturing description and the good manufacturing practice statement (for example, evidence of working to ISO 22716).
- Claim substantiation, such as a clinical or consumer study behind “hydrates for 24 hours”.
- Animal testing information.
In the other direction, detailed toxicological reasoning, exposure calculations and margins of safety live in the CPSR, and the PIF simply contains the signed report.
Which tests feed into each document?
Laboratory reports are inputs that serve both. A stability and compatibility test shows shelf life and whether the packaging is suitable. A microbiological specifications test shows the quality of the finished product, and a challenge test shows that a water-based product is protected against contamination. A patch test can support the skin tolerance part of the assessment and, where relevant, a claim. All our reports are signed PDFs that you can add to the file and the assessor can use in the CPSR.
Read also SDS vs CPSR: Which One Do You Need?
Common mistakes
- Treating the CPSR as the whole file. Authorities will also ask for manufacturing and claim evidence.
- Storing the file with a third party you cannot reach. It must be available at the address on the label.
- Not updating after a formula change. The report and file must stay current.
- Losing documents after ten years. The clock starts from the last batch, not from the first.
- Using a generic report. A report must match your exact formula and packaging.
How to organise your PIF
A simple structure helps: one folder per product and per formula version. Inside, create sections that mirror Article 11: product description, signed CPSR with test reports attached, manufacturing and GMP evidence, claim evidence and animal testing statement. Keep ingredient specifications and supplier certificates alongside the CPSR, since the assessor relied on them. Store a copy in a place the responsible person controls, ideally with a backup, and record the date of each update so you can show what was valid at a given time.
What about the SDS?
A safety data sheet is a different document again. It follows REACH and describes hazards and handling of a substance or mixture, mainly for professional users. If you want to know when you need one, our SDS page and the comparison of SDS and CPSR explain the difference. In short, the SDS is not a part of the PIF unless you choose to include it as supporting information.
Frequently asked questions
Can I buy a PIF from a lab?
You can buy parts of it, such as the CPSR and the test reports, but the PIF as a whole is your file. The responsible person is the one who must keep it complete and accessible.
Does every product variant need its own CPSR and PIF?
Each distinct formula needs its own assessment. Variants that differ only in a way the assessor can show to be irrelevant, such as certain colour shades within a defined range, may be covered together, but this is the assessor’s judgement and must be documented.
Which language should the PIF be in?
The information must be in a language easily understood by the competent authorities of the Member State where the file is kept, so check the accepted languages for your market.
Key takeaways
- The CPSR is the signed safety assessment, the PIF is the whole product file and contains the CPSR.
- You need both for every cosmetic placed on the EU market.
- Neither is uploaded to CPNP, but both must be available on request for ten years after the last batch.
- Keep tests, specifications and manufacturing evidence together so the file is ready for an inspection.