If you make, import or sell cosmetics in Europe, one law sits behind almost every rule you meet: the EU cosmetics regulation 1223/2009. It is long and written in legal language, so this guide explains it in plain English: what it covers, who must follow it and what you need to do before your product reaches a shelf or a web shop.
Contents
- The short answer
- What does the regulation cover?
- Who has to comply?
- The responsible person: the key role
- Safety comes first: the safety assessment and the CPSR
- The product information file (PIF)
- Good manufacturing practice
- Notification before you launch
- Ingredient rules and the annexes
- Labelling and claims
- Animal testing
- After launch: vigilance and corrective action
- A practical compliance checklist
- Frequently asked questions
- Key takeaways
The short answer
Regulation (EC) No 1223/2009 is the single EU law that governs every cosmetic product placed on the market in the EU. It requires that products are safe for human health, that a named “responsible person” in the EU is accountable for each product, and that the brand keeps a documented safety assessment and product file, notifies the product before launch and labels it correctly. It has applied since 11 July 2013 and replaced the earlier Cosmetics Directive. As a regulation it applies directly in all Member States, so the core rules are the same in every EU country.
What does the regulation cover?
It covers any substance or mixture intended to be applied to the external parts of the body or to the teeth and mucous membranes of the mouth, mainly to clean, perfume, protect, keep in good condition, change the appearance or correct body odours. Creams, shampoos, make-up, toothpaste, deodorants and sunscreens all fall under it. Medicines, biocides and medical devices are governed by other laws, and the borderline is decided case by case on the intended purpose and the way the product works.
Read also What Is Cosmetic Stability Testing? A Plain-English Guide
Who has to comply?
Several roles are named, and each has its own duties:
- Manufacturers must produce under good manufacturing practice.
- Importers bring products from outside the EU and must check that the product meets the rules before they place it on the market.
- Distributors must check labelling, durability and that the responsible person is shown before they make a product available.
- The responsible person carries the main legal responsibility. Our guide to the CPSR shows how this role connects to safety documentation.
The responsible person: the key role
Only a product with a responsible person established in the EU may be placed on the EU market. For a product made in the EU, this is normally the manufacturer. For an imported product, it is normally the importer, unless the non-EU manufacturer appoints an EU-based person by written mandate. A distributor becomes the responsible person if it sells the product under its own name or trademark, or changes a product already on the market in a way that may affect compliance. This person must make sure that all the obligations below are met, and their name and address appear on the label.
Safety comes first: the safety assessment and the CPSR
Article 3 of the regulation says a cosmetic product must be safe when used under normal or reasonably foreseeable conditions. To prove it, the responsible person must have a cosmetic product safety report (CPSR) before the product is placed on the market. It has two parts. Part A collects the safety information: formula, physical and chemical properties, microbiological quality, impurities, packaging, normal and foreseeable use, exposure, toxicological profile of the ingredients and undesirable effects. Part B is the assessment itself, with the conclusion, labelled warnings, reasoning and the credentials of the assessor.
The assessor must hold a qualification in pharmacy, toxicology, medicine or a similar discipline. The method follows the Commission’s guidelines and the SCCS Notes of Guidance. Without a signed report, a product is not compliant, however good the formula looks.
Read also Cosmetic Responsible Person (RP): Who Needs One and What They Do
The product information file (PIF)
For every product, the responsible person keeps a product information file. It contains a description of the product, the CPSR, the method of manufacture and a statement of compliance with good manufacturing practice, proof of any claimed effect where justified by the nature of the claim, and data on any animal testing carried out by the manufacturer or its suppliers. The file is kept for ten years after the last batch was placed on the market and must be readily accessible, at the address on the label, to the competent authority. Challenge, stability and microbiological reports belong here, as does the SDS for raw materials where relevant.
Good manufacturing practice
Article 8 requires production under good manufacturing practice. Compliance is presumed when the manufacturer follows the harmonised standard, which today is ISO 22716. In practice this means documented hygiene, equipment, batch records, quality control and traceability, even for a small producer.
Notification before you launch
Before placing a product on the market, the responsible person submits key product information through the Cosmetic Products Notification Portal (CPNP), which is free of charge and shared with all Member States, poison centres and market-surveillance authorities. The notification includes the category, the name, the responsible person, the country of origin for imports, the presence of nanomaterials, CMR substances and the frame formulation. Notification does not mean approval. It simply makes the product known to the authorities.
Read also CPNP Notification: How to Register a Cosmetic Product
Ingredient rules and the annexes
The regulation is supported by annexes that act as lists:
- Annex II: substances prohibited in cosmetics.
- Annex III: substances allowed only under restrictions, such as a maximum concentration.
- Annex IV: permitted colourants.
- Annex V: permitted preservatives.
- Annex VI: permitted UV filters.
The Commission updates these lists regularly, so a formula that was fine two years ago should be rechecked. Substances classified as carcinogenic, mutagenic or toxic for reproduction (CMR) are in principle banned. Nanomaterials have their own notification and safety rules.
Labelling and claims
Each product must carry the following on the container and outer packaging, in the language required by the Member State of sale: name and address of the responsible person, country of origin for imports, nominal content, date of minimum durability or the period-after-opening symbol, precautions for use, batch number, function, and the ingredient list using INCI names. Claims must be truthful and supported. The Commission’s common criteria cover legal compliance, truthfulness, evidential support, honesty, fairness and informed decision-making. Our patch test is one way to support claims such as “dermatologically tested” or “suitable for sensitive skin”, but only if the wording matches what the study really showed.
Animal testing
The regulation bans testing finished cosmetic products and their ingredients on animals in the EU, and it bans placing on the EU market products whose final formulation or ingredients were tested on animals to meet its requirements. This is why modern safety work relies on in vitro methods, existing data and human studies.
After launch: vigilance and corrective action
Once a product is on the market, the responsible person has to monitor it. Serious undesirable effects must be reported to the competent authority of the Member State where they happened, and if a product is found not to comply, the responsible person must take corrective action immediately, which can include withdrawal or recall. Authorities can request all documents proving compliance, and the file must be provided in a language they easily understand.
A practical compliance checklist
- Confirm that your product is a cosmetic and not a medicine or biocide.
- Name the EU responsible person.
- Check every ingredient against the annexes.
- Run stability and microbiological tests, plus a challenge test for water-based products.
- Obtain a signed CPSR (Part A and Part B).
- Build and store the PIF.
- Notify the product in CPNP.
- Check labelling and claims before printing.
Frequently asked questions
Does the regulation apply to small and handmade brands?
Yes. There is no exemption for size, for handmade production or for online-only sales. Every product placed on the EU market needs a safety assessment, a PIF and notification.
Is the regulation the same in the UK?
No. Great Britain has its own retained version with a UK responsible person and the UK SCPN notification, and the two systems are updated separately. If you sell in both, plan for two responsible persons or one that is established in each territory.
Does notification in CPNP mean the product is approved?
No. Authorities do not approve cosmetics before launch. Responsibility stays with the responsible person, and inspections can happen at any time.
Key takeaways
- Regulation 1223/2009 is the one EU law for all cosmetics, directly applicable in every Member State.
- An EU responsible person, a signed CPSR and a ten-year PIF are the three pillars of compliance.
- Notify in CPNP before launch and check ingredients against the annexes regularly.
- Labelling and claims are part of the law, not just marketing.