Private label and white label products let a brand launch quickly: a manufacturer supplies a ready formula, you add your name and your packaging. The part many founders miss is that your name on the pack also puts the legal duty on you. This guide explains private label cosmetics responsibility in the EU: who answers for safety, what the manufacturer can and cannot do for you, and what to agree in writing.
Contents
- The short answer
- What private label means in practice
- Who is the responsible person?
- What the responsible person must ensure
- What the manufacturer can do for you
- Why a supplier’s CPSR is often not enough
- Tests you should still do yourself
- What to agree in the contract
- Label and claims remain yours
- Common mistakes
- A short checklist for a private label launch
- Frequently asked questions
- Key takeaways
The short answer
If a cosmetic is placed on the EU market under your name or trademark, you are normally the “responsible person” and you are accountable for its safety, the CPSR, the product information file, the CPNP notification and the label, even if someone else made it. The manufacturer can supply data and documents, but they do not remove your legal duty.
What private label means in practice
In private label, a contract manufacturer owns or develops a base formula and produces it for several brands. White label usually means the same product sold under different names with little or no change. Custom or semi-custom formulation means the formula is adapted for you. In all three cases, the question for the law is not who mixed the product but whose name is on the pack and who places it on the market.
Read also Private Label Cosmetics CPSR: What Brands Must Do
Who is the responsible person?
Regulation (EC) No 1223/2009 requires every cosmetic product placed on the EU market to have a responsible person established in the EU. Article 4 says the responsible person can be the manufacturer, the importer, or someone appointed by written mandate. It also says that a distributor becomes the responsible person when it places a product on the market under its own name or trademark, or modifies a product already on the market in a way that may affect compliance. That is the private label situation.
The responsible person must be an EU or EEA-based legal or natural person, with an address that appears on the label. A brand outside the EU therefore needs an EU-based responsible person before it can sell in the EU.
What the responsible person must ensure
Article 5 summarises the duties. In practice you must make sure that:
- the product is safe under normal or foreseeable use and has a completed safety assessment and CPSR;
- it was made according to good manufacturing practice (GMP);
- a product information file (PIF) exists and is kept for ten years after the last batch was placed on the market;
- the product is notified in the CPNP before it is sold;
- the label meets Article 19 and every claim meets Article 20;
- complaints and serious undesirable effects are handled and reported to the authorities;
- corrective action, withdrawal or recall happens if the product does not comply.
What the manufacturer can do for you
A good private label manufacturer is a real help. It can usually provide:
- the formula with specifications and raw material documents;
- proof of GMP, ideally against ISO 22716, and batch records;
- stability, microbiological and preservation test data for the base formula;
- a sample or existing CPSR for the stock formula.
These documents are valuable, but they are inputs. The manufacturer’s paperwork was written for the manufacturer’s product in the manufacturer’s container.
Read also Sell Cosmetics on Etsy: Safety Documents You Need
Why a supplier’s CPSR is often not enough
A CPSR assesses a specific product in its actual use and packaging. When you buy a stock formula, check these points before you rely on an existing CPSR:
- Is your product the same? A changed fragrance, colour, preservative or percentage is a different formula.
- Does it cover your packaging? Compatibility and stability depend on your container, pump or tube.
- Does it cover your target group and claims? A product for babies, or with a sensitive-skin claim, is assessed differently.
- Is the assessment current? Annex changes and new data can make an older CPSR outdated.
- Is it addressed to you? The responsible person must have the assessment available in the PIF and be able to show it to authorities.
Often the safest route is a new CPSR for your finished product, built on the supplier’s data and your own tests.
Tests you should still do yourself
Even with a good base formula, your finished product is a new product. Typical evidence includes:
- a stability and compatibility test in your real packaging;
- a challenge test for water-containing products, to show that the preservative system works;
- a microbiological specifications test on the finished product;
- a patch test where you want to support a tolerance or sensitive-skin claim.
What to agree in the contract
A written agreement between brand and manufacturer prevents most disputes. Cover at least the following:
- Who is the responsible person and, if it is you, how the manufacturer supports you.
- Documents: which files the manufacturer delivers (formula data, GMP certificate, specifications, test reports) and in what format.
- Formula changes: the manufacturer informs you before changing any raw material or supplier.
- Batch records and retention: they are kept and available to you for the whole retention period.
- Complaints and undesirable effects: who collects them, how fast they reach you and what is shared.
- Recalls and corrective action: who does what and how fast.
- Audit rights: you may review the production site or its records.
- Confidentiality: the safety assessor can access the full formula even if the manufacturer wants to keep it secret.
The last point matters: a CPSR cannot be done without the complete formula, so a manufacturer that refuses to share it blocks your compliance.
Read also Responsible Person vs Safety Assessor: Who Does What
Label and claims remain yours
The manufacturer often prints or supplies a standard label. You are still responsible for the label text. Check the responsible person address, the ingredient list, the date of minimum durability or the period after opening, the batch number, the function, the precautions and the language requirements of each market. Claims on the pack, the website and social media must be supported by evidence you hold. A claim copied from the manufacturer’s brochure is still your claim.
Common mistakes
- Assuming the supplier’s name on the invoice makes the supplier the responsible person.
- Selling in the EU with a responsible person who is not based in the EU.
- Launching on a supplier CPSR for a different fragrance or packaging.
- Skipping the CPNP notification because the manufacturer “already did it” for another brand.
- Not having the PIF available at the address on the label.
- Not agreeing who informs whom when the supplier changes a raw material.
A short checklist for a private label launch
- Confirm the EU responsible person and the address on the label.
- Obtain the formula, specifications and GMP evidence from the manufacturer.
- Run the tests on the finished product in its final packaging.
- Obtain a signed CPSR for your product.
- Assemble the PIF and notify the product in the CPNP.
- Check the label and every claim, then release the first batch.
Frequently asked questions
Can the manufacturer be my responsible person?
Yes, if it is established in the EU and agrees by written mandate. You then still need to review the documents and keep control of claims and labelling. Check that the arrangement is clear in the contract.
Do I need my own CPSR if the manufacturer has one?
Usually yes, because your finished product, packaging and claims differ from the stock formula. Your safety assessor can reuse the manufacturer’s data, but the assessment must fit your product.
Does white label change the answer?
No. Whenever the product is sold under your name or trademark, the duties of the responsible person apply to you or to the person you appoint.
Key takeaways
- Your name on the pack means you are normally the responsible person, with a legal duty for safety, file, notification and label.
- The manufacturer supplies inputs, not your compliance.
- Test and assess your finished product in its real packaging.
- Put roles, change control and complaint handling into a written contract.