EU Cosmetic Regulation Compliance — Complete Guide

EU cosmetic regulatory compliance is governed by Regulation (EC) No 1223/2009, which sets the rules for safety, labelling, ingredient restrictions, the Product Information File (PIF), the Cosmetic Product Safety Report (CPSR) and the mandatory CPNP notification before a product is placed on the EU market. COSMIC CoFormulator runs automated screening against EC 1223/2009 and seven other major markets, giving the formulator and the Responsible Person an indicative compliance check at the formulation stage — long before the regulatory dossier is assembled.

Regulation (EC) No 1223/2009 in 60 seconds

Regulation EC 1223/2009 has applied since 11 July 2013 and replaced the previous Cosmetics Directive 76/768/EEC. It is directly applicable in all 27 EU Member States plus the EEA (Iceland, Liechtenstein, Norway). The core obligations are:

• Safety first. A cosmetic product placed on the EU market must be safe under reasonably foreseeable conditions of use.
• Responsible Person. Every product must have a designated Responsible Person (RP) established in the EU, accountable for compliance.
• Product Information File (PIF). Kept by the RP for 10 years from the last batch placed on the market.
• CPSR. Part of the PIF; a two-part Cosmetic Product Safety Report assessing the product's safety.
• CPNP notification. Every product must be notified through the Cosmetic Products Notification Portal before being placed on the market.

Prohibited and restricted ingredients — the Annexes

The regulation works through six annexes, mirrored in the European Commission's CosIng database:

The annexes are amended several times per year through implementing regulations. Restrictions can change concentration caps, add label warnings, narrow conditions of use, or move an ingredient from Annex III to Annex II. A formulation that was compliant six months ago may not be compliant today — which is why COSMIC's INCI catalog refreshes nightly against CosIng.

The Product Information File (PIF)

The PIF is the dossier the Responsible Person must keep at the address shown on the product label, available to the competent national authority for 10 years from the last batch placed on the market. The PIF must contain:

1. A description of the cosmetic product
2. The CPSR (Parts A and B)
3. A description of the manufacturing method and a statement of compliance with Good Manufacturing Practice (ISO 22716)
4. Proof of the claimed effects, where the nature of the claim justifies it
5. Data on any animal testing, if performed (note: animal testing of cosmetics is banned in the EU)

The CPSR — Cosmetic Product Safety Report

The CPSR is the heart of the PIF. It is split into two parts:

• Part A — Safety Information: quantitative and qualitative composition, physical-chemical characteristics and stability, microbiological quality (including challenge test under ISO 11930 where applicable), impurities, packaging material, normal and reasonably foreseeable use, exposure to the cosmetic product and to the substances, toxicological profile of the substances, undesirable effects, and other information.
• Part B — Safety Assessment: the assessor's conclusion on the safety of the product, signed by a qualified safety assessor (a person holding a recognised diploma in pharmacy, toxicology, medicine or a similar discipline).

A Part B safety assessment cannot be generated by software alone — it requires a qualified human assessor. COSMIC's role is to compress the data-gathering work that feeds Part A: ingredient-level toxicology, stability prediction, microbial risk pre-screen and regulatory cross-check across markets.

CPNP notification — the last step before launch

The Cosmetic Products Notification Portal (CPNP) is the European Commission's centralised electronic notification system. The Responsible Person must notify each product before it is placed on the market, providing:

• Product category and name
• RP name and address
• Country of origin (for imports)
• Member State where the product is to be placed on the market
• Contact details of a physical person in case of need
• Frame formulation or full formulation, depending on category
• Original labelling and photograph of the packaging
• Presence of substances classified as CMR 1A or 1B, or nanomaterials, when applicable

CPNP notification does not replace the safety assessment; it is a notification, not an authorisation. The product is placed on the market under the RP's responsibility.

How COSMIC automates compliance screening

COSMIC's regulatory module runs at the formulation stage, not at the dossier stage. For every formula generated, the platform:

• Checks each INCI ingredient against Annex II (prohibited substances)
• Checks each ingredient against Annex III (restricted substances): concentration cap, conditions of use, label warnings
• Validates preservatives against Annex V and concentration caps
• Validates UV filters against Annex VI
• Validates colorants against Annex IV
• Flags allergen disclosure obligations (the 81-fragrance-allergen list under the latest amendment)
• Runs an ISO 11930 challenge-test pre-screen on the preservation system
• Cross-checks the same formula against US MoCRA, China GB, Japan MHLW, Korea MFDS, Canada, Brazil ANVISA and Australia ARTG

The output is indicative compliance evidence the formulator can hand to the safety assessor — not a substitute for the assessor's signature on Part B.

International comparison — same product, different rulebooks

A formula that is compliant in the EU is not automatically compliant elsewhere. The major markets COSMIC screens:

Differences that bite in practice:

• Preservatives: an EU-approved preservative may not be on the China NMPA positive list, which would force a reformulation for the Chinese market.
• UV filters: the US, EU and China each maintain a different positive list.
• Concentration caps: the same restricted substance can have a different cap in different markets.
• Animal testing: banned in the EU, still required for some product categories in mainland China (although alternative pathways exist for general cosmetics since 2021).

COSMIC's 8-market regulatory module is built to make these differences visible at the formulation stage, before the regulatory dossier is committed.

Practical workflow — from formula to compliant launch

1. Formulate in COSMIC and accept the regulatory module's indicative output for the target markets.
2. Lab confirmation — physical-chemical, microbiological (challenge test under ISO 11930), stability study under real conditions.
3. Toxicological assessment by a qualified safety assessor — uses the data COSMIC has aggregated for Part A as input.
4. CPSR Part B signed by the qualified safety assessor.
5. PIF assembly by the Responsible Person.
6. CPNP notification before the product is placed on the EU market.
7. Equivalent notification / registration in each non-EU market the product targets.

FAQ

What is Regulation EC 1223/2009?

The EU Cosmetics Regulation in force since 11 July 2013. It governs safety, labelling, ingredient restrictions, the PIF, the CPSR and CPNP notification for every cosmetic product placed on the EU market.

Who is the Responsible Person under EC 1223/2009?

A natural or legal person established in the EU designated for each cosmetic product, accountable for the product's compliance with the regulation. Contact details must appear on the label.

What is the difference between PIF and CPSR?

The PIF (Product Information File) is the complete dossier kept by the Responsible Person. The CPSR (Cosmetic Product Safety Report) is one section of the PIF, split into Part A (safety information) and Part B (the assessor's signed conclusion on safety).

Does COSMIC generate the CPSR Part B?

No. CPSR Part B requires a qualified human safety assessor's signature. COSMIC accelerates the data-gathering work that feeds Part A — toxicology, stability, microbial pre-screen and regulatory cross-check — but cannot replace the assessor.

How does CPNP notification work?

The Responsible Person logs into the Cosmetic Products Notification Portal and submits product information before the product is placed on the EU market. CPNP is a notification, not an authorisation; the RP remains responsible for compliance.

Is an EU-compliant product automatically compliant in the US?

No. US cosmetic compliance is governed by MoCRA (2022) under FDA oversight, with different ingredient lists, facility registration requirements and product listing obligations. COSMIC runs both screens automatically.

Does COSMIC cover China NMPA requirements?

Yes. COSMIC checks formulations against China's GB standards under the CSAR framework as part of its 8-market regulatory screen. Final dossier preparation for NMPA filing or registration must be done by a qualified regulatory expert.

How often does the EU update the regulatory annexes?

Several times per year through implementing regulations. COSMIC's INCI catalog refreshes nightly against CosIng so new restrictions and SCCS opinions appear in the platform within 24 hours.