Quick Answer
Cosmetic regulations EU are set by Regulation (EC) No 1223/2009, which applies directly in every member state and requires an EU-established Responsible Person, a Cosmetic Product Safety Report, and notification through the CPNP portal before any product is sold.
The CPSR is a two-part safety assessment signed by a qualified assessor and held inside the Product Information File. Ingredient limits are set out in Annexes II to VI, cover more than 1,700 prohibited substances, and are updated regularly through Omnibus regulations, making the CosIng database the practical reference point for formulators.
Introduction
Formulators meeting cosmetic regulations in the EU for the first time usually underestimate one thing. The system is not a registration you file after launch, but a safety case you build before a single unit is sold.
This guide explains the framework in plain terms, though it is general information rather than legal advice, so confirm specifics with your national authority or a qualified adviser before acting.
I have seen brands treat CPNP notification as the whole job and discover the CPSR behind it too late. Notification is the final step of a process that starts with formulation and safety data.
By the end, you will understand how Regulation 1223/2009 works, what the CPSR and CPNP actually are, who your Responsible Person must be, and how ingredient and claims rules constrain your formula.
How Regulation 1223/2009 Works
The EU’s cosmetic framework is Regulation (EC) No 1223/2009, which replaced the earlier Cosmetics Directive and has applied across all member states since 11 July 2013. Because it is a regulation rather than a directive, it applies directly without national transposition, giving one set of rules across the EU and EEA.
The regulation places safety responsibility on the industry rather than on any approval body. There is no premarket approval for finished cosmetics, and instead, the burden is to prove and document safety before sale.
Four pillars carry the whole system. An EU Responsible Person, a safety assessment, a documented file, and portal notification must all be in place before the product reaches consumers.
The EU Responsible Person
Every cosmetic on the EU market must have a Responsible Person established inside the EU or EEA. This can be the manufacturer, the importer, a distributor selling under its own name, or an appointed third party who accepts the role in writing.
The role carries legal accountability rather than administrative convenience. The Responsible Person holds the Product Information File, submits the CPNP notification, and answers to national authorities on compliance and undesirable effects.
Brands outside the EU face a hard prerequisite here. Without an EU-established Responsible Person, you cannot notify, and without notification, you cannot lawfully place a product on the market.
The Cosmetic Product Safety Report Explained
The Cosmetic Product Safety Report, or CPSR, is the safety case for a specific product. It is set out in Annex I of the regulation and is split into two distinct parts.
Part A gathers the safety information, including the quantitative and qualitative formula, physical and chemical characteristics, stability, microbiological quality, impurities, exposure data, and the toxicological profile of each substance. Part B is the assessment itself, where a qualified safety assessor evaluates that evidence, concludes safety, and signs it.
The assessor must hold a recognised qualification in pharmacy, toxicology, medicine, or a similar discipline. A formulator cannot self-certify a product unless they personally hold that qualification.
Testing feeds the report directly. Stability data applies to every product, and preservative efficacy testing applies to water-containing formulations, since both determine whether the product stays safe across its life.
What Drives CPSR Cost
The cost of a CPSR varies widely, rather than following a fixed published rate. Assessors price on formula complexity, the number of ingredients, product category, available toxicological data, and whether any actives or nanomaterials need extra evaluation.
A simple anhydrous product with well-characterised ingredients costs far less to assess than a complex emulsion with novel actives. Missing stability or challenge test data raises the price further, since the assessor cannot conclude without it.
Get written quotes from several qualified assessors and supply complete data with your request. Preparing clean documentation before you approach an assessor is the single most effective way to control what you pay.
The Product Information File
The Product Information File, or PIF, is the dossier holding everything that proves compliance. It contains the CPSR, the product description, the manufacturing method, the GMP statement, evidence for claimed effects, and any animal testing data.
The Responsible Person keeps the PIF at their EU address for ten years after the last batch was placed on the market. National authorities may request it at any time, and it must be readily accessible in a language they understand.
Manufacturing must follow good manufacturing practice under Article 8. Compliance with the ISO 22716 standard is the accepted way to demonstrate this, covering premises, personnel, equipment, and documentation.
CPNP Notification
The Cosmetic Products Notification Portal, known as CPNP, is the EU’s central notification system managed by the European Commission. The Responsible Person must notify each product before it goes on sale, and the submission is free.
A single CPNP notification covers the entire EU rather than requiring registration in each country. It gives national authorities and poison centres immediate access to the formula and the responsible contact if a safety issue arises.
Notification comes after the CPSR, not before, since the portal draws on information the safety assessment produces. The Responsible Person must update the notification whenever the formula or key details change.
One post-Brexit point catches brands out. A CPNP notification covers the EU and Northern Ireland under the Windsor Framework, but it does not cover Great Britain, which requires separate notification through its own system.
Ingredient Restrictions and the CosIng Database
EU ingredient control runs through the regulation’s annexes, which are far stricter than most other markets. The table below shows what each annex governs.
| Annex | Function |
| Annex II | Prohibited substances, over 1,700 entries |
| Annex III | Restricted substances with conditions and limits |
| Annex IV | Permitted colorants, a positive list |
| Annex V | Permitted preservatives, a positive list |
| Annex VI | Permitted UV filters, a positive list |
Annexes IV, V, and VI work as positive lists, meaning a colorant, preservative, or UV filter may only be used if it appears there. Annex II operates in reverse, banning outright anything listed.
Article 15 adds an automatic mechanism. A substance classified as carcinogenic, mutagenic, or toxic for reproduction under the CLP Regulation becomes prohibited in cosmetics unless a specific exemption is granted.
The CosIng database is the Commission’s official reference for checking any ingredient’s current status. Search by INCI name or CAS number before finalising any formula, since the annexes change regularly.
Recent and Upcoming Changes
The annexes update through Omnibus regulations, which bundle multiple amendments into one instrument. Two deadlines demand attention right now.
Omnibus VIII, published as Regulation (EU) 2026/78 in January 2026, applies from 1 May 2026 and adds new CMR prohibitions while restricting silver by particle size and setting limits on hexyl salicylate. Earlier, Omnibus VII removed TPO from nail products as of September 2025.
Fragrance allergen labelling expands substantially under Regulation (EU) 2023/1545. Eighty allergens must be individually declared above 0.001 percent in leave-on and 0.01 percent in rinse-off products, with compliance required for products placed on the market from 31 July 2026 and existing stock saleable until 31 July 2028.
Treat EU compliance as continuous rather than complete. Formulas that were compliant last year can fall foul of an Omnibus update, so review your portfolio against CosIng on a schedule.
Labelling and Claims Rules
Article 19 sets what every EU label must show. The list includes the Responsible Person’s name and address, nominal content, a minimum durability date or period-after-opening symbol, precautions, batch number, product function, and the INCI ingredient list in descending order.
Claims are governed separately by Regulation (EU) No 655/2013, which sets common criteria. Every claim must be truthful, evidenced, honest, fair, and support informed decisions, and the evidence must sit in the PIF.
Cosmetic claims cannot describe treating or curing a condition, since that would make the product a medicine. The EU also bans animal testing for cosmetics and their ingredients, alongside the marketing of products tested on animals.
Common Mistakes in EU Cosmetic Compliance
EU compliance fails in recognisable ways, and each mistake below carries a direct fix. Avoiding them protects both consumers and market access.
The first mistake is notifying CPNP before obtaining a CPSR. Notification depends on the safety assessment, so commission the CPSR first and notify afterwards.
Assuming a non-EU business can notify directly is a second error. Only an EU-established Responsible Person may notify, so appoint one early rather than at launch.
Believing small or handmade brands are exempt is a third mistake. The regulation offers no exemption based on scale, so every product requires a full CPSR regardless of batch size.
Using a preservative, colorant, or UV filter absent from the positive lists is a fourth error. Those annexes permit only what they list, so verify every one against CosIng before formulating.
Assuming an EU notification covers Great Britain is a fifth mistake. Post-Brexit, the two systems are separate, so notify Great Britain independently, while CPNP still covers Northern Ireland.
The sixth error is treating compliance as a one-time task. Omnibus updates change the annexes regularly, so schedule portfolio reviews rather than reacting to a withdrawal notice; a disciplined resource like Formula Chemistry emphasises to growing brands.
Which Requirements Apply to You
Any brand selling a cosmetic anywhere in the EU or EEA faces the full framework. Responsible Person, CPSR, PIF, GMP, and CPNP notifications apply equally to a global manufacturer and a single-product indie brand.
Brands based outside the EU must resolve the Responsible Person question before anything else. Appoint an EU-established partner or service, since nothing downstream can proceed without one.
Those selling across the EU and Great Britain should plan for dual compliance. Two Responsible Persons, two portals, and increasingly two ingredient lists are the real cost of both markets.
Whatever your size, build the safety file before the launch date. To begin, check your formula against CosIng, commission a CPSR from a qualified assessor, and treat CPNP notification as the final step rather than the first.
Frequently Asked Questions
What is the EU cosmetic regulation?
It is Regulation (EC) No 1223/2009, which governs cosmetic safety and marketing across the EU and EEA. It applies directly in every member state without national transposition. Products need a Responsible Person, a safety report, and CPNP notification before sale.
What is a CPSR?
The Cosmetic Product Safety Report is a two-part safety assessment required for every EU cosmetic. Part A compiles the safety data, and Part B contains the qualified assessor’s evaluation and conclusion. It sits inside the Product Information File.
What is the CPNP portal?
CPNP is the EU’s Cosmetic Products Notification Portal, managed by the European Commission. The Responsible Person notifies each product there before it goes on sale. One notification covers all EU member states and is free to submit.
Who can write a CPSR?
Only a qualified safety assessor holding a recognised degree in pharmacy, toxicology, medicine, or a similar discipline may sign Part B. Formulators cannot self-certify unless they hold that qualification. The assessor evaluates the data compiled in Part A.
How much does a CPSR cost?
There is no fixed rate, since pricing depends on formula complexity, ingredient count, product category, and available toxicological data. Simple anhydrous products cost less to assess than complex emulsions with novel actives. Request written quotes from several qualified assessors.
Do small brands need a CPSR?
Yes, the EU offers no exemption based on business size or batch volume. Every cosmetic placed on the market needs a CPSR signed by a qualified assessor. Handmade and small-batch products are fully covered by the regulation.
What is the CosIng database?
CosIng is the European Commission’s official database of cosmetic ingredients and their regulatory status. It shows whether a substance appears in Annexes II to VI and under what conditions. Formulators should check it before finalising any formula.
Does CPNP cover the UK?
CPNP covers the EU and Northern Ireland under the Windsor Framework, but not Great Britain. Great Britain requires separate notification through its own SCPN system. Brands selling in both markets need two notifications.
Key Takeaways
Cosmetic regulations in the EU rest on Regulation 1223/2009, which demands an EU Responsible Person, a signed CPSR, a maintained PIF, GMP, and CPNP notification before any sale. No exemption exists for small or handmade brands.
Ingredient control runs through Annexes II to VI, with positive lists for colorants, preservatives, and UV filters, and CosIng is the reference that keeps you current. Omnibus updates change these lists regularly, including new prohibitions applying from May 2026 and expanded allergen labelling from July 2026.
Build safety before notification, not after. To act now, verify every ingredient in CosIng, appoint your EU Responsible Person, and commission the CPSR before you set a launch date.