EU Cosmetics Compliance: CPSR, PIF, CPNP and RP

A cosmetic product can be well formulated and professionally manufactured yet still be unready for the European Union. Market access depends on a named EU Responsible Person, a signed safety assessment, a complete and accessible Product Information File, a pre-market CPNP notification, and compliant labeling.

For a private-label brand, the practical risk is fragmentation. The factory may hold the master formula, a safety assessor may prepare the CPSR, the Responsible Person may maintain the PIF and submit CPNP data, while the brand controls claims and artwork. If those parties use different formula, package, or claim versions, the paperwork may look complete without describing the product actually sold.

This guide covers the EU baseline under Regulation (EC) No 1223/2009 and official information available on September 14, 2026. It is operational guidance, not legal advice. Great Britain uses a separate UK Responsible Person and notification route and is outside this article’s scope.

How CPSR, PIF, CPNP, and the Responsible Person Fit Together

The four terms describe different things. The Responsible Person is the accountable EU operator. The CPSR is the signed safety conclusion and its supporting assessment. The PIF is the broader product dossier. CPNP is the electronic notification channel used before market placement.^[1]

The dependencies matter. The Responsible Person cannot responsibly notify an unfinished product; the assessor cannot finalize the CPSR without reliable composition, exposure, stability, microbiological, packaging, and use data; and the PIF cannot stay accurate when artwork or formula changes bypass change control.

Appoint the EU Responsible Person Before Market Entry

Only a cosmetic product for which an EU-established Responsible Person is designated may be placed on the EU market. For a product manufactured in the EU and not exported then re-imported, the EU manufacturer is the default Responsible Person, although it may designate another EU-established person by written mandate. For an imported cosmetic, each importer is the default Responsible Person for the product it places on the market, but may likewise designate another EU-established person through a written mandate that the designee accepts in writing.^[1]

A distributor becomes the Responsible Person when it places a cosmetic on the market under its own name or trademark, or modifies a product already on the market in a way that may affect compliance. Translating label information alone is not treated as such a modification. Private-label contracts therefore need to identify the statutory role from the actual supply chain and branding arrangement, not simply call every participant a manufacturer or distributor.

The Responsible Person must ensure compliance with duties covering safety, GMP, safety assessment, the PIF, sampling and analysis, notification, restricted substances, labeling, claims, public access to certain information, and serious undesirable effects. When there is reason to believe a product is noncompliant, the role also includes corrective action, withdrawal or recall where appropriate, and cooperation with competent authorities.^[1]

Before accepting an appointment, define access rights and response obligations. The Responsible Person needs timely access to the formula, raw-material details, specifications, test reports, manufacturing records, claims evidence, artwork, distribution data, complaints, and change notices. A name and address on the label without those operating rights is not an effective compliance system.

Build the CPSR From the Final Product Configuration

The CPSR is product-specific. Article 10 requires a safety assessment before market placement, and Annex I divides the report into Part A, Cosmetic Product Safety Information, and Part B, Cosmetic Product Safety Assessment.^[1] It should evaluate the formula that will be manufactured, in the package that will be sold, under the intended and reasonably foreseeable conditions of use.

What the CPSR must evaluate

Part A covers the quantitative and qualitative composition; physical and chemical characteristics and stability; microbiological quality; impurities, traces, and packaging-material information; normal and reasonably foreseeable use; exposure to the product and its substances; toxicological profiles; undesirable and serious undesirable effects; and other relevant product information. Part B records the assessment conclusion, labeled warnings and instructions, scientific reasoning, and assessor credentials and approval.^[1]

This does not mean every product uses an identical testing program. A leave-on eye-area serum, rinse-off cleanser, anhydrous balm, acid peel, baby product, and aerosol have different exposure and hazard questions. The assessor determines what evidence is sufficient for the finished product. ZICAIL’s skincare product testing guide can help teams organize common stability, microbiological, compatibility, and performance inputs, but the assessor’s product-specific requirements govern the CPSR.

Packaging is part of the safety information, not a late decorative choice. Material composition, potential migration, barrier performance, dispensing behavior, contamination risk, and product-container interaction can affect the assessment. Complete packaging compatibility testing on the intended commercial system and notify the assessor when a component, liner, pump, closure, or decoration with potential product contact changes.

Who can sign the safety assessment

Part B must be performed by a person holding a diploma or other evidence of formal qualifications awarded after completion of a university course in pharmacy, toxicology, medicine, or a similar discipline, or a course recognized as equivalent by a Member State. The report should identify the assessor, show the qualification, and be signed or otherwise approved with a date.^[1]

The manufacturer can supply test data and technical reasoning, but a data pack is not automatically a signed CPSR. Likewise, a safety assessment for a base formula does not automatically cover a new fragrance, color, active level, package, use direction, target group, or exposure pattern. Reconfirm scope before reusing a report across variants.

Assemble and Maintain the Product Information File

The PIF is the controlled dossier for one product. It must contain:

• a product description that clearly links the file to the cosmetic product;
• the CPSR;
• a description of the manufacturing method and a statement of compliance with good manufacturing practice;
• proof of the effect claimed for the cosmetic product, where justified by the nature or effect of the claim; and
• data on animal testing performed by the manufacturer, its agents, or suppliers in connection with development or safety assessment of the product or ingredients, including testing used to meet third-country requirements.^[1]

Manufacturing must comply with GMP. Conformity is presumed when manufacture follows relevant harmonized standards; EN ISO 22716 is the harmonized cosmetics GMP standard commonly used for that purpose.^[1] A certificate can support supplier qualification, but the PIF still needs the manufacturing-method description and GMP statement. The cosmetic GMP and ISO 22716 guide explains how the standard relates to brand oversight without turning certification into a substitute for product evidence.

The Responsible Person must keep the PIF for 10 years after the date on which the last batch was placed on the market. It must be readily accessible in electronic or other format to the competent authority of the Member State where the file is kept, at the address indicated on the label. If multiple Responsible Person addresses appear, the address where the PIF is accessible must be highlighted. The file must be available in a language easily understood by that competent authority.^[1]

Access and retention should be written into supply agreements. The brand should establish who holds the controlled master, who can approve changes, how the Responsible Person obtains records if the commercial relationship ends, and how batch-linked evidence remains retrievable throughout the retention period. Use a structured manufacturer document request rather than waiting until the safety assessor or authority asks for missing data.

Submit the CPNP Notification Before Placing the Product on the Market

The Responsible Person must submit specified information electronically before placing the product on the market. Article 13 information includes the product category and name, the Responsible Person’s name and address where the PIF is accessible, country of origin for imports, the Member State where the product will be placed, emergency contact details, the presence and identification of nanomaterials, certain CMR-substance information, and a frame formulation for prompt medical treatment. When the product is placed on the market, the original labeling and a photograph of the packaging where reasonably legible must also be notified.^[1]

CPNP is a free notification system, not an authorization, safety certificate, or regulatory approval. Once a product is notified through CPNP, no further national product notification is required within the EU, although other national rules—such as language requirements and market surveillance—still apply.^[2]

Products containing nanomaterials can also require a separate Article 16 notification in addition to Article 13, generally six months before placement unless a stated exception applies. Do not confuse that advance nanomaterial process with the ordinary product notification. Ingredient names for nanomaterials must be followed by “(nano)” in the ingredient list.^[1]

Notification data must be updated without delay when covered information changes. Keep the submission record, account permissions, formula identifier, label version, package image, and update history together. A CPNP reference tied to an obsolete label or formula is not evidence that the current SKU was properly released.

Complete EU Cosmetic Labeling and Claims Review

Article 19 requires the container and packaging to bear specified information in indelible, easily legible, and visible lettering. Depending on the field and available space, required particulars include:

• the Responsible Person’s name or registered name and address, plus country of origin for imported cosmetics;
• nominal content at packaging time, subject to stated exceptions;
• the date of minimum durability or period-after-opening indication, as applicable;
• precautions for use, including required conditions in the Annexes and special professional-use precautions;
• the batch number or other reference identifying the product;
• the product function, unless clear from presentation; and
• the ingredient list headed by “ingredients,” using the required naming and ordering rules.^[1]

The language for nominal content, durability, precautions, and function is determined by the law of the Member State where the product is made available to the end user. Ingredient names follow the Commission glossary and specified nomenclature. Small-pack solutions exist for certain information when practical reasons prevent normal display, but limited space is not a general exemption from label review.

Claims must comply with the six common criteria: legal compliance, truthfulness, evidential support, honesty, fairness, and informed decision-making.^[3] Review product name, package, website, retailer copy, imagery, testimonials, and instructions as one commercial presentation. ZICAIL’s skincare product claims guide can help teams separate supportable cosmetic positioning from wording that may change product classification or overstate evidence.

Apply the 2026 fragrance-allergen transition correctly

Commission Regulation (EU) 2023/1545 expanded individual fragrance-allergen labeling requirements and provided two separate transition dates. Products that did not comply with the new restrictions could be placed on the Union market only until July 31, 2026, and qualifying products already placed on the market by that date may continue to be made available until July 31, 2028.^[4]

As of September 14, 2026, a new product being placed on the EU market cannot rely on the expired 2026 placement transition. The 2028 date is a sell-through period for eligible products already placed on the market by the earlier deadline; it is not an extension for launching newly labeled products under the old rules. Recalculate declarable allergens for the final fragrance and formula, apply the leave-on or rinse-off thresholds in the applicable Annex III entries, update artwork, and align the CPSR, PIF, and CPNP record.

Use a Controlled EU Private Label Compliance Workflow

1. Define the product and market route. Confirm that the intended use is cosmetic, identify destination EU Member States, map importer and distributor routes, and establish the brand’s claims and sales channels.
2. Appoint the Responsible Person. Document the default or designated EU operator, accepted mandate where needed, PIF address, authority-response duties, and access to technical and post-market records.
3. Lock the assessed configuration. Freeze formula version, raw-material compositions, manufacturing method, specifications, intended use, target users, directions, warnings, claims, package, and label inputs.
4. Collect manufacturer and supplier evidence. Obtain composition and toxicology data, specifications, certificates of analysis, stability and microbiological evidence, packaging information, GMP documentation, manufacturing description, and claim-support inputs.
5. Complete and approve the CPSR. Give the qualified assessor complete data, resolve gaps, implement required warnings or use limits, and obtain the approved Part B for the exact product.
6. Compile the PIF. Index every required component, reconcile versions, establish access at the label address, and set retention, confidentiality, and update controls.
7. Finalize labeling and notify CPNP. Approve destination-language artwork and claims, submit the required notification data before market placement, then retain the released labels, package image, and notification record.
8. Authorize distribution and monitor changes. Release only matching batches, keep complaint and serious-undesirable-effect procedures active, and route product or regulatory changes back through assessment, file, notification, and artwork review.

The sequence is intentionally gated. Starting artwork before the formula and role map are stable creates rework; notifying before label approval creates mismatches; and shipping before the Responsible Person can access the PIF creates avoidable enforcement risk.

Maintain Compliance After Launch

EU compliance is not completed by the first CPNP submission. The Responsible Person must keep the CPSR current when additional relevant information becomes available, maintain the PIF, update notified information, and ensure ongoing conformity. Serious undesirable effects must be notified without delay to the competent authority in the Member State where the effect occurred, with the information required by Article 23.^[1]

Use a change-control table that routes each proposed change to the correct reviewers.

The brand, manufacturer, Responsible Person, assessor, and distributors should agree who detects each trigger, how quickly records are supplied, and who can stop release. Periodically review current Annexes and amendment dates rather than relying on the regulation version used at the initial development stage.

Discuss Your EU Private Label Skincare Project

ZICAIL can discuss formulation, packaging, manufacturing, testing documentation, and quality-control inputs for an EU-focused private-label skincare project. The brand should appoint an appropriate EU Responsible Person and obtain product-specific regulatory and safety review for its final formula, package, claims, destinations, and artwork.

Prepare the intended product, formula or benchmark, target users, claims, package format, sales countries, importer route, Responsible Person arrangement, and required technical records before supplier discussions. Review ZICAIL’s private label skincare service and use the compliance workflow above to define the evidence your project will need.