The EU Cosmetics Regulation, formally Regulation (EC) No 1223/2009, is the single legal framework for every cosmetic product sold in the European Union. To place a product on the EU market, a company must designate a responsible person established in the Union, compile a product information file that includes a qualified safety assessment, notify the product through the Cosmetic Products Notification Portal, meet the ingredient and labeling rules, and keep monitoring the product for safety issues after launch.1European Commission. Regulation (EC) No 1223/2009 on Cosmetic Products The rules apply regardless of where the product was manufactured.
The scope is broader than most people expect. A cosmetic product is any substance or mixture meant to be applied to the external parts of the body (epidermis, hair, nails, lips, external genital organs) or to the teeth and mucous membranes of the mouth, for cleaning, perfuming, changing appearance, protecting, maintaining condition, or correcting body odors. Toothpaste, mouthwash, deodorant, sunscreen, and hair dye fall under the same regulation as lipstick and face cream. Products that make therapeutic claims, such as treating acne or curing eczema, can instead be classified as medicinal products under separate pharmaceutical law.
The Responsible Person
No cosmetic product may be placed on the EU market without a designated responsible person, a legal or natural person established within the Union. For EU-based manufacturers, that is usually the manufacturer. For products made outside the EU, it is the importer, or a person established in a member state whom the manufacturer has appointed in writing to take on the role.
The responsible person carries the core compliance burden. Before launch, they must ensure the product has undergone a proper safety assessment, compile and maintain the product information file, submit the CPNP notification, and check that labeling meets every requirement. After launch, they monitor the product, report serious undesirable effects to authorities, and take corrective action when problems appear. If a product turns out to be non-compliant, they must bring it into conformity, withdraw it from retailers, or recall it from consumers as the situation demands. The product information file must be kept for ten years after the last batch was placed on the market, and competent authorities can request access at any time.2Legislation.gov.uk. Regulation (EC) No 1223/2009 Article 11 – Product Information File
The Product Information File and Safety Assessment
The product information file is the product’s complete regulatory dossier. It contains the product description, manufacturing method, evidence of good manufacturing practice compliance, the safety assessment, and any data on undesirable effects.2Legislation.gov.uk. Regulation (EC) No 1223/2009 Article 11 – Product Information File It must be accessible at the address of the responsible person shown on the label.
At the heart of the file is the cosmetic product safety report, which is structured in two parts. Part A gathers the safety information: quantitative and qualitative composition, physical and chemical characteristics, microbiological quality, impurities and traces of prohibited substances, packaging details, normal and reasonably foreseeable use, and stability data.3Legislation.gov.uk. Regulation (EC) No 1223/2009 – Annex I Part A Part B is the safety assessment itself: a qualified assessor’s conclusion on whether the product is safe for human health, including the toxicological profile of each ingredient, expected consumer exposure, and any particular risk for vulnerable groups such as children under three.
The Part B assessor must hold a university-level qualification in pharmacy, toxicology, medicine, or a comparable discipline. This is not a role for someone without formal scientific training.
The file must also show that manufacturing follows good manufacturing practice. The EU recognizes EN ISO 22716:2007 as the harmonized standard for cosmetics GMP, covering production, control, storage, and shipment; manufacturing in line with it creates a presumption of GMP compliance.4European Commission. Harmonised Standards – Cosmetic Products
CPNP Notification
Before a cosmetic product is made available on the EU market, the responsible person must submit a notification through the Cosmetic Products Notification Portal (CPNP).5European Commission. Cosmetic Product Notification Portal The notification covers the product category, trade name, responsible person’s contact details, country of origin for imported products, presence of any nanomaterials, and the frame formulation or exact composition. The original labeling and a photograph of the packaging must also be uploaded.
The CPNP is not an approval gateway. There is no waiting period and no authorization step; compliance responsibility stays entirely with the responsible person. The data is shared with national competent authorities across the EU and with poison centers, which rely on the detailed formulas to give medical advice during emergencies such as accidental ingestion or allergic reactions.
Products containing nanomaterials (other than colorants, preservatives, and UV filters already regulated under the annexes) carry an additional obligation: the Commission must be notified at least six months before the product is placed on the market, with information on the nanomaterial’s chemical identity, particle size and physical properties, estimated annual quantity, toxicological profile, and safety data for the foreseeable exposure. The Commission can refer the file to the Scientific Committee on Consumer Safety if there are concerns.
Ingredient Restrictions
The regulation controls which substances can appear in a formulation through a system of annexes.
- Annex II lists prohibited substances that cannot be used in any cosmetic product at any concentration. The list contains over 1,750 entries.6European Commission. CosIng – List of Substances Prohibited in Cosmetic Products
- Annex III lists restricted substances, permitted only under specific conditions such as maximum concentrations, product-type limits, or mandatory warnings.
- Annexes IV, V, and VI are positive lists for colorants, preservatives, and UV filters. Only substances on these lists may be used for those functions, and only under the conditions stated.
The annexes are updated regularly through delegated regulations, so a substance permitted last year can be restricted or banned with a transition period. Substances classified as carcinogenic, mutagenic, or toxic for reproduction (CMR) are banned by default. For category 1A and 1B CMR substances, exceptions are possible only when the substance meets food safety requirements, no suitable alternative exists, the use is for a specific product category with known exposure, and the SCCS has evaluated it as safe for that use. Category 2 CMR substances can be used only if the SCCS has evaluated them and concluded they are safe in cosmetics. Any CMR substance added to an annex must be re-evaluated at least every five years.
Animal Testing
The EU maintains a two-part prohibition. The testing ban prohibits animal testing on finished cosmetic products (since September 2004) and on cosmetic ingredients or combinations of ingredients (since March 2009). The marketing ban prohibits selling in the EU any cosmetic product whose ingredients were tested on animals to meet the regulation’s requirements, no matter where the testing was performed. The final deadline for the marketing ban, covering repeated-dose toxicity, reproductive toxicity, and toxicokinetics, was March 11, 2013.7European Commission. Ban on Animal Testing Animal test data generated for cosmetics purposes cannot be used to justify market access in the EU, regardless of whether alternative methods exist.
Labeling
Every cosmetic product must carry specific information in indelible, legible, and visible lettering on both the container and any outer packaging:
- The name and registered address of the responsible person.
- The country of origin for imported products.
- Nominal content by weight or volume at the time of packaging.
- A “best before” date for products with a shelf life under 30 months, or a period-after-opening symbol (in months) for products lasting longer.
- Any warnings or conditions of use needed to prevent misuse.
- A batch number for traceability.
- The product’s function, unless obvious from its presentation.
- The ingredient list in descending order of weight at incorporation, using INCI names.
Member states can require certain information (particularly precautions, function, and special use conditions) in their national or official language, and some require a full translation of all label text. When a container is too small, the regulation allows certain details to be placed on an enclosed leaflet, label, tape, or tag.
Marketing Claims
The regulation prohibits text, names, trademarks, images, or signs that imply characteristics or functions the product does not have. Commission Regulation (EU) No 655/2013 sets out six criteria every claim must satisfy: legal compliance, truthfulness, evidential support, honesty, fairness, and informed decision-making.8EUR-Lex. Commission Regulation (EU) No 655/2013
Evidential support is where most companies stumble. Every claim on the label, in advertising, or on a website must be backed by adequate and verifiable evidence, whether experimental studies, consumer perception tests on statistically representative samples, or peer-reviewed literature. The level of proof is proportionate to the claim; a sunscreen’s SPF value, for instance, requires rigorous standardized testing because efficacy failure is a direct safety risk.9European Commission. Technical Document on Cosmetic Claims Truthfulness catches a subtler issue: attributing an ingredient’s known properties to the finished product without proving the ingredient is present at an effective concentration. Listing hyaluronic acid and implying deep hydration requires evidence that the product itself delivers the benefit.
“Free-from” claims receive special scrutiny. They are prohibited when they reference substances already banned under the regulation (a “corticosteroid-free” claim is misleading because corticosteroids cannot legally be in any cosmetic), when they denigrate legally permitted ingredients (“paraben-free” implies parabens are unsafe when they are authorized under specific conditions), or when they highlight the absence of an ingredient not typically used in that product category (marketing a fine fragrance as “preservative-free” is dishonest when fragrances rarely need preservatives).
After Launch: Adverse Events and Corrective Action
Compliance obligations continue once the product is on the shelf. The responsible person must monitor for undesirable effects. A serious undesirable effect is any adverse health reaction that results in temporary or permanent functional incapacity, disability, hospitalization, congenital anomalies, or an immediate risk to life. These must be reported to the competent authority of the member state where the event occurred “without delay,” which European Commission guidance interprets as within 20 calendar days from when any employee of the company becomes aware of the event.10European Commission. SUE Reporting Guidelines Other member states where the product is available must be informed if the event has cross-border implications.
When the responsible person concludes that a marketed product is non-compliant or presents a danger to human health, immediate corrective measures are required. Depending on severity, that can mean reformulating and updating labeling, withdrawing the product from retailers, or issuing a full consumer recall. National authorities share information about dangerous products across the single market through the EU’s Safety Gate rapid alert system, so a problem identified in one country quickly reaches all the others.11European Commission. Safety Gate: The EU Rapid Alert System for Dangerous Non-Food Products
Distributor Obligations
Distributors carry their own duties, separate from those of the responsible person. Before making a cosmetic product available, a distributor must verify that the required labeling is present (responsible person’s name and address, precautions, ingredient list), that language requirements for the country of sale are met, and that the date of minimum durability has not passed. Storage and transport conditions must not compromise compliance.
If a distributor suspects a product does not comply, it must not be sold until it has been brought into conformity. When non-compliant products have already reached the market, the distributor must ensure corrective measures are taken, including withdrawal or recall where warranted. Any product presenting a risk to human health triggers an immediate obligation to inform both the responsible person and the relevant national authority, with details of the non-compliance and any steps already taken.
Enforcement and Penalties
The regulation does not set specific fines at the EU level. Each member state must establish its own penalty framework, with the sole requirement that penalties be effective, proportionate, and dissuasive. Consequences for the same violation can therefore look very different depending on which country’s authority acts. Possible measures across member states include administrative fines, product seizures, forced withdrawals, import bans, and, in some jurisdictions, criminal prosecution for serious breaches that endanger public health.
National competent authorities carry out market surveillance by inspecting products, requesting access to the product information file, taking samples for laboratory testing, and auditing compliance with labeling and notification rules. When a product is found non-compliant, authorities can order the responsible person to correct the issue within a set timeframe or remove the product from the market. Both the responsible person and any distributor involved must cooperate with these investigations.