# Beauty and personal care: EU market entry basics
Short answer: Regulation (EC) No 1223/2009 is the central EU cosmetics act: it defines what counts as a cosmetic product, sets safety, labelling and claims rules, and requires a designated EU responsible person for every product. A qualified safety assessor must sign off the cosmetic product safety report in the product information file, every product must be notified on the CPNP portal before sale, and Annexes II through VI govern prohibited, restricted and permitted substances.
Key facts
- Regulation (EC) No 1223/2009 (the Cosmetics Regulation) is the single EU-wide rulebook for cosmetic products.
- Every cosmetic product placed on the EU market must have a designated responsible person established in the EU.
- A qualified safety assessor must complete a cosmetic product safety report, kept in the product information file (PIF).
- Every product must be notified on the EU Cosmetic Products Notification Portal (CPNP) before it is placed on the market; notification is not approval.
- Labelling must use INCI ingredient names and appear in the language(s) of each member state of sale.
- Annexes II, III, IV, V and VI control prohibited, restricted, permitted colorant, preservative and UV-filter substances, and they are amended regularly.
- Claims such as "free from", "dermatologically tested" or "natural" must be substantiated under common criteria.
1. The Cosmetics Regulation: one rulebook for the whole EU
Regulation (EC) No 1223/2009 applies directly in every EU member state, which means a compliant product can circulate across the single market without separate national approvals. The regulation defines a cosmetic product by its function and application: substances or mixtures intended to be placed in contact with the external parts of the human body (skin, hair, nails, lips, external genital organs) or with the teeth and the mucous membranes of the oral cavity, with a view to cleaning, perfuming, changing appearance, protecting, keeping in good condition, or correcting body odours.
That functional definition is the first classification decision a brand must get right. Products on the boundary, such as a cream that claims to treat a skin disease or a mouthwash with a medicinal claim, can fall under medicines or biocides legislation instead, with entirely different obligations. Decide the classification before you invest in testing, because the wrong regime means the wrong evidence file.
The regulation's architecture is consistent: safety first (the product must be safe under normal and reasonably foreseeable use), then documentation (the PIF), then notification (CPNP), then labelling and claims. Work in that order and the process stays orderly; start with packaging design and you will redo it.
2. The responsible person: the non-negotiable EU anchor
Every cosmetic product on the EU market must have a designated responsible person established within the EU. For products manufactured in the EU, that is normally the manufacturer. For imported products, each importer is the responsible person for the products it places on the market, unless it designates someone else in writing. A non-EU brand can also designate an EU-based person or company by written mandate to act as the responsible person.
This is not a mail-drop formality. The responsible person ensures the product complies with the regulation, holds the product information file and makes it available to authorities, carries out the CPNP notification, and takes corrective action (including withdrawal or recall) if the product proves non-compliant. When choosing between acting as importer-responsible-person yourself, appointing a specialist responsible-person service, or structuring distribution so an EU distributor takes the role, weigh control against capability: whoever holds the role must actually be able to produce the PIF within days of an authority request and must understand the formula.
Put the designation in writing, define who holds the PIF, who files CPNP notifications, and what happens to documentation if the commercial relationship ends. Gaps in responsible-person coverage during a distributor switch are a compliance exposure, not an administrative detail.
3. Safety assessment and the product information file
Before a cosmetic product goes on the market, its safety must be assessed by a qualified safety assessor, a person with the required toxicology and formulation qualifications, who signs the cosmetic product safety report (CPSR). The CPSR has two parts: safety information (composition, physical and chemical characteristics, microbiological quality, impurities, packaging material, normal and reasonably foreseeable use, exposure data) and the safety assessment itself (the assessor's reasoned conclusion on safety, with warnings and labelling instructions as needed).
The CPSR sits inside the product information file, which the responsible person keeps and makes available to competent authorities. The PIF also contains a description of the product, the manufacturing method, evidence for any claimed effects, and data on animal testing. The file must be kept for ten years after the last batch of the product is placed on the market, and it must be updated when the formula, the safety data, or the regulatory status of an ingredient changes.
Two disciplines keep this manageable. First, commission the safety assessment early, on the near-final formula, because assessors routinely send formulas back for more stability, microbiology or impurity data. Second, treat the PIF as a living file with change control: every reformulation, every new supplier of a key raw material, and every new claim should trigger a review of whether the CPSR still covers the product.
4. CPNP notification: before first sale, not after
The responsible person must notify each cosmetic product through the CPNP portal before placing it on the market. A single CPNP notification replaces national notifications across the EU. Notification registers the product's existence and key data (product name and category, the responsible person's details, the frame formulation or exact composition, labelling, and for some products additional data) with competent authorities and poison centres.
Notification is not approval, and it does not certify safety. Authorities can and do request the PIF after notification and challenge the safety assessment. Products containing nanomaterials face an additional, earlier duty: electronic notification six months before placing on the market, so the Commission can assess them.
Operationally, build notification into the launch critical path. The data must be final (final formula, final label artwork, confirmed responsible person), so late packaging changes delay notification. Maintain a register of every notification and update it when formulas, labels, or the responsible person change.
5. Labelling: INCI, languages, and mandatory particulars
Cosmetic labelling must include the responsible person's name and address, the nominal content, durability dating (either a date of minimum durability or the period-after-opening symbol, as applicable), precautions and warnings, the batch or reference number, the product's function (unless clear from presentation), and the list of ingredients using INCI nomenclature in descending order of weight. These particulars must appear in the language or languages required by each member state where the product is sold, which in practice means multilingual labels or market-specific packaging for most brands.
Common enforcement findings include missing or incorrect INCI lists, durability dating that does not match the stability data in the PIF, warnings omitted or mistranslated, and nominal content declarations that do not meet the applicable tolerances. Proofread labels against the PIF, not against the marketing brief: the label is a legal document that happens to be printed on packaging.
6. Claims and the substance annexes
Cosmetic claims must be substantiated under the common criteria for cosmetic claims: they must comply with the law, be truthful, be supported by evidence, be honest about what the evidence shows, be fair, and allow informed decision-making. "Free from" claims, "dermatologically tested", "natural" and "organic" positioning, and efficacy claims ("reduces wrinkles in 7 days") are all actively enforced. If the claim is on the pack, on the website, or in the ad, it needs evidence in the file.
The substance rules live in the annexes. Annex II lists prohibited substances. Annex III lists substances subject to restrictions (maximum concentrations, permitted product types, required warnings). Annexes IV, V and VI list permitted colorants, preservatives and UV filters respectively, with their conditions of use. The annexes are amended regularly as scientific opinions evolve, so a formula that was compliant two years ago may not be compliant today. Build annex monitoring into your regulatory calendar, and re-check the annexes at every reformulation.
| Annex | Function | What to check |
|---|---|---|
| Annex II | Prohibited substances | No listed substance may be present in the formula |
| Annex III | Restricted substances | Concentration limits, permitted uses, required warnings |
| Annex IV | Permitted colorants | Only listed colorants, within stated conditions |
| Annex V | Permitted preservatives | Only listed preservatives, within stated conditions |
| Annex VI | Permitted UV filters | Only listed filters, within stated conditions |
7. Market entry sequence for a beauty brand
Work in this order. First, confirm classification: cosmetic product under Regulation 1223/2009, not a medicine or biocide. Second, designate the EU responsible person in writing and agree who holds the PIF. Third, finalise the formula and check every ingredient against the current annexes. Fourth, commission the safety assessment and compile the PIF. Fifth, finalise labelling in the required languages, verified against the PIF. Sixth, file the CPNP notification (with the six-month lead time for nanomaterials). Seventh, set up change control, annex monitoring, and a process for handling authority requests and consumer complaints.
For non-EU brands, the responsible person decision is the critical path item: without an EU-established responsible person, there is no lawful route to market, and appointing one takes negotiation and contracting time. Start there.
Frequently asked questions
Is CPNP notification the same as product approval?
No. CPNP notification registers the product with competent authorities and poison centres; it does not approve the product or certify its safety. The responsible person remains fully responsible for compliance, and authorities can request the PIF and challenge the safety assessment after the product is on the market.
Who can act as the responsible person?
The EU-based manufacturer, the importer placing the product on the EU market, or a person designated in writing by either. Non-EU brands commonly appoint a specialist responsible-person service or designate their EU distributor, but the designation must be in writing and the role's duties must actually be performed.
How long must the product information file be kept?
The PIF must be kept available to authorities for ten years after the last batch of the product is placed on the market. Keep it updated during the product's life and archive it properly after discontinuation.
Do I need separate national notifications in each EU country?
No. A single CPNP notification replaces the need for further national notifications within the EU. Note that the United Kingdom operates its own separate notification portal, and the United States uses a different system (FDA facility registration and product listing under MoCRA).
What happens if an ingredient is added to a restricted annex after my launch?
You must reformulate or relabel to meet the new restriction by the applicable date, update the safety assessment and PIF, and update the CPNP notification. This is why annex monitoring belongs in the standing regulatory calendar rather than the launch checklist.
Can my US-compliant formula be sold in the EU as is?
Not automatically. EU and US cosmetic rules differ on permitted and restricted substances, safety assessment format, labelling (INCI and language requirements), and notification. Treat EU entry as a separate compliance build, starting with an annex-by-annex ingredient review.
Official sources
- EU Cosmetic Products Notification Portal (CPNP)
- European Commission: cosmetics sector overview
- US FDA: cosmetics (for the US MoCRA comparison)
- UK: submit a cosmetic product notification (for the UK comparison)
Last verified
Framework verified against official EU sources, September 2026. The Cosmetics Regulation annexes are amended regularly; always verify the consolidated text and current annex entries before finalising a formula.