Cosmetic regulatory guides.

Responsible Person

The Responsible Person is the legal entity accountable for a cosmetic product on a given market. In the EU, Regulation (EC) No 1223/2009 requires every product to have a Responsible Person established in the Union. That person holds the Product Information File, verifies the safety report, files the notification, checks labelling and claims, and is the official contact for authorities, including during a recall. The role can be filled by the manufacturer, the importer, a distributor, or a third-party service provider. A non-EU brand cannot be its own EU Responsible Person, so it must appoint a third-party Responsible Person or set up its own EU entity. The Responsible Person's name and address must appear on the product label. The liability is continuous: it lasts for the whole time the product is on the market, not just at launch.

Product Information File (PIF)

The PIF is the dossier a Responsible Person keeps for each product and makes available to authorities on request. Under Article 11 of Regulation 1223/2009 it must contain: a description of the product, the Cosmetic Product Safety Report, a description of the manufacturing method with a statement of compliance with good manufacturing practice (ISO 22716), proof of the claimed effect where the nature of the claim justifies it, and data on any animal testing. The PIF must be kept for ten years after the last batch was placed on the market.

Cosmetic Product Safety Report (CPSR)

The CPSR is the signed safety assessment that sits inside the PIF. It follows Annex I of Regulation 1223/2009 and has two parts. Part A, the safety information, covers the quantitative and qualitative composition, physico-chemical characteristics and stability, microbiological quality including challenge testing, impurities and traces and packaging, normal and reasonably foreseeable use and exposure, the toxicological profile, and any undesirable effects. Part B, the safety assessment, states the conclusion, any warnings and instructions for use, the reasoning behind the assessment including the Margin of Safety, and the assessor's name, address, qualification, date, and signature. Part B can only be signed by a qualified assessor who holds a university diploma in pharmacy, toxicology, medicine, or a similar discipline recognised by an EU Member State. A safety report written for another market, such as a US report, does not transfer to the EU format, so it usually has to be redone.

Notification

Notification is the act of registering a product with the authorities before it goes on sale. Each market has its own system. The EU uses the CPNP (Cosmetic Product Notification Portal). Great Britain uses the SCPN (Submit Cosmetic Product Notification) service run by the Office for Product Safety and Standards (OPSS). The US uses FDA product listing under MoCRA. Switzerland has no pre-market notification portal at all. These systems are separate and do not share data, so notifying in one market does nothing for the others.

European Union

The EU regime runs on Regulation (EC) No 1223/2009. Every product needs a Responsible Person established in the Union, a Product Information File, a signed CPSR, and a CPNP notification. The CPNP notification is required under Article 13 before a product is placed on the EU market. Once a product is notified in CPNP, no further national-level notification is needed within the EU. Products containing nanomaterials require a separate notification under Article 16.

The CPNP portal itself is free of charge. The cost is in appointing a Responsible Person and preparing the documentation. A notification requires the product name, category and function, the Responsible Person's contact details, the full INCI formulation, images of the label and packaging, the CPSR reference and the toxicologist's details, and manufacturing country and batch information. CPNP data is made available only to competent authorities for market surveillance and to poison centres for medical treatment. Full product and formula data is not visible to competitors or the public.

Compliance is size-blind. There is no small-business exemption and no turnover threshold. A hobbyist selling a few bars of soap faces the same mandatory Responsible Person, PIF, and CPSR burden as a multinational.

United Kingdom

After Brexit, Great Britain runs its own regime, effective 1 January 2021: the retained version of Regulation 1223/2009, known as the UK Cosmetics Regulation, enforced through the Cosmetic Products Enforcement Regulations 2013. A product made available in Great Britain must have a Responsible Person established in the UK, and notification goes through the SCPN service operated by OPSS, which replaced CPNP for the Great Britain market.

A UK Responsible Person needs a genuine UK-established address. PO boxes and mail-forwarding addresses do not qualify. The UK Responsible Person keeps the PIF for ten years after the last batch, notifies OPSS before the product is made available, and reports serious undesirable effects. A brand selling into both the EU and Great Britain needs both a UK Responsible Person and a separately established EU Responsible Person. One Responsible Person cannot cover both, and CPNP and SCPN operate independently, each requiring its own notification.

Northern Ireland is treated separately from Great Britain. Under the Windsor Framework, the Northern Ireland market continues to follow EU Regulation 1223/2009, so it aligns with the EU Responsible Person and CPNP route rather than the Great Britain UK Responsible Person and SCPN route.

Switzerland

Switzerland sits under the Federal Act on Foodstuffs and Utility Articles (817.0) and its ordinance, with cosmetics governed by Ordinance 817.023.331. Article 54 requires cosmetics to comply with the annexes of EU Regulation 1223/2009 for prohibited ingredients, colourants, and preservatives, so the ingredient rules track the EU. The rest of the compliance chain is Swiss.

An EU Responsible Person does not cover Switzerland. The responsible person, whether the manufacturer, the importer, or an appointed agent, must have an address on Swiss territory, and the obligation cannot be delegated to anyone located abroad. If no Swiss responsible person is appointed, the company's CEO or equivalent legal representative becomes the responsible person by default. Switzerland has no pre-market notification portal and no access to CPNP. In-market control relies on cantonal laboratories across the 26 cantons carrying out post-market inspections, so a brand must hold a self-monitoring dossier that is ready to show on request. The PIF must be kept for ten years from the date the last batch was first placed on the market. An existing PIF compiled abroad can satisfy Swiss requirements if it complies with Swiss cosmetics and labelling rules, and it may be written in an official Swiss language or in English. Labelling warnings and instructions must appear in at least one official Swiss language: German, French, or Italian.

United States (MoCRA)

MoCRA, the Modernization of Cosmetics Regulation Act, is the federal US regime. The Responsible Person is the manufacturer, packer, or distributor whose name appears on the product label. That person must list each marketed cosmetic product with the FDA, including its ingredients, and update the listing annually. The manufacturing facility must also be registered. These are two separate obligations: the manufacturer registers the facility, and the brand named on the label does the product listing and the adverse-event reporting. Assuming a contract manufacturer handles all of it is a common and costly error.

There is no FDA fee to register a facility or list a product under section 607 of the FD&C Act. Registration and listing use FDA's free Cosmetics Direct tool, which authors submissions in the SPL (Structured Product Labeling) XML format; paper alternatives are Form FDA 5066 for registration and Form FDA 5067 for listing. An FDA Establishment Identifier (FEI) is required before submitting. Listing a product with the FDA does not mean it is FDA approved. The FDA does not approve cosmetic products before they go on the market.

MoCRA defines a small business as one whose average gross annual US cosmetic sales over the previous three-year period are under 1,000,000 US dollars. Qualifying small businesses are exempt from good manufacturing practice requirements, facility registration, and product listing. The exemption is narrow. It does not apply to products that regularly contact the mucous membrane of the eye, are injected, are intended for internal use, or alter appearance for more than 24 hours where removal is not part of customary use. A single eyeliner or eye cream can void it. Adverse-event reporting, labelling, and safety substantiation still apply to every firm, exempt or not. A serious adverse event must be reported to the FDA within 15 business days, with follow-up information within a further 15 business days.

A foreign facility that must register has to designate a US Agent who resides or maintains a place of business in the US and is physically present there. A mailbox or answering service does not qualify. The US Agent is the FDA’s communication liaison for the foreign facility, and this role is separate from being the Responsible Person. Separately, the product label must include a US contact for adverse-event reporting.

Marketplaces such as Amazon, Etsy, and Notino now ask for proof that a Responsible Person is appointed before they will list cosmetics, which makes the appointment a commercial gatekeeper as well as a legal one. Enforcement is uneven across platforms, and that unevenness catches sellers out.

Etsy does not check for a CPSR at the point of listing, which lulls sellers into thinking they do not need one. They remain fully liable and can be asked for documentation at any time. Amazon EU actively demands the CPSR and PIF and suspends listings that do not have them. Without a valid Responsible Person, Amazon can suppress a listing so shoppers cannot see it, suspend the whole account, lock FBA inventory in the country it sits in, and goods can be seized and destroyed at customs.

GPSR adds a further layer. Since 13 December 2024, a product cannot be placed on the EU market without an EU-based economic operator, and marketplaces enforce this for third-party sellers. In Great Britain, failing to notify OPSS can carry a fine and up to three months' imprisonment, fines are unlimited in England and Wales and up to 5,000 pounds in Scotland and Northern Ireland, and OPSS and Trading Standards can prohibit sales until compliance is achieved.