EU regulatory guide

What testing does a cosmetic actually need?

The law names no test list, which confuses everyone. What it demands is a safety report built on adequate data, and in practice that translates into a familiar set: stability, preservation efficacy and microbiological quality. Here is what each is for, how long they take, and when they can be skipped.

Reviewed by Cassandra Maddocks, chemist & biochemist · last reviewed 27 July 2026

What tests are legally required in the EU?

Strictly, none by name: Annex I requires the safety report to rest on data covering stability, microbiological quality and preservation, and the assessor decides what evidence satisfies that for each product. In practice most products need stability, challenge and microbiological testing from a lab.

This is why two identical-looking quotes can hide different scopes: the legal requirement is the data, not a named test menu. The full input list the assessor works from is in the CPSR inputs guide.

Annex I of Regulation 1223/2009 on EUR-Lex showing the Cosmetic Product Safety Report structure — Annex I of Regulation (EC) No 1223/2009, the data structure your tests exist to fill, as published on EUR-Lex, consolidation of 1 May 2026 (02009R1223, EN, 040.001). Captured 26 July 2026. View the official text.

What does each test actually prove?

Stability shows the product stays safe and intact over its shelf life and supports the date or PAO on the label. Challenge testing proves the preservative system kills what consumers introduce during use. Microbiological testing shows the product leaves production clean in the first place.

They answer different questions, which is why one cannot substitute for another. Each has its own deep dive: microbiology testing, challenge testing and stability testing. The results become Part A data in the safety report and live in the PIF for ten years.

How long does cosmetic testing take?

Stability is the long pole: 3 to 12 months depending on the protocol, and no assessor or consultant can compress it, because the time is the data. Challenge and microbiological testing run in weeks. Brands that start stability during product development launch months earlier than those who wait.

This is the honest reason compliance timelines vary so much, as the CPSR cost and timeline guide explains: the paperwork takes days once the lab work exists.

Does every product need challenge testing?

Not always. Where the product's nature makes microbial growth implausible, an anhydrous formula, an extreme pH, a single-use pack, the assessor can scientifically justify omitting the challenge test. That justification is the assessor's call to make and document, not a box the brand ticks itself.

Waivers claimed without a documented justification are a classic inspection finding. If you think your product qualifies, raise it before commissioning tests; it is exactly the kind of question we answer at the inputs stage at no cost.

What about SPF and sunscreen testing?

Sunscreens carry the heaviest test burden in cosmetics. In the EU they are cosmetics, but an SPF number is a measured claim substantiated with standardised testing, not a formula calculation. In the US the same product is an over-the-counter drug with its own testing regime entirely.

If your range includes SPF, budget and plan it separately from the rest of the line, and read the classification split in our US vs EU guide before promising a simultaneous transatlantic launch.

Can I reuse test data across markets, and what about animal testing?

Lab data reuses almost everywhere: the same stability and challenge results serve the EU, UK and Swiss files and feed US safety substantiation. Animal testing is the opposite: banned for cosmetics under Article 18, with validated alternative methods used instead.

Data reuse is why second markets cost a fraction of the first, per the cost guide. The animal testing bans and what cruelty-free adds on top are in our dedicated guide.

Sources

Primary sources cited in this guide. Regulatory status last verified 27 July 2026.