EU regulatory guide

How to sell cosmetics in the EU.

A practical guide to Regulation 1223/2009: the Responsible Person, the Product Information File, the safety report and CPNP notification.

Reviewed by Cassandra Maddocks, chemist & biochemist · last reviewed 5 July 2026

The European Union sets its cosmetics rules in Regulation (EC) No 1223/2009, and they are strict. The rules apply uniformly across all member states, which works in your favour: meet them once and you can sell across the whole bloc. The obligations are real, though, and a product placed on the market without them is there unlawfully. This guide walks through what a brand has to put in place before the first unit is sold, in the order you will meet each step, with the article numbers, the portal, realistic timelines and the mistakes that most often cause a recall or a marketplace takedown.

One point matters before anything else: the regulation is size-blind. There is no small-business exemption and no turnover threshold. A hobbyist selling a few bars of soap into the EU carries the same core obligations as a multinational: a Responsible Person, a PIF, a signed CPSR and a CPNP notification. If you sell to EU customers, the rules apply to you regardless of where you are based or how small your run is. Since 13 December 2024 a second layer sits on top of this, the General Product Safety Regulation (GPSR), covered further down.

Who needs what, and who counts as the seller

The regulation puts the legal weight on economic operators: the manufacturer, the importer, the distributor and the Responsible Person. A brand established outside the EU cannot notify a product itself and cannot be its own Responsible Person, because the role has to be held by a person or company legally established inside the Union. That single fact is why almost every non-EU brand has to appoint a third-party Responsible Person or set up its own EU entity before it can sell a single unit. The obligations do not scale with your size; they attach to the act of placing a product on the market.

The Responsible Person

At the centre of the EU regime is the Responsible Person, or RP, required by Article 4 of Regulation 1223/2009. Every cosmetic product on the EU market must have an RP that is established in the EU. The RP is legally accountable for the product's compliance, holds and keeps the Product Information File, verifies the safety report, submits the CPNP notification, reviews labelling and claims, and is the official point of contact for national authorities, including during a recall. A brand based outside the EU cannot be its own RP without an EU establishment, which is why most international brands appoint an EU-based Responsible Person to take on the role. The requirement itself (who needs the role, who can hold it, and its duties) is unpacked in our EU Responsible Person requirements guide.

The role is not filled once and forgotten. RP liability is continuous: it stays active for the whole time the product is on the market, which means a recurring relationship and recurring cost, not a single setup fee. The RP's name and address also have to appear on the product label, so the choice of RP is printed on your packaging. The role can be held by the manufacturer, an importer, a distributor or a third-party service provider, but for a non-EU brand the practical route is a third-party RP or an EU entity of its own.

The Product Information File

For each product, the RP must hold a Product Information File, or PIF, defined by Article 11. The PIF is the complete technical dossier, and Article 11 sets out what it must contain: a description of the cosmetic product, the Cosmetic Product Safety Report, a description of the method of manufacture together with a statement of compliance with good manufacturing practice (ISO 22716 is the recognised standard), proof of the claimed effect where the nature of the claim justifies it, and data on any animal testing carried out. It must be kept up to date and made available in electronic or other format to the competent authority of the member state where the file is kept, at the address on the label. The PIF is not a one-off document; it has to reflect the product as it actually is, throughout the time it is on the market, and it must be retained for ten years after the last batch was placed on the market. See our Product Information File service for how this is assembled and maintained, and our PIF requirements guide for the file itself in depth.

A common point of confusion is how the PIF maps to product variants. Each finished product that a consumer buys needs its own file and its own notification. A shade range, a scent range or a set of sizes are separate products for these purposes, not a single recipe registered once. Budgeting for a catalogue means budgeting per product, not per formula family.

The Cosmetic Product Safety Report

No product can be sold without a Cosmetic Product Safety Report, or CPSR, which forms part of the PIF and is set out in Annex I. The CPSR has two parts. Part A is the cosmetic product safety information: the quantitative and qualitative composition, the physical and chemical characteristics and stability of the product, its microbiological quality including challenge (preservation efficacy) testing, impurities, traces and information about the packaging material, normal and reasonably foreseeable use, exposure to the product and to its substances, the toxicological profile of the substances, and any undesirable and serious undesirable effects. Part B is the cosmetic product safety assessment: the assessment conclusion, any labelled warnings and instructions for use, the reasoning behind the conclusion including the Margin of Safety calculation, and the assessor's credentials and approval.

Part B must be signed by a qualified safety assessor: a person holding a university diploma in pharmacy, toxicology, medicine or a similar discipline recognised by an EU member state. This is a hard bottleneck. A US or other non-EU safety report does not transfer, so a brand with an existing assessment from another regime generally has to have the assessment redone in the EU format by an EU-recognised assessor. A product is only as compliant as the professional judgement behind its safety report. Our safety assessment (CPSR) service is signed by a qualified assessor in every case, priced at $450 to $600 per product. The full cost and timeline picture is in our CPSR cost guide.

PIF, CPSR and safety assessment: how they fit together

These three terms get used interchangeably, and the confusion causes real budgeting mistakes. They are nested, not separate purchases. The safety assessment is Part B of the CPSR: the assessor's signed conclusion. The CPSR is Parts A and B together: the full safety report for one product. The PIF is the wider dossier that contains the CPSR along with the product description, the manufacturing method and GMP statement, claim substantiation and animal-testing data. In short, the safety assessment sits inside the CPSR, and the CPSR sits inside the PIF. You need all three for every product, and the RP is the party that holds and stands behind the PIF.

CPNP notification

Before a product is placed on the market, the RP must notify it through the Cosmetic Products Notification Portal, the CPNP, as required by Article 13. The CPNP itself is free of charge; the cost is in appointing the RP and preparing the documentation. The notification covers the product name, category and function, the RP's contact details, the full INCI formulation, images of the label and packaging, the CPSR reference and the assessor's details, and the country of manufacture and batch information. Once a product is notified in CPNP, no further national-level notification is needed anywhere in the EU. Products containing nanomaterials require a separate notification under Article 16. Selling before notification is complete is not permitted. The portal mechanics, grouping rules and confidentiality questions are covered in our CPNP notification guide. We handle this through our notifications service, at $150 per product.

Two worries come up constantly here. The first is confidentiality: once a formula is on CPNP, who can see it? CPNP data is made available only to competent authorities for market surveillance and to poison centres for medical treatment. Your full product and formula data is not visible to competitors or to the public. The second is time. With documentation ready, the notification step itself usually takes a few business days, but only the appointed RP can legally submit it, and a first-time do-it-yourself registration can stretch to several weeks. Plan to have the RP and dossier in place well before your launch date rather than at it.

Labelling and claims

EU rules also govern what appears on the label and what you can claim. Under Article 19 the label must carry mandatory information, including the name and address of the Responsible Person, the nominal content, a date of minimum durability or a period-after-opening symbol, precautions for use, the batch number, the product function, and the list of ingredients in INCI form. Under Article 20, claims must meet the common criteria set by Regulation (EU) No 655/2013: they have to be truthful, supported by evidence, honest, fair and not misleading. A safe product with a non-compliant label or an unsupportable claim can still face enforcement. A label and claims review checks both before you print, at $300 per product.

GPSR: the second layer since December 2024

The General Product Safety Regulation, Regulation (EU) 2023/988, became fully applicable on 13 December 2024. It applies to non-food consumer products sold to EU customers, cosmetics included, regardless of where the seller is based or how small the business is. A product cannot be placed on the EU market without an EU-based economic operator responsible for it. For cosmetics this sits alongside, not instead of, the Responsible Person duties under Regulation 1223/2009. The deadline caused acute disruption for small and handmade EU-facing sellers, many of whom stopped shipping to the EU rather than appoint an EU operator. Appointing an EU Responsible Person addresses the economic-operator requirement for the cosmetics you sell.

Step by step: launching a product in the EU

1. 1Appoint an EU-established Responsible Person and give them the address that will appear on your label.
2. 2Gather the technical inputs: the full INCI formulation with percentages, manufacturing details and a GMP statement, stability and challenge-test data, packaging information, artwork and the claims you intend to make.
3. 3Have a qualified safety assessor prepare and sign the CPSR (Part A information and Part B assessment).
4. 4Assemble the Product Information File around the CPSR so it holds everything Article 11 requires.
5. 5Check the label and claims against Articles 19 and 20 and correct anything before printing.
6. 6Submit the CPNP notification through the RP before the product is placed on the market.
7. 7Keep the PIF current for the life of the product and for ten years after the last batch.

Realistic timelines

The honest answer to "how long does this take" is months, not weeks, and the long pole is usually testing rather than paperwork. Stability testing in particular can run for several months, and for a brand-new formulation the full path from a standing start to a notified product commonly takes a few months once testing is factored in. Where a formula is already made, tested and stable, the compliance work itself moves faster: the assessor prepares the CPSR, the PIF is assembled and the CPNP notification follows within a few business days. Brands run into trouble when they treat compliance as a final formality and start it a fortnight before a planned launch. The fix is to appoint the RP and begin the dossier early, in parallel with production, so the notification is the last quick step rather than the bottleneck.

The mistakes that cause recalls and takedowns

Most first-time failures in the EU come from a short list of avoidable problems. An incomplete or missing PIF is a frequent market-surveillance finding. So is the use of a prohibited or restricted ingredient that is not permitted under the annexes to Regulation 1223/2009. Labelling errors are common: missing batch numbers, untranslated warnings, or an ingredient list that is not in proper INCI form. Microbiological contamination and weak preservation show up where challenge testing was skipped. Unsubstantiated claims are a recurring weakness under the Article 20 rules. Failing to notify on CPNP, or failing to appoint an RP at all, leaves the product unlawfully on the market from day one. Any of these can force relabelling, withdrawal or a recall.

Marketplaces: Amazon, Etsy and the compliance gatekeeper

A marketplace not checking your paperwork at the point of listing does not mean you are exempt. Etsy does not verify a CPSR when you list, which lulls some sellers into assuming they do not need one, but the seller remains fully liable and can be asked for documentation at any time. Amazon in the EU is stricter: it actively requests RP and manufacturer information and suppresses or suspends listings that cannot provide it. Increasingly, appointing a Responsible Person is a commercial gate as much as a legal one, because a compliant listing needs the RP details on file before it can stay live. If a marketplace has flagged or removed a listing, the underlying fix is the same: a valid RP, a complete dossier and a correct notification.

What this means in practice

To launch a single product in the EU, a brand needs an EU-established Responsible Person, a complete PIF, a CPSR signed by a qualified assessor, a CPNP notification and compliant labelling. For a portfolio, each product needs its own file and notification. Done by hand, in-house, this is a significant undertaking. Most brands appoint a specialist partner to act as RP and produce the dossiers, which is exactly the role CIG plays. Our EU and UK launch pack covers the CPSR, PIF and notification for one product at a fixed $1,500, and Compliance Care keeps the RP role and dossiers current after launch. For a market-level overview, see selling in the EU.

Put this into practice

From reading to selling in the EU.

EU questions, answered

Frequently asked questions.

In practice

Compliance, in the real world.