
What the law requires
What the EU market requires.
The EU is one of the most strictly regulated cosmetics markets, governed by Regulation (EC) No 1223/2009. To place a cosmetic on the EU market, your brand must meet four obligations, and they apply to every product before its first sale.
Reviewed by Cassandra Maddocks, chemist & biochemist · last reviewed 26 July 2026
To sell cosmetics in the EU you need an EU-established Responsible Person, a signed CPSR, a Product Information File kept for ten years, a CPNP notification per product, and Article 19 compliant labels. CIG provides all of it at fixed prices, from $150 per notification to a $1,500 per-product launch pack.
Legal basis: EUR-Lex: Regulation (EC) 1223/2009, CPNP (European Commission), EUR-Lex: GPSR (EU) 2023/988.
There is no small-business exemption and no turnover threshold. A hobbyist selling a few bars of soap faces the same Responsible Person, Product Information File, and safety report requirements as a large manufacturer. The Responsible Person is legally accountable for all four obligations for the whole time the product is on the market.
The Responsible Person
Who has to be your Responsible Person.
Regulation 1223/2009 requires every cosmetic on the EU market to have a Responsible Person established in the Union. This is the party that authorities hold accountable for compliance. The Responsible Person holds the Product Information File, verifies the safety report, manages CPNP notifications, reviews labelling and claims, and is the official contact for market surveillance authorities, including during a recall.
The role can be filled by the manufacturer, the importer, a distributor, or a third-party service provider, but the party must be legally established in the EU. A non-EU brand cannot be its own EU Responsible Person. If your company sits outside the Union, you either set up your own EU entity or you appoint a third-party Responsible Person located in the EU. There is no way to self-notify from outside: only a Responsible Person established in the EU can access CPNP and submit your product.
The name and address of the Responsible Person must appear on the product label. Responsibility is continuous rather than a single filing. It stays active for as long as the product is on the market, which is why the role carries a recurring fee and ongoing regulatory duties rather than a one-time setup cost.
Notification, the file, and the safety report
What a notification and a compliant file contain.
CPNP notification, Article 13
Notification through the Cosmetic Product Notification Portal is required under Article 13 before a product is placed on the EU market. Once a product is notified in CPNP, no separate national-level notification is needed anywhere in the EU. Products containing nanomaterials need an additional notification under Article 16.
What a notification includes
A CPNP entry carries the product name, category and function, the Responsible Person contact details, the full INCI formulation, images of the label and packaging, the safety report reference and assessor details, and the country of manufacture and batch information. The CPNP portal itself is free to use.
Who can see your formula
CPNP data is released only to competent authorities for market surveillance and to poison centres for medical treatment. Your full product and formula data is not visible to competitors or to the public.
The Product Information File, Article 11
Under Article 11 the Product Information File must contain a product description, the safety report, the manufacturing method with a GMP statement to ISO 22716, proof of any claimed effect where the claim justifies it, and data on any animal testing. It must be kept for 10 years after the last batch was placed on the market.
The safety report, Annex I
The Cosmetic Product Safety Report has two parts. Part A gathers the safety information: composition, physico-chemical characteristics and stability, microbiological quality including challenge testing, impurities and packaging, use and exposure, the toxicological profile, and undesirable effects. Part B is the assessment itself, with the conclusion, warnings, the reasoning including the Margin of Safety, and the assessor’s signature.
Who can sign it
Part B must be signed by an assessor holding a university diploma in pharmacy, toxicology, medicine, or a similar discipline recognised by an EU Member State. A safety report written for the US or another non-EU market does not transfer. The assessment has to be redone in the EU format even when you already hold documentation from elsewhere.
Labels and enforcement
Labels, penalties, and the GPSR layer.
The label has to carry the Responsible Person name and address, the batch number, the ingredient list in INCI, and any mandatory warnings and instructions, in the language required by each Member State where the product is sold. Missing batch numbers, untranslated warnings, and missing INCI are among the most common reasons a first product has to be relabelled or withdrawn.
On top of Regulation 1223/2009 sits the General Product Safety Regulation, Regulation (EU) 2023/988, which became fully applicable on 13 December 2024. It applies to all non-food consumer products sold to EU customers, cosmetics included, regardless of where the seller is based or how small the business is. A product cannot be placed on the EU market without an EU-based economic operator behind it.
How CIG covers it
Your full EU compliance, in one relationship.
CIG meets every one of these requirements in a single relationship. We act as your EU Responsible Person, compile and hold your Product Information File, prepare your safety report and have it signed by a qualified assessor, and notify your products through CPNP after your confirmation. As your range or the rules change, we keep your EU compliance current.
Why CIG
Why brands choose CIG for the EU.
No EU entity required
A compliant EU Responsible Person without setting up your own EU entity.
Fixed, transparent pricing
Published prices per product, with a fixed quote before any work begins.
Signed and insured
Qualified assessor sign-off on every safety report and an insured Responsible Person role.
Four markets, one partner
The EU handled alongside the UK, Switzerland and the US, from a single relationship.
How it works, step by step
From your formula to a notified product.
Most of the calendar in an EU launch is testing, not paperwork. Stability and challenge testing on a new formulation can take months, so the honest timeline runs in months rather than weeks. The regulatory steps below are the part CIG runs, and they move at a fixed pace once your documents are ready.
Send us your products and documents
You give us the formula and INCI list, the manufacturing details, your artwork, and any test data or existing dossier you hold. We tell you what is complete and what is still missing before any work starts.
We appoint as your EU Responsible Person
We take on the Responsible Person role for each product and give you the EU name and address to place on your label. This is what lets your product be placed on the market and lets us access CPNP on your behalf.
We build the file and the safety report
We compile the Product Information File to Article 11 and prepare the Cosmetic Product Safety Report. A qualified assessor reviews the composition and exposure and signs Part B. If your formula uses a prohibited or restricted ingredient, we flag it here, before it becomes a market problem.
We review your label and claims
We check the label against Article 19 and the claims against the substantiation you hold, so the batch number, INCI, warnings, and translations are right before printing rather than after a withdrawal.
We notify through CPNP, after you confirm
Once the file is signed and the label is right, we notify each product through CPNP. No notification is filed without your confirmation. With documents ready, a CPNP notification typically takes about 2 to 5 business days. A first-time do-it-yourself attempt commonly stretches to several weeks, which is why brands are advised to start 6 to 8 weeks before launch.
We keep the file live
We hold your Product Information File for the required 10 years after the last batch, stay the contact for authorities, and update your dossier and notifications as your formula, artwork, or the rules change.
Why products get pulled here
What trips up first-time EU sellers.
Most first EU withdrawals come from a short list of avoidable mistakes rather than from a bad formula. Marketplace behaviour hides the risk: Etsy does not check for a safety report at listing, so founders assume they do not need one, but they stay fully liable and can be asked for documentation at any time. Amazon EU actively demands a safety report and file and suspends listings that cannot produce them.
No Responsible Person appointed
Selling into the EU without an EU-established Responsible Person leaves the product with no legal party behind it. Without one, the product cannot lawfully be placed on the market, and marketplaces increasingly demand proof of appointment before a cosmetic can be listed.
Incomplete or missing file
An incomplete Product Information File is one of the most common surveillance findings. When an authority asks and the file cannot be produced in full, the product can be withdrawn until it is fixed.
A US report that does not transfer
A safety assessment written for another market does not satisfy Annex I. Brands that assume their existing report carries over find they have to redo the assessment in the EU format, signed by a qualified EU assessor.
Label and translation errors
Missing batch numbers, missing INCI, and warnings that are not translated for the Member State of sale force relabelling. These are label problems, not formula problems, and they are entirely avoidable with a review before print.
A prohibited or restricted ingredient
Using an ingredient that is banned or restricted under the annexes is a direct cause of recalls. Restrictions change over time, so a formula that was fine at launch can fall out of compliance later without a review.
Not notifying on CPNP
Failure to notify before placing the product on the market is a compliance breach in itself. Notification is a legal step under Article 13, not an optional registration.
What you need in this market
The EU requirements, each handled by a CIG service.
EU questions, answered
Frequently asked questions.
In practice
Compliance, in the real world.

