What EU cosmetics law actually says, in the order you meet it

0. First: is it a cosmetic?

Not everything you make is caught. A cosmetic product is defined in Art. 2(1)(a), Reg. (EC) 1223/2009 — a substance or mixture intended to be placed in contact with the external parts of the human body, or with the teeth and the mucous membranes of the oral cavity, with a view exclusively or mainly to cleaning, perfuming, changing the appearance, protecting, keeping in good condition or correcting body odours.

Three consequences people find surprising:

• Soap is usually a cosmetic. A bar you sell to wash with is doing the cleaning job in that definition.
• Intended use decides it, not the recipe. The definition turns on a purpose that is exclusively or mainly one of those listed in Art. 2(1)(a). The same jar of ointment can fall inside or outside it depending on what it is presented as doing. A product presented as preventing or treating disease is presented for a different purpose, and the borderline with medicinal products is decided under Directive 2001/83/EC rather than under this Regulation. Which side a particular product falls on is a question about that product, not one a page can answer.
• A candle, a reed diffuser or a room spray is not a cosmetic. It is not intended to go on the body. It has its own rules, and they are not these.

If you are not sure which side of the line you are on, that is what our check answers first, and it is the answer that saves the most money, because a product that is not a cosmetic does not need any of the five things below.

1. Responsible Person (Art. 4)

The opening requirement is not a document. It is a legal person.

Only cosmetic products for which a legal or natural person is designated within the Community as "responsible person" shall be placed on the market. — Art. 4(1), Reg. (EC) 1223/2009

Read that carefully, because it is structural rather than procedural. Before there is a report, a file or a notification, there has to be somebody inside the Union whose name is attached to the product. Art. 5, Reg. (EC) 1223/2009 sets out what that person is obliged to do.

Art. 4(3)–(6) then says who that person is. For a product manufactured in the Union, the manufacturer established in the Union is the responsible person, unless it designates, by written mandate, a person established in the Union who accepts in writing. For an imported product, the importer is the responsible person for the product it places on the market, unless it designates someone established in the Union by written mandate in the same way. A distributor becomes the responsible person where it places the product under its own name or trademark, or modifies a product already placed in a way that may affect compliance. And any person established in the Union may be designated by written mandate, provided they accept it in writing.

So if you are established in the EU, you can be your own responsible person. If you are not — a brand in the United States, the United Kingdom, India or Korea — the role has to sit with someone established in the Union: your importer, or a person you designate by written mandate who accepts it.

We can be appointed as your EU Responsible Person, by written mandate. How that works → What a Responsible Person actually does →

The responsible person's name and address also go on the pack: Art. 19(1)(a), Reg. (EC) 1223/2009 requires the container and the packaging to bear "the name or registered name and the address of the responsible person".

2. Safety assessment and safety report (Art. 10, Annex I)

Before a cosmetic product is placed on the market, the responsible person has to ensure it has undergone a safety assessment and that a cosmetic product safety report is set out in accordance with Annex I (Art. 10(1), Reg. (EC) 1223/2009). That report is what people mean when they say CPSR.

The person who carries out the assessment is not free-choice. Art. 10(2) requires:

a diploma or other evidence of formal qualifications awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine or a similar discipline

Pharmacy is named in that list ahead of the rest. It is why this practice exists in the shape it does.

3. Product Information File (Art. 11)

The file is the folder the report lives in, plus everything the report was built from.

When a cosmetic product is placed on the market, the responsible person shall keep a product information file for it. The product information file shall be kept for a period of ten years following the date on which the last batch of the cosmetic product was placed on the market. — Art. 11(1), Reg. (EC) 1223/2009

It is held at the responsible person's address as indicated on the label and made readily accessible there, in electronic or other format, to the competent authority of the Member State in which it is kept; the information in it must be available in a language those authorities can easily understand (Art. 11(3), Reg. (EC) 1223/2009). Ten years after the last batch — which for a product you sell for a decade means an obligation running for twenty.

4. CPNP notification (Art. 13)

Before placing the product on the market, the responsible person submits a set of information electronically to the Commission (Art. 13(1), Reg. (EC) 1223/2009): the category and name of the product, the responsible person's details and where the file is kept, the country of origin for an imported product, the Member State where it will be placed, a contact, any nanomaterials, any CMR substances, and the frame formulation.

The portal — the Cosmetic Product Notification Portal — is free to use. We say so plainly on our CPNP page, along with when you do not need us for it.

5. The label (Art. 19)

The pack carries the responsible person's name and address (Art. 19(1)(a)) and the list of ingredients (Art. 19(1)(g)), among other things. The ingredient list is the artefact that most often has to be rebuilt, because it has rules about order, about what counts as under 1 %, and about which fragrance substances have to be named rather than gathered under PARFUM.

With us, the portal turns this into your own checklist →

The word that ties them together: placed

Art. 10, Art. 11 and Art. 13 each bind the responsible person before the product is placed on the market. The Regulation defines that term, and defines a second one next to it:

• Making available on the market — "any supply of a cosmetic product for distribution, consumption or use on the Community market in the course of a commercial activity, whether in return for payment or free of charge" (Art. 2(1)(g), Reg. (EC) 1223/2009).
• Placing on the market — a cosmetic product's first making available on the Community market (Art. 2(1)(h)). The Regulation says "Community"; read it as the Union.

They are separately defined and they are not interchangeable. Transitional provisions in amending regulations routinely give one date for placing and a later one for making available, which is how a brand ends up either withdrawing stock it could still have sold or selling stock it could not.

So which of the five do I need?

For a cosmetic product placed on the EU market: all of them. A responsible person, a safety assessment and report, a file, a notification, a compliant label. They are not a menu.

What varies is how much work each one is, and that depends on your product, not on your size. There is no turnover threshold and no small-business concession in Regulation (EC) 1223/2009 that we have been able to find; the obligations attach to the product being placed on the market.

Where you might need none of it:

• Your product is not a cosmetic under Art. 2(1)(a) — a candle, a diffuser, a supplement, a device.
• You are not placing it on the Union market at all: you sell only in your own non-EU market, and you are not shipping into the EU.
• You are a distributor buying product that a responsible person has already placed on the EU market under their own name. In that case the obligations sit with them, and the sensible thing is to ask them for evidence rather than to build a file of your own.

Where you can do a good deal of it yourself:

• You are established in the EU, you are your own responsible person, and the notification is a form you can fill in.

What you cannot do yourself is the safety assessment, unless you hold the qualification in Art. 10(2). That is the piece of this that is a person rather than a process.

FAQ

The registry behind it

Every Annex II–VI entry as consolidated on 18 May 2026 — 2,385 entries, 36,023 substances — re-checked daily against EUR-Lex, CosIng, SCCS and IFRA.