Selling cosmetics in the EU; CPNP, PIF, Responsible Person, the annexes

Everything hangs off one sentence in Article 4: a cosmetic product may only be placed on the market where a legal or natural person is designated within the Union as the Responsible Person. Without that, nothing else matters, because there is no one the regulation can address.

For an importer the default is unpleasant and often overlooked: under Article 4(5), the importer is the Responsible Person for each cosmetic product he places on the market, unless he designates someone else in writing and that person accepts in writing. So if you import without arranging anything, you are not outside the regime; you are the Responsible Person, with the Product Information File, the safety assessment and the ten-year retention duty on your desk. The GPSR then adds only what 1223/2009 leaves uncovered, which in practice is little.

Article 5 lists what the cosmetics Responsible Person must actually do: ensure compliance with the safety, GMP, sampling, notification and labelling requirements; take corrective action, withdraw or recall where the product is not compliant; inform the competent authority and cooperate; and provide the authority with the information it asks for in a language it can readily understand.

Two things follow. The Responsible Person cannot be a mailbox, because he has to hold and produce the file. And distributors are not off the hook: a distributor who places a product on the market under his own name or brand, or who modifies a product already on the market in a way that affects compliance, becomes the Responsible Person himself under Article 4(6). White-label imports are the most common way to acquire that role without noticing.

The purpose of the notification is not approval; nobody approves a cosmetic in the EU. It gives poison centres the formulation they need to treat someone and gives market surveillance a starting point. That is why it has to be complete rather than clever: a frame formulation that is too vague to be usable is the kind of thing that surfaces at exactly the wrong moment.

Practical points that catch importers. The notification is per product, and a change of formulation, of pack size for certain categories, or of the label means updating it. It happens before placing on the market, not after the first sale; a product on the shelf without a CPNP number is non-compliant from the first unit. And the notification is tied to the Responsible Person, so switching service provider means the entries move with the role.

The safety report is the expensive half. Part A is the safety information: the physical and chemical characteristics, the microbiological quality, impurities and packaging material, normal and foreseeable use, exposure to the product and to each substance, and the toxicological profile of each substance. Part B is the assessment itself, with the reasoning, a warning on labelling where needed, and the credentials and signature of the assessor, who must hold a pharmacy, medicine or comparable qualification.

The duty is the Responsible Person’s, and it is not delegable by contract in the sense that matters: if the file is not there when the authority asks, the Responsible Person is the one in breach. The realistic failure mode is not a missing file but an incomplete one, usually the claim substantiation and the exposure calculation. The consequence is withdrawal from the market while it is fixed, which for a seasonal product is the same as a total loss.

This is where formulations actually die, and it is a moving target rather than a fixed list. Article 15 bans substances classified as CMR category 1A, 1B or 2 under the CLP Regulation, with narrow derogations, and the classification changes: each Adaptation to Technical Progress of CLP is followed by an Omnibus regulation that moves the newly classified substances into Annex II of the cosmetics regulation, with a date for placing on the market and a later date for making available.

The practical consequence for an importer is a stock problem, not a legal one. When a preservative you use is added to Annex II, existing stock becomes unsellable on a date printed months in advance, and your supplier will not tell you. Check the annexes and CosIng against your full ingredient list before each reorder, and put the reformulation lead time of your manufacturer next to the transition dates.

The six months is a real lead time, not a formality: it exists so the Commission can ask the Scientific Committee on Consumer Safety for an opinion where it has concerns, and the product cannot be placed on the market until the period has run. An importer who discovers a nano ingredient in the specification a month before the launch has lost the launch.

The definition is the difficulty. It catches insoluble or biopersistent intentionally manufactured material with one or more external dimensions in the order of 1 to 100 nm, and the ingredients most often caught are titanium dioxide and zinc oxide in sun care and certain colourants and silicas. Suppliers rarely volunteer it. Ask for the particle-size specification in writing for every ingredient, because the labelling omission is visible on the shelf and is the easiest non-compliance an inspector can find.

The criteria are more demanding than they look. ‘Evidential support’ means the claim must be supported by adequate and verifiable evidence, held in the Product Information File, and the level of evidence has to match the claim: a consumer-perception study supports ‘skin feels smoother’, not ‘reduces wrinkle depth by 30%’. ‘Fairness’ blocks denigrating a competitor or an ingredient that is lawfully used.

The traps are the familiar marketing words. ‘Free from’ claims are only acceptable in narrow circumstances and not where the substance could not lawfully be present anyway. ‘Hypoallergenic’ requires evidence that the allergenic potential has been minimised, not merely that no complaints were received. ‘Dermatologically tested’ without an identifiable test and an identifiable dermatologist is a claim without support. National authorities enforce this at the shelf and online, and the usual outcome is an order to change the packaging, which means destroying the printed stock.

GMP for cosmetics is not a certificate the EU issues and there is no inspection regime comparable to medicines. That is exactly why it is a weak point: the Responsible Person asserts compliance in the Product Information File on the strength of what the manufacturer tells him, and if the assertion turns out to be empty the Responsible Person is the one who made it.

What to actually ask a contract manufacturer for: an EN ISO 22716 certificate from a credible certification body, or a recent third-party audit report against that standard, plus the batch documentation for the batches you import. Keep both in the file. When a microbiological problem shows up in a finished product, the question the authority asks is what you knew about the manufacturing conditions, and ‘the supplier said it was fine’ is not an answer that ends the file.

The line that matters is drawn around the purpose and the use of the data, not around geography. Testing carried out outside the EU to satisfy another country’s market access rules does not by itself close the EU market; relying on that data in the cosmetic product safety report to demonstrate safety under 1223/2009 does. That is a documentation problem: the assessor has to be able to build Part A of the safety report without it.

Separately, an ingredient that is also a REACH-registered substance can still be subject to vertebrate testing requirements imposed by ECHA for worker exposure or the environment, which is why the blanket statement that anything tested on animals anywhere cannot be sold in the EU is too strong. Do not put that sentence on a pack: it is a claim, and under Article 20 and Regulation 655/2013 it has to be true and substantiated.

The classification is not chosen by the seller; it follows from the presentation and the function. Two products with identical formulations can land in different regimes because one claims to soothe dry skin and the other to treat eczema. Where a product falls under the medicinal-product definition the medicines rules apply even if it also meets the cosmetics definition; that is the doubtful-case rule in Article 2(2) of Directive 2001/83/EC.

The commercial consequence is severe and immediate. A cosmetic needs a Responsible Person and a CPNP entry; a medicinal product needs a marketing authorisation, which is years and six figures away. National authorities reclassify at the shelf, and the product is withdrawn while the argument runs. Sun care, oral-care whiteners, hand sanitisers, scalp treatments, wound-adjacent creams and anti-lice products are the recurring borderline cases; get a written classification opinion before the first order, not after the first inspection.

Two items are missed most often by importers. The country of origin has to appear for products imported into the Union; this is a cosmetics-specific requirement and is not the same thing as the customs origin marking. And the ingredient list has to use INCI names, in descending order of weight at the time they are added, with ingredients below 1% listable in any order after those above 1%, and perfume and aromatic compositions given as ‘parfum’ or ‘aroma’ with the listed allergens named separately.

Language is set by each member state, which for a pan-EU listing means a multilingual pack or a country-specific pack. Where the label physically cannot carry everything, Article 19(2) allows an enclosed or attached leaflet, label, tape, tag or card, with the hand-in-book symbol on the pack. Sticking a translation over the original text is common and is only lawful if the result still shows everything Article 19 requires, legibly and indelibly.