By OnlyTRAININGS | EU Cosmetics Compliance Training
Most cosmetic products that fail EU regulatory review are not poorly formulated. The chemistry works. The performance is there. What fails is the safety documentation - the CPSR is not structured to withstand toxicologist review, the PIF has gaps that surface only during inspection, or the safety assessment does not align with the formulation decisions made three months earlier.
EU Regulation 1223/2009 is not ambiguous about what is required. The difficulty is not knowing the rules. It is translating those rules into safety justification, exposure calculations, and documentation that holds up under real scrutiny, not just paper compliance.
This article covers where experienced teams get this wrong, and why getting it right requires more than reading the regulation.
What EU 1223/2009 Actually Demands
Every cosmetic product placed on the EU market must be safe for human health under normal or reasonably foreseeable conditions of use. That sentence sounds straightforward. The compliance machinery behind it is not.
The regulation requires a Cosmetic Product Safety Report (CPSR) prepared and signed by a qualified safety assessor. It requires a Product Information File (PIF) maintained by the Responsible Person and available to competent authorities on request. It requires CPNP notification before market entry. It requires labeling that aligns with the formulation and the safety assessment. It requires that any claim made for the product is substantiated.
None of these elements can be treated as a final step before launch. Each one depends on decisions made during formulation - which means compliance problems that appear at documentation stage were usually created in the lab weeks or months earlier.
The CPSR: Where Most Products Actually Fail
The Cosmetic Product Safety Report is divided into two parts. Part A is the safety information: the qualitative and quantitative composition, the physicochemical and microbiological specifications, the impurity and trace substance profile, the exposure assessment, the toxicological profile of the ingredients, and the undesirable effects data. Part B is the safety assessor's evaluation: the conclusion on safety, the labeling warnings, the reasoning behind the assessment, and the assessor's credentials and signature.
The document looks structured. The failure modes are not obvious until you understand what a qualified assessor is actually evaluating.
Exposure calculation errors. Margin of Safety calculations depend on getting exposure right. The exposure estimate for a leave-on facial product is not the same as for a rinse-off body wash, and using a generic systemic exposure dose across product categories is one of the most common technical weaknesses in CPSR submissions. When MoS values are borderline, the quality of the exposure reasoning determines whether the assessor can sign or cannot.
Data gap management. Very few formulations have complete toxicological datasets for every ingredient at every relevant endpoint. The accepted approaches for handling data gaps - read-across from structurally similar substances, weight-of-evidence arguments, QSAR predictions - each require specific justification that most documentation teams do not structure clearly. An unsupported data gap is not a minor deficiency. It is a reason the assessor cannot sign Part B.
Impurity and trace substance handling. Raw materials carry impurities. Processing generates trace contaminants. Fragrance mixtures carry undisclosed components. Each of these needs to be identified, characterised, and addressed in the safety assessment. Formulators who treat the declared ingredient list as the complete scope of the CPSR are leaving the most unpredictable risk sources unexamined.
Annex misinterpretation. Annexes II through VI define what is prohibited, what is restricted, which colorants are permitted, which preservatives are permitted, and which UV filters are permitted. The restrictions in Annexes III, IV, V, and VI are product-type and concentration-specific. A preservative that is compliant in a rinse-off product may be non-compliant at the same concentration in a leave-on product. These distinctions have to be resolved at formulation stage, not documentation stage.
The PIF: What Inspectors Actually Look For
The Product Information File is not a folder of supporting documents. It is a structured record that must allow a competent authority to assess the product's safety and regulatory status without requiring anything additional from the Responsible Person.
In practice, PIF inspections surface three categories of weakness consistently.
Claim substantiation that does not support the label. If the product label claims "dermatologically tested," "hypoallergenic," or a specific efficacy outcome, the PIF must contain evidence that substantiates the claim with appropriate methodology. Consumer perception data does not substantiate a clinical claim. A single irritation patch test result does not substantiate a broad "suitable for sensitive skin" claim. The gap between what is on the label and what is in the PIF is where brand reputation and regulatory risk converge.
Stability and microbiological data that does not cover the shelf life claimed. Stability studies need to support the period of time after opening (PAO) marked on the product. Microbiological challenge testing needs to meet the criteria in ISO 11930 and align with the product's preservative system. Stability data generated on a different formula version from the one being launched, or using accelerated conditions only, frequently does not satisfy inspection requirements.
Manufacturing and GMP documentation that cannot be traced. The PIF must include evidence that the product was manufactured in accordance with EU GMP standards (ISO 22716). Where manufacturing is outsourced, the Responsible Person must hold GMP certification for the manufacturer and be able to demonstrate oversight. This is the area where smaller brands and contract manufacturers most commonly leave audit exposure.
The Responsible Person: More Than a Named Contact
Under EU 1223/2009, every cosmetic product placed on the EU market must have a designated Responsible Person established within the EU. This is not a legal technicality. The Responsible Person carries substantive obligations.
The Responsible Person must ensure the CPSR is complete and accurate. They must maintain the PIF and make it available within 10 working days of a competent authority request. They must report serious undesirable effects. They must notify on CPNP. They must ensure that GMP was followed and that the labeling is compliant.
For companies outside the EU using an EU-based Responsible Person under a mandate, the practical question is whether the Responsible Person has sufficient access to the documentation and the manufacturing evidence to actually discharge these obligations. A Responsible Person holding a mandate without visibility into the CPSR quality, PIF completeness, or manufacturing controls is carrying liability they cannot manage.
SCCS Opinions: How to Use Them and When They Create Complexity
The Scientific Committee on Consumer Safety publishes safety opinions on specific cosmetic ingredients, fragrances, nanomaterials, and broader safety topics. These opinions are the primary reference standard for safety assessors evaluating those ingredients.
Using them correctly is not simply a matter of checking whether the SCCS has evaluated an ingredient. The opinion has to be read in full. SCCS opinions frequently contain Notes that restrict the scope of the conclusion, define the exposure scenarios that were evaluated, or identify data gaps that limit the conclusion's applicability. A safety assessor who cites an SCCS opinion as supporting safety without applying the Notes may be relying on a conclusion that does not apply to their specific formulation, product type, or consumer population.
For borderline ingredients, fragrance allergens under the current restriction framework, and nanomaterials, SCCS opinions are not simplifying documents. They are the starting point for a more complex assessment.
CPNP Notification: Where Administrative Errors Create Market Access Risk
The Cosmetic Products Notification Portal notification is required before placing a product on the EU market. The notification is product-specific and must accurately reflect the formulation, the product category, the frame formulation if applicable, the presence of nanomaterials, and the Responsible Person details.
Administrative errors in CPNP notification are more consequential than they appear. An incorrect product category affects which regulatory requirements apply. A missing nanomaterial notification is a direct compliance breach with specific enforcement implications. A mismatch between the notified formulation and the marketed product creates audit exposure. These errors are not difficult to make and are not automatically detected before market entry.
Why Compliance Built Late Always Costs More
The consistent pattern in EU cosmetics regulatory problems is timing. A formulation is developed. At some point before launch, compliance documentation begins. The safety assessor reviews the CPSR draft and identifies that a restricted substance is present above the permitted concentration for the intended product type. Or that the exposure assumptions used for MoS calculation do not match the product's intended use. Or that a key ingredient lacks adequate toxicological data for the relevant endpoint.
At that point, the options are reformulation, additional testing, or revised justification - all of which take time and money that would not have been spent if the regulatory constraints had been applied at the formulation design stage.
EU cosmetics compliance built into the development workflow from the beginning is not more complex than compliance built at the end. It is substantially less expensive, faster to market, and more defensible under inspection.
What the Training Covers
The EU Cosmetics Regulation 1223/2009 Training on OnlyTRAININGS focuses on exactly the gap described above: not the regulation as text, but how experienced professionals translate regulatory expectations into CPSR documentation, PIF structure, and risk-based safety assessment workflows that withstand audit and market scrutiny.
It covers practical CPSR construction including exposure estimation, MoS calculations, toxicological profile evaluation, and data gap management. It covers PIF structure that integrates formulation data, stability, microbiological quality, claim support, and manufacturing controls. It addresses how to interpret Annex II through VI restrictions in formulation decisions, how to apply SCCS guidance to real ingredient scenarios, and how safety assessor decision liability affects documentation practice.
The training includes real case scenarios from industry, CPNP notification strategy, Responsible Person obligations, and a compliance workflow designed for faster, repeatable EU market access across multiple product launches.
Six months of access. Downloadable training materials including slides, Q&A, and FAQ PDFs. Expert connect via discussion forum. Training certificate on completion.
If your team is preparing CPSRs, building PIFs, or managing EU market entry for cosmetic products and finding that the documentation does not hold up the way it should, this training gives you the practical framework to change that.
Access the EU Cosmetics Compliance Training
Frequently Asked Questions
Why does a technically compliant formulation still fail EU regulatory review?
Because EU compliance depends on safety assessment quality and documentation structure, not formulation performance. A product with an acceptable safety profile can fail review if the CPSR does not adequately justify the MoS, handle data gaps, or address impurities. The formulation and the documentation have to tell the same story.
What makes a CPSR fail toxicologist review even when it looks complete?
The most common reasons are MoS calculations based on incorrect or generic exposure assumptions, unresolved data gaps without adequate justification, impurities and trace substances not addressed in the toxicological profile, and Annex restrictions applied at product category level without resolving product-type-specific concentration limits. A CPSR that satisfies a checklist but cannot be defended under questioning is a CPSR that will not get signed.
What does the Responsible Person actually need to be able to do?
The Responsible Person must be able to make the complete PIF available within 10 working days of a competent authority request, report serious undesirable effects within 10 days of becoming aware, and ensure the CPSR is accurate and the product is manufactured to GMP standards. This requires active oversight of documentation quality, not just a named contact on a label.
How do SCCS opinions affect safety assessment for specific ingredients?
SCCS opinions are the primary reference standard for safety assessors evaluating ingredients that the SCCS has reviewed. But the opinion has to be read in full, including any Notes that restrict the scope or define the exposure scenarios evaluated. A conclusion that applies to rinse-off products only, or to specific concentration ranges, does not automatically support a leave-on application at a higher concentration. Misapplying SCCS opinions is one of the technical weaknesses that most commonly undermines otherwise solid CPSR documentation.
When should EU compliance considerations enter the formulation process?
From the beginning, not at documentation stage. Annex restrictions, preservative and UV filter permitted lists, impurity thresholds, and exposure constraints that affect MoS calculation all have direct implications for formulation decisions. Identifying these constraints after a formulation is finalized leads to reformulation, additional testing, or launch delays. Building them into the development workflow from the start eliminates most of the cost and timeline risk of late-stage compliance failures.
OnlyTRAININGS delivers specialist technical training for the chemical and allied industries. Trusted by 5,000+ companies globally. View all trainings.
