EU Biocidal Products Regulation for Disinfectants and Sanitisers: A Manufacturer's Guide

What the EU Biocidal Products Regulation Is and Why It Exists

The BPR was adopted on 22 May 2012 and became fully applicable on 1 September 2013, replacing Directive 98/8/EC which had governed biocidal products since its transposition into member state law in the early 2000s. The regulation was driven by three interconnected policy objectives: harmonising the fragmented national authorisation systems that had developed under the Directive; strengthening the scientific evaluation of active substances to ensure only safe, effective, and environmentally acceptable biocides remained on the market; and improving transparency and access for industry by introducing the Union authorisation route, which allows a single EU-wide product approval rather than separate national authorisations in each member state.

The BPR operates as a directly applicable EU regulation — unlike a directive, it does not require national transposition and takes effect in identical form across all EU member states. The European Chemicals Agency (ECHA) plays a central role as scientific evaluator and dossier manager, while national competent authorities in each member state are responsible for national product authorisation decisions. The regulation's scope is deliberately broad: it covers any product intended to destroy, deter, render harmless, prevent the action of, or otherwise exert a controlling effect on any harmful organism by chemical or biological means. This captures not only conventional cleaning disinfectants but also treated articles that incorporate biocidal substances to confer a biocidal property on the article itself — a category that is increasingly relevant to antimicrobial coatings and treated textiles.

Scope: Who It Applies To and Which Products Are Covered

The BPR applies to any person or company that manufactures, imports, or places a biocidal product on the EU market. The regulation defines 22 product types (PTs) across four main groups — disinfectants, preservatives, pest control, and other biocidal products — and each product must be authorised specifically for the product type(s) that match its intended use. For disinfectant and sanitiser manufacturers, the four most relevant product types are set out in the table below.

Certain products are exempt from the BPR. Pure cleaning products that work by physical or mechanical action rather than biocidal activity — detergents that clean but do not make antimicrobial claims — fall outside the regulation's scope. However, the moment a product label or marketing material makes a disinfection, antimicrobial, or biocidal claim, BPR authorisation obligations are triggered regardless of the actual active substance concentration. This boundary is one of the most commercially significant scope questions for cleaning product manufacturers developing multi-function products.

Key Requirements: The Two-Tier Authorisation System

The BPR's central compliance mechanism is a mandatory two-tier authorisation system. First, the active substance — the biocidally active ingredient — must be approved at EU level. Second, the finished biocidal product formulation must separately obtain product authorisation before it can legally be placed on the EU market. Both tiers must be satisfied; active substance approval alone does not authorise a finished product for sale. Understanding how these two tiers interact is the foundation of BPR compliance strategy for any disinfectant manufacturer.

Tier 1: Active Substance Approval

Active substances used in biocidal products must be evaluated and approved by ECHA and the European Commission. Approved active substances are listed in the Union list (formerly Annex I) — a dynamic list updated as new evaluations are completed and periodic renewals are assessed. Active substances not on this list cannot be used in new biocidal products placed on the EU market. The approval specifies the product type(s) for which the substance is approved, any conditions of use, and the renewal date. For disinfectant formulators, the commonly used actives — quaternary ammonium compounds (quats), hydrogen peroxide, peracetic acid, sodium hypochlorite at defined concentrations, ethanol above threshold concentrations — are generally approved for relevant PTs, but conditions attached to their approvals (concentration limits, excluded uses, environmental restrictions) must be reviewed carefully before formulating.

Tier 2: Product Authorisation Routes

Once the active substance is confirmed as approved, the finished product must be authorised through one of three routes: national authorisation (application to a single member state competent authority, with access only to that market); mutual recognition (extending an existing national authorisation to additional member states via a formal mutual recognition procedure); or Union authorisation (a centralised route managed by ECHA giving a single authorisation valid across all EU member states). A fourth simplified route is available for low-risk biocidal products under Article 25, where all active substances are on the approved low-risk list and the formulation meets defined criteria. The choice between these routes depends on target markets, timeline constraints, and product eligibility.

Testing and Documentation Requirements

The BPR product authorisation dossier is a substantial technical submission. For a standard PT2 disinfectant authorisation, the core data requirements cover the active substance (if not already fully characterised in an existing approved dossier), the finished product formulation, efficacy data demonstrating the product meets its claimed biocidal performance, and a complete risk assessment for human health and the environment. The competent authority evaluates all three elements: whether the product works (efficacy), whether it is acceptable from a safety standpoint (risk assessment), and whether the proposed labelling and use conditions adequately control exposure.

Efficacy Testing for PT2 Disinfectants

Efficacy data for PT2 surface disinfectants must be generated using the relevant CEN standardised test methods. The minimum testing framework for a general surface disinfectant bactericidal claim covers EN 13697 (quantitative non-porous surface test for bactericidal and fungicidal activity) and EN 16615 (four-field quantitative test simulating practical surface disinfection conditions). Where virucidal claims are required — increasingly standard for healthcare and food industry products — EN 14476 is mandatory. Sporicidal claims, for products targeting Clostridioides difficile spores or surgical instrument sterilisation, require EN 13704 or EN 17126. All efficacy tests must be conducted at the claimed use concentration, contact time, and temperature — at both clean conditions (without interfering substances) and dirty conditions (with bovine serum albumin and/or yeast extract as organic load), and results must meet the pass threshold for each standard. Testing must be performed by laboratories accredited to ISO/IEC 17025 for the specific test methods.

Physical, Chemical, and Toxicological Data

Beyond efficacy, the dossier must include a complete physicochemical characterisation of the product (pH, stability, corrosiveness, flammability), toxicological data covering acute and repeat-dose toxicity, irritation, sensitisation, and genotoxicity for the complete formulation, and ecotoxicological data addressing aquatic toxicity and environmental persistence. For many co-formulants — surfactants, solvents, fragrances, stabilisers — data may be available from existing REACH registration dossiers or from supplier Safety Data Sheets, which can be read-across. Where data gaps exist, additional testing is required. The Summary of Product Characteristics (SPC) — the formal document describing approved use conditions, dosage, and target organisms — is the binding output of the authorisation and governs what the product label must say.

Step-by-Step BPR Compliance Pathway for Disinfectant Manufacturers

The compliance pathway for a new disinfectant product entering the EU market under the BPR follows a defined sequence of steps. Each step builds on the previous, and skipping or shortcutting any stage is likely to result in dossier rejection or authorisation refusal. The following sequence applies to the most common route for new products — national authorisation with subsequent mutual recognition.

1. Identify product type(s) and intended use. Confirm which PT(s) apply to your product's intended use and claims. A product claimed for both skin disinfection (PT1) and surface disinfection (PT2) requires authorisation under both product types, potentially requiring separate dossiers or a combined submission.
2. Verify active substance approval status. Check the ECHA R4BP database and the EU active substance Union list to confirm each active substance in your formulation is approved for the relevant PT(s). Note any conditions of use, concentration limits, or exclusions attached to the approval. If an active substance is under the review programme but not yet approved, assess the transitional measures timeline.
3. Conduct BPR-compliant efficacy testing. Commission CEN standardised efficacy tests from an accredited laboratory at your claimed use conditions. Define the scope of claims (bactericidal, fungicidal, virucidal, sporicidal; clean vs dirty conditions; contact time; temperature) before testing, as scope cannot be extended after authorisation without additional tests.
4. Compile the complete technical dossier. Assemble physicochemical data, toxicological data, ecotoxicological data, and efficacy data into the BPR dossier format. Prepare the Summary of Product Characteristics (SPC) draft, including proposed label text, use instructions, and risk mitigation measures. Use IUCLID 6 software for dossier preparation — the format required by ECHA and all EU competent authorities.
5. Submit to a member state competent authority. Choose the first member state for national authorisation based on strategic, scientific, or timeline considerations — different member states have different fee structures and evaluation speeds. Submit through the R4BP 3 portal. Pay the applicable fee and respond to completeness check requests within the prescribed period.
6. Manage the evaluation process. The competent authority has 365 days from acceptance to complete its evaluation, pausing for information requests (clock stops). Respond to all requests for additional information (RAI) promptly and thoroughly. A draft authorisation decision and draft SPC will be shared for comment before finalisation.
7. Extend to additional member states via mutual recognition. Once national authorisation is granted, submit mutual recognition applications to additional EU member states to extend market access. Existing authorisation holders in those states may raise concerns via the mutual recognition procedure — manage these carefully as they can delay or constrain the extension.

Realistic Timeline and Cost Expectations

BPR product authorisation is a multi-year undertaking when approached from a standing start. The headline statutory evaluation period is 365 days from dossier acceptance, but this clock pauses for every information request from the competent authority — and for a complex PT2 disinfectant dossier, two or three information request cycles are normal. Effective calendar time from dossier submission to receiving a first national authorisation decision typically runs from 18 months to 36 months, depending on member state, dossier quality, and whether the active substance evaluation is already complete. Union authorisation, while in principle delivering a single EU-wide approval, requires pre-submission scientific advice, ECHA dossier evaluation, and European Commission decision — a total process that routinely takes four or more years end-to-end.

Cost drivers fall into three main categories: testing (the most significant single item — a full efficacy data package across bactericidal, fungicidal, and virucidal endpoints for a PT2 product runs to a substantial laboratory investment); dossier preparation and regulatory consultancy; and competent authority fees, which vary between member states from a few thousand euros to tens of thousands depending on application type and national fee schedules. Annual fees for maintaining an authorisation once granted add an ongoing compliance cost. For manufacturers considering EU market entry, accurate budget modelling from pre-submission advice through to authorisation maintenance should be completed before committing to the BPR pathway — total project investment is often significantly higher than initial estimates based on headline fee schedules alone.

Common Mistakes Manufacturers Make — and How to Avoid Them

BPR non-compliance and authorisation delays share a consistent set of root causes that experienced regulatory teams encounter repeatedly. Awareness of these pitfalls before starting the process saves significant time and cost compared to discovering them at the dossier submission or evaluation stage.

Misclassifying the Product Type

The most frequent error is applying for the wrong product type — most commonly, registering a surface disinfectant under PT1 (human hygiene) because the company considers its product a "hygiene" product, when the product is applied to surfaces rather than directly to human skin. PT1 and PT2 carry different active substance approval conditions and different efficacy test requirements. A PT1 authorisation does not permit surface disinfection claims; a PT2 authorisation does not permit claims for direct skin application. Products that genuinely serve both uses require dual PT authorisation. The product type must be assigned based on the product's use as applied — not its general category or the manufacturer's commercial positioning.

Assuming Active Substance Approval Covers the Product

Several manufacturers — particularly those entering the EU market from non-EU jurisdictions — assume that because their active substance is on the EU approved list, their formulated product is automatically authorised. It is not. Active substance approval is a necessary but entirely insufficient condition for product authorisation. The finished formulation, with all its co-formulants, concentrations, intended uses, and proposed label, must be separately assessed and authorised. Trading without a valid product authorisation — even if the active substance is approved — constitutes unlawful placing on the market of a biocidal product and is subject to enforcement action. For further context on how cleaners and disinfectants intersect in practice, our overview of household and industrial cleaner formulation covers the boundary between cleaning and biocidal claims in product development.

Insufficient Efficacy Data Scope

Submitting a dossier with efficacy data that does not cover the full scope of the product's label claims is the single most common cause of information requests that extend evaluation timelines. If a product label claims bactericidal, fungicidal, and virucidal activity, all three endpoints must be tested to the relevant EN standards before submission. If the label claims efficacy under dirty conditions (the standard for healthcare environments), dirty condition tests must be included — clean condition tests alone are insufficient. Defining the complete claim scope and commissioning all required tests before dossier preparation begins is the essential pre-submission step that most delays are traceable to having skipped. Our guide to hospital-grade disinfectant formulation provides technical background on the efficacy standards that define these test requirements.

No EU Responsible Person Established

Non-EU manufacturers routinely overlook the requirement to designate an EU-established Responsible Person before market entry. Without this, no product authorisation application can be filed, and no product can legally enter EU distribution channels. Identifying and contracting with a suitable EU Responsible Person — whether an affiliated EU entity, a distribution partner willing to accept the legal responsibility, or a specialist regulatory service provider — must be the first step in any non-EU manufacturer's EU market entry plan, not a detail addressed after authorisation is sought. The BPR's requirements for labelling, language localisation, and product formulation compliance also rest on the Responsible Person's obligations and cannot be delegated away.