EU Cosmetics Regulation 1223/2009: A Formulator's Practical Guide

What Is EU Regulation 1223/2009 and Why It Exists

EU Cosmetics Regulation 1223/2009 was adopted on 30 November 2009 to consolidate and modernise the fragmented body of cosmetics law that had accumulated under the previous 1976 Directive and its 56 subsequent amendments. The regulation addresses a fundamental challenge in consumer product safety: cosmetics are applied directly to the human body, sometimes daily, across the full range of skin types, ages, and health conditions — yet they fall outside the strict pre-market authorisation requirements of pharmaceuticals. The regulation creates a structured framework that ensures products are safe before they reach consumers while allowing manufacturers to bring products to market without a central pre-authorisation process, as long as all requirements are met. It also harmonises the rules across member states, replacing the patchwork of national transpositions that had created compliance inconsistencies across the EU single market.

The regulation operates on the principle of manufacturer and importer responsibility: rather than each product being reviewed by a regulator, the entity placing it on the market must ensure compliance and must appoint a Responsible Person who is accountable under EU law. Competent national authorities carry out post-market surveillance — testing products, inspecting Product Information Files, and initiating enforcement action where violations are found.

Scope: Which Products and Markets Are Covered

EU Regulation 1223/2009 applies to any "cosmetic product" — defined in Article 2 as "any substance or mixture intended to be placed in contact with the external parts of the human body (epidermis, hair system, nails, lips and external genital organs) or with the teeth and the mucous membranes of the oral cavity with a view exclusively or mainly to cleaning them, perfuming them, changing their appearance, correcting body odours, protecting them or keeping them in good condition." This deliberately broad definition covers a wide spectrum of product categories, from shampoos and body lotions to nail varnish, toothpastes, deodorants, sunscreens, and colour cosmetics. Products that cross into medicinal claims or functions may instead fall under the Medicinal Products Directive — the borderline between cosmetic and medicinal is a critical classification decision that carries significant compliance consequences.

The regulation applies to all products made available to EU consumers, including those sold via e-commerce by non-EU businesses. Products marketed exclusively for professional use — such as salon-only hair dye — still require a Responsible Person and CPNP notification; they are not exempt from the regulation's core provisions, though some labelling concessions may apply for professional-only supply.

Key Requirements: Responsible Person Obligations and Ingredient Compliance

The cornerstone of EU Regulation 1223/2009 is the Responsible Person system. Under Article 4, only a cosmetic product for which a Responsible Person (RP) is established within the EU or EEA may be placed on the market. The RP bears the full weight of legal compliance: they must ensure the product is safe, that a completed safety assessment is held on file, that a Product Information File (PIF) is maintained and accessible, and that the product is notified on the CPNP portal before market launch. For EU-based manufacturers, the manufacturer typically acts as RP. For products imported into the EU — including those from the UK post-Brexit — an EU-based importer or a designated EU representative must formally accept the RP role in writing.

Ingredient compliance operates through the Annex framework. Every ingredient in a cosmetic formulation must be checked against:

• Annex II — over 1,300 substances prohibited in cosmetics. If an ingredient appears here, it cannot be used under any circumstances for cosmetic purposes.
• Annex III — substances subject to restrictions. These may only be used at specified maximum concentrations, in certain product types, with mandatory label warnings, or subject to other conditions. The list is regularly updated based on SCCS opinions.
• Annex IV — permitted colourants (positive list). Colourants not listed may not be used.
• Annex V — permitted preservatives (positive list). Preservatives not listed may not be used for preservation purposes.
• Annex VI — permitted UV filters (positive list). UV filters not listed may not be used for sun protection purposes.

Substances not governed by these Annexes are evaluated as part of the Cosmetic Product Safety Report — they must be demonstrated to be safe at the concentrations used through existing toxicological data, literature review, or product-specific testing.

Safety Assessment and Product Information File Requirements

Under Article 10, every cosmetic product must undergo a safety assessment carried out by a qualified cosmetic safety assessor — a person holding at minimum a degree in pharmacy, toxicology, medicine, or a related discipline as defined in the regulation. The output of this assessment is the Cosmetic Product Safety Report (CPSR), which must be completed before the product is placed on the market and must be maintained in the Product Information File (PIF). The CPSR consists of two mandatory parts that work together to demonstrate product safety.

Part A — Product Safety Information must include all of the following:

• Quantitative and qualitative composition with INCI names and concentrations
• Physicochemical characteristics and stability of the finished formula
• Microbiological quality — specification and challenge test results for preservative efficacy
• Impurity and trace substance assessment (including raw material contaminants)
• Packaging material compatibility data
• Normal and reasonably foreseeable use conditions
• Existing cosmetic safety data for each ingredient (from SCCS opinions, toxicological databases, or literature)

Part B — Safety Assessment Conclusion contains the assessor's evaluation statement, the methodology used, exposure assessment (where relevant — particularly for leave-on products, sprays, or products intended for use around eyes or mucous membranes), and the conclusion that the product is safe for human health under normal and reasonably foreseeable use. The assessor must sign and date Part B personally.

The Product Information File (PIF), governed by Article 11, is the complete compliance dossier and must be maintained at the Responsible Person's EU address for 10 years after the last batch is placed on the market. It must include the CPSR, a description of the manufacturing method, proof of compliance with GMP (EN ISO 22716), claims substantiation data, and human safety data where applicable (such as undesirable effects reports or safety data from similar marketed products). The PIF must be made available to competent authorities promptly upon request — there is no grace period for assembly after a request is received.

Step-by-Step EU Market Compliance Pathway

Bringing a cosmetic product to the EU market under Regulation 1223/2009 follows a defined sequence of steps that must be completed before any product reaches EU consumers. Unlike some other regulatory systems, there is no central pre-market approval — instead, the Responsible Person self-certifies compliance against the regulation's requirements and notifies the product on the CPNP. The process typically takes 6–16 weeks from formulation finalisation to first market availability, depending on the complexity of the formulation and the speed of safety assessment.

1. Confirm product classification — Establish that your product meets the cosmetic product definition under Article 2. If any therapeutic or medicinal claims are intended, assess whether the product would be reclassified as a medicinal product and require a marketing authorisation instead.
2. Screen all ingredients against the Annexes — Check every ingredient against Annex II (prohibitions), Annex III (restrictions with conditions), and the positive lists in Annexes IV, V, and VI where applicable. Obtain current Annex text from EUR-Lex — do not rely on third-party summaries for Annex II checks as the list is regularly updated.
3. Appoint an EU Responsible Person — If you are outside the EU, appoint an EU-established company or individual to act as Responsible Person. Confirm the appointment in writing. The RP's EU address will be required for the CPNP notification and must appear on the product label.
4. Commission the Cosmetic Product Safety Report (CPSR) — Engage a qualified safety assessor to complete both Part A and Part B of the CPSR. Provide all raw material toxicological data, SDS sheets, and the formulation quantitative composition. Allow adequate time for the assessor to request additional data — incomplete toxicological data at this stage is the most common cause of delay.
5. Compile the Product Information File (PIF) — Assemble all documents required under Article 11: the completed CPSR, method of manufacture summary, GMP conformance declaration, claims evidence, and any human safety data. Verify the PIF is complete before proceeding to notification.
6. Notify on the CPNP portal — The Responsible Person must submit a CPNP notification for each product before it is placed on the EU market. The notification requires: product category, product name in all languages marketed, country of origin, responsible person details, frame formulation (ingredient list with approximate concentration ranges), and label image. CPNP access requires an EU Login account linked to the RP entity.
7. Verify labelling compliance — Confirm the product label complies with Article 19 requirements: RP name and address, nominal content, minimum durability date or period-after-opening (PAO) symbol, precautions for use, batch number, function (if not evident from presentation), ingredient list (INCI names, in descending order of concentration), and any warnings required by Annex III for specific restricted ingredients.
8. Establish ongoing post-market surveillance Systematically collect and assess undesirable effects under Article 23. Serious undesirable effects must be reported to the competent authority of the member state where they occurred within 15 days.

Realistic Timeline and Cost Expectations

The time required to achieve EU market readiness under Regulation 1223/2009 depends heavily on the complexity of the formulation, the speed of the safety assessor, and whether ingredients with restricted status require additional toxicological data gathering. A straightforward skincare moisturiser with well-characterised ingredients and an established safety assessor relationship can move from final formulation to CPNP notification in 6–10 weeks. A colour cosmetic with novel pigments, a sunscreen with Annex VI UV filter questions, or a product containing ingredients with limited existing toxicological data can easily require 16–24 weeks when accounting for data gap analysis and safety assessor review cycles.

Cost drivers fall into several categories. The safety assessment fee is typically the largest single expense — qualified safety assessors command fees that vary with the formulation complexity, the number of ingredients requiring individual toxicological review, and the assessor's jurisdiction and experience level. Expect costs to range from a few hundred pounds or euros for simple formulations assessed against established data, to several thousand for complex or novel formulations requiring in-depth gap analysis. Stability and challenge testing (preservative efficacy testing and accelerated stability runs) adds laboratory costs that depend on the number of conditions tested and the laboratory's turnaround time. Claims substantiation — consumer perception studies, instrumental testing, or clinical evaluation — adds further cost if claims beyond functional description are made. CPNP notification itself carries no fee from the Commission, but your RP or regulatory affairs consultant's time to prepare and submit the notification is a real cost. Ongoing compliance costs include annual CPSR review when significant formulation changes occur, Annex update monitoring, and undesirable effect surveillance.

Common Mistakes Formulators Make — and How to Avoid Them

The most frequent compliance failures under EU Regulation 1223/2009 fall into predictable categories, most of which stem from insufficient attention to the regulation's detail during formulation development rather than at the compliance stage. Catching these issues early — ideally before the formulation is locked and scale-up has begun — dramatically reduces the cost of remediation.

• Using Annex III restricted ingredients without reading the full restriction conditions. Many formulators check only whether an ingredient is listed in Annex III and confirm it is present below the stated maximum concentration, without reading the full restriction entry. Annex III restrictions often specify that the limit applies to specific product types (e.g., rinse-off only), requires a specific on-label warning, or excludes use in certain applications (e.g., products intended for use on mucous membranes or broken skin). A concentration that is compliant in a rinse-off product may be non-compliant in a leave-on formulation.
• Assuming EU-compliant raw materials guarantee a compliant finished product. Raw material suppliers may certify an ingredient as "REACH compliant" or "EU cosmetics compliant" — but ingredient compliance does not guarantee finished product compliance. The CPSR must evaluate the ingredient combination, potential interactions, cumulative exposure to restricted substances, and product-specific use conditions.
• Delaying safety assessor engagement until formulation is finalised. Safety assessors frequently identify toxicological data gaps or Annex issues during their review that require reformulation — substituting an ingredient, reducing a concentration, or changing the preservative system. If this happens after scale-up has begun or packaging has been ordered, the cost is substantial. Engaging a safety assessor at prototype stage allows iterative compliance review before costs are sunk.
• Inadequate PIF maintenance after market launch. The PIF is not a one-time document — it must be updated to reflect any formulation changes, claims changes, undesirable effects received, or Annex updates that affect the product. Competent authorities conducting market surveillance may request the PIF with short notice. A PIF that reflects a formula version no longer manufactured, or that lacks the CPSR update following a preservative system change, creates serious enforcement exposure.
• Ignoring the undesirable effects reporting obligation. Article 23 requires the Responsible Person to report serious undesirable effects (those that result in temporary or permanent functional incapacity, disability, hospitalisation, congenital anomalies or death) to the national competent authority within 15 days. Many brands — particularly smaller ones without a dedicated pharmacovigilance function — lack systems to capture, assess, and escalate consumer feedback to identify serious effects. Failure to report a serious effect is a significant regulatory and reputational risk.
• Launching in the EU via a third-party distributor without formally assigning Responsible Person status. A distribution agreement alone does not constitute RP assignment. The RP must accept their role in writing, must hold the PIF, must complete the CPNP notification, and must have their EU address on the product label. Distributing products through a third party who has not formally and legally accepted RP status means the original manufacturer bears that responsibility — without having EU establishment. This is a structural compliance failure, not a paperwork oversight.

For formulators exporting into the EU from outside the bloc — including the UK, US, and Asian markets — it is worth noting that EU Regulation 1223/2009 has been significantly amended since its 2009 adoption, with updates to Annex II, III, V, and VI occurring frequently. The European Commission's cosmetics legislation page is the authoritative source for current Annex text and implementing regulations. For UK formulators, the retained UK version of the regulation (UK Regulation (EC) No 1223/2009 as retained in UK law) diverged from the EU text on Brexit day and continues to diverge as both regimes independently update — compliance with one does not guarantee compliance with the other. Understanding this regulatory divergence is increasingly important for dual-market product launches.

Formulators developing products for the cosmetics and personal care sector will also benefit from understanding emulsion science and formulation fundamentals, since many CPSR data requirements intersect directly with formulation physicochemical properties. For preservative system selection and compliance under Annex V, our detailed guide to preservative failure in aqueous cosmetic formulations covers the practical challenge testing and formulation parameters that safety assessors will review.