Stability and challenge testing: what your manufacturer has to prove before you can sell

Stability testing asks whether the product is still the same product after it has spent months in a warehouse, a container and a bathroom. Separation, colour shift, odour change, viscosity drift, pH movement, pack interaction — any of these can appear weeks after a batch looked perfect on the filling line.

The protocol is straightforward: samples are held at several temperatures — typically a cold condition, ambient, and an elevated condition around 40–45°C — and assessed against the baseline at set intervals. Freeze-thaw cycling is usually run alongside, because a product that travels through a Central European winter or sits in a van in a Gulf summer meets conditions the lab needs to anticipate.

Accelerated testing shortens the wait, it does not remove it. Elevated temperature is a proxy for time, and a reasonable one, but it is a prediction. Real-time data at ambient is what ultimately confirms shelf life, and it accumulates at the speed of a calendar.

Preservative efficacy testing — the challenge test — asks a different question: if the product is contaminated, can its preservative system bring the contamination back down? This matters because the realistic threat is not a dirty factory. It is a consumer with wet hands, an open jar, and six months of daily use.

The product is deliberately inoculated with a defined set of organisms and the surviving counts are measured over time. Under ISO 11930, the standard written for cosmetics, the panel is *Escherichia coli*, *Staphylococcus aureus*, *Pseudomonas aeruginosa*, *Candida albicans* and *Aspergillus brasiliensis*, held at around 32.5°C and assessed across a 28-day period. USP <51> and Ph. Eur. 5.1.3 are the pharmacopoeial equivalents and are sometimes requested instead or in addition.

Twenty-eight days is the floor. It is not a queue you can pay to skip, and it begins only once the exact formula you intend to sell exists.

Changing the fragrance changes the challenge test result. Fragrance components can have antimicrobial activity of their own, or can interact with the preservative system; a formula that passed with one scent is not evidence for another.

Changing the pack can change it too. An open jar, a pump and an airless dispenser present different contamination risks, and a preservative system validated in one is not automatically validated in the others.

This is the mechanism behind the per-variant minimum that surprises founders. Six scents in a range are not one product in six packs; to a testing regime they are closer to six products — which is why a manufacturer quoting per SKU rather than per order is giving you the number that actually governs your launch.

Sample development and approval first. Then, once the final formula is fixed, challenge testing runs its 28 days while stability runs in parallel at its own pace. Only after both read acceptably does a sane manufacturer commit the bulk order for a first production run.

Run in parallel rather than in series, the testing block is roughly a month to six weeks of calendar before production — longer if a result comes back marginal and the preservative system needs adjusting, which restarts the clock on the challenge test.

The practical consequence: a founder who approves a sample in January and promises a retailer February delivery has already missed. A founder who books the production slot for April has a plan.

Check that the report names your formula, with a batch or formulation code you can match to what you are buying. A report for the base formula is not a report for your version of it.

Check the dates. A challenge test report with a start and end date less than 28 days apart is describing something other than a completed ISO 11930 study.

Check which conditions the stability study actually ran. A single elevated-temperature point is a screening test, not a stability study. And check who signed it: an in-house report from the manufacturer's own lab is normal and useful, but an external accredited laboratory is what an EU Responsible Person or a demanding retailer will want to see in the Product Information File.

Run the testing before taking your money for a full production run, not after. Tell you when a modification you have requested triggers a retest, and what that does to the date. Keep the raw data, not only the summary, because the Product Information File needs the substance rather than the certificate.

At our own plant this sits inside the ISO 22716 quality system rather than beside it — batch records, retained samples and test data are part of how a run is released, not paperwork assembled afterwards for a customer who asked. The question worth putting to any factory is simple: *show me the stability and challenge data for a product you are currently producing for someone else*, with the commercial details removed. A manufacturer who can produce that in a day is a manufacturer whose system works.