Selling cosmetics in the EU: the four things that must exist before the first sale

Cosmetics placed on the EU market fall under Regulation (EC) No 1223/2009. It applies to the finished product rather than to the factory, which is the point most non-EU manufacturers and their customers get wrong: a compliant factory does not produce a compliant product on its own. Compliance is a file, a person and a notification, and someone has to own each of them.

Turkish cosmetics regulation is aligned with the same framework, which makes the documentation a Turkish manufacturer produces directly usable. It does not make the product notified. That step belongs to whoever places it on the EU market.

Every cosmetic on the EU market must have a Responsible Person established in the EU. Not reachable in the EU — established in it. The RP's name and EU address go on the label, and a post box does not satisfy the requirement.

If you manufacture outside the EU, the entity that first places the product on the EU market becomes the RP by default at the moment of import. There is no opt-out. Alternatively an EU-established distributor can take the role, but only under a written mandate they explicitly accept — a verbal arrangement does not transfer the liability.

One detail that still catches brands out: since 1 January 2021 a UK-established entity no longer qualifies as an EU Responsible Person. A brand that set this up before Brexit and has not revisited it may be non-compliant without having changed anything.

The PIF is the dossier that proves the product is what you say it is and is safe to use. It must be kept accessible to the competent authority at the RP's address for ten years after the last batch was placed on the market — not ten years after launch, and not for as long as you happen to keep selling it.

It contains a description of the product, the Cosmetic Product Safety Report, a description of the manufacturing method and a statement of GMP compliance, evidence for the effects claimed where the nature of the claim justifies it, and data on any animal testing carried out by the manufacturer or its suppliers.

Most of the manufacturing-side content comes from your factory: formula and raw material specifications, batch documentation, stability and challenge data, GMP statement. Most of the assessment-side content comes from a safety assessor. Agreeing who supplies which part, in writing, at quotation stage, is the single most useful thing a brand can do here.

The CPSR sits inside the PIF and has two parts. Part A assembles the safety information: composition, physico-chemical characteristics, microbiological quality, impurities, packaging material, exposure, toxicological profile of the substances. Part B is the assessment itself — the reasoned conclusion, signed by a qualified safety assessor.

The assessor must hold a recognised qualification in pharmacy, medicine, toxicology or a similar discipline. This is not a document a brand or a factory writes for itself; it is an independent professional judgement, and that independence is precisely what gives it value in an inspection.

Budget for it per formula rather than per range. Variants that differ only by fragrance are usually assessed together, but that is the assessor's call, not an assumption you can make in a spreadsheet.

Before the product reaches a shelf, the Responsible Person notifies it through the Cosmetic Products Notification Portal. The notification carries the product category and name, the RP's EU contact details, the country of origin for imported products, the frame formulation, and specific data where CMR substances or nanomaterials are involved.

The frame formulation exists so that poison centres can respond to an incident without the full formula being published. It is a real obligation, not a formality, and it is the step that converts a compliant file into a product that may legally be sold.

There is no grace period. Notification precedes placing on the market, which means it precedes the first sale rather than the first shipment.

The manufacturer supplies the technical substance: formula and raw material documentation, GMP statement and certification scope, stability and challenge test data, batch records, packaging specifications. A factory that works with EU customers routinely will have this assembled before you ask; one that does not will treat each request as a project.

The safety assessor writes the CPSR. The Responsible Person holds the PIF, files the CPNP notification and carries the legal liability. The brand decides which claims it wants to make, and pays for the substantiation when the claim goes beyond what the formula obviously does.

If you are importing into the EU and none of these roles is formally assigned, the default answer is that they have all landed on you.

Compliance is not a step at the end. The safety assessment needs the final formula, the stability and challenge data, and the packaging specification — which means it starts after testing completes, and testing starts after the sample is approved.

A workable sequence: approve the sample, fix the formula, run stability and challenge testing in parallel, commission the CPSR as the data lands, appoint the RP while that is in progress, notify through CPNP, then ship. Compressed hard, that is still a couple of months between an approved sample and a legal first sale in the EU.

Brands that plan it this way launch on the date they announced. Brands that treat compliance as paperwork at the end explain to a retailer why the goods in the warehouse cannot be invoiced.