CPSR: the cosmetic product safety report you need before selling in the EU

A CPSR, the cosmetic product safety report, is the document that shows a cosmetic is safe to use. The EU Cosmetics Regulation, Regulation (EC) No 1223/2009Regulation (EC) No 1223/2009, Cosmetic Products RegulationThe whole regulationClick opens the law on the EU Publications Office., requires one for every cosmetic product before it is placed on the EU market (Art. 10(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 1Click opens the article on EUR-Lex.).

What a CPSR is

The CPSR is the safety report set out in Annex I of the Cosmetics Regulation. It exists “in order to demonstrate that a cosmetic product complies with Article 3” (Art. 10(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 1Click opens the article on EUR-Lex.): that the product is safe for human health under normal or reasonably foreseeable conditions of use (Art. 3Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 3Click opens the article on EUR-Lex.). Annex I lists what it contains “as a minimum”, in two parts:

• Part A, the safety information. The data: what is in the product, how stable and clean it is, how people use it, and how much of each substance reaches them.
• Part B, the safety assessment. A qualified assessor’s reasoning from that data to a signed conclusion.

“Part A aims to gather all the data necessary for the safety assessment of the product, while Part B sets out the reasoning, starting from the data, for drawing conclusions as to the safety of the product” (point 2 of the Commission’s guidelines). Those guidelines, adopted as Commission Implementing Decision 2013/674/EU, explain each heading. They help you comply; the binding text is Annex I itself.

The report may refer to other documents. Under each heading it may be enough to give “a clear reference to a document containing the information and readily available in electronic or printed format” (point 1 of the guidelines). It should keep the headings of Annex I, so an authority can find each part.

Part A holds the safety information

Each of the ten headings of Part A, with what the guidelines expect under it:

Data may come from “any reliable source”: suppliers, the scientific literature, experience with similar products, studies on the product or its substances, or computer models (point 3 of the guidelines). Where a heading does not apply to your product, Part A says why, and the assessor confirms that reason in Part B (point 3).

Stability decides your date. The stability study is used to set the date of minimum durability and the period after opening (point 3.2 of the guidelines). A product that keeps for more than 30 months needs no date on the label; it shows the period after opening instead, except where durability after opening is not relevant (Art. 19(1)(c)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 19, paragraph 1, point (c)Click opens the article on EUR-Lex.).

Microbiology depends on the product. The guidelines sort products into three groups (point 3.3.2):

Packaging counts. The container in direct contact with the product is assessed for what could migrate into it. A material made for food packaging has often been tested already, and more testing may not be needed; new or novel packaging may need more (point 3.4.3 of the guidelines).

The margin of safety is worked out per substance

Part A asks that “the systemic effects and margin of safety (MoS) based on a no observed adverse effects level (NOAEL) shall be calculated”, and that their absence “be duly justified” (Annex I, Part A, point 8).

The margin of safety is the ratio between the substance’s NOAEL and its systemic exposure dose: how much of it gets into the body from normal use (point 3.8.3 of the guidelines). The rules of thumb the guidelines give:

• At least 100. “It is generally accepted that the margin of safety should be at least 100 to declare a substance safe for use in a finished product” (point 3.8.4).
• 100% absorption unless shown otherwise. With no measured dermal absorption, a worst case of 100% is used. Where the molecular weight is over 500 Da and log Pow is below -1 or above 4, 10% can be considered (point 3.8.3).
• A NOAEL from repeated-dose studies. A margin worked out from single-dose LD50 data alone “cannot be used to justify safe use” (point 3.8.4).
• Leaving it out needs a reason. For example, a substance at a level whose worst-case exposure is below the threshold of toxicological concern (point 3.8.4).

Where the Scientific Committee on Consumer Safety has published an opinion on an ingredient, the NOAEL used in that opinion should be used (point 3.8.7 of the guidelines).

Part B is the assessor’s conclusion and signature

Part B has four headings (Annex I, Part B):

1. Assessment conclusion. A statement on the product’s safety under Art. 3Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 3Click opens the article on EUR-Lex.. The conclusion says whether the product is safe, safe with restrictions, or not safe (point 4.1 of the guidelines).
2. Label warnings and instructions for use. Which warnings must go on the label under Art. 19(1)(d)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 19, paragraph 1, point (d)Click opens the article on EUR-Lex., at least those the Annexes III to VI require.
3. Reasoning. How the data of Part A lead to the conclusion, with the margins of safety discussed where relevant, interactions between substances, and the effect of stability. A product for children under three, or one only for external intimate hygiene, gets its own specific assessment.
4. The assessor’s credentials. Name and address, proof of qualification, date and signature. An electronic release is acceptable where it clearly ties the assessor, the formula and the date together (point 4.4 of the guidelines).

“If the product has been assessed as not safe, it cannot be considered to comply with Regulation (EC) No 1223/2009Regulation (EC) No 1223/2009, Cosmetic Products RegulationThe whole regulationClick opens the law on the EU Publications Office. and therefore is not to be placed on the market” (point 4.1 of the guidelines).

Who may sign the safety assessment

Part B is carried out by “a person in possession of a diploma or other evidence of formal qualifications awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State” (Art. 10(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 2Click opens the article on EUR-Lex.).

• Art. 10(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 2Click opens the article on EUR-Lex. sets no residence condition. A person qualified in a third country may act where an EU country recognises the course as equivalent (point 4.4 of the guidelines).
• The proof is a copy of the diploma and, where needed, the proof of equivalence (point 4.4).
• Only the qualified assessor carries out Part B. The guidelines are not meant to replace that person’s expertise (recital 5 of Implementing Decision 2013/674/EU).

A supplier’s data sheet is not a CPSR

Sellers often hold a document from the factory or an ingredient supplier and are told it is not enough. Supplier data feeds Part A; the guidelines name it as a source of data, together with the classification of a substance under the CLP Regulation (points 3 and 3.8.7). A safety data sheet for a raw material, a certificate of analysis or a specification is that kind of data. None of them is the report: the report covers the finished product and needs a signed Part B (Annex I, Part B, point 4).

Two supplier documents matter most:

• The fragrance. The report names the fragrance’s name, code number and supplier (Annex I, Part A, point 1). The amounts of regulated substances in it, such as the listed fragrance allergens, are disclosed to the responsible person and the assessor (point 3.1 of the guidelines). Where the composition is confidential, the fragrance supplier may give a safety assessment of the fragrance itself (point 4.3.1).
• The manufacturer. Where the responsible person is not the manufacturer, it needs access to the skills to obtain reliable data, and may need the manufacturer, the raw material suppliers and other experts as well as the assessor (point 1 of the guidelines).

The CPSR sits inside the product information file

The CPSR is one of five parts of the product information file (PIF), which the responsible person keeps for each product once it is placed on the market (Art. 11(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 1Click opens the article on EUR-Lex., Art. 11(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 2Click opens the article on EUR-Lex.):

• a description that ties the file clearly to the product;
• the cosmetic product safety report;
• the method of manufacture and a statement of compliance with good manufacturing practice;
• proof of the effect claimed, where the nature or effect of the product justifies it;
• data on any animal testing for the product or its ingredients, including tests done for countries outside the EU.

The file is kept for ten years following the date the last batch was placed on the market (Art. 11(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 1Click opens the article on EUR-Lex.). It is readily accessible, electronically or otherwise, at the responsible person’s address on the label, to the authority of the EU country where it is kept, in a language that authority easily understands (Art. 11(3)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 3Click opens the article on EUR-Lex.). The guidelines call the CPSR the most important part of the file from a safety point of view (point 1).

Every cosmetic product has three things, and sellers meet the names at once: a responsible person, a PIF and a CPSR (Art. 4(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 1Click opens the article on EUR-Lex., Art. 10(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 1Click opens the article on EUR-Lex., Art. 11(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 1Click opens the article on EUR-Lex.). They nest. The responsible person keeps the PIF, and the PIF holds the CPSR. The fourth step, the notification, is a separate online filing in the CPNP that gives the address where the file is kept (Art. 13(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 13, paragraph 1Click opens the article on EUR-Lex., point (b)).

The EU responsible person holds the CPSR

“Only cosmetic products for which a legal or natural person is designated within the Community as ‘responsible person’ shall be placed on the market” (Art. 4(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 1Click opens the article on EUR-Lex.). That person ensures the safety assessment and the report are done before the product is placed on the market (Art. 5(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 5, paragraph 1Click opens the article on EUR-Lex., Art. 10(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 1Click opens the article on EUR-Lex.).

A private-label brand outside the EU that has a product made and markets it under its own name or trademark is its manufacturer (Art. 2(1)(d)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 2, paragraph 1, point (d)Click opens the article on EUR-Lex.). It still needs a responsible person designated in the EU (Art. 4(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 1Click opens the article on EUR-Lex.).

An importer is a person “established within the Community” (Art. 2(1)(i)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 2, paragraph 1, point (i)Click opens the article on EUR-Lex.). Translating a label does not make a distributor the responsible person (Art. 4(6)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 6Click opens the article on EUR-Lex.). How the cosmetics role compares with the EU representatives other laws require is in EU responsible person vs authorised representative.

On a reasoned request, the responsible person gives the authority the documents that show the product conforms, in a language it easily understands (Art. 5(3)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 5, paragraph 3Click opens the article on EUR-Lex.). A reseller of a product someone else placed on the market checks the label items, not the report (Art. 6(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 6, paragraph 2Click opens the article on EUR-Lex.).

What a brand outside the EU arranges

A business outside the EU that ships to EU buyers itself has no EU importer behind it, and the product still needs a responsible person in the EU (Art. 4(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 1Click opens the article on EUR-Lex.). In practice, the brand:

1. Contracts an EU company that accepts the role of responsible person in writing. Its name and address go on the container and the packaging (Art. 19(1)(a)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 19, paragraph 1, point (a)Click opens the article on EUR-Lex.).
2. Sends it, or its assessor, the Part A data: the full formula with percentages, raw material specifications and safety data sheets, the fragrance supplier’s documents, stability, challenge and microbiological test results, packaging information, the label artwork, and the claims and the evidence for them.
3. Sends the manufacturing description and the statement of good manufacturing practice (Art. 11(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 2Click opens the article on EUR-Lex., point (c)). Manufacture in line with a harmonised standard published in the Official Journal is presumed to be good manufacturing practice (Art. 8(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 8, paragraph 2Click opens the article on EUR-Lex.).
4. Has a qualified assessor sign Part B, whether the responsible person’s own assessor or one the brand hires.
5. Lets the responsible person keep the whole file at its EU address before the first sale (Art. 11(3)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11, paragraph 3Click opens the article on EUR-Lex.), and tells it about every change to the formula, the supplier or the label.

The product formula, raw material by raw material, reaches the responsible person: the file it keeps holds the quantitative composition (Annex I, Part A, point 1; point 3.1 of the guidelines). A fragrance’s own composition can stay confidential, apart from its regulated substances (points 3.1 and 4.3.1 of the guidelines).

When the CPSR must be updated

The responsible person keeps the report “up to date in view of additional relevant information generated subsequent to placing the product on the market” (Art. 10(1)(c)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 1, point (c)Click opens the article on EUR-Lex.). The guidelines name when the assessment is reviewed and, if necessary, updated (point 4.3.2):

• new scientific findings or toxicological data on a substance;
• a change in the formula or in a raw material’s specification;
• a change in the conditions of use;
• a rising trend in the nature, severity or frequency of undesirable effects;
• a change in the law, such as a new restriction on one of the substances.

The 2023 extension of the fragrance allergen list is such a change in the law. Its effect on labels and reports is in EU fragrance allergens.

The UK keeps the same report under its own Cosmetics Regulation

Great Britain applies its own version of Regulation (EC) No 1223/2009Regulation (EC) No 1223/2009, Cosmetic Products RegulationThe whole regulationClick opens the law on the EU Publications Office., as amended by the Product Safety and Metrology etc. (Amendment etc.) (EU Exit) Regulations 2019 (GOV.UK guidance). The safety report is the same:

• The same Annex I. The UK Annex I has the same Parts A and B, heading for heading.
• A UK responsible person. “A cosmetic product may not be placed on the market unless there is a responsible person established in the United Kingdom” (UK Article 4(1)). GOV.UK adds that a UK established address does not include mail forwarding or PO box addresses.
• The assessor. The same university qualification, or a course recognised as equivalent by the Secretary of State (UK Article 10(2)).
• The file in English. The PIF is kept at the address notified for it and “must be in English” (UK Article 11(3) and (4)).
• Notification to OPSS. The responsible person notifies the Office for Product Safety and Standards before the product is made available in Great Britain (GOV.UK guidance).

Selling in the EU and Great Britain, you need a responsible person established in each, and each keeps the file at its own address. For Northern Ireland, the GOV.UK guidance says the responsible person must be established in Northern Ireland or the EU.

Who owes what

What happens if you sell without a CPSR

A product placed on the market without a safety assessment breaks Art. 10Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10Click opens the article on EUR-Lex., and a file without the report breaks Art. 11Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 11Click opens the article on EUR-Lex.. For either, the authority requires the responsible person to bring the product into conformity, withdraw it or recall it, within a time limit it sets (Art. 25(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 25, paragraph 1Click opens the article on EUR-Lex., points (b) and (c)). A distributor that breaks its own duties faces the same measures (Art. 26Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 26Click opens the article on EUR-Lex.). Each EU country sets the penalties, which must be effective, proportionate and dissuasive (Art. 37Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 37Click opens the article on EUR-Lex.). No responsible person in the EU, and the product may not be placed on the market at all (Art. 4(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 1Click opens the article on EUR-Lex.).

What is agreed but not yet law

On 8 July 2025 the Commission proposed deleting the separate six-month nanomaterial notification of Art. 16(3)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 16, paragraph 3Click opens the article on EUR-Lex. and moving that nanomaterial information into the safety report instead (recital 23 and points (3) and (7) of the article amending the Cosmetics Regulation in COM(2025) 531). Parliament and Council negotiators reached a political agreement on 16 June 2026. It still awaits the legal-linguistic revision, formal adoption and publication in the Official Journal, and it reinstated notification for nanomaterials in cosmetics, which the proposal would have deleted (European Parliament Legislative Train). It is not law: the consolidated text of 18 May 2026 still contains Art. 16(3)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 16, paragraph 3Click opens the article on EUR-Lex., and Annex I applies as it stands.

What the law leaves open

• One report for a range of shades or scents. Art. 10(1)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 1Click opens the article on EUR-Lex. speaks of “a cosmetic product”, and the guidelines ask for an assessment “on a case-by-case basis for each individual cosmetic product” (point 4.3). Neither says whether variants that differ only in colorant or fragrance share one report. Meanwhile: each formula has its own composition under Part A, point 1, so the report covers each formula by name.
• Who signs the mandate when the brand is outside the EU. Art. 4(5)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 5Click opens the article on EUR-Lex. gives the mandate to an EU importer; it does not name a mandate from a brand outside the EU that sells straight to EU buyers. Meanwhile: the EU company that takes the role accepts it in writing, as every designated responsible person does under Art. 4(3)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 3Click opens the article on EUR-Lex.-(5)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 4, paragraph 5Click opens the article on EUR-Lex., and its name is on the label.
• A UK-qualified assessor for an EU report. The guidelines date from 2013, when the UK was in the EU. They accept a third-country qualification where an EU country recognises the course as equivalent (point 4.4). Neither Art. 10(2)Regulation (EC) No 1223/2009, Cosmetic Products RegulationArticle 10, paragraph 2Click opens the article on EUR-Lex. nor the guidelines name UK degrees. Meanwhile: where the assessor’s degree is from outside the EU, keep the proof of equivalence in Part B.
• How often to review without a trigger. The guidelines say the finished product “should be reassessed regularly” (point 4.3.2) and give no interval.

What you can skip