EU Cosmetics Regulation: how to sell skincare legally in the EU

How the EU system works

Regulation (EC) No 1223/2009 applies directly in all 27 member states. There is no pre-market approval: nobody at the European Commission checks your formula before you sell. Instead the law makes one company, the Responsible Person, answerable for every product, and requires a written safety case and a notification before the first sale. National authorities (for example ANSM in France, BVL and the German states, HPRA in Ireland) check products already on the market.

Terms used below:

• Placing on the market: the first time a product is made available in the EU, for example when your importer releases the first pallet.
• Making available: any later supply, such as a retailer selling stock. Many ingredient changes have two dates: one for placing, one for making available.
• CMR substance: a substance classified as carcinogenic, mutagenic or toxic for reproduction under the CLP Regulation (EC) No 1272/2008. Article 15 bans them in cosmetics, with narrow exceptions.
• SCCS: the Scientific Committee on Consumer Safety, whose opinions are behind most ingredient limits.

The Responsible Person (Articles 4 and 5)

Article 4 says only cosmetics with a legal or natural person designated within the EU as Responsible Person may be placed on the market. Who that is depends on the route:

Under Article 5 the RP ensures compliance with the safety, GMP, safety assessment, PIF, notification, ingredient, animal testing, labeling, claims and adverse effect articles. If the RP has reason to believe a product is not compliant, it must take corrective action at once, withdraw or recall it, and, where there is a risk to health, tell the authorities of each member state where it was sold. Distributors (Article 6) must check the label, language and date marking before they sell and must not supply products they believe are non-compliant.

A brand outside the EU usually hires a professional RP service. Its name and address then go on every label, and it holds your PIF.

Step by step: from formula to legal EU sale

The steps follow a niacinamide serum made in Korea and sold online to consumers in Germany, France and Ireland.

1. Appoint the Responsible Person

   Sign a written mandate with an EU-established RP before artwork is final, because the RP's name and address go on the label.

2. Check the formula against Annexes II to VI

   Search each ingredient in CosIng, the Commission's ingredient database, and check the amended annex entries, including changes not yet in force on your launch date. Check that every colorant, preservative and UV filter is on a positive list (Annexes IV, V, VI).

3. Collect the safety data

   Formula with percentages, raw material specifications and safety data, stability and compatibility results, challenge test, microbiology, impurity data (for example heavy metals), and the packaging specification. If a new stability study is needed, an accelerated study typically runs about 3 months.

4. Get the CPSR

   A qualified safety assessor writes Part A from the data and signs Part B, the conclusion. Ask the assessor for a timeline; it depends on how complete the data is.

5. Approve the EU label

   Article 19 items, the local language for each country, and the fragrance allergens required under Regulation (EU) 2023/1545.

6. Build the PIF

   The RP assembles the CPSR, product description, GMP statement, proof of claimed effects and animal testing data in a file held at its EU address.

7. Notify in CPNP

   The RP notifies before the first unit is placed on the market, and uploads the label and a pack photo once the product is placed. If the serum contains a nanomaterial not covered by an annex entry, the separate nano notification is due 6 months before.

8. Import and sell

   Customs clearance, import VAT and duty are handled by your importer or customs broker. Then keep the file current, log complaints and report serious undesirable effects.

Safety assessment and the CPSR (Article 10, Annex I)

Before placing a product on the market, the RP must ensure it has undergone a safety assessment and that a CPSR exists in the format of Annex I. The assessment must consider the intended use and the systemic exposure to each ingredient, use a weight-of-evidence approach, and be kept up to date as new information arrives.

Who may sign. Article 10(2) requires a person with a university diploma in pharmacy, toxicology, medicine or a similar discipline, or a course a member state recognizes as equivalent. Non-clinical safety studies done after 30 June 1988 must follow good laboratory practice rules.

A CPSR is written for one formula. Two sizes of the same serum share one CPSR; a new fragrance or a changed preservative needs a review. Our product testing guide covers the stability, challenge and skin tests the assessor will ask for.

The Product Information File (Article 11)

The RP keeps a PIF for each product from the day it is placed on the market until 10 years after the last batch was placed. It contains:

• a description of the product that clearly links the file to it;
• the CPSR;
• a description of the manufacturing method and a statement of GMP compliance;
• proof of the effect claimed, where the nature or effect of the product justifies it (for example a "reduces the look of wrinkles in 4 weeks" claim needs study data);
• data on any animal testing done by the manufacturer, its agents or suppliers for the product or its ingredients, including tests done for other countries' rules.

The PIF must be readily accessible, electronically or otherwise, at the RP's address on the label, in a language the authority of that member state can easily understand (English is accepted by many authorities; check with the RP).

CPNP notification (Article 13)

Before placing the product on the market, the RP submits electronically through the CPNP:

• the product category and name;
• the RP's name and the address where the PIF is kept;
• the country of origin for imports;
• the member state where it is first placed on the market;
• a contact person for emergencies;
• any nanomaterials, with their identity and exposure conditions;
• the name and CAS or EC number of any CMR substance of category 1A or 1B;
• the frame formulation, used by poison centers for medical treatment.

Once the product is placed, the RP also uploads the original label and, where legible, a photo of the packaging. CPNP notification is free and one notification covers every member state. A distributor that translates the label on its own initiative for another country files its own distributor notification. The CPNP number is not printed on the label. More on the number in what a CPNP number is.

Good manufacturing practice (Article 8)

Manufacture must follow good manufacturing practice (GMP). Compliance is presumed when production follows the relevant harmonized standard published in the Official Journal, which is EN ISO 22716. The PIF needs a statement of GMP compliance, so ask your manufacturer for its ISO 22716 certificate. KoreanOEM products are made at an ISO 22716 certified facility, and we send a copy of the certificate.

Annexes II to VI explained

The positive lists matter most for Korean formulas: a preservative or UV filter allowed in Korea but not in Annex V or VI cannot be used in the EU. The annexes are amended several times a year, so check the consolidated text and CosIng on the day you finalize a formula.

Ingredient changes 2024 to 2027

These acts amend the annexes. Dates are taken from the Official Journal texts.

Coming next, not yet law as of October 2026. A further CMR omnibus (often called Omnibus IX) was notified to the WTO in July 2026 and is reported to apply from 1 February 2027; check the final text. Separately, the Council and Parliament reached a provisional agreement on 16 June 2026 on the "chemicals omnibus" simplification, which changes how quickly products with newly banned CMR substances must leave the market (reported as 6 months for placing and 12 months for making available) and keeps the prior nanomaterial notification. It still needs formal adoption and publication.

Fragrance allergens: Regulation (EU) 2023/1545

Fragrance allergens must be named in the ingredient list when their concentration is above 0.001% in leave-on products or 0.01% in rinse-off products. Regulation (EU) 2023/1545 expands the list from the 24 historic entries to about 80, including groups that are named under a single group name. Ireland's HPRA summarizes the RP's duties:

• Products placed on the market from 31 July 2026 must comply.
• Products placed before 31 July 2026 need updated labels and an updated PIF and CPSR by 31 July 2028.
• The RP should review every formula and give distributors notice to clear old stock before the deadline.

Ask your fragrance supplier for an allergen declaration under the new list, or choose a fragrance-free formula. Canada has adopted the same EU list by reference, with its own dates, so one compliant ingredient list can serve both markets (see our Canada guide).

Nanomaterials (Article 16)

A nanomaterial is an insoluble or biopersistent, intentionally made material with one or more external dimensions, or an internal structure, of 1 to 100 nm. Three rules apply:

• Separate notification 6 months before placing. A product containing a nanomaterial must be notified through the CPNP nano module 6 months before it is placed on the market, unless the nanomaterial is a colorant, preservative or UV filter regulated in Annexes IV to VI, or it complies with an Annex III entry. The Commission can ask the SCCS for an opinion and then restrict or ban it.
• Normal notification too. Every nanomaterial is declared in the standard CPNP notification.
• Label. The ingredient name is followed by the word "nano" in brackets, for example "Titanium Dioxide (nano)".

Regulation (EU) 2024/858 shows what the Article 16 process produces: after SCCS opinions, several nano forms of metals and copolymers were banned and nano hydroxyapatite was limited to oral care. Ask your manufacturer whether any raw material, especially mineral UV filters and pigments, is in nano form.

Microplastics: Regulation (EU) 2023/2055

The REACH restriction on intentionally added microplastics (synthetic polymer microparticles) applies to cosmetics in stages. Microbeads used to exfoliate, polish or clean were banned when the restriction took effect on 17 October 2023. The other dates:

Many common film formers and texturizers (some acrylates copolymers, nylon powders, polyethylene) can count as microparticles depending on size and solubility. Ask your chemist for a polymer review now, so a reformulation lands before the rinse-off date.

Claims, animal testing and the medicine borderline

Claims. Article 20 bans text, names, trademarks or pictures that imply characteristics a product does not have. Regulation (EU) No 655/2013 sets six common criteria every claim must meet: legal compliance (no "approved by the authority" claims, no claims that a product is special for meeting legal minimums), truthfulness, evidential support, honesty, fairness, and informed decision-making. The Commission's technical document on claims adds guidance on "free from" and "hypoallergenic" claims. Our claims guide has worked examples.

Animal testing. Article 18 bans animal testing of finished products and ingredients to meet the regulation, and bans marketing products or ingredients tested on animals for that purpose; the full marketing ban has applied since 11 March 2013. Animal data generated for other laws (such as REACH) or for other countries is a complex area; the PIF must record any animal testing.

The medicine borderline. A product presented as treating or preventing disease, or that restores, corrects or modifies physiological functions by a pharmacological action, is a medicinal product under Directive 2001/83/EC, not a cosmetic. "Treats acne", "cures eczema" or "stops hair loss" move a product out of the Cosmetics Regulation. The Commission's borderline manual and national authorities decide hard cases. Sunscreens are cosmetics in the EU, with UV filters from Annex VI and efficacy labeling under Commission Recommendation 2006/647/EC; see the sunscreen regulation guide.

Labeling summary and languages

Article 19 requires, on the container and outer packaging: the RP's name and address, the country of origin for imports, the nominal content, the date of minimum durability (or the period after opening for products lasting more than 30 months), precautions, the batch number, the function, and the ingredient list (outer pack is enough for the list). Each member state decides the language for the content, durability, precautions and function, which in practice means German for Germany, French for France and so on. Full details, with symbols and small-pack exceptions, are in our label requirements by country and INCI, PAO and claims guide.

Post-market duties: SUEs, recalls, Safety Gate

• Serious undesirable effects (Article 23). A serious undesirable effect (SUE) is one that results in temporary or permanent functional incapacity, disability, hospitalization, congenital anomalies, an immediate vital risk or death. The RP and distributors notify the authority of the member state where it happened without delay, with the product name and any corrective measures. That authority passes it to the other member states.
• Corrective action (Article 5). When a product is non-compliant, the RP brings it into conformity, withdraws or recalls it, and informs authorities where there is a health risk.
• Authority action (Articles 25 to 27). National authorities can require corrective measures, withdrawal or recall, and can act against products that pose a serious risk even when they appear compliant.
• Safety Gate. The EU rapid alert system for dangerous non-food products publishes authority notifications, including cosmetics with banned substances or microbial contamination. A listing there is public and is used by marketplaces.
• Information on request (Article 21 and 24). The RP must make the qualitative and quantitative composition (for dangerous substances) and existing undesirable effect data easily accessible to the public, and answer authority requests about substances of concern.

Our recalls and adverse events guide gives a full incident plan.

What your RP does and what we provide

Frequently asked questions

Do I need an EU Responsible Person if I sell online from outside the EU?

Yes. Article 4 of Regulation (EC) No 1223/2009 allows a cosmetic on the EU market only if a person established in the EU is designated as Responsible Person, and that person's name and address must be on the label.

Who can sign a CPSR?

A safety assessor holding a university diploma in pharmacy, toxicology, medicine or a similar discipline, or a course a member state recognizes as equivalent, under Article 10(2). The assessor signs Part B, the safety conclusion.

How long must the PIF be kept?

For 10 years after the last batch of the product was placed on the market, at the Responsible Person's address shown on the label, in a language the national authority can easily understand.

Does one CPNP notification cover the whole EU?

Yes. The Responsible Person notifies once in the CPNP before placing the product on the market, and that notification covers every member state. It is free.

What is the EU retinol limit?

Regulation (EU) 2024/996 limits vitamin A to 0.05% retinol equivalent in body lotion and 0.3% in other leave-on and rinse-off products, with the warning "Contains Vitamin A. Consider your daily intake before use". Non-compliant products could not be placed on the market from 1 November 2025 and cannot be made available from 1 May 2027.

When do the new EU fragrance allergen labels apply?

Products placed on the market from 31 July 2026 must name the expanded list of about 80 allergens above 0.001% in leave-on or 0.01% in rinse-off products. Products placed earlier must be relabeled by 31 July 2028.

Is alpha-arbutin still allowed in the EU?

Yes, within limits: up to 2% in face cream and 0.5% in body lotion, with hydroquinone kept at unavoidable trace levels. Arbutin is limited to 7% in face cream and kojic acid to 1% in face and hand products.

When does the microplastics ban hit skincare?

Under Regulation (EU) 2023/2055, rinse-off cosmetics with intentionally added synthetic polymer microparticles cannot be placed on the market from 17 October 2027 and leave-on products from 17 October 2029. Exfoliating microbeads have been banned since 17 October 2023.

Can KoreanOEM handle EU compliance for me?

Through our partner we provide the CPSR and PIF (USD 1,250 per formula, UK notification included), CPNP notification (USD 420 per product) and a Responsible Person service (USD 335 per product per year for the UK and EU), plus the test data and documents from production.

Sources

• EUR-Lex: Regulation (EC) No 1223/2009 on cosmetic products (Articles 4, 5, 8, 10, 11, 13, 16, 18 to 23, Annex I)
• EUR-Lex: Regulation (EU) 2024/996 (vitamin A, arbutin, alpha-arbutin, kojic acid, genistein, daidzein, 4-MBC, triclosan, triclocarban)
• EUR-Lex: Regulation (EU) 2024/858 (nanomaterials)
• EUR-Lex: Regulation (EU) 2025/877 (Omnibus VII, CMR substances, from 1 September 2025) and HPRA: TPO added to the list of prohibited ingredients
• EUR-Lex: Regulation (EU) 2026/78 (Omnibus VIII, from 1 May 2026) and HPRA: Omnibus Act VIII summary
• EUR-Lex: Regulation (EU) 2023/1545 (fragrance allergens) and HPRA: Labelling of cosmetic fragrance allergens
• EUR-Lex: Regulation (EU) 2023/2055 (microplastics restriction) and European Commission: microplastics restriction overview
• EUR-Lex: Regulation (EU) No 655/2013 (common criteria for claims)
• European Commission: Nanomaterials in cosmetics and Cosmetic Products Notification Portal
• European Commission: CosIng ingredient database and Safety Gate alerts
• Fendler Salva: provisional agreement on the chemicals omnibus (June 2026) and MDSS: Omnibus IX notified to the WTO

Checked against these sources in October 2026. Rules and fees change; check with the authority or your importer before you sell.