EC Regulation 1223/2009 Compliance: The Safety Assessment Gaps That Block EU Market Entry

The rejection happens after months of preparation. A brand based in Australia, Canada, or the US has spent thousands developing a new serum line, arranged an EU Responsible Person, and submitted their CPNP notification — only to receive a market withdrawal notice from a national authority within weeks of launch.

Nine times out of ten, the problem isn’t the product. It’s the safety documentation.

EC Regulation No 1223/2009 is the cornerstone of the EU cosmetics framework, governing every cosmetic product placed on the market across all 27 Member States. Most international brands know this much. What they routinely underestimate is the precision the regulation demands — particularly inside the Cosmetic Product Safety Report (CPSR), where vague toxicological profiles and incomplete ingredient assessments can invalidate an otherwise sound product before it ever reaches a shelf.

Here’s what we see going wrong, consistently.

Part A vs. Part B: The Distinction That Breaks Most CPSRs

The CPSR has two distinct sections, and confusing their scope is the single most common structural error we encounter in non-EU submissions.

Part A is the informational backbone: quantitative composition, physical and chemical characteristics, microbiological quality, impurities, packaging material data, intended use, and exposure assessment. It’s essentially the dossier of documented facts. But “facts” here means traceable, validated facts — not label claims copied from a supplier spec sheet. Every concentration listed must match batch manufacturing records, and impurity data must come from validated analytical testing, not extrapolated estimates from generic literature.

Part B is where the qualified safety assessor — who must hold at minimum a degree in pharmacy, medicine, toxicology, or a related discipline under Article 10 — interprets Part A and renders a professional judgment. The assessor evaluates each ingredient’s toxicological profile: acute toxicity, irritation, sensitisation, sub-chronic and chronic toxicity, mutagenicity and genotoxicity, reproductive toxicity, and carcinogenicity where relevant data exist. For most established ingredients, SCCS opinions and peer-reviewed literature cover this ground adequately. For novel actives or proprietary complexes, however, the burden of generating original safety data falls squarely on the applicant.

A CPSR where Part B says nothing more than “all ingredients are permitted per Annexes II through VI” is not a safety assessment. It’s a checklist. DGCCRF inspectors in France can and do distinguish between the two during market surveillance — and a checklist will not satisfy them.

Four Annex-Related Gaps That Trigger Withdrawal Actions

Annex II of Regulation 1223/2009 lists over 1,600 prohibited substances. Annex III covers approximately 250 restricted substances, each with specific conditions on maximum concentration, product type, and rinse-off versus leave-on application. Annexes IV, V, and VI enumerate permitted colorants, preservatives, and UV filters respectively — with tight purity specifications and, in several cases, molar concentration limits that differ from US FDA thresholds.

The gaps we see most often:

1. Annex III conditions applied incorrectly by product type. Formaldehyde-releasing preservatives are permitted up to 0.2% (expressed as free formaldehyde) in rinse-off products, but only 0.1% in nail hardeners, and the maximum in leave-on products is subject to additional SCCS guidance. A brand migrating a formula developed under FDA’s broader permissiveness will sometimes apply the rinse-off limit to a leave-on product without recognising the EU distinction. RAPEX notifications for preservative violations in leave-on formulations remain among the top five recurring cosmetic infractions year over year across Member States.

2. Fragrance allergen labelling thresholds missed. Commission Regulation (EU) 2023/1545, which entered into force in late 2023, added 56 additional fragrance substances to the mandatory on-label disclosure list. The new threshold is 0.001% in leave-on products and 0.01% in rinse-off products — unchanged from the original 26 listed allergens, but now applied to a significantly wider ingredient set. Brands using complex fragrance blends with opaque supplier compositions — listed only as “parfum” on the INCI — frequently miss undisclosed allergen thresholds. The safety assessor has an explicit obligation to verify allergen content against the fragrance manufacturer’s full compositional data, not just the consumer-facing INCI declaration.

3. Nanomaterial notification not submitted separately. Article 16 of Regulation 1223/2009 requires a dedicated CPNP notification for any ingredient used in nanomaterial form, submitted at least 6 months before placing the product on the EU market. The Commission’s nanomaterial definition — particles with one or more external dimensions in the 1–100 nm size range — captures titanium dioxide, zinc oxide, and certain silica grades used in sunscreens and anti-aging serums. We regularly see brands complete a product-level CPNP notification without realising their UV filter is supplied in nano form, a fact buried in the supplier’s technical data sheet rather than the INCI name.

4. Raw material impurities not addressed in Part A. SCCS guidance (SCCS/1602/18 and subsequent Notes of Guidance for the Testing of Cosmetic Ingredients and Their Safety Evaluation) is explicit: the safety assessment must account for technically unavoidable trace impurities — heavy metals, pesticide residues, polycyclic aromatic hydrocarbons in mineral-origin ingredients — that arrive with raw materials. Presenting a supplier COA showing “below detection limit” for lead, without specifying the method’s detection limit or citing an ICP-MS protocol, does not meet the documentation standard. The assessor must work with quantified impurity data, not absence-of-evidence statements.

Your Product Information File: A Ten-Year Obligation That Starts at Launch

The PIF is not submitted to any regulatory authority — it’s held by the Responsible Person and produced to national competent authorities on request, sometimes with as little as 24 hours’ notice during an active surveillance action. Under Article 11 of Regulation 1223/2009, it must be retained for 10 years after the date on which the last batch of that product was placed on the EU market.

A compliant PIF contains: a product description sufficient to link it to the CPSR, the full CPSR itself, a manufacturing method description with a GMP conformity statement (ISO 22716 is the accepted standard), proof of efficacy for any specific claims made in marketing materials, and — critically — data on any animal testing conducted anywhere in the supply chain.

That last requirement catches exporters outside the EU. If a raw material supplier in China or South Korea conducted animal testing on an ingredient in your formula — even tests mandated under domestic law — that fact must be disclosed in the PIF. The EU’s marketing ban on products tested on animals (Article 18) applies regardless of where in the world the testing occurred or who commissioned it. This is not a hypothetical enforcement risk: it has been cited in actual withdrawal proceedings involving Asian-sourced ingredients.

For brands targeting the French market specifically, there’s an additional layer of scrutiny. DGCCRF runs an annual inspection programme for cosmetics that covers both brick-and-mortar retail and e-commerce. In 2023, the agency identified non-compliance in approximately 15% of cosmetic products inspected, with labelling deficiencies and missing or inadequate PIFs accounting for the largest share of findings. French distributors increasingly require sight of the PIF — or at minimum a summary declaration from the RP — before listing a new SKU.

Serious Undesirable Effects: The Reporting Chain Most Brands Haven’t Built

Article 23 of Regulation 1223/2009 requires that the Responsible Person or a distributor, upon becoming aware of a serious undesirable effect (SUE) — defined as an adverse reaction leading to hospitalisation, causing persistent incapacity, or resulting in death — notify the competent authority of the Member State where the effect occurred, without undue delay. In practice, most Member State guidance interprets “without undue delay” as within 3 working days for life-threatening events.

The RP must log all undesirable effects, not just serious ones, and keep the log accessible within the PIF.

Brands without a functioning post-market surveillance process — a mechanism that collects consumer adverse event reports, triages them against the SUE definition, and escalates confirmed cases to the RP — are exposed to Article 23 violations even when the product itself is fine. We’ve worked with non-EU brands operating with Responsible Persons who are essentially EU address services, with no actual feedback loop connecting consumer complaints back to the RP’s monitoring function. That arrangement satisfies the letter of Article 4, perhaps, but not the intent — and national authorities across France, Germany, and the Netherlands are increasingly scrutinising RP arrangements for operational substance, not just legal form.

One Step to Take Before Your Next CPNP Submission

Before your safety assessor finalises Part B, run a targeted Annex III screen against your complete formulation — including every component of fragrance blends (not just the INCI “parfum” entry) and every impurity profile from raw material testing. If your formula contains any particulate active — zinc oxide, titanium dioxide, silica — and you don’t have a particle size distribution report from the supplier, request one before the CPSR is signed.

That single step catches two of the four common gaps in one pass: the nanomaterial notification exposure and the impurity documentation gap.

The EU cosmetics framework genuinely rewards methodical preparation. The CPSR is a scientific document, not a form to fill in. Brands that approach it that way arrive on the EU market with clean documentation, confident Responsible Persons, and much less to explain to DGCCRF.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• Analytical Testing to Support Your EU Cosmetic Safety Assessment — Qalitex Laboratories provides ISO 17025-accredited testing for heavy metals, preservatives, fragrance allergens, and contaminant profiling to support CPSR Part A documentation.
• Cosmetic and NHP Regulatory Testing for Canadian Market Entry — If your product requires Health Canada NHP classification alongside EU registration, Androxa offers bilingual regulatory support and accredited lab analysis.