EU Cosmetics Regulation 1223/2009: Complete Guide for Brands

If you sell — or plan to sell — cosmetics in the European Union, EU Regulation 1223/2009 is the single most important document you need to understand. It governs every cosmetic product placed on the EU market: what ingredients are permitted, what safety assessments are required, how products must be labeled, and who bears legal responsibility for compliance. This guide breaks down the regulation’s core requirements in plain language, with specific attention to what non-EU brands need to do to enter the market.

---

What Is EU Regulation 1223/2009?

EU Regulation (EC) No 1223/2009 on cosmetic products entered into force on 11 July 2013, replacing the previous Cosmetics Directive 76/768/EEC. It applies uniformly across all EU member states — meaning there is no separate French, German, or Italian cosmetics law. One regulation governs the entire single market.

The regulation defines a cosmetic product as “any substance or mixture intended to be placed in contact with the external parts of the human body (epidermis, hair system, nails, lips and external genital organs) or with the teeth and the mucous membranes of the oral cavity with a view exclusively or mainly to cleaning them, perfuming them, changing their appearance, protecting them, keeping them in good condition or correcting body odours.”

This covers: skincare, haircare, makeup, perfume, deodorants, toothpaste, shampoo, nail products, sunscreens, and baby cosmetics — among others.

Expert note: “One of the most common mistakes we see from North American brands entering the EU market is assuming that FDA compliance translates to EU compliance. The two frameworks are fundamentally different — the EU requires a pre-market safety assessment and product file, while the FDA operates largely on post-market enforcement.” — Nour Abochama, Quality & Regulatory Advisor, Care Europe

---

The Five Core Requirements

1. Cosmetic Product Safety Report (CPSR)

Before any cosmetic product can be placed on the EU market, it must have a Cosmetic Product Safety Report (CPSR) — a formal safety assessment prepared and signed by a qualified cosmetic safety assessor.

The CPSR has two parts:

• Part A — Safety Information: Full ingredient list with concentrations, physicochemical properties, microbiological quality, impurities, packaging material safety, and normal/reasonably foreseeable use
• Part B — Safety Assessment: The assessor’s professional conclusion on safety, exposure assessment, risk characterization, and reasoning

The safety assessor must hold a degree in pharmacy, toxicology, medicine, or a related discipline. This is not a document you can write yourself — it requires a qualified professional.

Care Europe provides CPSR preparation and safety assessor services for brands entering the EU market. Request a CPSR assessment →

2. Product Information File (PIF)

Every cosmetic product must have a Product Information File (PIF) kept at the address of the Responsible Person (see below). The PIF must contain:

• Product description
• CPSR
• Description of the manufacturing method and GMP compliance statement
• Evidence of the claimed effect (if any claims are made)
• Data on animal testing (if applicable)

The PIF must be accessible to competent authorities for 10 years after the last batch of the product was placed on the market.

3. Responsible Person (RP)

Every cosmetic product on the EU market must have a designated Responsible Person — a legal entity established within the EU that takes legal responsibility for the product’s compliance.

• For EU-based manufacturers: the manufacturer is typically the RP
• For non-EU brands importing into the EU: the importer is the RP, OR the manufacturer can designate an EU-based entity as RP by written mandate

This is a critical requirement for US, Canadian, and other non-EU brands. You cannot sell directly into the EU without either establishing a legal entity there or appointing an EU-based RP. Care Europe provides Responsible Person services for non-EU brands.

4. CPNP Notification

Before placing a cosmetic on the EU market, the Responsible Person must submit a notification through the Cosmetic Products Notification Portal (CPNP) — the EU’s online notification system.

The CPNP notification includes:

• Product category and name
• Country of first placement on the market
• Responsible Person details
• Frame formulation or full ingredient list
• Original labeling and photo of packaging
• Presence of nanomaterials, CMR substances, or substances with endocrine disrupting properties

CPNP notifications are free to submit but require an EU login and accurate product data. Errors in the notification can result in enforcement action.

5. Labeling Requirements

EU cosmetics labeling is strictly regulated. Required label elements include:

• Name and address of the Responsible Person
• Country of origin (for imported products)
• Nominal content by weight or volume
• Date of minimum durability (“best before”) or period after opening (PAO symbol)
• Precautions for use
• Batch number
• Function of the product
• Full ingredient list in INCI nomenclature, in descending order of weight

Labels must be in the official language(s) of the country where the product is sold. For EU-wide distribution, this typically means multiple language versions.

---

Prohibited and Restricted Substances

Regulation 1223/2009 includes three key annexes governing ingredient safety:

Annex II — Prohibited Substances (~1,600 substances) Substances that may not be used in cosmetic products. This list is significantly longer than the FDA’s prohibited list, which is why EU-compliant formulations often differ from US versions.

Annex III — Restricted Substances Substances that may be used only under specific conditions (maximum concentration, product type, labeling requirements, etc.). Includes colorants, preservatives, UV filters, and other functional ingredients.

Annexes IV, V, VI — Permitted Colorants, Preservatives, UV Filters Only substances on these positive lists may be used for these functions. Using a colorant not on Annex IV — even if it’s FDA-approved — is not permitted in EU cosmetics.

---

Special Requirements: Nanomaterials, CMR Substances, Endocrine Disruptors

Nanomaterials: Products containing nanomaterials require specific CPNP notification 6 months before market placement, plus labeling with “[nano]” after the ingredient name in the INCI list.

CMR Substances (Carcinogenic, Mutagenic, Reprotoxic): Category 1A and 1B CMR substances are prohibited. Category 2 CMR substances may only be used if the SCCS (Scientific Committee on Consumer Safety) has evaluated them as safe.

Endocrine Disruptors: The EU is progressively strengthening restrictions on substances with endocrine disrupting properties. Brands should monitor the evolving regulatory landscape, particularly for sunscreen actives and preservatives.

---

What Changes Post-Brexit: UK vs. EU

Since Brexit, Great Britain (England, Scotland, Wales) operates under its own UK Cosmetics Regulation — which mirrors EU Regulation 1223/2009 but requires a separate UK Responsible Person and SCPN (Submit Cosmetic Product Notification) notification. Northern Ireland continues to follow EU rules.

Brands selling in both the EU and UK need separate compliance tracks.

---

Frequently Asked Questions

Does EU Regulation 1223/2009 apply to products sold online to EU consumers?

Yes. If you sell cosmetics to consumers in the EU — including via e-commerce from outside the EU — the regulation applies. The importer (or the non-EU seller acting as importer) must comply with all requirements including CPSR, CPNP notification, and labeling. Enforcement is increasing, particularly for cross-border e-commerce.

How long does it take to get a cosmetic product compliant for the EU market?

Timeline depends on complexity. A straightforward product with an existing safety-assessed formula can be compliant in 4–8 weeks (CPSR preparation + CPNP notification). A new formula requiring full safety assessment and testing can take 3–6 months. Products with nanomaterials require an additional 6-month pre-notification period.

Can I use my FDA-compliant formulation in the EU?

Not necessarily. Many ingredients permitted by the FDA are restricted or prohibited under EU Regulation 1223/2009. Common examples include certain preservatives (e.g., some parabens at higher concentrations), colorants not on Annex IV, and UV filters not on Annex VI. A full ingredient review against EU annexes is required before assuming FDA compliance equals EU compliance.

What is the SCCS and why does it matter?

The Scientific Committee on Consumer Safety (SCCS) is the EU’s independent scientific body that evaluates cosmetic ingredient safety. SCCS opinions form the basis for amendments to the regulation’s annexes. Brands should monitor SCCS opinions for ingredients in their formulations, as a negative SCCS opinion often precedes a regulatory restriction.

What happens if a product is non-compliant?

Competent authorities in EU member states can order product withdrawal from the market, require corrective action, impose fines, and in serious cases pursue criminal liability. The Responsible Person bears primary legal responsibility.

---

The Bottom Line

EU Regulation 1223/2009 is comprehensive, technically demanding, and strictly enforced. For non-EU brands, the three most critical steps are: appointing a Responsible Person, obtaining a CPSR from a qualified safety assessor, and completing CPNP notification before market placement.

The regulation is also a living document — annexes are regularly updated as new safety data emerges. Ongoing compliance monitoring is as important as initial market entry.

Need EU cosmetics compliance support? Care Europe provides CPSR preparation, Responsible Person services, CPNP notification, and full EU regulatory consulting for brands entering the European market. Get a free regulatory assessment →

For brands also selling in the USA, Qalitex provides ISO 17025 accredited cosmetic testing and safety testing services in California. For Canadian market entry, Androxa handles Health Canada compliance and NHPD requirements.