The EU Responsible Person Under Regulation (EC) No 1223/2009: Who Is Legally Liable When Your Cosmetic Goes to Market?

It’s a scenario we encounter more often than brands expect. A French beauty startup launches a skincare range — their formulator sits in Tunisia, fill-and-finish happens in Poland, and a UK distributor handles online sales across Europe. Six months after launch, an ANSM inspector requests the Product Information File. No one in the supply chain can confidently answer who the Responsible Person actually is.

This is not a hypothetical. Under Regulation (EC) No 1223/2009 — the cornerstone piece of EU cosmetics legislation — every product placed on the EU market must have one, and only one, designated Responsible Person (RP) established within the European Union. Get the designation wrong and your product is, legally speaking, not authorized for sale. The EU cosmetics market is worth approximately €77 billion annually and serves around 450 million consumers across 27 member states. Regulators have every incentive to enforce rigorously.

What Regulation (EC) No 1223/2009 Actually Says About the Responsible Person

Article 4 of the regulation is unambiguous. The RP is the legal entity — a company or natural person — established in the EU who ensures the cosmetic product complies with the regulation before it is placed on the market. Not after complaints arise. Not after the first batch sells out. Before.

The RP is determined primarily by your position in the supply chain, and the default rules are worth knowing precisely:

EU manufacturer: If you manufacture the finished cosmetic product inside the EU, you are automatically the RP unless you formally designate another party in writing and that party accepts the mandate. Many EU manufacturers don’t realize they’re carrying RP liability for products they made for a client brand that has no other EU presence.

Importer: If the product is manufactured outside the EU — whether that’s Morocco, India, South Korea, or the United States — the company or individual who first places it on the EU market becomes the RP by default. That moment of first import is the moment of assumption. There’s no opt-out provision.

Distributor by mandate: A distributor established in the EU can take on the RP role, but only via a written mandate from the manufacturer or importer. Article 4(3) requires written form and explicit acceptance. A verbal arrangement between a brand owner and their French logistics partner doesn’t constitute compliance, regardless of how long the relationship has existed or how much both parties trust each other.

One misconception worth addressing plainly: registering a legal entity in the EU does not automatically produce a compliant RP. The regulation requires the RP to actually fulfill the obligations — maintaining the PIF, submitting CPNP notifications, running cosmetovigilance, and responding to competent authorities within reasonable timeframes. A letterbox arrangement or a nominee-director setup that exists on paper but carries no operational substance does not hold up under inspection.

The Obligations That Come With the Title

The RP role is not administrative. The obligations under the regulation are substantial, and the liability follows the designation regardless of what internal contracts say between brand owner and RP.

Product Information File (PIF): The RP must compile and maintain a PIF for each distinct cosmetic product — and keep it accessible to competent authorities for 10 years after the last batch is placed on the EU market. That’s a long tail of liability for any product line you wind down. The PIF must include the Cosmetic Product Safety Report (CPSR), a full product description, the manufacturing method, a statement on GMP compliance under ISO 22716, data on undesirable effects, and proof of claimed effects where relevant.

The CPSR is split into two parts: Part A covers the cosmetic product safety information (ingredients, physicochemical profile, microbiological quality, impurities, packaging interactions), and Part B contains the safety assessor’s evaluation and conclusions. Part B must be signed by a qualified safety assessor who holds a diploma in pharmacy, toxicology, medicine, dermatology, or an equivalent discipline, as specified in Article 10(2). This is not a checkbox for a general chemist to tick.

CPNP Notification: Before any product reaches an EU shelf, the RP must notify it through the Cosmetic Products Notification Portal. The notification must include the product category, the formulation frame (either the full formula or a frame formulation where applicable), CMR (carcinogenic, mutagenic, or reprotoxic) substance data if any Annex II or Annex III substances are present, nanomaterial status under Article 16, the country of origin for imported products, and the RP’s EU contact details. Competent authorities in all 27 member states draw from this database when conducting market surveillance and responding to adverse event reports from poison centres.

Cosmetovigilance: The RP must operate an active system for collecting and evaluating information on undesirable effects following normal or reasonably foreseeable use. When a serious undesirable effect occurs — defined in Article 2(1)(p) as one involving temporary or permanent functional incapacity, disability, hospitalization, congenital abnormalities, or death — the RP must notify the competent authority of the member state where the effect was observed without undue delay. The safety assessor must simultaneously be informed. This is not a passive, reactive obligation. It requires an operational monitoring infrastructure: a mechanism for consumers and healthcare professionals to report effects, a triage process, and documented escalation procedures.

Label Compliance: Under Article 19, the RP’s name and address — not a PO box, a real EU address — must appear on the outer packaging of every cosmetic product. Brands distributing across multiple EU markets with different contract RPs for different countries frequently discover labelling inconsistencies that require costly relabelling runs.

Where European Brands Most Often Get This Wrong

After working with cosmetic brands across France, Germany, and the Benelux region, the gaps we encounter cluster around four recurring problems.

Informal mandates that live nowhere. A manufacturer tells their distributor verbally “you handle the regulatory side” — and nothing goes into writing, nothing goes into the PIF. Under Article 4(3), the mandate must exist in writing and the RP must have accepted it. In the absence of a written mandate, regulatory liability remains with whoever occupies the highest position in the supply chain’s EU presence. If that entity is your Moroccan manufacturer’s French logistics depot, the depot is legally the RP whether they know it or not.

Post-Brexit residue. The UK left the EU single market on 1 January 2021. From that date, UK-established entities ceased to qualify as the Responsible Person for products placed on the EU market. Despite this being a firm, non-ambiguous change with years of notice, a significant number of brands — particularly those operating simultaneously across the UK and the EU continent — had UK entities listed as their RP in CPNP notifications well into 2022 and 2023. Some still do. If your CPNP record shows a UK address as the RP, that product is non-compliant today.

Variant mismanagement. It’s tempting to group product variants — five shades of a foundation, three fragrance versions of a body lotion — under a single CPNP notification and a single PIF. Each cosmetic product is, however, a distinct notification. If the variants differ in formulation (even a fragrance switch between variants counts), each requires its own CPSR, its own notification, and its own PIF. Competent authorities have flagged this pattern repeatedly during market surveillance sweeps.

Safety assessors without the qualifying credential. The CPSR Part B must be signed by a safety assessor who demonstrably meets the educational criteria in Article 10(2). We have reviewed PIFs where the assessor held a general biology degree, or where a consultant based outside the EU had prepared the report with no co-signatory meeting the qualification. Both scenarios leave the RP exposed. If ANSM or Germany’s BfArM requests proof of the assessor’s qualifications, a biography page on a consultant’s website is not sufficient — the actual diploma or degree certificate is what’s needed.

Formalizing Your RP Designation: A Practical Starting Point

If you’re reading this as a brand owner trying to confirm your current RP status is solid, start here.

First, map every product you have on the EU market against the CPNP notifications. Confirm who is listed as the RP for each one. If any RP entity is outside the EU — UK, Switzerland, United States, North Africa — you have a remediation task before the next market surveillance cycle finds it for you.

Second, review your written mandate if you’re using a third-party RP service. The document should specify the exact products covered (by name or notification number), the specific obligations the RP is accepting on your behalf, the duration of the mandate, and — critically — the exit clause. What happens to the CPNP notifications if the relationship ends? Does the RP retain the data? Does it transfer? This question catches brands off guard when they switch RP providers.

Third, confirm your PIFs are current. The CPSR must reflect the actual current formulation. Any ingredient change — a preservative substitution, a supplier swap for the same botanical extract, a fragrance modification — potentially triggers a new or updated safety assessment. The PIF is a living document, not a one-time filing.

Fourth, document your cosmetovigilance procedure. It needs to exist as a written SOP before you need it, not after. If ANSM asks to see your procedure for collecting and escalating serious undesirable effects, the answer cannot be improvised in the moment. Most small-to-mid-size brands have never written this down.

The Broader Picture for Brands Operating Across Multiple Markets

For European brands whose ambitions extend beyond the EU — into the US market under FDA oversight, or Canada under Health Canada’s NHPD framework — the Responsible Person question often overlaps with parallel designation requirements in those jurisdictions. The US requires a US Agent for certain cosmetic and drug filings. Canada requires a site licence holder for natural health products. Managing these designations coherently across three regulatory frameworks, with consistent product and ingredient data flowing between them, is where complexity compounds quickly.

Getting the EU RP right is the foundation. The competent authorities in France, Germany, and the Netherlands have grown considerably more active in market surveillance since the regulation was strengthened in 2013. ANSM, in particular, publishes its cosmetics inspection findings annually — and the Responsible Person designation failures appear in that data more than most brands would expect.

The designation is, in practical terms, a contractual and regulatory commitment that should receive the same legal review as a major distribution agreement. If it hasn’t been reviewed since your product launched, that’s the first thing worth putting on the compliance calendar.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and Responsible Person compliance. Contact us

Related from our network

• Supplement and Cosmetic Testing for FDA Compliance — Qalitex Laboratories provides ISO 17025-accredited testing for European brands entering the US market, covering label claim verification, heavy metals, and contaminants.
• Health Canada NHPD Compliance for European Brands — Androxa supports European cosmetics and supplement brands navigating Canadian regulatory requirements, from NHP licensing to GMP site compliance.