SPF Claims Under EU Regulation 1223/2009: What ISO 24444 Testing Demands Before You Print a Number

Sun protection products are among the most closely scrutinised categories under EU cosmetics law — and, in our experience, among the most poorly documented by the brands that sell them. The SPF number printed on your packaging isn’t a marketing claim you decide on with your formulation chemist. It’s a substantiated measurement derived from a standardised test method, subject to market surveillance by national authorities, and expected to be supported by data sitting in your Product Information File before the product ships to a single retailer.

If you’re a European brand, a contract manufacturer, or a private-label operator launching or relaunching a sun care range in 2026, here is what the current requirements actually demand — and where the gaps between markets will cost you.

Why EU Sunscreens Are Classified as Cosmetics — and Why It Drives Everything

Under Regulation (EC) No 1223/2009, sun protection products are regulated as cosmetics. That single classification has significant practical consequences. There is no pre-market authorisation from a regulator. No dossier submitted to a central agency for approval. But full responsibility for safety substantiation sits with the Responsible Person (RP), documented in a Product Information File, before the product is placed on the EU market.

The UV filters permitted for use are listed exhaustively in Annex VI of Regulation (EC) No 1223/2009. There are currently more than 25 authorised UV filter substances, each with maximum concentration limits and specific conditions of use. Adding a filter not on the Annex VI list — or exceeding its concentration ceiling — is a direct violation of the Regulation, regardless of your safety assessor’s opinion on the substance. Market surveillance authorities, including France’s DGCCRF, conduct regular in-market testing specifically for non-compliant UV filter use. The fines are secondary; having product pulled from retail and triggering a mandatory RAPEX notification is the exposure that brands don’t recover from quickly.

Compare this to the United States, where sunscreens are regulated as over-the-counter (OTC) drugs by the FDA — a fundamentally different pathway with its own active ingredient approvals, manufacturing standards, and label requirements. A sun care product fully compliant with EC regulation 1223/2009 is not automatically suitable for the US market. That distinction matters considerably for brands with cross-market ambitions, and we’ll return to it.

The ISO 24444:2019 Standard: What the SPF Test Actually Measures

ISO 24444:2019 is the current international reference method for in-vivo determination of sun protection factor. It replaced the earlier COLIPA 2011 protocol — developed by what is now Cosmetics Europe — and introduced tighter requirements around test panel size, product application technique, and statistical analysis of results.

Under the standard, a minimum of 10 subjects with phototype I to III skin must be recruited, tested, and analysed. The product is applied at a dose of 2 mg/cm² to defined areas of the back. That application density is the prescribed test dose — not the amount most consumers actually apply in practice, which studies consistently put at around 0.5 to 1 mg/cm². The gap between the test dose and real-world application is a known limitation; it’s why the sun protection a consumer receives on a beach day is reliably lower than the label value, and the standard acknowledges this in its informational annexes.

The SPF itself is calculated from the ratio of the minimal erythema dose (MED) on protected skin to the MED on unprotected skin. The final reported SPF is the arithmetic mean across the panel, with the standard specifying that results must fall within a defined confidence interval. If your test panel is too small or the between-subject variance too high, the data is statistically insufficient — and the label claim it was supposed to support isn’t defensible.

One thing we regularly flag with clients: brands that commissioned SPF testing under the COLIPA 2009 or 2011 methods and have never revisited whether that data meets ISO 24444:2019 criteria. Protocol revisions between the two versions affect result comparability. Test data that is more than five to seven years old warrants a fresh assessment, particularly if the supplying test lab has since updated its internal protocol to the ISO standard. Your Responsible Person carries the liability for what’s in the PIF.

UVA Protection Claims: The 1/3 Rule and the Critical Wavelength Requirement

EU Commission Recommendation 2006/647/EC established two criteria that any product carrying a UVA protection claim — including the “UVA” circle logo — must satisfy. Both are absolute.

First, the UVA protection factor (PF-UVA) must be at least one-third of the labelled SPF value. A product labelled SPF 30 must demonstrate a PF-UVA of at least 10. A product labelled SPF 50 must show a PF-UVA of at least 17. This is measured in-vitro using the method now standardised as ISO 24443:2021, which covers spectrophotometric determination of UVA photoprotection. The 1/3 ratio is what earns the right to display the UVA circle logo — a graphic that consumers increasingly look for and that major French and German retailers have started requiring contractually from their suppliers.

Second, the critical wavelength must reach at least 370 nm. Critical wavelength is a broadspectrum indicator: specifically, the wavelength below which 90% of a product’s total UV absorbance falls. A critical wavelength of 370 nm or above signals meaningful protection into the UVA1 range (340–400 nm) — the portion of the UV spectrum most associated with photoaging and certain forms of long-wave DNA damage. Products that fail this threshold cannot claim broadspectrum protection under the EU framework, irrespective of their SPF value.

In-vitro UVA testing is conducted on PMMA substrate plates using a spectrophotometer. Because a product’s UVA absorption profile can shift after UV irradiation — certain chemical filters degrade photochemically — photostability is an integral component of a complete UVA assessment, not an optional follow-on exercise. Skipping it and later discovering that your PF-UVA drops below the 1/3 threshold after irradiation is an expensive lesson in documentation sequencing.

Water Resistance Claims Require Separate Testing — Not Judgement Calls

“Water resistant” and “very water resistant” are functional claims regulated under the EU Commission Recommendation. A brand cannot support either claim on the basis of formulation reasoning alone. Testing must be conducted and the data must be in the PIF.

The reference method under the EU framework involves water immersion cycles followed by drying periods, with SPF re-measured after the immersion sequence. A product claiming “water resistant” must retain at least 50% of its original measured SPF after two 20-minute immersion cycles. “Very water resistant” requires the same retention threshold after four cycles. These tests typically add two to four weeks to a development timeline at a qualified laboratory, and they should be built into launch planning rather than treated as optional documentation to retrieve later.

We’ve seen this omission come up in both DGCCRF inspection responses and retailer compliance audits. A marketing team decides that water resistance language is a category norm, it goes on the pack, and the test data to support it simply doesn’t exist. The absence of substantiation in the PIF is treated as a labelling violation under Regulation 1223/2009 — not a procedural gap you can close retroactively once a regulator has already flagged the product.

SPF Label Categories: You Cannot Print Whatever Number the Test Returns

EU Commission Recommendation 2006/647/EC specifies that SPF claims appear in standardised categories, not raw test values. The four categories and their label values are:

• Low protection: SPF 6, SPF 10
• Medium protection: SPF 15, SPF 20, SPF 25
• High protection: SPF 30, SPF 50
• Very high protection: SPF 50+

If your product tests at SPF 43, you label it SPF 30. If it tests at SPF 68, you label it SPF 50+. There is no SPF 60, no SPF 70, no SPF 100 in the EU market. The 50+ ceiling reflects the scientific position of the SCCS (Scientific Committee on Consumer Safety) that higher numerical claims generate disproportionate consumer confidence and extend UV exposure time without commensurate benefit.

This is a persistent point of confusion for brands entering the EU from markets where SPF 100 products are routinely sold. A US-formulated sunscreen positioned as a premium product based on its SPF 100 claim needs complete relabelling and freshly structured test data mapped to EU categories before a single unit can legally be sold on the European market.

Exporting EU-Formulated Sun Products to the US: Where Your ISO 24444 Data Falls Short

European brands formulating high-performance sun care products frequently use UV filters from the Annex VI list that have no US equivalent approval. Tinosorb M (bis-ethylhexyloxyphenol methoxyphenyl triazine), Tinosorb S, Mexoryl SX (ecamsule), and Mexoryl XL are all Annex VI-approved and widely used in European sunscreens. None are currently approved under the FDA’s OTC drug monograph, and none can be incorporated into a US-marketed sunscreen without either a New Drug Application or Time and Extent Application pathway — both of which are multi-year processes.

This creates a real commercial problem. A European sun care product with an excellent, validated SPF and UVA profile — fully compliant with EC regulation 1223/2009 and backed by ISO 24444:2019 in-vivo data — cannot be sold in the US without reformulation. Your ISO 24444 test report doesn’t transfer into an FDA submission. The FDA uses different test method conventions, different statistical criteria, and a drug manufacturing framework (21 CFR Part 211) rather than a cosmetic GMP standard.

The reverse situation is equally constrained. A US-formulated sunscreen built around FDA-approved actives — zinc oxide, titanium dioxide, avobenzone, octinoxate within their concentration limits — can potentially be exported to Europe, but it requires EU-specific SPF and UVA testing conducted under ISO protocols, Annex VI compliance verification for every active and inactive ingredient, and a complete CPSR signed off by a qualified safety assessor before a Responsible Person can place it on the EU market.

For brands managing sun care ranges across both markets, the practical resolution is either to maintain separate formulations for each market, or to select UV filters appearing on both Annex VI and the FDA’s approved list — a notably shorter roster that constrains formulation flexibility, particularly for achieving high SPF values efficiently.

Our team regularly helps European sun care brands map their Annex VI formulations against export market requirements, identify the testing gaps, and build a documentation package that supports multi-market launches without duplicating effort unnecessarily.

What Your PIF Needs to Support an SPF Claim in 2026

If you’re planning a sun care launch or reformulation this year, the minimum documentation your Product Information File must contain to substantiate an SPF claim under Regulation (EC) No 1223/2009 is:

1. ISO 24444:2019-compliant SPF test report — in-vivo, minimum 10 subjects, confidence interval confirmed
2. ISO 24443:2021-compliant UVA test report — if any UVA, broadspectrum, or UVA logo claim appears on pack
3. Critical wavelength ≥ 370 nm — confirmed in the spectrophotometry data, post-irradiation
4. Water resistance test data — if any water resistance language appears anywhere on the packaging or product communications
5. UV filter concentration verification — each active filter confirmed within current Annex VI limits for the intended use conditions
6. CPSR from a qualified safety assessor — reflecting all test data and the product formula as manufactured

Starting a launch with outdated test reports, or skipping the UVA documentation because “SPF is what retailers are asking about”, are the two fastest ways to end up underprepared for a DGCCRF inspection or a retailer compliance audit. The SPF number is the number consumers read. Everything behind it is what keeps it on the shelf.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025-Accredited Cosmetic and Sun Care Testing for the US Market — Qalitex Laboratories provides ISO 17025-accredited testing for sun care products destined for FDA-regulated markets, including SPF and active ingredient verification.
• Canadian Sunscreen Classification and Compliance for European Brands — Androxa supports European brands navigating Health Canada’s sunscreen pathway, where solar products may be classified as cosmetics, NHPs, or drugs depending on SPF value and label claims.