The PAO Symbol Is Not a Default: EU Cosmetics Stability Testing Under Regulation (EC) No 1223/2009

A brand we spoke with last year had been selling a moisturiser across five EU markets for two years. Their Product Information File listed a 24-month PAO — the open jar symbol — chosen because it “seemed standard for a product like this.” When a national competent authority in Germany requested the underlying stability documentation, the file contained exactly two data points: an initial physico-chemical assessment and one follow-up at six weeks. No accelerated study, no challenge test data, no justification for the 24-month figure. The product was pulled from two retail platforms while the brand ran a proper study from scratch.

This isn’t an isolated incident. The PAO symbol has quietly become a shorthand for “we think this is fine,” when Regulation (EC) No 1223/2009 — and the SCCS’s own guidance — demands considerably more. And with national competent authorities increasingly exercising their PIF access rights across the EU, the gap between what a label claims and what the file can prove is closing fast.

The 30-Month Rule and Why It Determines Everything

Under Article 19(1) of Regulation (EC) No 1223/2009, your labelling obligation splits cleanly at the 30-month mark.

Products with a minimum durability of less than 30 months must display a date of minimum durability — the “best used before the end of” declaration, shown with the hourglass symbol. Products with a durability of 30 months or more must instead show the PAO: the open jar icon followed by the period (in months) during which the product can be safely used once opened.

The first misconception we encounter regularly is that the PAO is the more flexible or lenient option. It isn’t. Both claims require supporting data. The distinction is in what kind of degradation you’re protecting against: pre-opening chemical and physical degradation (the shelf-life question) versus post-opening microbial and physico-chemical degradation (the PAO question). A product can carry both a minimum durability date and a PAO — and for some formats, particularly anhydrous products that are chemically stable pre-opening but vulnerable to contamination once in use, that combination is exactly right.

The second misconception is that simple formulations with few ingredients don’t need formal stability work. They do. Complexity of formulation has no bearing on the legal requirement to have data. A two-ingredient product with a 24-month PAO still needs 24 months of evidence — or at minimum, a defensible accelerated study and ongoing real-time monitoring — sitting in the PIF.

What Regulation 1223/2009 Requires in Your Product Information File

Article 10(1) of Regulation (EC) No 1223/2009 sets out the PIF contents. Annex I goes further: the cosmetic product safety report must include stability data demonstrating that the product remains safe “under reasonably foreseeable storage conditions.” The SCCS Notes of Guidance interpret this in considerable technical detail, and competent authority inspectors lean on that document heavily when deciding whether a PIF is adequate.

In practice, your PIF’s stability section needs to demonstrate four things:

Physico-chemical stability: pH, viscosity, appearance, colour, and odour measured at defined intervals across defined storage conditions — and where you’re making an active ingredient claim, concentration of that active. A single time-point measurement is not a stability study.

Microbial quality: Total aerobic microbial count and detection testing for relevant pathogens including Pseudomonas aeruginosa, Staphylococcus aureus, Candida albicans, and Escherichia coli, per the relevant ISO cosmetics microbiology standards. This applies to water-containing products; certain anhydrous formats may qualify for a risk-based exemption.

Preservative efficacy: Challenge testing per ISO 11930, demonstrating that the product’s antimicrobial protection system performs as intended in the finished product in its final packaging.

Packaging compatibility: Evidence that the closure system, pump mechanism, inner liner, or tube material doesn’t interact with the formulation over the stated shelf life. A switch from glass to HDPE, or from a standard pump to an airless format, constitutes a material change that warrants fresh compatibility data.

A PIF containing only a supplier’s Certificate of Analysis and a raw material safety datasheet is not a stability file. This distinction matters more today than it did five years ago, because authorities are requesting PIFs and actually reading them.

Designing a Stability Study That Holds Up to Scrutiny

The Cosmetics Europe (formerly COLIPA) stability guidelines remain the practical industry standard for study design across the EU, even though they’re guidance rather than regulation. A defensible study typically runs three conditions concurrently:

Long-term / real-time: 25°C ± 2°C / 60% RH ± 5%, with measurements at T0, 3 months, 6 months, 9 months, 12 months, 18 months, and 24 months. This is your ground truth.

Accelerated: 40°C ± 2°C / 75% RH ± 5%, with measurements at T0, 4, 8, and 12 weeks. The Arrhenius principle applies here — with a Q10 factor of approximately 2 for most aqueous systems, each 10°C increase roughly doubles the rate of degradation, allowing accelerated data to project long-term behaviour. Twelve weeks at 40°C gives you a reasonable predictive basis while your real-time data builds.

Stress / cycling: freeze-thaw cycling (typically −5°C to +40°C, repeated 3–6 times) plus light stress testing for photosensitive products or anything carrying a UV-related claim. This is also where you stress-test the packaging: pump mechanisms that function perfectly at ambient temperature can fail after two freeze-thaw cycles.

One number worth knowing: ISO 29621 allows a risk-based waiver of challenge testing for products that meet specific low-risk criteria — anhydrous formats with water activity below 0.75, products with pH below 3 or above 10, single-use sachets, and certain alcohol-based products, among others. If your product qualifies, a properly documented ISO 29621 risk assessment in the PIF can remove the challenge testing requirement and save four to six weeks of laboratory time. But the risk assessment itself must be explicit, referenced, and auditable. “We don’t think it needs it” is not a risk assessment.

The accelerated study result is a projection, not a proof. Present it in the PIF with a clear note that real-time data is ongoing and will be added as it becomes available. Inspectors who see a 24-month PAO claim supported only by 12 weeks of accelerated data — with no acknowledgment that long-term data is pending — will flag it as incomplete.

Preservative Efficacy Testing: The Requirement Brands Keep Underestimating

Preservative efficacy testing (PET) per ISO 11930 is the test most frequently missing or under-documented in the PIFs we review. The method inoculates the finished formulation with five microorganisms — Aspergillus brasiliensis, Candida albicans, Escherichia coli, Pseudomonas aeruginosa, and Staphylococcus aureus — at approximately 10⁵ to 10⁶ CFU/g, then measures the reduction in viable counts at 2 days, 7 days, 14 days, and 28 days.

The 2019 revision of ISO 11930 moved away from the earlier binary pass/fail framework and introduced two acceptance criteria — Criterion A and Criterion B. Criterion A is the target for leave-on products and anything with contact near mucous membranes. Criterion B may be acceptable for certain rinse-off products, but it requires explicit justification in the cosmetic safety assessment; you can’t just cite the criterion and move on.

The mistake we see most often: a brand runs PET once during formulation development, then changes something — a different preservative supplier, a new fragrance blend, a packaging switch from glass to an HDPE tube — and doesn’t retest. Under the SCCS guidance, any change that could plausibly affect preservative efficacy (different preservative concentration, altered pH, change in water activity, new packaging material) triggers a reassessment. That’s not a technicality. It’s precisely the kind of gap that generates a non-conformity when DGCCRF arrives.

It’s also worth noting that PET must be performed on the finished product in final packaging, not on a bench-scale batch in a beaker. The packaging material can interact with the preservative — certain HDPE grades absorb parabens — and those interactions won’t show up in a bulk formulation test.

What a DGCCRF Inspection Actually Looks Like

Since our team operates from France, the DGCCRF context is directly relevant. The Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes conducts regular cosmetics market surveillance campaigns, and its inspection approach has become more technically granular since 2023.

In recent inspection cycles, DGCCRF agents have specifically requested:

• Full stability study reports with raw data tables, not executive summaries or one-page overviews
• PET reports showing organism-by-organism viable counts at each time point, not just a conclusion
• Chamber calibration records for the incubators and stability cabinets used in the study
• A traceable link between the stability data in the PIF and the specific PAO or durability date on the label

That last point is critical. Inspectors want to see a logical chain, not just a file. If your accelerated data shows borderline viscosity drift at week 12 and you’ve claimed a 24-month PAO, the file needs a documented scientific rationale for why that drift doesn’t affect product safety or performance. “The formulator approved it” is not a rationale.

Working with an ISO 17025-accredited third-party laboratory for stability and PET work carries more evidentiary weight than equivalent data generated in an unaccredited internal lab. Third-party reports are harder to dismiss and easier to defend in a regulatory conversation. Our team works with accredited partner laboratories across France, Spain, and through our North American network to ensure stability reports are structured in the format European authorities expect to receive.

The Practical Starting Point

If you’re launching a product in 2026 and the stability plan still reads “we’ll finalise this closer to launch,” move it up the timeline. Real-time and accelerated studies need to run concurrently from the first representative pilot batch — not from the commercial batch, which arrives too late. PET needs to be performed on final formulation in final packaging, after your last formulation lock. And if you’re claiming an ISO 29621 exemption, the risk assessment needs to be written, referenced, and sitting in the PIF before any authority ever asks for it.

The open jar symbol is a specific regulatory claim. Treat it that way.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025-Accredited Cosmetics Testing at Qalitex Laboratories — Physico-chemical analysis, microbial counts, and challenge testing for EU stability files, run from an accredited California laboratory
• Health Canada Cosmetics Compliance Testing at Androxa — Canadian market entry testing for European brands, including stability and preservative efficacy under Health Canada requirements