EU Cosmetics Digital Labelling: What the QR Code Amendment to Regulation 1223/2009 Actually Allows

Open almost any premium skincare product released since 2022 and you’ll find a QR code on the box. Sometimes it links to a tutorial. Sometimes it’s a sustainability report, an extended ingredient glossary, or a loyalty programme sign-up. Occasionally — and this is where compliance teams should pay close attention — it’s doing quiet regulatory work that the physical pack itself isn’t doing.

The push toward digital labelling in EU cosmetics is real, and the policy machinery is moving. But the migration from the current cosmetic regulation 1223/2009 framework to anything that formally recognises QR codes as mandatory-information carriers is not complete. What’s been proposed, what’s still in draft, and what brands are getting wrong right now are three quite different things.

What Article 19 of Regulation 1223/2009 Actually Mandates on the Physical Pack

Regulation (EC) No 1223/2009 Article 19 defines eight categories of information that must appear on cosmetic product labels. Four of them — the name and address of the responsible person, the batch number, the date of minimum durability (or the period-after-opening symbol for products with a shelf life exceeding 30 months), and the nominal content at time of packaging — must appear indelibly on the outer packaging. Where there is no outer packaging, they must appear on the immediate container.

There is currently no provision in ec regulation 1223/2009 to move any of these four fields into digital channels. A QR code cannot replace a batch number. It cannot substitute for the responsible person’s street address. It cannot serve as the date of minimum durability or the PAO symbol. These fields must be physically printed, indelibly, on the pack — full stop.

The remaining four mandatory categories — precautionary statements, country of origin for products imported from outside the EU, the function of the product (unless self-evident from its presentation), and the INCI ingredient list — carry slightly different rules. Article 19(2) creates a specific mechanism for situations where labelling these directly on the product is physically impossible.

But “slightly different” is doing a lot of work in that sentence.

The Leaflet Route: What “Impossible” Actually Means in Practice

Article 19(2) of Regulation 1223/2009 states that when the size, shape, or nature of the product makes it impossible to include precautionary information and the INCI ingredient list directly on the product, this information may instead appear on an enclosed or attached leaflet, label, tape, tag, or card. The outer packaging must carry a reference — conventionally the small hand-pointing-to-book symbol — directing consumers to that document.

The operative word is “impossible.” EU market surveillance bodies, including France’s ANSM (Agence nationale de sécurité du médicament et des produits de santé), Germany’s BfR, and Spain’s AEMPS, interpret this provision narrowly. A 50 mL glass perfume bottle housed in a shaped box is not a product where enclosing a leaflet is impossible — the box accommodates one easily. A 3 g lip balm in a twist-up tube with less than 8 cm² of total printable surface across all faces makes a far more credible impossibility case.

And here’s the part that surprises most people reviewing this for the first time: even when the leaflet route is legitimately used, the information must appear on a physical document — an enclosed card, a folded label, a tear-off tag. Article 19(2) describes a tangible item that travels with the product. It does not describe a URL. It does not describe a QR code. It does not describe a landing page that requires a smartphone and a data connection to access.

The leaflet route is not a digital route. It never has been.

Where EU Law Currently Stands on QR Codes — and Where It’s Headed

QR codes are not prohibited under regulation 1223/2009 ec. They simply were never addressed by it, because the regulation predates their ubiquity on product packaging. Brands have been printing them for supplementary content for years without compliance issue — provided the QR code is doing supplementary work rather than carrying mandatory information in place of physical text.

The regulatory conversation shifted meaningfully in 2022–2023 when the European Commission began consulting on formal digital labelling provisions as part of its broader digital and sustainability transition agenda. Those discussions explored allowing QR codes to carry certain categories of information — specifically instructions for use and some precautionary statements — while maintaining the position that the INCI ingredient list, batch number, responsible person details, and durability information must continue to appear physically on the pack.

The ESPR (Ecodesign for Sustainable Products Regulation) and its associated Digital Product Passport (DPP) framework add another layer of complexity. The DPP is designed to travel with a product through its entire life cycle and will almost certainly intersect with cosmetics labelling in the medium term. But “will intersect” is not the same as “has been formally adopted.” The DPP framework for cosmetics is still being scoped, with sector-specific delegated acts still pending.

As of mid-2026, no formal amendment to Regulation 1223/2009 authorising QR codes as mandatory-information substitutes has been adopted. The regulation as enforced today still does not recognise a QR code as a substitute for any of the eight mandatory Article 19 fields. Until a formal amendment is adopted and its transition period has run, assuming otherwise creates a market surveillance exposure.

The INCI List Gap Is the Most Common Compliance Problem

In reviewing product information files across EU markets, the INCI ingredient list is where digital labelling assumptions most often create genuine compliance problems. Long ingredient lists on small packs put formulators and packaging teams under real pressure. The solution sometimes becomes a QR code with “full ingredients available at our website” — with the physical label carrying a truncated version, a generic reference, or nothing at all.

This approach fails on two grounds simultaneously. First, regulation ec no 1223/2009 does not currently permit digital substitution for the INCI list. Second — and this matters directly to regulators — the INCI list serves a specific consumer safety function. It is the mechanism through which consumers with known sensitivities identify allergens, sensitisers, and irritants before they make contact with their skin. ANSM inspectors treat INCI list completeness and legibility as a primary criterion during product spot-checks. “The full list is on our website” is not a defensible response to a market surveillance inquiry, and the inspector holding your product will not pause the process to visit your URL.

If your formulation’s ingredient count makes physical label space genuinely impossible, Article 19(2) gives you a fully compliant solution: a complete INCI leaflet enclosed with the product, cross-referenced on the label with the book-and-finger symbol. That’s lawful under current regulation. A QR code pointing to a website is not — not for INCI list purposes, not under the law as it currently stands.

Two Legitimate Uses for QR Codes on EU Cosmetics Today

There are two uses for QR codes on EU cosmetics products that carry no compliance risk. The first is purely additive content: tutorials, sustainability credentials, product storytelling, detailed ingredient sourcing, certifications, or brand transparency initiatives. None of this is mandatory, none of it is regulated, and brands have wide latitude. Done well, this kind of digital content builds consumer trust and supports the EEAT signals that matter for brand authority.

The second is using a QR code as a digital companion to physical compliance — where the QR links to a richer, more accessible version of information that also appears physically on pack or in an enclosed document. A consumer reads the INCI list on the enclosed leaflet; they scan the QR code to see common names for those INCI names, photos of the botanical ingredients, and allergen call-outs in plain language. That’s genuinely useful, and it’s entirely compliant because the physical foundation is there.

The problematic use is when a QR code is the only home for mandatory information — when removing it from the packaging would leave a non-compliant label. That’s the audit risk. And it’s more prevalent than most brand compliance teams acknowledge when they first work through their own SKU portfolio systematically.

How to Build for the Rule Change Without Breaking Today’s Rules

The Commission’s direction toward digital labelling is clear, even if the legislative calendar is not. Formal digital labelling provisions for cosmetics are coming. When they arrive, they will almost certainly require structured, permanently accessible product data pages — not static PDFs, but queryable, market-surveillance-auditable product records linked from a specific QR code whose URL cannot be reassigned.

That infrastructure is worth building now, regardless of the legislative timeline. Clean CPNP records, accurate and regularly updated digital ingredient pages, and multilingual QR landing pages that precisely mirror the physical product’s data — these cost roughly the same to build now for supplementary purposes as they will to retrofit for compliance purposes later. The brands that will have an easy transition are the ones that are building the data hygiene today.

The near-term action is a label audit conducted as if your QR codes don’t exist. Run every SKU against Article 19. Does the batch number appear indelibly on the outer packaging? Does the responsible person’s address appear correctly? Is the nominal content marked for products over 5 g or 5 mL? Does the INCI list appear on pack or in an enclosed leaflet with the correct cross-reference symbol? Does the PAO symbol appear for every product with a shelf life beyond 30 months?

If every mandatory field passes that audit without the QR code doing any work, your QR code is an enhancement. You’re in a defensible position regardless of how the amendment develops and when it lands.

If the audit reveals fields that only exist digitally — if the QR code is load-bearing from a compliance perspective — that gap needs to close at the next production run, not during the investigation that follows a market surveillance visit.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and cosmetics compliance. Contact us

Related from our network

• ISO 17025-accredited cosmetics ingredient testing for EU brands entering the US market — Qalitex Laboratories provides label-claim verification, INCI ingredient identity testing, and FDA-facing compliance documentation for European cosmetics brands.
• Health Canada cosmetics notification compliance for European brands entering Canada — Androxa supports EU cosmetics manufacturers with Canadian market entry testing, ingredient dossiers, and regulatory submission support.