The EU Cosmetic Product Safety Report: What Regulation (EC) No 1223/2009 Requires in Part A and Part B

Every week, European cosmetics brands place products on the market without realising their Cosmetic Product Safety Report is structurally incomplete. Not factually wrong — structurally incomplete. And under Regulation (EC) No 1223/2009, that distinction does not protect you from an enforcement action.

The CPSR is the document at the heart of EU cosmetics compliance. Get it right, and your Responsible Person can defend any product against regulatory scrutiny. Get it almost right — which is far more common — and you’re exposed. ANSM inspections in France and DGCCRF market surveillance operations routinely flag Product Information Files where the safety report fails to meet the structural requirements laid out in Annex I of the Regulation.

What follows breaks down what Part A and Part B actually demand, where brands consistently fall short, and what a technically defensible CPSR looks like in practice.

Why the CPSR Exists — and What Article 10 Actually Says

Article 10 of Regulation (EC) No 1223/2009 is unambiguous: before any cosmetic product is placed on the EU market, the Responsible Person must ensure a safety assessment is carried out and documented in a Cosmetic Product Safety Report. That report must be kept in the Product Information File and be accessible to competent authorities on demand — not within 30 days, not “upon formal request,” but immediately.

There is no minimum sales volume threshold. No exemption for small producers. An artisan soap maker operating out of a workshop in Lyon and a multinational skincare group are held to exactly the same standard.

The CPSR must also be prepared — or at minimum reviewed and signed — by a qualified safety assessor. Article 10(2) specifies that this person must hold “a diploma or other evidence of formal qualifications awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine or a similar discipline.” Equivalent professional experience can qualify, but the burden of demonstrating that falls entirely on the Responsible Person.

This credential requirement is where smaller brands most commonly stumble. Having a formulation consultant draft your CPSR is not equivalent to having a qualified safety assessor sign it. ANSM inspectors will ask for the assessor’s credentials. If they are absent from the file — or if the qualification listed doesn’t meet the statutory threshold — the product may be deemed non-conforming regardless of how well the formula was designed.

Part A: Building the Safety Information File

Part A of the CPSR is the evidentiary foundation. Think of it as the dossier the safety assessor evaluates before drawing conclusions in Part B. Annex I specifies ten domains of information that must be addressed.

Quantitative and qualitative composition

Every substance present in the finished product must be declared — including impurities in raw materials that exceed technically unavoidable levels and that are toxicologically relevant. Fragrance mixtures may be listed as “perfume” or “aroma” per INCI convention in the finished product labelling, but the full fragrance palette must be disclosed internally to the assessor, particularly for the 26 regulated allergens listed in Annex III. As the SCCS continues to issue opinions on additional sensitising compounds, keeping this section current matters more than brands typically appreciate.

Physical and chemical characteristics and stability

This is not a marketing specification sheet. Regulators expect stability data appropriate to the product type. Accelerated stability testing at 40°C/75% relative humidity over a minimum of 12 weeks is a standard baseline for most finished formulas. Real-time data is required to substantiate shelf-life claims beyond 30 months, at which point the Period After Opening symbol becomes mandatory. For water-containing emulsions, pH stability and viscosity trends must be documented. For anhydrous products, oxidative stability is often the more relevant parameter.

Microbiological quality

Challenge testing per ISO 11930:2019 is the recognised method for demonstrating preservative efficacy in preserved cosmetics. The data must show the system is effective under normal and reasonably foreseeable conditions of use. A persistent gap we see in incoming PIFs: the challenge test was performed on a prototype formulation, not the commercially manufactured product. Any change to preservative concentration, water activity, or pH since the original test was run invalidates the data. Re-testing is not optional.

Impurities, traces, and packaging information

This section demands particular attention for brands sourcing botanical or mineral ingredients from non-EU suppliers. Trace contaminants — heavy metals, pesticide residues, polycyclic aromatic hydrocarbons, nitrosamines — must be addressed. If your supplier’s Certificate of Analysis does not cover analytically determined limits for relevant impurities, the assessor cannot responsibly complete this section. We’ve reviewed PIFs where the impurities entry reads “no relevant impurities identified” without a single analytical report behind it. That is not a CPSR; it’s a documented gap.

Normal and reasonably foreseeable use

This means describing how a consumer actually uses the product — not just what you intend them to do with it. A leave-on scalp serum applied daily to an adult with a compromised skin barrier presents a very different exposure profile from a rinse-off conditioning treatment used once weekly. Consumer misuse scenarios matter too: a product positioned for adults that a child could access, or a product stored in a bathroom where temperature and humidity fluctuate significantly.

Exposure to the cosmetic product and to its constituent substances

These two sections — Points 6 and 7 in Annex I — are where the real technical work happens. Exposure must be estimated using recognised methodology, expressed typically as a Systemic Exposure Dose (SED) for substances of concern. The SCCS Notes of Guidance (11th revision) provide the framework: body surface area covered, product retention factor, application frequency, and amount applied per use all feed into the model.

Brands that copy SED figures from a previous product’s CPSR without adjusting for the new product’s use profile are producing assessments that won’t survive scrutiny. A body lotion used daily by a 60 kg adult and a facial serum used three times weekly by a 75 kg adult have fundamentally different SEDs for the same ingredient at the same concentration.

Toxicological profile of the substances

For each substance of regulatory concern — preservatives, UV filters, colorants, substances with restricted use under Annex III — the assessor must document the toxicological dataset: the No Observed Adverse Effect Level (NOAEL) or benchmark dose, endpoint data covering dermal irritation, sensitisation potential, genotoxicity, and reproductive toxicity where relevant, and any applicable SCCS opinions. Stating that an ingredient “is listed in Annex III therefore is safe at the permitted concentration” is not a toxicological profile. It’s a citation without analysis.

Undesirable effects and serious undesirable effects

Article 23 of the Regulation requires Responsible Persons to notify competent authorities — in France, that means the ANSM — of serious undesirable effects. Part A must include a log of any known adverse events: consumer complaints, dermatologist reports, post-market surveillance data. Many brands list “none reported” for products that have been on market for two or three years. For those products, that claim requires documentation — records of the complaint-handling system and confirmation that no qualifying events occurred.

Part B: The Safety Assessment Itself

Part B is where the assessor makes their professional judgement. It is shorter than Part A, but it carries the regulatory weight.

The assessment conclusion must explicitly state whether the cosmetic product, as formulated and used according to its intended purpose and reasonably foreseeable misuse, is safe for human health. This is not a formality. The conclusion must follow logically from the data presented in Part A, and any gap between what Part A documents and what Part B concludes will attract regulatory attention.

The assessor must also identify any labelling warnings or conditions of use needed to ensure safety — “avoid contact with eyes,” “not suitable for children under 3 years,” concentration limitations for specific populations. If the exposure modelling in Part A reveals a Margin of Safety below the standard threshold of 100 for a given substance, Part B must address that finding directly — either with additional data justifying the deviation, a recommendation to reformulate, or a scientifically reasoned explanation for why the standard MoS is not applicable in that context.

The assessor’s full name, qualification, date, and signature must appear in Part B. Undated signatures are a surprisingly common deficiency in PIFs we review. So are signatures without the assessor’s qualification clearly identified. Both are straightforwardly correctable — and both will be flagged in an inspection.

One distinction worth making explicit: the safety assessor is not a rubber stamp on work prepared by the manufacturer’s QA team. Their professional liability is real, and a responsible assessor will question incomplete or inconsistent data in Part A rather than simply endorsing it. The best-functioning compliance arrangements we work with maintain a clear separation of roles — the brand’s technical team compiles Part A; the independent assessor critically reviews it before drafting Part B. That structure protects both parties.

What French Regulators Actually Look For

Based on publicly available enforcement data and the ANSM’s published cosmetics vigilance guidance, French market surveillance authorities focus consistently on a set of recurring deficiencies:

• Missing or insufficiently documented assessor credentials — particularly for products manufactured outside France by brands relying on remote safety assessors they’ve never met in person
• Stability data that predates the current formula — reformulations where the original stability study was never repeated
• SED calculations carried forward from a predecessor product without adjustment for the new product’s use profile or application frequency
• Challenge testing performed on a prototype formulation that differs from the batch currently being sold
• Incomplete documentation of post-market surveillance for products that have been on market for more than 12 months

The consistent finding from DGCCRF activity reports is that documentation deficiencies are more common than genuinely dangerous formulations. The products are often technically safe — but the paper trail that demonstrates that safety is absent or inadequate.

Three Priority Actions for This Month

If there is any uncertainty about whether your CPSR would survive an ANSM inspection today, these are the highest-priority items:

First, pull every CPSR for products that have been reformulated or repackaged since the original safety assessment. If the assessor’s sign-off predates a formula change — even a minor substitution of preservative system or a shift in batch supplier — the document needs to be updated and re-signed. “Minor” changes have a way of mattering under inspection conditions.

Second, confirm your safety assessor’s credentials are on file and unambiguous. A degree certificate, professional registration number, or equivalent documentary evidence should accompany every assessment in your PIF. This typically takes 15 minutes to request and file. It can save weeks of enforcement correspondence.

Third, cross-check your exposure calculations against your current product marketing. If a product was originally assessed under a “weekly use” positioning and your brand now promotes daily use, the SED calculation in Part A is wrong. Part B’s conclusion rests on incorrect assumptions. That misalignment between marketing and compliance documentation is a common source of inspection findings.

A properly constructed CPSR under Regulation (EC) No 1223/2009 isn’t just a regulatory obligation — it’s a genuine technical evaluation of your product’s safety. Brands that approach it that way tend to pass inspections with substantially fewer findings. And they tend to know what’s in their products well enough to stand behind them.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and CPSR review. Contact us

Related from our network

• ISO 17025 accredited cosmetic ingredient and stability testing — Qalitex Laboratories provides accredited analytical testing for EU cosmetics compliance, including microbiological challenge studies, heavy metal screening, and stability protocols that satisfy Part A documentation requirements.
• Health Canada NHP compliance for European brands entering Canada — Androxa supports European cosmetics and supplement manufacturers with Canadian natural health product registration and third-party testing documentation.