EU Cosmetics Stability Testing: The PAO Evidence Gap That Puts Brands at Risk

Most cosmetic brands can point to a PAO symbol on their packaging — that little open-jar icon followed by “12M” or “24M.” Far fewer can actually justify the number printed there with real stability data.

That gap matters. Under Regulation (EC) No 1223/2009, specifically Annex I Part A Section 7, stability information is a mandatory component of every Product Information File (PIF). Not a nice-to-have. Not something a safety assessor can wave through with a note saying “the formula appears stable.” Actual data, generated under defined conditions, documenting the product’s physical, chemical, and microbiological behaviour over time.

In the CPSR reviews our team handles for European brands, incorrectly justified PAO periods are among the top three deficiencies we encounter. Those deficiencies don’t just delay a safety assessment — in a DGCCRF inspection or a cross-border market access review, they can trigger a recall or a market withdrawal.

What Regulation 1223/2009 Actually Requires for Stability

The regulation draws a clear line at 30 months. For products with a shelf life greater than 30 months, you don’t need to print an expiry date — but you do need a PAO (Period After Opening) symbol, the open-jar icon specified in Annex VII. For products at or under 30 months, you need a minimum durability date (the “best before” date, indicated by the hourglass symbol).

The logic is straightforward: shorter shelf-life products carry an expiry date; longer-lived products rely on the consumer understanding that once opened, the clock changes. But here’s where brands go wrong: they assume that choosing a 30-month-plus shelf life means less documentation burden. It means different documentation. The PAO you print must be supportable by stability evidence — and “we’ve been making this formula for years and no customer has complained” is not evidence.

Annex I Part A Section 7 of the Regulation calls for “stability of the cosmetic product under reasonably foreseeable storage conditions.” The operative word is stability, not familiarity. Your formula may well be stable for 24 months after opening. You need to be able to demonstrate that.

The SCCS (Scientific Committee on Consumer Safety) Notes of Guidance for the Testing of Cosmetic Ingredients and their Safety Evaluation — currently in its 12th revision — provides useful methodology context, though it addresses ingredient testing primarily rather than finished-product stability. In practice, the framework used by most EU safety assessors aligns with ISO 22716:2007, specifically clause 7.5, which addresses finished product stability within the Good Manufacturing Practice standard.

What a Defensible Stability Study Actually Looks Like

A stability study that holds up under regulatory scrutiny typically runs two tracks in parallel: accelerated testing and real-time testing.

Accelerated conditions for cosmetics commonly use 40°C ± 2°C at 75% ± 5% relative humidity for a minimum of six months, adapting ICH Q1A guidance to cosmetic applications. Some labs run 50°C stress cycles to identify rapid instability, but those conditions alone rarely constitute a primary dataset. Real-time storage at 25°C ± 2°C / 60% RH — or conditions reflecting actual storage environments for the product category — provides the baseline.

What do you measure? At minimum:

• Appearance: colour, clarity, phase separation, precipitation, creaming
• pH: drift of more than ±0.5 units typically warrants investigation
• Viscosity and rheology: especially critical for emulsions, gels, and creams where texture is a functional property
• Organoleptic properties: odour and texture, assessed by a trained panel
• Microbiological counts: total aerobic microbial count (TAMC) and total yeast and mould count (TYMC) per Ph. Eur. 5.1.4 or applicable EN ISO methods
• Preservative system efficacy: tested separately via challenge testing (PET) per Ph. Eur. 5.1.3, but time-point micro data in the stability study must show no degradation

For products with functional active ingredients — SPF actives, vitamin C, retinol, alpha-hydroxy acids — you also need potency or concentration data at each interval. A sunscreen that shows physical stability at 12 months but whose UV filter has degraded by 15% is not a stable product in any meaningful regulatory sense.

Batch representativeness is another requirement brands consistently underestimate. One batch of stability data may be sufficient for an initial safety assessment, but the expectation in most EU national authority guidance is that you extend your dataset across at least three production batches over time. A single-batch PAO claim is technically defensible at market launch but increasingly scrutinised in post-market compliance reviews.

Finally, the study must be conducted on the finished product in its final packaging. Stability data generated in glass containers does not apply to a product launched in an HDPE squeeze tube. The primary packaging is part of the product’s protective system — it affects oxygen permeation, UV exposure, and potential leaching interactions. If you’ve changed your packaging since the original study, you need to re-run the study or formally justify packaging equivalence.

The Three Deficiencies We See Most Often in CPSRs

After reviewing CPSRs from brands across France, Germany, the Netherlands, and beyond, certain failure patterns repeat themselves with uncomfortable regularity.

1. A PAO pulled from a category default, not a study.

“24M is standard for this type of product” appears in safety assessor notes far more often than it should. Category benchmarks can serve as a starting point for study design — a rinse-off product might reasonably be expected to have a longer PAO than an anhydrous product with no preservative — but they cannot substitute for actual data. A DGCCRF inspector reviewing your PIF will ask for the stability report. “It’s industry standard” is not a report.

2. Stability data that no longer matches the marketed product.

Formula and packaging changes — even minor ones — don’t always trigger a re-evaluation of the PIF. A brand adjusts a preservative from phenoxyethanol to ethylhexylglycerin, or switches from a glass pump to a plastic tube, and the stability data in the file still references the original formulation. This creates a documentation mismatch that is easy for an inspector to identify and very difficult to justify after the fact.

3. Challenge testing results treated as stability data.

These are related but distinct. Preservative efficacy testing confirms that your preservative system works at a point in time. Stability testing confirms the product remains within specification across its shelf life. A passing PET result from Day 1 doesn’t tell you whether the preservative system remains effective at Month 18 — that requires time-point microbiological data from the stability study itself. Conflating the two in a CPSR is a reliable red flag for any experienced safety assessor.

How Stability Data Feeds Into the Cosmetic Product Safety Report

Under Annex I of Regulation 1223/2009, the CPSR is structured in two parts. Part A covers safety information — including stability data at Section 7. Part B is the safety assessor’s evaluation and conclusions. The assessor cannot complete a credible Part B without reviewing robust Part A data.

What does a safety assessor expect to see in Section 7? A summary table of stability results at each time point under each study condition; a statement on the study protocol (storage conditions, parameters measured, testing frequency); a batch reference number; and a conclusion on the proposed PAO or minimum durability date. A full stability study report as an appendix completes the package.

When stability data is thin, safety assessors face a professional ethics problem: they’re being asked to sign off on a product lifespan claim they cannot verify. Many add conditional language — “subject to ongoing stability confirmation” — but that’s a liability that travels with the product throughout its market life.

For brands also targeting export markets, the same data does double duty. US FDA’s voluntary cosmetics registration and Health Canada’s cosmetics regulations both expect brands to be able to substantiate product safety claims, which effectively requires stability data even where no explicit regulatory obligation is written. Build a robust study once, structured appropriately, and you’re positioned across multiple market requirements from day one.

Where to Start If Your PIF Has a Gap

If your current PIF contains a PAO without corresponding stability data, you’re carrying regulatory risk on every product it applies to. The path forward isn’t complicated, but it requires lead time.

Start by auditing your PIF against each product’s current formulation and packaging. Identify where stability data exists and where it’s absent or outdated. For products already on market, commission retroactive accelerated studies — a six-month study at 40°C provides sufficient evidence for a PAO decision while real-time data accumulates in parallel. For new launches, stability study design belongs in your development timeline, not retrofitted after your safety assessor raises the issue.

Work with your contract laboratory or internal QC function to standardise the study protocol across your range. Consistency matters: when all your stability studies use the same parameters, intervals, and acceptance criteria, your PIF documentation becomes coherent and audit-ready rather than a patchwork of one-off reports.

Stability testing isn’t glamorous regulatory work. It doesn’t have the urgency of a recall or the complexity of a novel ingredient dossier. But a DGCCRF inspector who asks to see stability data for a product carrying a 24M PAO symbol is making a very reasonable request. Being ready for that question is a baseline expectation — and right now, a surprising number of brands in the EU market are not.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• ISO 17025-Accredited Cosmetic and Supplement Testing — Qalitex Laboratories provides accredited finished-product testing, including stability and microbiological studies, for brands preparing US market dossiers.
• Cosmetic and NHP Stability Testing for the Canadian Market — Androxa supports Health Canada compliance with stability, challenge testing, and safety documentation for European brands exporting to Canada.