EU General Product Safety Regulation: What Cosmetics Brands Compliant With 1223/2009 Still Need to Fix

Your cosmetics portfolio is Regulation (EC) No 1223/2009-compliant. Completed Product Information File, qualified Responsible Person registered on the CPNP, stability data, safety assessment signed by a toxicologist with the right credentials. Everything in order — or so it seemed.

Since 13 December 2024, the EU’s General Product Safety Regulation (GPSR), Regulation (EU) 2023/988, has been fully applicable. And a significant number of EU cosmetics brands have discovered, somewhat uncomfortably, that their 1223/2009 file doesn’t close the compliance gap that GPSR opens.

This matters practically, not theoretically. France’s DGCCRF, Germany’s Länder market surveillance authorities, and the European Commission’s Safety Gate rapid alert portal are already applying the new rules. Getting this wrong means documentation failures, marketplace delistings, and — in more serious cases — enforcement actions that your safety assessor’s letterhead cannot fix.

Why Your 1223/2009 Compliance Doesn’t Make You GPSR-Exempt

The most common misconception we hear from brand owners goes like this: “Cosmetics are covered by a specific EU regulation, so GPSR doesn’t apply to us.”

That’s not quite right — and Article 2(3) of GPSR explains why. The regulation applies to all consumer products “to the extent that there are no specific provisions with the same objective in rules of Union law.” The operative phrase is same objective. GPSR doesn’t disappear because your product has a separate regulatory home. It steps back only in the areas where 1223/2009 already legislates to the same end.

What does 1223/2009 cover? Broadly: ingredient safety (prohibited and restricted substances across Annexes II–VI), safety assessment methodology, the Product Information File structure, the Responsible Person appointment, labeling obligations, and CPNP notification. These are genuine lex specialis provisions, and GPSR defers to them.

But 1223/2009 says nothing specific about:

• Internal traceability systems for finished products across the full downstream supply chain
• Mandatory complaints and corrective-actions registers
• Harmonized recall procedures and Safety Gate notifications
• Obligations for fulfillment service providers and online marketplace operators
• Standardized post-market surveillance process documentation

In every one of those areas, GPSR applies in full to cosmetics brands. And those are exactly the areas where market surveillance authorities are now asking questions.

The Five Obligations That Land on Top of Your Existing PIF

1. A documented product traceability system. Article 9 of GPSR requires manufacturers to maintain technical documentation — including records that allow identification of the product, its origin, and its downstream distribution chain — for a minimum of 10 years after placing the product on the market. This is not the same as your PIF’s batch manufacturing records under ISO 22716. It encompasses traceability through wholesale, distribution, and — where technically feasible — through to end consumer. Brands with complex multi-market structures, selling simultaneously in France, Germany, and the Netherlands via different distributors, need a centralized system that links batch numbers to shipment destinations and economic operators at every tier.

2. A mandatory complaints and corrective-actions register. Article 9(6) requires manufacturers to keep a register of complaints relating to the safety of the product, alongside records of any corrective actions and recalls. Under 1223/2009, cosmetovigilance obligations cover serious undesirable effects — a narrower, clinically-defined category. GPSR’s complaints register captures a wider set: any consumer report suggesting a safety concern, even one that doesn’t meet the cosmetovigilance threshold. If your current process routes all complaints to customer service and no safety-flagged register exists, you have a documented gap.

3. Incident notification to market surveillance authorities. When a manufacturer becomes aware that a product they’ve placed on the market poses a risk to consumer safety, GPSR requires notification to the competent market surveillance authority without undue delay. The regulation is clear that “without undue delay” means acting promptly once the internal risk assessment is complete — not waiting for a quarterly review cycle. This runs in parallel to, and does not replace, cosmetovigilance reporting under Annex I, Part B of 1223/2009. Both systems need to be operational, and in most brands they’re managed by different people who haven’t coordinated their procedures.

4. Harmonized recall procedure documentation. Safety Gate — the EU’s product safety rapid alert portal, formerly known as RAPEX — is now the mandatory notification channel for product recalls under GPSR. Article 35 sets out the content requirements for a recall notice, including the product identifier, hazard description, risk level, and actions consumers must take. What the regulation expects is that this process is documented before an incident occurs: a written corrective-action plan specifying who notifies whom internally, how consumers are contacted, and what records are generated. Having a blank recall template that’s never been tested or assigned an owner is not sufficient. Market surveillance inspectors are starting to ask to see it.

5. Electronic contact address on the product. Article 9(7) requires that the manufacturer’s name, registered trade name or trademark, postal address, and — explicitly — electronic contact address be available on the product or its packaging. For cosmetics, much of this overlaps with existing 1223/2009 labeling obligations. But the electronic contact address requirement is new and specific. If your current labels carry a postal address and no URL or email contact point, you have a straightforward labeling gap to close before your next production run.

Online Marketplace Sales: The GPSR Gap Most EU Cosmetics Brands Haven’t Closed

Since late 2024, brands selling on Amazon EU have been receiving GPSR compliance documentation requests — packages that go well beyond what a CPNP printout covers. This is not Amazon acting overcautiously. It reflects GPSR Article 22, which for the first time makes online marketplace providers “economic operators” with specific obligations under EU product safety law.

Amazon, Zalando, and comparable platforms are now required to cooperate with market surveillance authorities, respond to product safety orders, and maintain records of potentially dangerous products flagged through their systems. They’re fulfilling those obligations partly by pushing documentation requirements upstream onto brand sellers. What they’re typically requesting includes: evidence of a documented safety management process, traceability records, a complaints register reference, and confirmation that recall procedures are established.

Your PIF and your safety assessment certificate satisfy none of those four requirements. Brands that respond to these requests with their CPNP registration confirmation are getting compliance flags — or temporary delistings — until they can supply the right documentation.

The practical fix is a GPSR Compliance File: a separate, structured documentation package that sits alongside your 1223/2009 file and addresses specifically the GPSR-mandated elements. It doesn’t replace your PIF. It complements it. Some brands we work with have built a single master folder linking both, with a cover sheet clarifying which document satisfies which regulatory obligation.

What DGCCRF Market Surveillance Looks Like in Practice

France’s DGCCRF is one of the EU’s most active market surveillance authorities and has historically operated as a leading indicator for how enforcement trends migrate across member states. Their published 2025 and 2026 supervisory priorities explicitly include consumer product traceability and digital commerce compliance — both squarely GPSR territory.

During a DGCCRF market surveillance inspection, the inspector will expect to review: a functional complaints register (date-stamped entries, not a blank template); the documented corrective-action and recall procedure with a named process owner; and confirmation that the CPNP Responsible Person appointment has been communicated in writing to all relevant downstream economic operators. Many brands have the RP appointed and registered on the CPNP but have never formally notified their distributors of that appointment in writing. Under GPSR’s traceability and economic-operator obligations, that downstream communication matters.

Member states are implementing GPSR penalty provisions differently — some have set fines scaled to percentage of annual global turnover, others have established fixed maximum amounts that apply per violation. The regulation itself, in Recital 79, calls explicitly on member states to ensure penalties are “effective, proportionate, and dissuasive.” Proportionate to a multinational brand’s turnover can mean a significant number.

Build the Second Layer Now

The brands handling this transition well aren’t necessarily the largest or best-resourced. They’re the ones that treated the GPSR compliance file as a live document rather than a one-time exercise.

Practically: audit your existing 1223/2009 documentation stack against the five GPSR obligations above. Identify the gaps specifically. Create or formalise the missing procedures before your next market surveillance interaction — not as a response to it. The complaints register needs to be operational with a process owner, not pending implementation. The recall procedure needs a named decision-maker and a tested notification pathway. The traceability records need to cover your current distribution footprint, including any third-party logistics providers and fulfillment partners that qualify as economic operators under GPSR.

If your Responsible Person was appointed with Regulation 1223/2009 exclusively in mind, confirm in writing that their mandate extends to GPSR obligations. Those are legally distinct responsibilities. In a significant proportion of RP service contracts signed before December 2024, the GPSR scope hasn’t been addressed. That’s a contractual gap with practical consequences.

EU cosmetic regulation 1223/2009 is the foundation. GPSR is the layer on top. Both need to be solid — and right now, most brands have built only the first one.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025-accredited cosmetic ingredient testing and supplier CoA verification — Qalitex Laboratories provides accredited analytical testing to support the traceability records and supplier documentation that GPSR-compliant brands need.
• Canadian market entry compliance for European cosmetics and supplement brands — Androxa supports European brands building compliant product files for the Canadian market across cosmetics and natural health products.