The EU Responsible Person Under Regulation EC No 1223/2009: What Non-EU Cosmetic Brands Must Understand Before Launch

Many brands discover the hard way that the phrase “my distributor handles EU compliance” is one of the most expensive assumptions in cosmetics export. When a UK skincare label entered the French market in late 2024 and a DGCCRF inspector requested its Product Information File, the importer produced a folder of translated ingredient lists and a safety data sheet. That is not a PIF. The resulting market withdrawal cost the brand an estimated €80,000 in returned stock, relabeling, and legal fees — none of which was covered by any insurance policy, because the Responsible Person obligations had never been properly assigned in the first place.

Regulation EC No 1223/2009 has governed cosmetics placed on the EU market since July 2013. After more than a decade, its core requirement — every cosmetic product must have a single, identifiable Responsible Person (RP) established within the EU — still trips up a remarkable number of non-EU brands each year. This post breaks down exactly what that obligation means, what the Product Information File must contain, and where the gaps most commonly appear before CPNP notification.

What Article 4 of Regulation EC No 1223/2009 Actually Requires

Article 4 is worth reading in full, not the summary you find in most distributor contracts. The Responsible Person must be a legal or natural person established in the European Union. Post-Brexit, a UK address no longer qualifies. The RP bears legal responsibility for compliance with the entire Regulation — not just labeling. That includes the safety assessment, GMP compliance statements, claims substantiation, and the maintenance of the Product Information File for at least 10 years after the last batch is placed on the market.

The RP can be the manufacturer (if EU-based), the importer, or a third party designated by written mandate. That written mandate matters enormously. We’ve seen regulatory consultants acting as RP without any formal document specifying the scope of their authority — which creates a compliance gap that competent authorities can and do exploit during inspections.

One thing Article 4 does not say is that the RP must hold specific technical qualifications. But it does say they must ensure compliance. In practice, that means either having qualified internal staff or contracting a firm that does. An RP who can’t read a Cosmetic Product Safety Report (CPSR) is not really in a position to “ensure” anything.

Building the Product Information File: What Article 11 Demands Step by Step

The Product Information File is defined under Article 11, and the Regulation is unusually specific about its required contents. Getting it right before CPNP notification isn’t optional — it’s a legal prerequisite.

Step 1 — Product description. This must be specific enough for a competent authority to unambiguously identify the product: shade range, format, intended use, and target population (adults, children under 3, etc.). A trade name alone is insufficient.

Step 2 — Cosmetic Product Safety Report (CPSR). This is the most frequently incomplete document in any PIF. Under Article 10, the CPSR must be prepared by a person holding a diploma awarded on completion of a university course in pharmacy, toxicology, medicine, or a similar discipline. That credential requirement is non-negotiable. A CPSR signed by someone without the qualifying background can invalidate the entire PIF during enforcement review.

The CPSR has two mandatory parts. Part A covers cosmetic product safety information: physicochemical profile, microbiological quality, impurities, packaging material interactions, and normal and reasonably foreseeable use conditions. Part B is the safety assessor’s conclusions on safety and their professional judgment on the adequacy of the Part A data. Both parts must be signed, dated, and include the assessor’s full qualifications.

Step 3 — Manufacturing method and GMP compliance statement. This is typically a declaration of conformity with EN ISO 22716:2007, the international standard for cosmetics Good Manufacturing Practice. The standard covers premises, personnel, equipment, raw materials, and batch documentation. Competent authorities can — and do — request audit records supporting this declaration.

Step 4 — Proof of the claimed effect. This consistently catches brands off-guard. If your label says “reduces the appearance of fine lines by 35% in 4 weeks,” that claim must be substantiated in the PIF. The EU’s Cosmetic Claims Regulation (EC No 655/2013) and the COLIPA claims substantiation guidelines both apply. In vitro data, clinical trial summaries, consumer perception studies, and ingredient-level peer-reviewed literature can all constitute valid evidence — but they must be specific to the claim being made and present in the PIF at the time of notification.

Step 5 — Animal testing data. Article 11(2)(e) requires a statement of the development history, including any animal testing conducted by the manufacturer, its agents, or its suppliers, in compliance with Article 18. Even a declaration that no animal testing was conducted is a required entry. Omitting it is a documentation gap, not a compliant silence.

CPNP Notification and What Has to Be True Before Your First Unit Ships

Article 13 requires notification through the Cosmetic Products Notification Portal (CPNP) before placing the product on the EU market. The notification must be submitted by the Responsible Person and includes: the product category, product name and exact function, all countries of intended sale, presence of nanomaterials (for which Article 16 creates additional requirements), presence of CMR substances used under Article 15(2) conditions, and the RP’s name and EU-registered address.

A detail non-EU brands frequently miss: CPNP access requires an EU Login account linked to an established EU entity. If your RP is a third-party consultancy, they should already have this in place. If you’re attempting to set it up yourself from a non-EU registered address, expect delays — and understand that any notification submitted before the PIF is complete is a liability, not a shortcut.

For products sold in France, the DGCCRF has statutory authority to request the PIF from the RP within 2 working days of the request under Article 11(3). This is the legal clock. If your PIF is sitting in a shared cloud folder that your RP doesn’t directly control, that’s a compliance failure regardless of how thorough the documents themselves are.

France also enforces bilingual labeling requirements under the Loi Toubon more strictly than most EU Member States. While Regulation EC No 1223/2009 requires label information in the language(s) of the country of sale, French authorities expect all mandatory label fields — usage instructions, precautions, and the list of ingredients — to appear in French. Decorative or fantaisie product naming may remain in another language, but functional mandatory text cannot.

Where Non-EU Brands Consistently Fall Short

Three gaps come up in PIF review processes with regularity, and none of them are obscure.

The safety assessor’s credentials aren’t on file. Article 10 requires the assessor’s name, address, and evidence of qualification to appear within the CPSR itself — not in a separate file, not “available on request.” Some brands outsource their CPSR to consultancies outside the EU that don’t meet the qualifying discipline requirement, and discover the problem only when a competent authority challenges it. By then, re-commissioning a compliant CPSR takes 6–12 weeks and blocks distribution.

Claims don’t have corresponding substantiation. Marketing teams routinely add claims after the initial PIF is assembled — on e-commerce listings, in social media copy, on retailer platforms. Every claim about the product is within regulatory scope. The PIF needs to grow alongside the brand’s messaging, and most internal processes don’t enforce that connection. A product that launched with “nourishing formula” on its label but now carries “clinically tested to improve skin barrier function in 28 days” on its retail page has a substantiation gap in its PIF whether or not the marketing team is aware of it.

The 10-year retention requirement has no supporting document management system. If your brand reformulates, discontinues a shade, or changes packaging, the retention clock resets for each affected batch. Without version-controlled PIF management that tracks which document set applied to each production run, reconstruction becomes expensive and potentially impossible. We typically advise clients to implement PIF version control as part of their initial setup — the cost of doing it at launch is a fraction of the cost of recreating it under regulatory pressure.

The initial cost of a thorough PIF build — typically €2,000–€6,000 for a standard leave-on formulation, depending on whether toxicological testing is required — is significantly lower than the cost of a single market withdrawal. The Regulation is clear on what’s required. The gap is almost always in execution, not intent.

---

If you haven’t confirmed your RP’s formal written mandate is in place, verified that your CPSR carries a qualified signatory whose credentials appear within the report, and ensured your PIF is retrievable by an EU-based entity within 2 working days — those are the three things to address before your next EU shipment. Everything else in your compliance program sits on top of that foundation.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• Raw material safety dossiers and COA verification for EU PIF submissions — ISO 17025-accredited ingredient testing to support your cosmetic product safety documentation
• GMP compliance and product testing for Canadian brands expanding into the EU — Cross-border regulatory testing support for North American cosmetic manufacturers