EU regulatory guide

CPNP Notification: what it is, who files it, and what the portal requires

CPNP is the European Commission's mandatory online system for notifying every cosmetic product before it is placed on the EU market. No notification, no legal sale. The legal basis is Article 13 of Regulation (EC) No 1223/2009, in force since 11 July 2013.

Only the EU-established Responsible Person can submit a CPNP notification. Distributors file in narrow cases; the notification duty stays with the RP. That rule decides who holds the portal account. Everything else follows from it.

CPNP definition: what it stands for and why it exists

Before the CPNP existed, brands notified products separately in each country. The Commission replaced that patchwork with a single portal: one notification covers all 27 member states, with no national repeat filings.

The data does not sit idle. Competent authorities use it for market surveillance. Poison centres use it to identify product composition in real time when someone swallows or is exposed to a product. A notification is not box-ticking; it is what makes emergency medical response possible.

Who needs to notify on CPNP?

The rule is absolute: no product may be placed on the EU market before the notification is complete. There is no grace period and no provisional sale window. A brand that ships to an EU retailer without a completed notification breaches the regulation from day one.

CPNP notification requirements and fees: what you actually pay for

Two of those fields carry practitioner traps. First, the INCI list must use exact INCI nomenclature; supplier trade names invalidate the record. Second, nanomaterials trigger a separate obligation under Article 16: a distinct notification to the Commission six months before the product is placed on the market. It cannot be folded into the standard Article 13 filing, and the six-month clock is why nano-containing sunscreens and foundations need their regulatory work started half a year before the launch date, not the week before.

The CPNP is a notification system, not a product approval. Submitting data does not certify safety. The Product Information File and the signed Cosmetic Product Safety Report must be complete before the portal ever comes into it.

Single-component products vs kits and sets: what changes in the notification

A single-component product is one sellable item, one notification. A kit or set is not. The configuration itself is the product, and the configuration needs its own notification.

The test is what the customer buys. If a serum ships alone, that serum carries one CPNP notification. If the same serum ships in a box with a cleanser and a cloth, the box is a distinct product - its own name, its own label, its own Responsible Person named on that label.

The components do not lose their existing notifications. Sold separately, each keeps its own entry in the portal. Sold inside the kit, they sit under the kit's notification as well. That is how a brand ends up with more CPNP registration entries than it has formulas.

Formulation data follows the same logic. What you submit is the formulation of the configuration as sold, not three ingredient lists stapled together. If the kit includes an applicator, a mixing step, or a dilution, that detail belongs in the notification.

Practical takeaway: count sellable configurations, not formulas. A gift set that ships in two sizes is two notifications; a refill pouch sold with a case is a third. Product Information File coverage has to match the configurations you sell, and the step-by-step CPNP notification guide sets out the order of work.

CPNP notification fees and what you are actually paying for

The portal does not charge you to file. The European Commission levies no submission fee for a CPNP notification, and adding a second EU member state to an existing product costs nothing extra. The Cosmetic Products Notification Portal is a free online system.

So when a brand asks what a CPNP notification fee covers, the honest answer is that the money is not in the filing. It sits in what has to exist first: the Cosmetic Product Safety Report, a Product Information File that holds together, an agreed EU Responsible Person arrangement, and the time to enter formulation, labelling, and packaging data accurately.

That preparation is not a formality. A CPSR that is unsigned or missing Part B, or a formula entered at the wrong concentration, blocks the notification or pushes it into revision. Fixing the record afterwards takes longer than building it correctly.

Practical takeaway: budget for preparation, not for a portal fee. Anyone quoting a "CPNP filing fee" is charging for the work around the portal - ask what is in scope, and request a scoped quote that names the CPSR, the PIF, and the filing.

CPNP portal access: who can submit, log in and hold an account

The Responsible Person is not a mailbox. They carry full legal liability for the product: the accuracy of the safety assessment, the correctness of the label, the completeness of the notification. Appointing an entity that does not genuinely understand the regulation creates exposure that lands back on the brand.

CPNP portal access, logins and account roles

Access runs through EU Login. A user creates an EU Login account, confirms the email address, requests access to the CPNP application through the Commission's access tool, and attaches that login to an organisation with a declared role - Responsible Person, or distributor.

Who holds the account matters more than who clicks submit. The organisation record is tied to an EU-established legal entity, so a CPNP account should sit with the Responsible Person - not with a brand's marketing team and not on an agency staffer's personal login.

Brand-side staff and outside consultants can be granted user access to work inside the account without owning it. On a well-run setup, the brand has visibility and the RP has control. That distinction is what an authority looks for when it checks who was accountable on a given date.

When the Responsible Person changes, the account does not travel with the product. The incoming RP files under its own organisation record, and the outgoing RP's entries are superseded. Sequence matters: appoint the new RP first, then re-notify, or the products sit in limbo with no one accountable.

Practical takeaway: treat portal access as part of the EU Responsible Person role, and read switching your EU Responsible Person before any handover so access moves in the right order. Brands selling into Great Britain run a separate SCPN filing through a UK Responsible Person.

How to access and use the CPNP portal

Once inside, each product follows a structured form: category, formulation data, label image, packaging photo, Responsible Person details. The record becomes visible to authorities and poison centres immediately. Keep it current: a formula change, a label update or a change of Responsible Person all require the record to be updated, and an outdated notification is a non-compliant notification. The full filing sequence is in our step-by-step CPNP notification guide.

What happens to the notification when you switch Responsible Person?

In practice the switch is a controlled handover: the new RP takes over the Product Information Files, re-notifies each product, and the label’s RP name and address change with the next print run. Done in the right order it causes no sales interruption; done late it leaves products on shelves referencing an RP that no longer answers for them. The full sequence is in our guide to switching your EU Responsible Person.

CPNP and the UK: what changed after Brexit?

A brand selling in both markets therefore needs two notifications, two Responsible Persons and two label blocks. Handling both through one partner removes the duplication; that is exactly the pairing of our EU and UK Responsible Person services.

Common CPNP mistakes, and what gets flagged first

From the notifications we review, the first-rejection causes rank like this: wrong product category (a leave-on classified as rinse-off changes the whole exposure assessment), trade names where INCI nomenclature belongs, label and notification naming different legal entities, and nano ingredients filed under Article 13 alone with no six-month Article 16 pre-notification. Behind all of them sits the structural one: treating the CPNP as the whole compliance process. The notification is the final step; without a completed PIF and a signed CPSR underneath, it is a compliant-looking shell over an incomplete file.

The quiet failure mode is staleness. Brands file once and never revisit; three reformulations later the poison-centre record describes a product that no longer exists. Reformulation, repackaging, relabelling and RP changes all trigger an update duty.