EU regulatory guide

EU Cosmetics Regulation: what brands need to know before selling in Europe

One regulation, 27 markets, six annexes and a fixed sequence of pre-market duties. This is the map of Regulation (EC) No 1223/2009 for brands entering the EU.

Written and reviewed by Cassandra Maddocks

Chemist & biochemist · cosmetic safety assessor · LinkedIn · last reviewed 22 August 2026

TL;DR: Regulation (EC) No 1223/2009 is the single framework for every cosmetic sold in the EU’s 27 member states, wherever it is made. Before sale a product needs a designated Responsible Person established in the EU, a completed CPSR, a Product Information File, and a CPNP notification. Non-compliance is grounds for market withdrawal, not a paperwork slap.

EU Cosmetics Regulation (EC) No 1223/2009: the framework

Regulation (EC) No 1223/2009 is the primary law for cosmetics on the EU market: in force since 11 January 2010, fully applicable since 11 July 2013, replacing Directive 76/768/EEC. As a regulation it applies directly and identically in all 27 member states, with no national transposition. This guide follows our cosmetic regulatory methodology.

It defines a cosmetic as any substance or mixture intended for contact with the external parts of the body, skin, hair, nails, lips, external genital organs, teeth or oral mucosa, to clean, perfume, change appearance, protect, keep in good condition or correct body odours. Fit that definition and the regulation applies to you.

Who does EU cosmetic regulation apply to?

Anyone placing a cosmetic on the EU market, wherever they are based. Manufacturers, importers (the default Responsible Person for goods from outside the EU), distributors with verification duties, and private-label brands all carry defined obligations.

The Responsible Person is the load-bearing concept: every product must have one, established in the EU, and a non-EU brand cannot hold the role itself. It appoints an EU entity by written mandate. This is the barrier non-EU brands hit first, because without it nothing else can proceed.

Key compliance requirements under Regulation 1223/2009

Eight duties, all mandatory: a signed CPSR, a PIF kept 10 years, a CPNP notification for EU cosmetic product registration, Article 19 labelling, a designated RP, GMP to ISO 22716, post-market surveillance, and serious-undesirable-effect reporting. Miss one and the product is non-compliant.

The six annexes, explained

Annex I sets the CPSR structure. Annex II bans over 1,700 substances outright. Annex III restricts hundreds more to conditions. Annexes IV, V and VI are positive lists: only listed colorants, preservatives and UV filters may be used at all. Every formula must clear all six before launch.

Annex III entry for retinol in Regulation 1223/2009 on EUR-Lex showing concentration limits — A live Annex III row: the retinol restriction in the consolidated text on EUR-Lex, one of the 2024-wave amendments now in force. From our evidence library.

Annex III is the most frequently amended, and the positive-list logic of IV, V and VI catches formulators used to the US model: in the EU an unlisted preservative is not a grey area, it is prohibited. Our guide to banned and restricted EU ingredients goes deeper.

EU cosmetics regulation amendments: 2024-2026 updates

Regulation 2024/858 banned or restricted a set of nanomaterials (colloidal gold, silver, platinum, styrene/acrylates copolymer nano). Regulation 2024/996 restricted retinol and other vitamin A derivatives, arbutin, kojic acid, triclosan, triclocarban and suspected endocrine disruptors, phasing in from 1 May 2025. Regulation 2025/877 and a further 2026 omnibus added CMR substances to Annex II, and Implementing Decision 2025/1175 refreshed the INCI glossary.

Each amendment carries staggered dates for placing on the market versus making available, which is how a product can be legal to ship in March and illegal to restock in November. The expanded fragrance-allergen list under Regulation 2023/1545 (0.001% leave-on, 0.01% rinse-off thresholds) is on its own transition through 2026. A formula checked two years ago has not been checked.

My take, from practice

The 2024 to 2026 amendment wave changed the job. Ingredient review used to be a launch-time task; it is now a subscription. Retinol limits, the nano prohibitions, the expanded allergen list and two CMR omnibus rounds all landed inside two years, each with its own staggered deadlines for placing versus making available on the market, and each quietly stranding formulas that were compliant when they shipped. The brands that get caught are almost never using exotic ingredients; they are using last year’s ingredient check. Every file we hold gets re-screened against the consolidated text when an amendment publishes, which is exactly the kind of tedium worth paying someone else to own.

EU labelling requirements

Article 19 mandates the eu cosmetic labeling regulations: RP name and address, country of origin for imports, nominal content, durability date or PAO symbol, precautions, batch number, product function where not obvious, and the full INCI list in descending order, colorants last by CI number. Nano ingredients carry (nano) after the name.

Article 19 labelling requirements of Regulation 1223/2009 highlighted on EUR-Lex — Article 19 in the consolidated text: the mandatory label elements, highlighted at source.

Claims sit under Regulation 655/2013 and its six common criteria: legality, truthfulness, evidential support, honesty, fairness and informed decision-making, with the evidence living in the PIF. See the claims rules explained and the full labelling guide.

Common criteria for cosmetic claims in Regulation 655/2013 highlighted on EUR-Lex — The claims criteria of Regulation (EU) No 655/2013, highlighted in the official text.

EU vs UK after Brexit

Since 1 January 2021 Great Britain runs its own retained version of the regulation, enforced by OPSS, and the two systems are diverging: separate RPs, separate portals, separate restriction timelines. Northern Ireland stays on EU rules under the Windsor Framework. Full detail in EU vs UK compliance compared.

Topic	EU	Great Britain
Responsible Person	Established in the EU/EEA	Established in Great Britain
Notification portal	CPNP	SCPN
Ingredient restrictions	Updated continuously by Commission regulation	Updated by separate UK statutory instrument; timing diverges
Label address	EU RP name and address	GB RP name and address
Updates reach the market	Automatically, all 27 states	Only via separate UK instrument

GB has moved on substances like methyl salicylate and BHT on its own schedule. EU-compliant no longer implies GB-compliant, and vice versa; both files need their own ingredient watch.

EU vs US (MoCRA) and Switzerland

MoCRA (December 2022) brought US facility registration, product listing, GMP and adverse-event reporting, but no CPNP-style pre-market notification and no signed-CPSR equivalent; the EU restricts over 2,000 substances against a far shorter US federal list. Switzerland’s KoV/OCos ordinance tracks EU rules closely, so an EU-compliant product usually needs only labelling-language tweaks and a Swiss-established responsible party.

EU compliance is the most demanding of the three, which is exactly why it travels: clear the EU bar first and the Swiss and US files inherit most of the science.

How to comply, step by step

The sequence: 1) ingredient review against all six annexes in the current consolidated text; 2) appoint the EU Responsible Person; 3) commission the CPSR; 4) compile the PIF; 5) prepare Article 19 labelling; 6) notify on the CPNP; 7) stand up post-market surveillance. Typical end-to-end: 8 to 16 weeks for a straightforward product.

The order matters because each step feeds the next: the assessment needs the final formula, the label needs the assessment’s warnings, the notification needs the label. Reformulating after the CPSR is signed reruns the chain, which is why the ingredient review comes first, not last.

FAQ

Common questions about EU cosmetics regulation

Regulation (EC) No 1223/2009, applied directly in all 27 member states since July 2013 and amended continuously since. The current consolidated text on EUR-Lex is the working reference; older cached versions are how compliant-looking formulas go wrong.

Yes, under Article 4, established in the EU or EEA. A non-EU brand cannot hold the role itself and appoints an EU entity by written mandate. Without one, no sale in any member state.

The Cosmetic Products Notification Portal: the EU’s free, centralised pre-market notification system, filed by the Responsible Person. One notification covers all 27 member states.

Not since 1 January 2021. Great Britain runs a retained version with its own RP requirement, its own SCPN portal and its own restriction timetable; the lists are diverging. Northern Ireland stays on EU rules.

Member-state authorities can order withdrawal, require corrective action and impose national penalties; prohibited-substance and missing-CPSR cases draw recalls and import bans. The Responsible Person carries primary liability.

Typically 8 to 16 weeks from ingredient review to CPNP notification for a straightforward product; the safety assessment is the usual bottleneck. Novel ingredients, nanomaterials and heavy claims extend it. Start before production is finalised.

Sources

Primary and industry sources cited in this guide. Regulatory status last verified 22 August 2026.

Entering the EU market?

Responsible Person, CPSR, PIF and CPNP notification, handled end to end at fixed prices.

Get a quote