EU regulatory guide

EU Cosmetics Regulation: what brands need to know before selling in Europe

One regulation, 27 markets, six annexes and a fixed sequence of pre-market duties. This is the map of Regulation (EC) No 1223/2009 for brands entering the EU.

EU Cosmetics Regulation (EC) No 1223/2009: the framework

It defines a cosmetic as any substance or mixture intended for contact with the external parts of the body, skin, hair, nails, lips, external genital organs, teeth or oral mucosa, to clean, perfume, change appearance, protect, keep in good condition or correct body odours. Fit that definition and the regulation applies to you.

What Regulation (EC) No 1223/2009 actually replaced

The Cosmetics Directive 76/768/EEC governed the EU market until 11 July 2013. It was a directive, which meant 27 national transpositions and 27 sets of interpretations. Regulation (EC) No 1223/2009 replaced it with a single text that applies directly in every member state, with no national implementing law in between.

That shift matters commercially. Under the directive, a product could be compliant in one country and non-compliant in the next on the same formula. Under the regulation, one compliant dossier travels. The CPNP notification filed once covers all 27 member states, and the PIF kept for 10 years satisfies every competent authority that asks.

The regulation also introduced the Responsible Person as a single, named, EU-established legal entity accountable for the product. Before 2013, responsibility was diffuse. After 2013, an authority has one address to write to.

Two things did not change. The Annexes still define what may and may not be used, and the safety assessment obligation still sits with a qualified assessor. What changed is who signs, where the file lives, and how fast a non-compliant product can be pulled from 27 markets at once.

Who does EU cosmetic regulation apply to?

The Responsible Person is the load-bearing concept: every product must have one, established in the EU, and a non-EU brand cannot hold the role itself. It appoints an EU entity by written mandate. This is the barrier non-EU brands hit first, because without it nothing else can proceed.

Key compliance requirements under Regulation 1223/2009

The Responsible Person: Article 4 in practice

Article 4 requires an EU-established Responsible Person before a cosmetic product is placed on the market. Not after launch. Not once a retailer asks. Before.

The Responsible Person is a legal entity, not a job title. It must hold a written mandate from the brand, keep the PIF available to competent authorities, and act as the single point of contact for market surveillance. If the authority cannot reach a Responsible Person, the product is not compliant — regardless of how good the formula is.

For brands outside the EU, this is the first hard gate. A US or UK brand cannot self-appoint. It needs an EU-established entity to accept the mandate in writing. That entity carries real obligations: cooperating with authorities, initiating withdrawals, and holding the technical documentation for the retention period.

The practical test is simple. If a national authority in any member state requested the CPSR today, could the Responsible Person produce it within the deadline? If the answer is no, the product is exposed. The mandate is not paperwork — it is the legal mechanism that makes the product sellable.

The six annexes: Annex II bans, Annexes III–VI restrictions

Annex III is the most frequently amended, and the positive-list logic of IV, V and VI catches formulators used to the US model: in the EU an unlisted preservative is not a grey area, it is prohibited. Our guide to banned and restricted EU ingredients goes deeper.

Annex II vs Annex III: the difference that catches formulators

Annex II is the prohibition list. It names substances that cannot be present in a cosmetic product at all — more than 1,700 entries, including the substances banned under Regulation (EU) 2024/858 such as colloidal gold, silver, platinum, and styrene/acrylates nano forms. Presence is the offence. There is no concentration at which an Annex II substance becomes acceptable.

Annex III is the restriction list. Substances here are permitted, but only inside stated limits: maximum concentration, product type, area of application, and mandatory label warnings. A preservative allowed at 0.5% in a rinse-off product may be prohibited in leave-on. Same substance, different verdict.

Annexes IV, V and VI are positive lists — colorants, preservatives, and UV filters respectively. If a substance is not on the relevant positive list, it cannot be used for that function, even if it is safe for another. A colorant not listed in Annex IV cannot colour a product, full stop.

The compliance failure is almost never a banned ingredient used deliberately. It is a restricted ingredient used outside its conditions, or a positive-list substance used for a function it is not listed for. Both are caught at the CPSR stage — if the assessor sees the full formula.

EU cosmetics regulation amendments: 2024-2026 updates

Each amendment carries staggered dates for placing on the market versus making available, which is how a product can be legal to ship in March and illegal to restock in November. The expanded fragrance-allergen list under Regulation 2023/1545 (0.001% leave-on, 0.01% rinse-off thresholds) is on its own transition through 2026. A formula checked two years ago has not been checked.

Reading the amendment pipeline without panicking

Amendments to 1223/2009 arrive continuously and change the Annexes, not the framework. The framework has been stable since 2013. What moves is the substance lists.

Regulation (EU) 2024/858 restricted several nanomaterials, including colloidal gold, silver, and platinum. Regulation (EU) 2024/996 updated restrictions on vitamin A, alpha-arbutin, and kojic acid, with transition periods for products already on the market. Regulation (EU) 2025/877 addressed further substance entries. Decision (EU) 2025/1175 sits in the same pipeline of technical updates.

The pattern is consistent: a substance is restricted, a transition window opens for existing stock, and the window closes on a fixed date. Products placed on the market before the cut-off may continue to be sold until the stated end date. Products placed after it may not.

The operational rule is to track the transition date, not the publication date. Publication tells you a change is coming. The transition date tells you when your current stock becomes unsellable. Reformulate against the transition date and the CPSR must be updated to match.

EU cosmetic labelling regulations: Article 19 in full

Claims sit under Regulation 655/2013 and its six common criteria: legality, truthfulness, evidential support, honesty, fairness and informed decision-making, with the evidence living in the PIF. See the claims rules explained and the full labelling guide.

The INCI list and the labelling rules that trip brands up

Article 19 sets the mandatory label content: the Responsible Person’s name and EU address, nominal content, date of minimum durability or period-after-opening, precautions for use, batch number, and function unless obvious from presentation.

The INCI ingredient list has its own rules. Ingredients are listed in descending order of concentration at the time of manufacture, down to 1%. Below 1%, order is free. Ingredients at any concentration below 1% may be listed in any order after the 1% threshold — a detail that decides whether a “hero ingredient” claim survives scrutiny.

Nanomaterials must be labelled with the word nano in brackets after the ingredient name. This is not optional and not cosmetic. Regulation (EU) 2024/858 tightened which nano forms may appear at all.

Language is the other trap. The label must be in a language easily understood by the consumer in the member state of sale. An English-only label is compliant in Ireland and non-compliant in France. Multi-market packaging needs multi-language panels, and the PIF must reflect the artwork actually shipped.

EU vs UK cosmetic regulation after Brexit

GB has moved on substances like methyl salicylate and BHT on its own schedule. EU-compliant no longer implies GB-compliant, and vice versa; both files need their own ingredient watch.

EU vs US (MoCRA) and Switzerland: one product, three rulebooks

EU compliance is the most demanding of the three, which is exactly why it travels: clear the EU bar first and the Swiss and US files inherit most of the science.

How to comply with EU cosmetic regulation, step by step

The order matters because each step feeds the next: the assessment needs the final formula, the label needs the assessment’s warnings, the notification needs the label. Reformulating after the CPSR is signed reruns the chain, which is why the ingredient review comes first, not last.

The order of operations: what must exist before what

Compliance has a sequence. Running it out of order costs weeks.

First, appoint the Responsible Person under Article 4. Nothing else can be finalised without an EU-established entity holding the written mandate.

Second, complete the CPSR. Part A covers the safety assessment, Part B the product data. Both must be signed by a qualified assessor. The formula must be frozen before this step — a reformulation after sign-off invalidates the assessment.

Third, build the PIF. The CPSR, the manufacturing method, the proof of efficacy for claims, and the label artwork all live here. It is retained for 10 years from the date the last batch was placed on the market.

Fourth, file the CPNP notification. One filing covers all 27 member states. It can be filed before the product is on sale, but not after.

Fifth, verify the label against Article 19 and the claims against Regulation (EU) No 655/2013. Claims must be supported by evidence in the PIF — the common criteria are not advisory.

The sequence is the compliance. Skipping step one to save time means redoing steps two through five.