EU regulatory guide

What a CPSR needs from you.

A Cosmetic Product Safety Report is only as good as the data behind it. This guide lists the inputs a qualified assessor actually needs, which ones set the real timeline, and what to request from your manufacturer before the assessment starts.

Laboratory data and formulation documents prepared for a CPSR

Reviewed by Cassandra Maddocks, chemist & biochemist · last reviewed 26 July 2026

What inputs does a CPSR require?

The core set: the full formula with INCI names and exact percentages, raw material specifications and safety data sheets, stability data, microbiological quality including challenge testing, impurity and packaging information, and the product label. Annex I of Regulation (EC) No 1223/2009 defines what the report must cover.

Most of these are documents your manufacturer or formulator already holds. The work is collection, not creation. The exception is the lab testing, which is where timelines are made or lost. What the assessor produces from these inputs is described on our CPSR service page.

Whether each ingredient is even allowed, and at what concentration, is a separate check against the annexes: our banned and restricted ingredients guide shows the actual entries, and what each lab test proves is in the dedicated guides for microbiology, challenge and stability testing, summarised in the testing guide.

Article 10 of Regulation 1223/2009 on EUR-Lex with the safety assessment requirement highlighted
Article 10(1) of Regulation (EC) No 1223/2009, the safety assessment duty, as published on EUR-Lex, consolidation of 1 May 2026 (02009R1223, EN, 040.001). Captured 26 July 2026. View the official text.

Why does the assessor need exact percentages?

Because the safety assessment is quantitative. The assessor calculates exposure and margins of safety ingredient by ingredient, and checks each concentration against the regulation's annexes: restricted substances, permitted preservatives, colourants and UV filters all have limits that only exact percentages can verify.

A marketing INCI list is not enough. If your manufacturer treats percentages as proprietary, they can usually supply them directly to the assessor under confidentiality, a routine arrangement we handle regularly.

Which inputs set the real timeline?

Stability and challenge testing. Stability runs from three to twelve months depending on method, and challenge (preservation efficacy) testing has its own lab lead time. The report itself is fast once data is complete. The lab work is the schedule.

These are also the two inputs founders most often forget to budget for. A new formulation should start its testing months before the planned launch. The full cost and timeline picture is in our CPSR cost and timeline guide.

What about raw material documentation?

Each ingredient needs a specification and safety data sheet from its supplier, covering identity, purity and known impurities. The assessor uses these to evaluate toxicological profiles and impurity risks: allergens, heavy metals, and restricted-substance traces.

This is usually the largest pile of paper and the easiest to obtain: suppliers provide specs and SDS routinely on request. Gaps show up with exotic or artisanal ingredients, where documentation may need to be commissioned.

Does the label count as an input?

Yes. The assessor reviews the label's warnings, instructions and claims as part of the assessment. A product can be safe as formulated yet non-compliant as labelled. The label you provide should be the label you intend to print.

Getting the label reviewed in the same pass avoids the classic sequencing error of printing packaging before the assessment settles required warnings. That check is part of our label and claims review.

What happens to the inputs afterwards?

They become part of your Product Information File. The CPSR sits at the heart of the PIF, and the data behind it (specs, test reports, formula) stays in the file for ten years after the last batch, ready for inspection.

Collect once, use everywhere: the same input set feeds the EU file, its UK adaptation and the Swiss self-monitoring file. What the file itself must contain is in our PIF requirements guide.

Sources

Primary sources cited in this guide. Regulatory status last verified 26 July 2026.

Put this into practice

From data to a signed report.

Ready for your safety assessment?

Send us your product list and we will tell you exactly which inputs you already have, which are missing, and what the assessment will cost, before you commit.