EU regulatory guide

Private label: whose compliance is it.

Reviewed by Cassandra Maddocks, chemist & biochemist · last reviewed 22 August 2026

TL;DR: If you market private label cosmetics under your name or trademark, you are the manufacturer under Article 2(1)(d) of Regulation (EC) No 1223/2009. Hiring a contract manufacturer or white-label lab does not move that status. The site is a subcontractor. You still need a Community Responsible Person, a CPSR, a PIF, and CPNP notification before placing the product on the market. Fully applicable 11 July 2013.

A purchase order that names the filling site as manufacturer is a commercial line, not a legal transfer. Article 2(1)(d) asks who had the product designed or manufactured and who markets it under their name or trademark. If that is your brand, you are the manufacturer, even when every kettle, filler and carton line sits at a third-party site.

CIGREG is the regulatory partner on that file. We are not the lab, and we do not take over manufacturing. The site remains a subcontractor. The brand remains the manufacturer. Mixing those roles is how private-label launches ship with the factory named in the wrong legal box.

Who is the manufacturer under Article 2(1)(d)?

The manufacturer is any natural or legal person who manufactures a cosmetic product or has such a product designed or manufactured, and markets that cosmetic product under his name or trademark. That is Article 2(1)(d). The filling lab is not that person. Article 2(1)(e) defines the distributor. Article 2(1)(i) defines the importer.

Article 2(1)(d) of Regulation 1223/2009 on EUR-Lex: manufacturer means the person who has the product made and markets it under their name or trademark — Article 2(1)(d) of Regulation (EC) No 1223/2009, manufacturer definition, from the official EUR-Lex consolidated PDF, consolidation of 1 May 2026 (02009R1223, EN, 040.001). Captured 23 August 2026. View the official text.

Article 2(1)(d) defines the manufacturer as any natural or legal person who manufactures a cosmetic product or has such a product designed or manufactured, and markets that cosmetic product under his name or trademark. Having it designed or made for you, then selling it under your name, is manufacturing in this regulation. The site that only fills to your brief is a subcontractor. The neighbouring definitions matter when you are not rebranding: a distributor under Article 2(1)(e) is anyone in the supply chain other than the manufacturer or the importer who makes the product available, and an importer under Article 2(1)(i) is the Community-established person who places a third-country product on the market. The map of those roles is in EU cosmetic regulations.

Did hiring a lab transfer manufacturer status?

No. Hiring a contract manufacturer or white-label lab does not transfer manufacturer status. The site is a subcontractor. Status follows the person who had the product designed or made and who markets it under their name or trademark. A purchase order cannot rewrite Article 2(1)(d).

The commercial document can name the filler, allocate batch records, and set a price per unit. It cannot move the legal face of the product. If your name or trademark is on the pack and you commissioned the design or the fill, you are the manufacturer. The lab stays a subcontractor even when the invoice says otherwise.

How does manufacturer status differ from the Responsible Person?

They are different roles. Article 4(1) to 4(6) say who must be designated as the Community Responsible Person and allow a written mandate. That written designation is not a transfer of Article 2(1)(d) manufacturer status. Translating a product already placed on the market is not a modification that changes those roles.

Article 4 of Regulation 1223/2009 on EUR-Lex with the responsible person requirement highlighted — Article 4 of Regulation (EC) No 1223/2009, where branding decides responsibility, as published on EUR-Lex, consolidation of 1 May 2026 (02009R1223, EN, 040.001). Captured 26 July 2026. View the official text.

Article 4(3) makes an EU-established manufacturer the default Responsible Person unless a written mandate appoints someone else. Article 4(5) does the same for the importer of a third-country product. Article 4(6) steps a distributor into the role when that distributor places the product on the market under its own name or trademark, or modifies it in a way that may affect compliance. The second paragraph of Article 4(6) is the trap people miss: translation of information relating to a product already placed on the market is not such a modification. Appointing an EU Responsible Person by written mandate is how a non-EU brand gets a Community RP. It does not stop that brand being the manufacturer under Article 2(1)(d).

What files must exist before placing on the market?

Before placing the product on the market, Article 5 duties sit with the Responsible Person. Article 10 and Annex I require a CPSR. Article 11 requires a PIF kept for 10 years. Article 13 requires CPNP notification. A lab COA does not replace a CPSR. A CPSR is $450-600 per product and is not optional because of that COA.

Article 11 of Regulation 1223/2009 on EUR-Lex: the product information file and its 10-year retention — Article 11 in the consolidated Regulation (EC) No 1223/2009: the PIF obligation and the 10-year retention window, highlighted at source. From our evidence library.

The factory file is built for the factory’s product, label and claims. Yours are different, so the file must be rebuilt for your brand. Ask the site for formula percentages, raw-material data, GMP evidence and existing tests, then commission a product-specific CPSR, hold a PIF for ten years after the last batch, and complete CPNP before first sale. A cooperative lab shortens the assessment. It does not finish it.

Does GMP sit with the site or the brand?

Article 8 requires manufacture in accordance with good manufacturing practice. The filling site performs GMP. The brand, as manufacturer under Article 2(1)(d), still needs the method of manufacture and a GMP statement in the PIF. ISO 22716 is the usual standard used to show GMP. It is not named in Regulation 1223/2009.

The site should be able to show how the batch was made and controlled. The PIF is where that method and the GMP statement live, at the Responsible Person’s address. ISO 22716 is the usual way to demonstrate the Article 8 duty. Treating the certificate as belonging only to the filler, and leaving nothing in the brand file, is how an inspection finds a hole.

How do GB, CH, US treat the same split?

Great Britain retained Regulation 1223/2009, with a UK Responsible Person and SCPN notification. Switzerland needs a separate file and a Swiss-territory address. In the United States the Responsible Person is typically the manufacturer, packer or distributor named on the label (FD&C Act 604(4) / 21 U.S.C. 364(4)). Facility registration is the site.

Article 2(1)(d) of retained Regulation 1223/2009 on legislation.gov.uk, with GB amendments F1 and F2 their visible — Article 2(1)(d) as retained in Great Britain: the manufacturer reading with GB amendments F1 and F2 visible on legislation.gov.uk. Captured 23 August 2026. View the official text.

VKos Article 2 Abs. 1 Bst. c on Fedlex: Hersteller is the person who has the product made and places it on the market under their name or mark — VKos Art. 2 Abs. 1 Bst. c, Hersteller, from the official Fedlex PDF of Verordnung des EDI über kosmetische Mittel, SR 817.023.31, Stand 1. Januar 2026. Letter c, not d. Captured 23 August 2026. View the official text.

GB keeps the same manufacturer reading and a separate UK RP plus SCPN filing; the retained text is on legislation.gov.uk, and the working guidance is GOV.UK on making cosmetics available in Great Britain. Switzerland is not a second CPNP: hold a separate file and a Swiss-territory address. That file is not an EU PIF by another name. The Swiss manufacturer reading sits in VKos Art. 2 Abs. 1 Bst. c, not letter d. In the US, the name on the label is typically the Responsible Person under FD&C Act section 604(4) / 21 U.S.C. 364(4). Facility registration is the manufacturing or processing site. FDA Media 190681 restates that split; the PDF is often bot-walled, so treat the statute as the working text, not a screenshot of the guidance.

What are the common private-label mistakes?

The recurring mistakes are treating the invoice as a legal transfer of manufacturer status, using the factory CPSR or PIF as they stand, leaving the Responsible Person with the filling site, treating CPNP as the whole process, and reading a US label name as an EU Responsible Person. None of those moves Article 2(1)(d).

The invoice names a supplier. It does not transfer manufacturer status. The factory CPSR and PIF describe the factory’s product, not yours. Leaving the RP at the filling site ties market access to that commercial relationship and, for an EU-made product, can leave the default Article 4(3) role with the site if no written mandate exists. CPNP is the last filing, not the file. A US label name is a MoCRA Responsible Person under FD&C 604(4). It is not a Community RP.

My take, from practice

The competent authority chases the manufacturer. Under Article 2(1)(d) that is the brand that has the product made and markets it under its name, not the lab. The lab is a subcontractor. That is why the client needs a strong commercial contract with the lab: the law is not looking through the brand to the filler. It is looking at the face on the pack.

What to lock before the first EU or UK batch?

Lock the manufacturer reading, an independent Community Responsible Person, a product-specific CPSR and PIF, and CPNP plus SCPN if you sell in Great Britain, before the first EU or UK batch. The EU+UK launch pack is $1,500 per product. A CPSR priced alone is $450-600. Notification priced alone is $150.

Do this before the first batch, not after the first shipment. Confirm in writing that your brand is the Article 2(1)(d) manufacturer and that the site is a subcontractor. Appoint the Community RP by written mandate so the role does not default to the filler. Build the CPSR and PIF for your label. Notify on CPNP, and on SCPN if Great Britain is in scope. Then fill.

FAQ

Common questions.

You are, if you have the product designed or manufactured and market it under your name or trademark. That is Article 2(1)(d) of Regulation (EC) No 1223/2009. The contract manufacturer or white-label lab is a subcontractor. The purchase order does not move that status.

No. Manufacturer status follows the person who commissioned the product and markets it under their name. The filling site remains a subcontractor. An invoice that calls the lab the manufacturer is a commercial line, not a legal transfer under Article 2(1)(d).

No. Article 4 designates the Community Responsible Person and allows a written mandate. That mandate is not a transfer of Article 2(1)(d) manufacturer status. Translation of a product already on the market is not a modification that changes either role.

No. The factory file is built for the factory’s label, claims and notification. Yours must be product-specific: a CPSR under Article 10 and Annex I, a PIF under Article 11 kept for 10 years, and CPNP under Article 13. A lab COA does not replace the CPSR.

The site performs GMP. Article 8 still requires the method of manufacture and a GMP statement in the PIF held for the brand. ISO 22716 is the usual standard used to show that duty. It is not named in Regulation 1223/2009.

Lock manufacturer status, an independent Community Responsible Person, a product-specific CPSR and PIF, and CPNP, plus SCPN if you sell in Great Britain. The EU+UK launch pack is $1,500 per product. A CPSR priced alone is $450-600. Notification priced alone is $150.

Sources

Primary sources cited in this guide. Regulatory status last verified 22 August 2026.