The Product Information File (PIF): what it is and what it must contain.
The PIF is your product’s compliance passport: the one dossier that proves it is assessed, manufactured correctly and fit to sell. One PIF per product; no PIF, no market.
Chemist & biochemist · cosmetic safety assessor · LinkedIn · last reviewed 22 August 2026
TL;DR: A Product Information File is the mandatory compliance dossier for every cosmetic on the EU or UK market, required by Article 11 of Regulation (EC) No 1223/2009 and held by the Responsible Person, nobody else. It must contain the product description, the CPSR, the manufacturing method with GMP evidence, claims substantiation and animal-testing data, and stay accessible for 10 years after the last batch. Incomplete or missing, the product is non-compliant and withdrawable.
What is a Product Information File?
The complete regulatory dossier for one cosmetic product: the single file proving it has been assessed for safety, manufactured correctly and is fit to sell. Every label claim, every ingredient and every batch must trace back to it. One PIF per product.
Is a PIF legally required?
Yes, unambiguously. Article 11 of Regulation (EC) No 1223/2009 requires the Responsible Person to compile a PIF for each product, keep it current and keep it readily accessible to authorities at the address on the label. Great Britain retained the identical article; OPSS and Trading Standards can request the file at any time. No threshold, no small-brand exemption.
Article 11 in the consolidated Regulation (EC) No 1223/2009: the PIF obligation and the 10-year retention window, highlighted at source. From our evidence library.
What must the PIF contain? The five components
1) A product description that unambiguously identifies the product. 2) The CPSR, Part A data and signed Part B. 3) The manufacturing method and a GMP statement to EN ISO 22716. 4) Proof of every claimed effect. 5) Any animal-testing data generated for third-country requirements.
Part A alone spans the full formula with concentrations, physico-chemical and stability data, microbial quality and challenge-test results, impurities and packaging interactions, exposure assessment and per-substance toxicological profiles. An unsigned or unqualified Part B invalidates the CPSR, and with it the file.
Who is responsible for the PIF?
The Responsible Person, exclusively. Maintaining it is ongoing: updated on every formula, packaging or claims change, extended with post-launch adverse-event data, re-signed where new information would change the assessor’s conclusion, and retrievable promptly on request.
A PIF accurate at launch and untouched since is not compliant; the regulation treats it as a living document. Distributors and retailers have no right to see it; access belongs to competent authorities.
My take, from practice
The failure mode we inherit most often is the “distributed PIF”: the formula with the manufacturer, the CPSR in an email thread, the GMP certificate on someone’s laptop, the claims evidence nowhere. Each piece exists, so everyone believes the file exists; the first authority request proves it does not, because a PIF is defined by retrievability at the RP’s address, not by the theoretical existence of its parts. The second-most-common gap is claims substantiation: labels get finalised in marketing, and “48-hour hydration” reaches print with nothing behind it in the file. When we take a product over, reassembling and versioning the dossier under one roof is usually the real work; the science is mostly already paid for.
Where is it kept, and for how long?
At the Responsible Person’s address, the one printed on the label, readily accessible on request; electronic storage is fine. Retention: 10 years after the last batch was placed on the market, surviving product discontinuation. UK files in English; EU member states may require their language, though English is widely accepted.
PIF vs CPSR: the difference
The CPSR is one component inside the PIF. Brands that commission a safety report and stop there are missing four mandatory elements; a CPSR alone is not market access. The full comparison against the notification is in CPSR vs PIF vs notification.
PIF
CPSR
What it is
The complete compliance dossier
The safety assessment inside it
Contains
Description, CPSR, GMP, claims evidence, animal-testing data
Part A safety information + Part B signed assessment
Who is responsible
Compiled and held by the Responsible Person
Signed by a qualified safety assessor
Legal basis
Article 11
Article 10 + Annex I
UK vs EU after Brexit: one PIF or two?
Formally two. The EU PIF sits with the EU RP and links to the CPNP reference; the GB PIF sits with the UK RP in English and links to the SCPN. The technical core, formula, stability, CPSR, GMP, can be identical; the administrative wrapper cannot. Northern Ireland needs the EU-compliant file.
What happens if the PIF is incomplete or missing?
The product is treated as non-compliant on the spot: withdrawal or recall under Article 5, national fines (France runs to €300,000 for serious breaches), and criminal liability in the UK under the 2013 Enforcement Regulations. The duty survives discontinuation until the 10-year window closes.
How to build a PIF: the inputs
Before compilation you need the exact formula (percentages, not ranges), stability data, 28-day challenge-test results, the signed CPSR, GMP certificates, documented claims evidence, final artwork and packaging specifications. Missing inputs mean a delayed file or an incomplete one; neither survives scrutiny.
Our PIF service compiles, hosts and maintains the dossier at our RP address, fixed at $400 per product.
FAQ
Common questions.
The Product Information File: the mandatory compliance dossier for every cosmetic sold in the EU or UK, containing the product description, the CPSR, the manufacturing method, claims evidence and animal-testing data. It is the document that proves the product is safe and legal.
Every product on the EU or UK market, regardless of brand size or channel. The obligation sits with the Responsible Person, not the manufacturer or retailer.
Five elements: the product description, the CPSR (Part A and signed Part B per Annex I), the manufacturing method with GMP statement, substantiation for every claim, and any animal-testing data.
10 years after the last batch was placed on the market, discontinued or not, accessible to authorities throughout.
No. The CPSR is one component inside the PIF. A safety report alone does not make a compliant file; four other mandatory elements sit alongside it.
Yes, formally: one with the EU Responsible Person linked to the CPNP, one with the UK RP in English linked to the SCPN. The technical core can be shared; the wrappers cannot.
Sources
Primary sources cited in this guide. Regulatory status last verified 22 August 2026.
