EU & UK regulatory guide

Responsible Person for cosmetics: EU and UK obligations, explained

Every cosmetic sold in the EU or UK has a Responsible Person legally attached to it: the entity on the label that answers for safety, filings and recalls. Without one, the product cannot be sold.

What is a Responsible Person in cosmetics?

It is not a title a brand can self-assign loosely. The Responsible Person must be genuinely established, with a real registered address, in the EU to sell in the EU or in the UK to sell in Great Britain. A mail-forwarding address does not qualify. A PO box does not qualify. If a product is recalled, it is the Responsible Person who answers to the competent authority.

Is a Responsible Person legally required?

One EU Responsible Person covers all 27 member states. One UK Responsible Person covers England, Scotland and Wales. You cannot notify, label or sell first and appoint later: the requirement is pre-market.

What are the Responsible Person’s obligations?

PIF (Product Information File)

The Product Information File is the compliance dossier for a single product. It must be held at the Responsible Person’s registered address and be available to a competent authority on request — in the EU without delay, in the UK within a set statutory window. It is not a one-off document: it is a living file that must be updated whenever the formula, the packaging or the safety assessment changes.

CPSR (Cosmetic Product Safety Report)

The Cosmetic Product Safety Report is Part A and Part B of the PIF, and it must be signed by a qualified safety assessor. Part A holds the safety assessment; Part B holds the assessor’s conclusion on whether the product is safe for its intended use. No CPSR, no lawful placing on the market — the report is the evidence that the product was assessed before it was sold, not after.

CPNP notification

Before a cosmetic is placed on the EU market, the Responsible Person must notify it through the Cosmetic Products Notification Portal. The notification carries the product category, the formula framework, the responsible entity and the nanomaterial content where relevant. The UK runs a separate notification route — the Submit Cosmetic Product Notification service — so an EU CPNP entry does not cover Great Britain.

Labelling

The Responsible Person’s name and address must appear on the product label, alongside the nominal content, the batch code, the function and the full ingredient list in INCI order. The label is where the RP’s legal identity becomes visible to the market and to the regulator. Get the address wrong and the product is non-compliant even if the formula is perfect.

Serious undesirable effects (SUE) reporting

A serious undesirable effect is any adverse reaction that results in death, disability, hospitalisation or a congenital anomaly. The Responsible Person must report SUEs to the competent authority of the member state where the effect occurred, and must keep the record accessible. Reporting is a duty of the RP, not of the brand owner or the retailer.

Animal-testing compliance

Cosmetics placed on the EU market must not contain ingredients tested on animals for cosmetic purposes, and the finished product must not have been animal-tested. The Responsible Person carries the burden of proving that compliance across the supply chain. That means ingredient-level documentation, not a supplier’s verbal assurance.

Who can be the Responsible Person?

The importer-default is the trap that catches marketplace sellers: ship stock into the EU without designating anyone, and whoever imports it becomes the Responsible Person by law, whether they know it or not. Fulfilment providers and freight forwarders do not want that role and are not equipped to hold it, which is why authorities checking marketplace listings look for exactly this gap.

The written mandate is not decorative. To stand up in an inspection it must name the parties, state that the designated entity accepts the RP role and its obligations, be signed by both sides, and match the name and address printed on the label. An email agreement is not a mandate.

Manufacturer

A manufacturer established in the EU or the UK is automatically the Responsible Person for the products it makes. No appointment is needed — the role attaches to the act of placing the product on the market. A manufacturer based outside the EU or UK cannot hold the role directly and must appoint a representative inside the territory.

Importer

An importer becomes the Responsible Person when it places a product from a non-EU or non-UK manufacturer onto the market under its own name or trademark. The condition is establishment inside the territory plus the act of first placing the product on that market. Importing alone is not enough if the manufacturer has already appointed an RP.

Distributor

A distributor holds the role only when it modifies a product in a way that affects its compliance — reformulating, repackaging or relabelling it under its own name. A distributor that simply moves compliant product along the chain does not become the Responsible Person. The condition is material influence over the product, not possession of it.

External provider (appointed RP service)

A brand without an establishment in the EU or UK must appoint an external Responsible Person by written mandate. The condition is a formal, documented appointment — the provider must be established in the territory and must accept the role in writing. This is the route most non-EU brands take, and it is the route CIGREG provides.

EU vs UK Responsible Person: what changed after Brexit?

Selling in both markets means two RPs, two notifications and two label blocks. The efficient route is one partner holding both roles, which is the pairing of our EU and UK Responsible Person services. If you are changing an existing arrangement, the sequence matters: see switching your EU Responsible Person.

EU RP after Brexit

Since Brexit, a UK-established entity can no longer act as the Responsible Person for the EU market. An EU RP must be established in an EU member state and must hold the PIF, the CPSR and the CPNP notification for every product it covers. A UK address on an EU-facing product is no longer a valid RP address.

UK RP after Brexit

Great Britain runs its own regime under the Cosmetic Products Enforcement Regulations 2013. A UK RP must be established in Great Britain and must hold the PIF, the CPSR and the UK product notification. An EU-established entity cannot act as the UK RP, so the two roles cannot be filled by the same address.

Dual EU + UK appointment

Selling in both markets means holding two Responsible Persons — one established in the EU, one in Great Britain. The obligations are parallel, not shared: separate PIFs, separate notifications, separate points of contact for each authority. A single appointment cannot cover both territories.

31 Dec 2027 is the deadline by which products placed on the GB market must carry a UK or EU address. After that date, a product labelled with only a non-UK, non-EU address is not compliant for Great Britain. Brands with legacy stock or long packaging print runs should plan the label change now, not in the final quarter of 2027.

Can you sell cosmetics from home in the UK without a Responsible Person?

Make the product yourself and sell under your own name, and you are the manufacturer and the default RP: the CPSR, the PIF, the SCPN notification and compliant labelling all fall on you. You can move the accountability to a third-party UK entity by written mandate, but the CPSR and PIF are non-negotiable either way. There is no cosmetics seller licence in the UK; the absence of a licence is not the absence of legal requirements.

How much does a Responsible Person cost?

Responsible Person pricing is driven by three variables: how many SKUs you place on the market, how many markets you sell into, and whether the PIF and CPSR are included in the service or billed separately. A single-market brand with a handful of products sits at one end; a multi-market brand with a large catalogue sits at the other.

SKU count matters because the PIF and the CPSR are per-product documents. Each formula needs its own safety assessment, its own file and its own notification. Ten products is not one job repeated ten times — it is ten separate compliance artefacts, each with its own assessor sign-off.

Market count matters because the EU and Great Britain are separate regimes. Two markets means two Responsible Persons, two notification routes and two sets of documentation. A bundled RP service prices this as one engagement; buying a CPSR and a PIF separately for each market usually costs more, because you are paying for the same coordination twice.

Fixed pricing matters because compliance is a budget line, not a surprise. A per-SKU, per-market quote lets you forecast the cost of a product launch before you commit to it. Variable or hourly pricing pushes that uncertainty onto your launch plan, which is the wrong place for it.

How to appoint a Responsible Person

When selecting a third-party RP, check four things: genuine establishment in the jurisdiction (not just registration), access to qualified safety assessors, professional indemnity insurance, and a defined process for serious-undesirable-effect reports and corrective action. A provider who quotes only the designation and excludes the safety assessment or notification is quoting a fraction of the job.

What happens if you don’t have a Responsible Person?

Authorities do not need to prove harm: the missing designation is itself sufficient grounds, and the label tells the story. Major retailers run the same check in supplier onboarding; no RP, no listing.