Testing guide

Stability testing for cosmetics: what it is, why it’s required, and how it works.

Stability testing proves a product stays safe, effective and intact through its shelf life. Without the data, no assessor can sign your safety report.

Cosmetic stability testing samples in a laboratory climate chamber
CM
Written and reviewed by Cassandra Maddocks
Chemist & biochemist · cosmetic safety assessor · LinkedIn · last reviewed 22 August 2026
TL;DR: Stability testing verifies a cosmetic remains safe, effective and chemically intact through its intended shelf life. Annex I of Regulation (EC) No 1223/2009 and its UK-retained equivalent make it a precondition of the Cosmetic Product Safety Report: no stability data, no signed CPSR, no legal sale in the EU or Great Britain.

What is stability testing in cosmetics?

The systematic evaluation of how a product changes, or holds steady, over time: whether the formula, packaging and finished product keep their intended physical, chemical and microbiological properties under defined storage conditions, at defined timepoints, against acceptance criteria set before the study starts.

A cream that separates after three months, a serum that yellows under UV, a preservative system that fails at elevated temperature: these are stability failures, and they are safety failures. Stability testing catches them before consumers do, in the actual product in its final packaging.

Is stability testing legally required?

Yes. Annex I of Regulation (EC) No 1223/2009 requires the CPSR to include the product’s physical and chemical characteristics and its stability under reasonably foreseeable storage conditions, with the durability methodology described. Great Britain carries the identical requirement in the retained regulation, enforced by OPSS.
Annex I of Regulation 1223/2009 on EUR-Lex requiring physical, chemical characteristics and stability in the CPSR
Annex I in the consolidated Regulation (EC) No 1223/2009: the CPSR must document the product’s characteristics and stability, with the durability methodology described. From our evidence library.

The regulation prescribes no single protocol; it requires a study that is justified, documented and sufficient, with the SCCS recommending tests adapted to product type. The practical rule is short: no data, no CPSR; no CPSR, no market.

What does stability testing measure?

Three property groups: physical (appearance, odour, texture, viscosity, pH), chemical (active and preservative concentrations, oxidation markers, degradation products) and microbiological (TAMC, TYMC, and preservative efficacy via the ISO 11930 challenge test).

Each parameter has pre-defined acceptance criteria: a product that looks fine but has lost 30% of its preservative has failed. ISO 29621 can classify a formula as microbiologically low-risk and waive the full challenge test, but most water-containing products do not qualify.

Types of cosmetic stability tests

A complete programme combines real-time testing (25°C/60% RH, the gold standard), accelerated testing (40°C/75% RH for early evidence), freeze-thaw cycling for transport robustness, packaging compatibility in the final container, and photostability where light-sensitive actives are involved.

Accelerated data supports early launch decisions while real-time studies continue; it never replaces them for the final shelf-life claim. For a standard leave-on product the working combination is accelerated + real-time + challenge test + compatibility.

How long does stability testing take?

Accelerated: 12 weeks minimum. Intermediate: 6 to 12 months. Real-time: 12 to 36 months. Challenge test: 28 days. None of it can be compressed, because the elapsed time is the data; a day-14 reading is not a day-28 result.
Study type Conditions Minimum duration Timepoints
Accelerated40°C / 75% RH12 weeks0, 4, 8, 12 weeks
Intermediate30°C / 65% RH6 to 12 months0, 3, 6, 9, 12 months
Real-time25°C / 60% RH12 to 36 monthsQuarterly year 1, then 6-monthly
Challenge test (ISO 11930)Controlled inoculation28 daysDays 2, 7, 14, 28

Many assessors will not sign a 30-month shelf-life claim on accelerated data alone; the longer the claimed durability, the more real-time coverage it needs. Build the programme into the development timeline, not the launch week.

My take, from the lab bench

Two habits separate clean stability files from problem ones. First, samples in final packaging: a surprising share of programmes start with product in lab beakers or stand-in jars because the real packaging “isn’t ready yet”, which quietly voids the compatibility arm of the study and gets discovered when the assessor asks which closure the data covers. Second, checkpoint discipline: a stability programme is a calendar of dated observations, and the calendar is part of the record. Our own convention is that a checkpoint falling on a weekend shifts forward to the next working day and is documented as performed on that date; what an assessor cannot accept is a table of perfectly spaced dates that the lab diary does not support. The data is only as credible as its timestamps.

What triggers a stability failure?

Formulation causes (incompatible actives, under-dosed preservation for the water activity, pH drift), packaging causes (preservative absorption, oxygen ingress, UV through clear packs), unvalidated raw-material substitutions, and unvalidated process changes at manufacture.

A failure is information, not the end: find the root cause, reformulate or repackage, retest, document. What is not an option is ignoring the failed timepoint and selling anyway.

How stability data feeds the CPSR

Part A of the CPSR must contain the study design and conditions, results per timepoint, the durability methodology, preservative-efficacy results and the PAO justification. Incomplete Part A means no signed Part B, no CPNP or SCPN notification, no sale.

The accelerated protocol in practice

Primary condition 40°C/75% RH with a concurrent 25°C/60% RH control; timepoints T0, 4, 8, 12 weeks; measurements covering appearance, odour, pH, viscosity, colour, preservative assay (HPLC), microbial counts and product-specific parameters like SPF. Samples in final primary packaging, acceptance criteria fixed at T0.

Post-hoc acceptance criteria are the tell of a study written backwards from its results; no qualified assessor accepts them. Additional stress screens (45°C, 4°C, UV) extend the picture where the formula warrants it.

UK vs EU: any difference post-Brexit?

The science is identical; the infrastructure is duplicated. One well-designed study supports both markets if formula and packaging are identical, but each market needs its own Responsible Person, notification and PIF. Northern Ireland follows the live EU rules.

When must you repeat stability testing?

On any formula change (including supplier switches), any packaging change, scale-up or site transfer, entry into hotter or more humid markets than the data covers, and any shelf-life extension beyond the existing real-time coverage. Stability data is version-specific.

Minor changes can sometimes ride on bridging data; significant ones need a fresh study. Our stability testing service scopes exactly which applies before any work begins.

FAQ

Common questions.

The scientific evaluation of whether a product maintains its physical, chemical and microbiological properties through its shelf life, under defined conditions, at set timepoints, against pre-defined acceptance criteria. The results live in the PIF and feed the CPSR.

Yes. Annex I of Regulation 1223/2009, and the retained GB version, require the CPSR to document stability under reasonably foreseeable storage conditions. Without the data the assessor cannot sign, and the product cannot be sold in the EU or GB.

Accelerated: minimum 12 weeks at 40°C/75% RH. Real-time: 12 to 36 months. Challenge test: 28 days. The elapsed time is the data and cannot be shortened; plan it into development, not the launch week.

Storage at elevated stress, typically 40°C/75% RH, to simulate ageing quickly. It gives early evidence and can support initial market entry, but never replaces real-time data for the final shelf-life claim. Run both in parallel.

No, if formula and packaging are identical one study supports both safety reports. What must be duplicated is the infrastructure: Responsible Persons, notifications and PIFs per market.

It cannot go to market in its current form. Identify the root cause, formulation, packaging or process, fix it, retest, and document the change. A failure is a development signal, not a dead end.

Need stability data your assessor will sign off?
Accelerated, real-time and challenge testing through our accredited lab, built straight into your CPSR.
Get a quote