Bringing a face cream, lipstick, or bar of soap to market in Europe is about far more than a great formula and good branding. Before a single unit can be sold, EU law requires that the product is proven safe, properly documented, correctly labelled, and officially notified. If you want to sell cosmetics in the EU — whether you are a local start-up or a brand importing from outside the bloc — this guide walks you through exactly what “legally compliant” means and the steps to get there.
Key takeaways
- Every cosmetic sold in the EU is governed by Regulation (EC) No 1223/2009, which applies identically in all 27 member states.
- You must appoint an EU-based Responsible Person (RP) before placing a product on the market — non-EU brands cannot skip this.
- The core compliance documents are the Cosmetic Product Safety Report (CPSR) and the Product Information File (PIF).
- Products must be notified on the CPNP portal and carry a fully compliant label before sale.
- Non-compliant cosmetics can be withdrawn from the market, recalled, or fined — compliance is a legal prerequisite, not an optional extra.
What counts as a “cosmetic product” in the EU?
Under EU law, a cosmetic is any substance or mixture intended to be placed in contact with the external parts of the body (skin, hair, nails, lips) or with the teeth and the mucous membranes of the mouth, with the purpose of cleaning, perfuming, changing the appearance, protecting, keeping in good condition, or correcting body odours. That covers creams, make-up, shampoos, perfumes, soaps, toothpaste, and far more.
The category you fall into matters, because products that make medical or “active” claims can tip over into being classed as medicines or biocides — a completely different regulatory regime. If you are unsure where your product sits, start with our guide on what qualifies as a cosmetic product under EU law.
The one rule that governs everything: Regulation (EC) No 1223/2009
The cornerstone of placing cosmetics on the market in Europe is Regulation (EC) No 1223/2009. It applies directly and uniformly across all EU member states, so a product that is compliant for sale in Germany is, in principle, compliant for the Netherlands, France, Italy, and the rest of the single market. The regulation sets out the safety, documentation, labelling, and notification obligations that every brand — large or small — must meet.
Crucially, the regulation works on the principle of “no product on the market without a Responsible Person and a completed safety assessment.” There is no grace period and no “sell first, comply later” route.
Who can sell cosmetics in the EU? The Responsible Person
Every cosmetic placed on the EU market must have a designated Responsible Person (RP) established within the EU. The RP is the legal entity accountable to the authorities for the product’s compliance — they hold the Product Information File, ensure the safety assessment is done, manage notifications, and act as the contact point for market surveillance authorities.
If you are a non-EU brand
This is the step that catches out most international sellers. A US, UK, or Asian brand cannot simply ship products into the EU and sell them. You must either establish a legal entity inside the EU or appoint a third party to act as your Responsible Person. Many brands choose the latter, using an RP service so they can access the market without setting up a European company.
The 7 steps to legally place a cosmetic on the EU market
Here is the compliance journey at a glance. Most of these steps run in parallel rather than strictly one after another, but all must be complete before your first sale.
| Step | What it involves | Output |
|---|---|---|
| 1. Formulation review | Confirm every ingredient is permitted and within EU concentration limits (Annexes II–VI). | Compliant formula |
| 2. Appoint a Responsible Person | Designate an EU-based RP accountable for the product. | RP in place |
| 3. Laboratory testing | Stability, microbiological, preservative-efficacy (challenge) and other tests as required. | Test reports |
| 4. Safety assessment (CPSR) | A qualified assessor evaluates the product’s safety for human health. | CPSR (Part A & B) |
| 5. Compile the PIF | Assemble all data into a single Product Information File. | PIF |
| 6. Labelling | Design a label with all mandatory information and INCI ingredient list. | Compliant label |
| 7. CPNP notification | Register the product on the EU’s Cosmetic Products Notification Portal. | Notified product |
The documents that make or break compliance
Cosmetic Product Safety Report (CPSR)
The CPSR is the heart of your compliance file. It has two parts: Part A gathers all the safety data (ingredient toxicological profiles, exposure, microbiological quality, stability), and Part B is the assessor’s reasoned conclusion on whether the product is safe. It must be signed by a suitably qualified safety assessor — typically a toxicologist or pharmacist with the right EU-recognised qualifications. You can order a CPSR through Lexora as a standalone service.
Product Information File (PIF)
The PIF is the master dossier that authorities can request at any time. It contains the product description, the CPSR, the manufacturing method and a GMP statement, proof of any claimed effects, and data on animal testing. The Responsible Person must keep it readily accessible for ten years after the last batch is placed on the market.
CPNP notification
Before a product goes on sale, it must be notified through the Cosmetic Products Notification Portal (CPNP). This single electronic notification covers the whole EU and gives poison centres and market surveillance authorities the information they need. No notification means no legal sale.
Labelling
Your label must carry a defined set of mandatory information: the function of the product, a list of ingredients in INCI format, the net quantity, a durability date or period-after-opening symbol, batch number, precautions for use, and the name and address of the Responsible Person. For the full breakdown, see our regulatory guide to cosmetic labelling and the rules on ingredient labelling. A professional label review is the cheapest insurance against an expensive reprint.
How much does it cost and how long does it take?
Timelines depend almost entirely on whether new laboratory testing is needed. If your formulation is stable and you already hold the necessary test reports, ingredient data, and an INCI breakdown, a CPSR can usually be finalised within a few weeks. If stability or challenge testing is required, the timeline extends to match the mandatory test periods (often 8–12 weeks for accelerated stability).
On cost, the smartest approach for a new brand is rarely to buy each service piecemeal. A bundled Full Compliance Pack combines the safety assessment, lab-test coordination, PIF, labelling, RP and notification into one managed process — which is both cheaper and far less error-prone than stitching it together yourself.
Selling online and through marketplaces
Selling through your own webshop, Amazon, Etsy, TikTok Shop, or Bol.com does not change the underlying rules: the product still needs a Responsible Person, a CPSR, a compliant label, and a CPNP notification. Marketplaces increasingly ask for this documentation up front, so having your compliance file ready is now a commercial advantage as much as a legal duty.
Bringing it all together
Legally selling cosmetics in the EU comes down to a clear sequence: confirm your product is a cosmetic, secure a Responsible Person, prove safety through testing and a CPSR, assemble the PIF, get the label right, and notify through CPNP. Each piece is manageable on its own — the difficulty is doing all of them correctly and in the right order.
That is exactly where Lexora’s team of EU-recognised safety assessors comes in: we take a product from formula to fully market-ready, so you can focus on building the brand rather than decoding regulation.
Frequently asked questions
Do I need an EU Responsible Person if I only sell online from outside the EU?
Yes. Every cosmetic placed on the EU market must have a designated Responsible Person (RP) established in the EU, no matter where the seller is based. If you ship directly to EU consumers from a non-EU country, you still need an EU-based RP named on the label and registered in CPNP before your first sale.
How long does it take to make a cosmetic compliant for the EU market?
For a straightforward product that already has its safety data, 4–8 weeks is realistic: compiling the PIF, commissioning the CPSR from a qualified safety assessor, finalising the labelling, and submitting the CPNP notification. Products that still need stability, microbiological or challenge testing take longer, because the laboratory work runs on its own timeline.
What is the difference between a CPSR and a PIF?
The CPSR (Cosmetic Product Safety Report) is the safety assessment itself — Part A gathers the safety data and Part B is the assessor’s reasoned conclusion. The PIF (Product Information File) is the full dossier the Responsible Person must keep for 10 years; it contains the CPSR plus the product description, GMP statement, manufacturing method and claims evidence. In short, the CPSR is one document that lives inside the PIF.
Can a single CPSR cover a whole product range?
Sometimes. Closely related variants — for example the same base formula in different shades or fragrances — can often be covered by one CPSR using a justified read-across. But the safety assessor decides whether the differences are significant enough to require a separate report. We cover the thresholds in detail in when a separate CPSR is required for cosmetic variants.
Is CPNP notification the same as product registration or approval?
No. The CPNP (Cosmetic Products Notification Portal) is a notification, not an approval. You submit the product’s details to the EU before placing it on the market, but no authority “approves” a cosmetic. Legal responsibility for the product’s safety and compliance stays with the Responsible Person at all times.
Does an EU notification also cover the UK after Brexit?
No. Since Brexit, Great Britain runs its own SCPN portal and requires a UK Responsible Person. An EU CPNP notification does not cover the UK market, and a UK notification does not cover the EU — if you sell in both, you need to comply with both regimes separately.