A CPSR for soap is the one document that most often catches indie soap makers off guard when they decide to sell into the European Union. The assumption that “it’s just soap, surely it doesn’t need all that paperwork” is understandable, but under EU law a soap sold for washing, cleansing or pampering the skin is a cosmetic product, and cosmetics are governed by Cosmetic Regulation (EC) No 1223/2009. That regulation does not carve out a hobbyist or small-batch exemption: a single bar of cold-process soap and a global skincare line are held to the same legal safety standard.
This guide explains exactly what compliance your handmade soap needs before it can be lawfully placed on the EU market — what a CPSR actually is, how saponification and pH affect your safety assessment, when microbiological and challenge testing are genuinely required (and when they are not), and the labelling basics that trip up newcomers. Whether you make cold process, melt and pour, or liquid soap, the principles below apply.
Key takeaways
- Soap sold to clean, cleanse or care for the skin is a cosmetic under Regulation (EC) No 1223/2009 and needs a CPSR before sale — there is no small-batch exemption.
- Cold process, melt and pour and liquid soap each need a CPSR, a Product Information File (PIF) and CPNP notification, but their testing needs differ.
- Anhydrous bar soaps generally do not need a preservative or challenge test (see ISO 29621); any water-containing product such as liquid soap normally does.
- Saponification, free alkali and pH must be controlled and documented — a high or unverified pH is a common reason a safety assessment cannot be signed off.
- Stability testing supports your shelf life and Period After Opening (PAO), and correct labelling (INCI, batch, warnings) is a legal requirement, not a nicety.
Why handmade soap is a cosmetic — and what that means
Under Article 2 of Regulation (EC) No 1223/2009, a cosmetic product is any substance intended to be placed in contact with the external parts of the body for the purpose of cleaning, perfuming, changing the appearance or keeping them in good condition. A soap bar designed to wash skin fits squarely within that definition. (The narrow exception is “true soap” placed on the market purely as a cleaning product with no cosmetic claim — but the moment you market it for skin, sell it as skincare, or make any cosmetic claim, it is a cosmetic.)
Being a cosmetic triggers three core obligations before the product reaches a single EU customer: a Cosmetic Product Safety Report (CPSR), a complete Product Information File (PIF), and notification on the CPNP (the EU’s Cosmetic Products Notification Portal). The CPSR is the heart of it — a two-part dossier (Part A, the safety information; Part B, the assessment and conclusion) that must be drawn up by a suitably qualified safety assessor before the product is placed on the market. For a step-by-step walkthrough, see our guide on how to get a CPSR for your cosmetic product.
Selling only at local craft fairs or via your own website does not change the rules. The trigger is “placing on the EU market,” not the size of your operation or your sales channel. A handful of bars sold per month still requires the same dossier as a commercial range.
Saponification and pH: getting the chemistry into the dossier
Soap is the product of saponification — the reaction of a fat or oil with a strong alkali (sodium hydroxide for bars, potassium hydroxide for liquid and soft soaps). The safety assessor needs to see that this reaction is complete and that the finished product is safe to use on skin.
Free alkali and superfat
Incomplete saponification leaves free (caustic) alkali in the bar, which is irritating and potentially corrosive. Most makers deliberately use a slight fat excess (“superfat”) so that all the lye is consumed. Your dossier should document the recipe, the lye calculation, and ideally a free-alkali check, so the assessor can confirm there is no residual caustic soda.
pH expectations
Genuine soap is naturally alkaline, typically pH 8–10, because of the chemistry of saponification — this is normal and acceptable for a wash-off soap, unlike a “syndet” (synthetic detergent) bar, which can be formulated closer to skin pH. What matters is that you measure and record the pH of a representative batch and that it sits within an expected, defensible range. An unverified or unexpectedly high pH is one of the most common reasons an assessor cannot complete Part B.
Never describe lye-based soap as “lye-free” or imply a neutral, skin-matching pH when it is genuinely alkaline. Misleading claims breach the regulation’s claims rules and can invalidate your safety assessment. State the chemistry honestly and let the data support it.
Microbiological and challenge testing: when you do and don’t need it
This is where soap makers most often over- or under-spend. The deciding factor is water. Microbes need moisture to grow, so the question is whether your product contains water (or is likely to encounter it in use) in a way that allows microbial growth.
Anhydrous bar soap
A well-cured cold-process or melt-and-pour bar is essentially anhydrous and has a high pH, both of which make it a hostile environment for microorganisms. ISO 29621 sets out how to identify products considered low microbiological risk — typically those with very low water activity, high or low pH, or high alcohol content. Such products generally do not require a preservative or a preservative efficacy (challenge) test. You will still usually confirm low risk with a documented rationale, and in some cases a one-off microbiological purity check.
Water-containing soap (liquid, cream, foaming)
Liquid soaps, foaming hand washes and any cream or paste that contains water are a different matter. They need an appropriate preservative system, and that system must be proven to work. The relevant tools are ISO 11930, the cosmetic challenge (preservative efficacy) test, and ISO 17516, which sets the microbiological limits a finished cosmetic must meet. Our explainers on microbiological safety standards for cosmetic products and the preservative efficacy test go deeper into how each works and how to read the results.
“Anhydrous” means no added water — but if your bar will sit in a pool of water in a soap dish, or your scrub is oil-based but used with wet hands, the assessor will consider in-use exposure too. When in doubt, a short low-risk justification under ISO 29621 is cheaper and faster than an unnecessary challenge test.
Stability, shelf life and Period After Opening
The safety assessment must reflect the product as customers will actually use it over its life, not just on day one. Stability testing — observing colour, odour, texture, pH and any separation over time and under varied conditions — gives you the evidence to set a defensible shelf life and, where relevant, a Period After Opening (PAO).
For solid bars, a minimum durability (best-before) date is often more appropriate than a PAO. For liquid and cream soaps, the open-jar PAO symbol (e.g. “12M”) is common. Either way, the figure should come from data, not guesswork. Our overview of why stability testing matters explains how to scope a proportionate study for a small range. Cost-conscious makers also tend to ask about budgeting early — our breakdown of how much a CPSR costs sets realistic expectations.
What each soap type actually needs
The table below summarises the typical compliance picture for the three most common formats. Treat it as a guide — your assessor confirms the final scope for your specific recipe and claims.
| Requirement | Cold-process bar (anhydrous) | Melt-and-pour bar | Liquid / foaming soap (water-based) |
|---|---|---|---|
| CPSR (Part A + B) | Required | Required | Required |
| PIF + CPNP notification | Required | Required | Required |
| pH measurement | Required | Required | Required |
| Free-alkali / saponification check | Recommended | Usually n/a (pre-made base) | Recommended |
| Preservative system | Generally not needed | Generally not needed | Required |
| Challenge test (ISO 11930) | Not usually needed (ISO 29621 low-risk) | Not usually needed | Required |
| Micro limits (ISO 17516) | Low-risk rationale | Low-risk rationale | Required |
| Stability + shelf life / PAO | Best-before date | Best-before date | Stability + PAO |
Labelling basics you must get right
A flawless safety file can still leave you non-compliant if the label is wrong. Article 19 of Regulation (EC) No 1223/2009 sets the mandatory elements, which must appear on the container and/or outer packaging in the language(s) of the markets you sell into.
- Ingredient list (INCI): in descending order of weight, using International Nomenclature of Cosmetic Ingredients names. For saponified oils, the convention is to declare them as their sodium/potassium salts (e.g. Sodium Olivate, Sodium Cocoate) plus any unreacted oils, fragrance (as Parfum) and the 26 declarable allergens above threshold.
- Nominal content (weight or volume), batch/lot number, and the durability date or PAO symbol.
- Function of the product where it is not obvious, and any warnings/precautions (e.g. “avoid contact with eyes”).
- Name and address of the entity responsible for the product within the EU, as required by Article 19.
Get the INCI and allergen declaration right at formulation stage — retro-fitting a label after the CPSR is drafted often means re-checking the assessment.
Bringing it all together
Selling handmade soap into the EU is entirely achievable for a small maker — the key is treating compliance as part of your recipe, not an afterthought. Confirm your product is a cosmetic, document your saponification and pH, decide honestly whether you need a challenge test or an ISO 29621 low-risk rationale, back your shelf life with stability data, and label it correctly. Once those pieces are in place, your CPSR can be completed, your PIF assembled and your CPNP notification filed.
If you would rather have specialists scope and write the dossier for you, Lexora can help. For a single bar or a starter range, our Low-Risk Compliance Kit bundles the essentials for low-risk products like anhydrous soap, while a standalone Cosmetic Product Safety Report (CPSR) covers products that need full safety assessment. Either way, you will know exactly what your soap needs before it goes on sale.
Frequently asked questions
Does handmade soap really need a CPSR to sell in the EU?
Yes. If your soap is marketed to clean or care for skin, it is a cosmetic under Regulation (EC) No 1223/2009 and needs a Cosmetic Product Safety Report before being placed on the market. There is no exemption for small batches, hobbyists or craft-fair sellers.
Do I need a challenge test for a cold-process soap bar?
Usually not. A cured, anhydrous bar with a high pH is normally classed as low microbiological risk under ISO 29621, so it does not need a preservative or an ISO 11930 challenge test. You document a low-risk rationale instead. Water-containing soaps, such as liquid hand wash, do need challenge testing.
Is melt-and-pour soap treated differently from cold process?
The legal requirements are the same — both need a CPSR, PIF and CPNP notification. The practical difference is that melt-and-pour uses a pre-made base, so saponification is already done; you still record pH and assess any additives, colours and fragrances you introduce.
What pH should my soap be?
True soap is naturally alkaline, typically around pH 8–10, because saponification produces an alkaline product. That is acceptable for a wash-off soap. What matters for your safety assessment is that you measure and record the pH of a representative batch and that it falls within an expected, defensible range with no residual free alkali.
Do I need stability testing for a soap bar?
Some form of stability evidence is expected so you can justify a shelf life. For a solid bar this usually supports a best-before (minimum durability) date rather than a Period After Opening. For liquid and cream soaps, stability data underpins both the shelf life and the PAO symbol on the label.
What must appear on a handmade soap label?
Under Article 19 of Regulation (EC) No 1223/2009 you need the INCI ingredient list in descending order, nominal content, batch number, durability date or PAO symbol, any warnings, the product function where unclear, and the name and address of the entity responsible for the product in the EU — all in the language of each market you sell into.
