Exfoliating acids in EU cosmetics sit in an odd regulatory position. Salicylic acid, the most common beta hydroxy acid, has its own entry in Annex III with concentration limits and mandatory warnings. Glycolic acid and lactic acid, the two alpha hydroxy acids that built the category, are not restricted by name at all, which leads a surprising number of brands to assume anything goes.
It does not. When an annex is silent, the safety assessor becomes the limit, and they work from published scientific opinions that recommend specific concentrations and pH values. A 10% glycolic toner sold to consumers is not illegal because a number in a table says so, it is a problem because no assessor will sign it off against the available guidance. This article explains what is written down, what is convention, and how to build an acid product that survives assessment and inspection.
Key takeaways
- Salicylic acid is in Annex III, capped at 3.0% in rinse-off hair products and 2.0% in most other products, with a ban on use in products for children under three years apart from shampoos.
- Salicylic acid also appears in Annex V as a preservative at 0.5%, and the two uses have to be distinguished in your documentation.
- Glycolic and lactic acid are not named in Annex III, so the ceiling comes from SCCS guidance and your safety assessment rather than from a table.
- The working consumer benchmark for glycolic acid is up to 4% at pH 3.8 or above, with higher levels reserved for professional use.
- pH is part of the specification, not a formulation detail. Free acid content drives both efficacy and irritation, so an assessor will ask for the finished product pH and its stability.
- Acid products normally need sun protection advice and eye contact warnings on the pack, plus care with children and sensitive area use.
- This area is under active regulatory review, so check the consolidated annexes before you commit to a launch concentration.
What the annexes actually restrict
Only one of the common exfoliants has a numerical entry.
| Acid | Status in the annexes | Working limit |
|---|---|---|
| Salicylic acid | Annex III entry, plus Annex V as preservative | 3.0% rinse-off hair, 2.0% other products, 0.5% when used as a preservative |
| Glycolic acid | Not named in Annex III | Assessor sets it, commonly up to 4% at pH 3.8 or above for consumer use |
| Lactic acid | Not named in Annex III | Assessor sets it, similar consumer benchmark to glycolic acid |
| Mandelic, malic, tartaric acid | Not named in Annex III | Assessed by analogy with other AHAs and their own data |
| Trichloroacetic acid | Not a cosmetic ingredient in practice | Chemical peel use falls outside the cosmetic definition |
The salicylic acid entry carries conditions as well as a number. It cannot be used in products for children under three years of age, other than shampoos, and the label has to say so. There are also restrictions on use in oral products and in body lotions in some sub-entries, so read the current entry rather than working from a remembered figure.
Salicylic acid used at 0.5% to preserve a formula and salicylic acid used at 2% to exfoliate are the same molecule doing different jobs, and your PIF has to be clear about which. If you declare it as a preservative but use it at 2% for its keratolytic effect, the file contradicts the product. State the function, state the level, and let the assessment address both.
Why AHAs are governed by opinion rather than by table
Alpha hydroxy acids were reviewed by EU scientific committees long before the current regulation, and the outcome was guidance rather than an annex entry. The practical benchmark that assessors work with is a consumer ceiling around 4% with a minimum pH near 3.8, and a professional ceiling around 10% at a lower pH for products applied by trained operators.
Three consequences follow for a brand:
- Your assessor is the gatekeeper. There is no table to point at, so the CPSR has to argue the case. A well documented 8% lactic acid serum with supporting irritation data is more likely to pass than a 5% one with nothing.
- Professional and consumer are different products. If a formula is only defensible at professional level, the pack, the channel and the instructions all have to reflect that, and selling it through a general marketplace undermines the argument.
- Stacking counts. A routine that pairs a glycolic toner with a lactic serum increases total acid exposure. Where your own marketing tells consumers to layer products, expect that to enter the exposure calculation.
Restriction of AHAs has been raised repeatedly at EU level, and the annexes change several times a year. Before you fix a launch concentration, check the current consolidated text rather than an article, including this one. Our overview of how the annexes change explains the mechanism, and a monitoring subscription exists to catch these moves early.
pH, free acid and why assessors ask about both
Concentration alone does not describe an acid product. What matters biologically is how much of the acid is present in its free, unneutralised form, and that depends on pH. A 10% glycolic acid solution neutralised to pH 5 behaves very differently from the same percentage at pH 3.
This is why a safety assessment for an exfoliating product asks for:
- The total acid concentration in the finished product, including acid contributed by partially neutralised salts such as sodium lactate.
- The finished product pH, measured, with a specification range rather than a single number.
- The buffering system, since pH drift over shelf life changes the free acid content.
- Compatibility with packaging, because low pH formulas interact with metal components and some pump mechanisms.
If you sell a toner or an essence in this space, our guidance on facial leave-on assessment covers the surrounding logic, and the margin of safety calculation explains how exposure is turned into a number.
Labelling an acid product
Beyond the standard requirements of Article 19, exfoliating products normally carry additional consumer information:
- Sun sensitivity advice. Acid exfoliation increases sensitivity to UV, and advising daily sun protection is standard practice for AHA products. It also protects you if the product is blamed for a burn.
- Eye area avoidance and instructions to rinse if contact occurs.
- Frequency of use, particularly for higher strength products, since misuse is the main driver of consumer complaints in this category.
- The salicylic acid child restriction, where applicable, in the wording required by the annex entry.
- Patch guidance for sensitive skin, phrased as advice rather than as a clinical instruction.
All of this has to appear in the language of every Member State where you sell, which is where translated artwork usually breaks. A cosmetic label review checks the warnings against the actual formula rather than against the artwork you inherited.
The claims problem
Exfoliation claims sit close to two lines. Language about peeling, resurfacing at depth or treating acne moves towards medicinal presentation, and our note on the cosmetic and medicinal borderline explains why presentation alone can trigger reclassification. Language about removing dead surface cells, refining texture and improving radiance stays within the cosmetic function, provided you hold the substantiation required by Regulation (EU) 655/2013.
Percentage-led marketing deserves its own caution. Putting the number on the front of the pack is common in this category, and it commits you to that exact figure in the formula, on the certificate of analysis and in the assessment. Rounding a 3.7% formula up to a friendlier 4% on the label is a labelling breach, not a marketing decision. Our guide to allowed cosmetic claims covers substantiation in more detail.
Bringing it all together
Exfoliating acids are a case where reading the annex is not enough. Salicylic acid has a number and conditions you must follow exactly. The alpha hydroxy acids have neither, which means your safety assessor sets the ceiling and your documentation has to support the level you want.
Practically, that means deciding early whether you are building a consumer product around the 4% benchmark or a professional product with a restricted channel, specifying pH as tightly as you specify concentration, and writing warnings that match the formula rather than the category. Do that and an acid range is straightforward to keep compliant, even while the underlying rules are moving.
Lexora assesses acid based formulas, sets defensible concentration and pH specifications, and reviews the pack warnings against the finished formula. Start with a safety assessment for face toner, or screen the formula first with cosmetic formula screening.
Frequently asked questions
What is the maximum salicylic acid allowed in EU cosmetics?
Annex III permits up to 3.0% in rinse-off hair products and up to 2.0% in most other cosmetic products, with conditions including a prohibition on use in products for children under three years other than shampoos. A separate Annex V entry allows 0.5% when it is used as a preservative.
Is there a legal limit on glycolic acid in the EU?
Glycolic acid is not named in Annex III, so there is no figure in the regulation. The practical ceiling comes from EU scientific guidance, which supports consumer use around 4% at pH 3.8 or above, with higher concentrations reserved for professional application. Your safety assessor applies that reasoning to your specific product.
Why does my assessor ask for the pH of my exfoliating product?
Because pH determines how much of the acid is present in free, unneutralised form, which is what drives both the exfoliating effect and the irritation potential. Two products with the same percentage on the label can behave completely differently at pH 3 and pH 5, so pH is part of the specification.
Can I sell a 10% glycolic peel to consumers in the EU?
Not easily. That level is associated with professional use in the available guidance, so a consumer product would need substantial supporting data and an assessor willing to sign it. If the product is genuinely professional, the packaging, instructions and sales channel all have to reflect that, and a general online marketplace does not.
Do I need a sunscreen warning on an AHA product?
It is standard practice and expected by assessors, because alpha hydroxy acids increase sensitivity to UV light. Advising daily sun protection and avoiding the eye area belongs on the pack, in the language of each market where the product is sold.
Can I put the acid percentage on the front of the pack?
Yes, provided the figure is accurate, matches the formula in the product information file and can be verified in the finished batch. A stated percentage is a claim under Regulation (EU) 655/2013, so rounding up for marketing reasons is a compliance breach rather than a presentation choice.
