Every cosmetic sold in the EU carries a promise: that someone has assessed it, documented it, and stands behind its safety. When that promise is broken, the consequences arrive as a chain, not a single dramatic event. Understanding non-compliant cosmetics penalties means understanding that enforcement is a ladder: national authorities start with a request to fix the problem and escalate, step by step, to withdrawal, recall, fines and — in some countries — criminal liability. This article walks through what actually happens when a product breaches Regulation (EC) No 1223/2009, who is held responsible, and how proper documentation stops the sequence before it begins.
If you sell into the EU as a brand owner, importer or distributor, the reassuring part is that almost every penalty on that ladder is preventable with paperwork you can prepare in advance. The uncomfortable part is that once an authority is knocking, your options narrow fast.
Key takeaways
- EU enforcement is a graduated ladder — corrective action first, then market withdrawal, product recall, and financial penalties — not a single fixed punishment.
- National competent authorities run market surveillance; one finding can trigger a Safety Gate (RAPEX) alert seen by all EU/EEA countries at once.
- The Responsible Person is the primary duty-holder and the first party authorities contact when a product is non-compliant.
- Penalties are set by each Member State and must be effective, proportionate and dissuasive; they range from administrative fines to criminal liability in some countries.
- Marketplaces such as Amazon delist products fast when documentation is missing — often before any authority acts.
- A complete CPSR, PIF and CPNP notification neutralises almost the entire enforcement chain in advance.
How authorities actually find non-compliant products
Enforcement of the EU Cosmetic Products Regulation is decentralised. There is no single EU cosmetics police force; instead, each Member State designates national competent authorities — typically the national health, consumer-protection or medicines agencies — that carry out market surveillance under Regulation (EC) No 1223/2009 and the general framework, Regulation (EU) 2019/1020.
The most common triggers are routine market inspections (reviewing products bought off shelves or from online listings), documentation audits where an authority demands your safety file, consumer or competitor complaints, adverse-effect reports, and customs checks on imports at the EU border. A single prohibited claim, a missing ingredient declaration, or an unnotified product can be enough to open a case.
Crucially, authorities can request your Product Information File at any time and expect it to be produced without delay, in a language they can understand, at the address on the label. If you cannot produce it, the product is treated as non-compliant regardless of how safe the formulation actually is. Documentation gaps — not exotic ingredient breaches — are the single most common reason ordinary brands get caught.
The Safety Gate (RAPEX): one alert, twenty-seven markets
When a Member State identifies a cosmetic that presents a risk to health, it does not just act locally. It enters the product into the EU Safety Gate — the rapid alert system formerly known as RAPEX — which shares the alert with every other EU and EEA country plus the European Commission. Within days, authorities across the bloc know the product name, brand, batch, the nature of the risk (say, a prohibited preservative or an undeclared allergen) and the corrective measures under way.
Two things make these alerts costly. First, they are public — the database is searchable by anyone, including journalists, retailers and competitors. Second, they are cross-border: an alert raised in one country routinely triggers withdrawal or recall action in the others where you sell. A single national inspection becomes an EU-wide problem, and the record stays online long after the issue is fixed.
Note: Being listed on Safety Gate is not the same as being fined. It is a public notification that a product presents a risk and that corrective measures are under way. But it frequently precedes — and evidences — the enforcement steps that carry financial penalties.
The enforcement ladder: from a polite letter to a recall
Authorities do not usually jump straight to the harshest measure. Article 25 of the Regulation lets a competent authority require the Responsible Person to take proportionate corrective action, and only escalate if the risk is serious or the problem is not fixed. The safeguard clause in Article 27 allows immediate provisional measures — including withdrawal — where a product presents a risk to human health. The table below shows how the rungs typically connect.
| Trigger / non-compliance | Authority action | Business impact |
|---|---|---|
| Missing or inadequate CPSR, PIF, or no CPNP notification | Formal request for corrective action within a fixed deadline (Art. 25) | You must produce or fix documentation fast; product may be blocked from further sale until you do |
| Labelling or misleading-claim breach (Art. 19 & 20) | Order to correct labelling or stop the claim | Relabelling, reprinting, delayed batches, wasted printed stock |
| Product presents a risk to health (Art. 27 safeguard clause) | Provisional market withdrawal — pulling stock back from retailers/distribution | Product removed from shelves and warehouses, often EU-wide; lost revenue |
| Serious risk confirmed, or Responsible Person unresponsive | Mandatory product recall from end users + Safety Gate alert | Recall logistics, customer refunds, public alert visible across the EU |
| Repeated or serious infringement | Administrative fines; in some Member States, criminal liability (Art. 37) | Financial penalties, possible prosecution of directors, trading restrictions |
The distinction between the last two rungs matters for your logistics. A market withdrawal removes a product from the supply chain — wholesalers, retailers and your own stock — before it reaches more consumers. A product recall goes further, retrieving units already in consumers’ hands, usually with public notices and refunds. Recalls are far more expensive and damaging, which is exactly why authorities reserve them for genuine risks — and why the early rungs are worth taking seriously.
Fines and criminal liability: set by each Member State
The Regulation does not fix a single EU-wide penalty amount. Article 37 requires each Member State to lay down penalties that are “effective, proportionate and dissuasive” and to enforce them. Financial exposure for the same breach therefore genuinely differs from country to country, set in national law rather than in Brussels — so any specific figure you read online should be checked against the relevant national rules rather than assumed to apply everywhere.
In practice, penalties escalate with the severity and persistence of the breach. A first, minor documentation lapse you correct promptly is treated very differently from knowingly selling a product with an Annex II prohibited substance, or ignoring an authority’s order. In several Member States, serious or repeated infringements — especially those endangering health, or continuing to sell after a withdrawal order — can attract criminal liability, not just administrative fines, meaning prosecution of the company and potentially of the individuals directing it.
Warning: Ignoring a competent authority’s corrective-action request is one of the fastest ways to convert a manageable administrative issue into an escalated case. Once you fail to respond within the deadline, the authority can move straight to withdrawal, recall and penalties — and non-cooperation is itself an aggravating factor.
Who is actually liable? The Responsible Person
This is the question that catches many brands out. Under Regulation (EC) No 1223/2009, no cosmetic may be placed on the EU market unless a Responsible Person — a legal or natural person established in the EU — is designated for it. That party, not the factory and not the marketplace, is the primary duty-holder: it ensures the CPSR is done, keeps the PIF, files the CPNP notification, guarantees the labelling is correct, and is contacted first when something is wrong.
If you are an EU manufacturer, you are typically the Responsible Person yourself. If you import from outside the EU, the importer is the Responsible Person unless you formally designate someone else in writing. Distributors carry lighter but real obligations too — they must not supply products they know or should know are non-compliant, and in some situations (for example, selling under their own name, or translating a label) they can themselves become the Responsible Person. If you are unsure where you sit, our guide to what an EU Responsible Person is and does sets out the role in detail, and how to legally sell cosmetics in the EU shows how the pieces fit together.
The practical takeaway: naming a Responsible Person concentrates liability in one accountable place. That is a feature, not a bug — it is who authorities hold to account, so it is who needs the documentation in order.
Delisting and reputation: the penalties that arrive first
Formal enforcement is not the only cost, and often not the first. Online marketplaces run their own compliance checks that are frequently stricter and faster than any regulator. Amazon’s EU stores, in particular, can require proof of a CPSR, CPNP notification and Responsible Person details, and will delist a product — freezing your sales overnight — if you cannot supply them. No inspector needs to be involved; the listing simply disappears. Our guide to the safety documentation Amazon expects from EU cosmetics sellers covers what to have ready before you list.
Retailers and distributors behave the same way. Most reputable buyers will not stock a product without seeing its compliance file, and a Safety Gate alert or recall can see you dropped from their shelves permanently. Then there is reputational damage: a public recall, an angry review referencing a safety issue, or a searchable Safety Gate entry can outlast the regulatory case by years. For a young brand, losing consumer trust is often more expensive than any fine.
Bringing it all together
Non-compliance in the EU is rarely a single penalty — it is a ladder that starts with a corrective-action letter and can climb to withdrawal, recall, fines, criminal liability, marketplace delisting and lasting reputational harm. Almost every rung is triggered by the same root cause: a product placed on the market without the documentation that proves it is safe and legal. A complete safety report, a maintained Product Information File and a valid CPNP notification are precisely the evidence authorities and marketplaces ask for — and having them ready is what keeps you off the ladder entirely.
The foundation of all of it is the safety assessment itself. If you want that done properly, our CPSR service produces the Article 10 safety report that anchors your PIF and CPNP notification, and the Full Compliance Pack bundles the whole file for brands that want to launch fully covered. To understand what the safety report contains and why it sits at the centre of your compliance, read our overview of the CPSR explained, or if you sell primarily online, whether you need a CPSR to sell cosmetics online.
Frequently asked questions
What is the penalty for selling non-compliant cosmetics in the EU?
There is no single EU-wide penalty; each Member State sets its own under Article 37 of Regulation (EC) No 1223/2009, and they must be effective, proportionate and dissuasive. Consequences typically escalate from a corrective-action order to market withdrawal, product recall, administrative fines and — for serious or repeated breaches in some countries — criminal liability. The exact figure depends on national law and the severity of the breach.
Who is legally responsible if a cosmetic breaches EU rules?
The Responsible Person is the primary duty-holder — the EU-established company or individual designated for the product. Authorities contact them first and hold them accountable for the CPSR, PIF, CPNP notification and labelling. For imports, the importer is usually the Responsible Person unless another party is formally designated. Learn more in our guide to the EU Responsible Person role.
What is the difference between a market withdrawal and a product recall?
A market withdrawal removes a product from the supply chain — retailers, distributors and your own stock — before more units reach consumers. A product recall goes further, retrieving units already bought by end users, usually with public notices and refunds. Recalls are more expensive and damaging, so authorities reserve them for products that present a genuine risk to health.
What is the EU Safety Gate and does it affect cosmetics?
The Safety Gate (formerly RAPEX) is the EU’s rapid alert system for dangerous non-food products, including cosmetics. When one country flags a risky product, the alert is shared with every EU and EEA country and the Commission, and the database is public. A single national finding can therefore trigger withdrawal or recall action across multiple markets at once.
Can a marketplace remove my product before any authority acts?
Yes. Marketplaces such as Amazon run their own compliance checks and will delist a cosmetic if you cannot supply a CPSR, CPNP notification and Responsible Person details — often faster than any regulator. See what to prepare in our guide to safety documentation for selling cosmetics on Amazon EU.
How does proper documentation prevent penalties?
Most enforcement is triggered by missing or inadequate paperwork rather than genuinely dangerous formulations. A complete CPSR, a maintained PIF you can produce on demand, and a valid CPNP notification are exactly the evidence authorities and marketplaces request. Having them ready means an inspection or documentation audit ends in minutes instead of on the enforcement ladder.
