Guide

Cosmetic Stability & Preservative Efficacy: ISO 11930 in Practice

Stability testing and preservative efficacy testing (PET, also called challenge testing) are the two studies most cited in EU PIFs, UK PIFs and MoCRA safety substantiation files — and the two most commonly under-documented in cosmetics audits. ISO 11930:2019 sets the global reference method for PET, while stability protocols draw on ISO/TR 18811:2018 and Colipa/Cosmetics Europe guidelines. This guide covers protocol design, acceptance criteria, the Period After Opening (PAO) decision, and how the stability/PET dossier feeds the Cosmetic Product Safety Report (CPSR) and the Responsible Person's record. It is written for formulation, QC and regulatory leads at cosmetics manufacturers and brand owners.

Start free trial Free trial, no credit card, onboard in days, not months.

Why stability and PET are the linchpin of the safety dossier

EU Annex I Part A of 1223/2009 explicitly requires data on microbiological quality (including PET) and on physical/chemical stability of the cosmetic product in its packaging. The UK PIF inherits the same requirements. MoCRA Section 608 does not name PET specifically but expects 'adequate substantiation of safety,' which in practice means a stability programme and a PET result. Retailers (Sephora, Ulta, Boots, Watsons) routinely demand both as a condition of shelf space. Audit findings cluster in three places: PET not repeated after preservative system changes, stability protocol that doesn't represent the marketed packaging, and PAO assigned without supporting data.

ISO 11930: the PET method

ISO 11930:2019 specifies inoculation of the cosmetic with five test organisms — Pseudomonas aeruginosa, Staphylococcus aureus, Escherichia coli, Candida albicans and Aspergillus brasiliensis — at a target inoculum of 10^5–10^6 CFU/g (bacteria) and 10^4–10^5 CFU/g (mould). Recovery counts are taken at 7, 14 and 28 days, with an optional re-challenge at 28 days. Acceptance criteria distinguish 'criteria A' (logarithmic reduction equivalent to USP <51>) and 'criteria B' (a slightly lower reduction permitted when risk assessment supports it). Choice of criteria A vs B is a documented decision in the report, not an afterthought. Re-PET is required after any change to preservative system, surfactant level, pH or primary packaging contact surface.

Stability protocol design and the marketed-packaging rule

A robust stability programme includes accelerated (40°C/75% RH for 3 months minimum, often 6), real-time (25°C/60% RH at 3, 6, 9, 12, 18, 24 months), freeze-thaw cycles, light exposure where relevant, and centrifuge testing for emulsions. The non-negotiable rule: stability must be run in the actual marketed primary packaging, not in glass jars or surrogate containers. The interaction between formula and packaging — leachables, permeation, headspace oxidation, fragrance migration — is the failure mode auditors look for. Acceptance criteria cover appearance, colour, odour, pH, viscosity, microbiological quality and active ingredient content where applicable.

Period After Opening (PAO) and minimum durability

EU Article 19 and UK equivalent require either a 'best before end of' (minimum durability) date on products with a stability under 30 months, OR a Period After Opening symbol (the open-jar icon) on products with a stability over 30 months. PAO is the period during which the product remains safe and functional after first opening. The value is determined by combining real-time stability data with an 'in-use' study — the product is opened and used representatively over its PAO, then tested at the end. Assigning PAO without supporting data is one of the most common OPSS and EU competent authority findings.

Tying the dossier to the PIF, CPSR and MoCRA file

Stability and PET reports are not standalone artefacts — they are referenced in the CPSR Part A (safety information), summarised in CPSR Part B (safety assessor's reasoning), and held in the PIF for ten years. For the US, the same reports are held under MoCRA Section 608 safety substantiation records (six years, three for small businesses). A single dossier per SKU that survives an EU competent authority inspection will also satisfy UK OPSS and FDA MoCRA inspections; running three separate dossiers is the inefficient default.

A 60-day readiness path

Days 1–10: inventory current stability and PET reports against the top 30 SKUs; flag SKUs with reports older than the last formula change or packaging change. Days 11–30: re-run PET per ISO 11930 on the highest-risk SKUs (aqueous, surfactant-based, leave-on); validate acceptance criteria A vs B per SKU. Days 31–45: re-design stability protocols to match actual marketed packaging; start the in-use study for any SKU with PAO printed but no backing data. Days 46–60: roll the refreshed studies into the PIF/CPSR/MoCRA dossier; freeze the baseline.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Stability & PET records

Bound to formula version and primary packaging.

PIF & CPSR linkage

Studies regenerate-on-demand into the dossier.

Change-driven re-test

Formula or packaging change re-opens stability.

Industries this hits hardest

Cosmetics

Frequently asked

Do we still need PET if the product is anhydrous?

ISO 11930 explicitly allows a justified exclusion for products that, by formulation, do not support microbial growth — typically anhydrous (water activity below ~0.6), high-alcohol (>20%), or extreme pH products. A risk assessment must be documented in the PIF; the exclusion is not automatic. Re-confirm if formula or packaging changes, and consider an in-use study for products that contact wet skin (e.g. anhydrous balms applied with fingers).

How does ISO 11930 relate to USP <51> and Ph. Eur. 5.1.3?

USP <51> (US Pharmacopeia) and Ph. Eur. 5.1.3 are pharmaceutical preservative efficacy methods; ISO 11930 was written specifically for cosmetics and is now the harmonised reference under EU 1223/2009 GMP guidance. ISO 11930 criteria A correspond closely to USP <51> Category 2 (topical) acceptance levels. A study run to USP <51> is typically acceptable for a cosmetic CPSR if the report demonstrates equivalence; running ISO 11930 from the outset is cleaner.

How long should real-time stability run before a SKU launches?

Industry practice is to launch on the basis of 3 months accelerated (40°C/75% RH) plus at least 3 months real-time data, with the full real-time programme continuing post-launch and the shelf-life claim updated as data accrues. Some markets and retailers require 6 months real-time before launch. Always document the launch criteria and the continuing study in the PIF — launching on accelerated data alone, without a planned real-time programme, is the common audit gap.

Does FDA accept ISO 11930 results for MoCRA safety substantiation?

MoCRA does not prescribe a specific PET method. ISO 11930 is widely accepted as 'evidence or information that experts qualified by scientific training and experience would consider sufficient' under Section 608. Pair the PET result with stability data and a finished-product safety assessment from a qualified toxicologist; that triad is the de facto MoCRA standard until FDA's cosmetic GMP final rule prescribes more specifically.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →