Cosmetic Stability & Preservative Efficacy: ISO 11930 in Practice
Stability testing and preservative efficacy testing (PET, also called challenge testing) are the two studies most cited in EU PIFs, UK PIFs and MoCRA safety substantiation files — and the two most commonly under-documented in cosmetics audits.
In Short
- EU Annex I Part A of 1223/2009 explicitly requires data on microbiological quality (including PET) and on physical/chemical stability of the cosmetic product in its…
- ISO 11930:2019 specifies inoculation of the cosmetic with five test organisms — Pseudomonas aeruginosa, Staphylococcus aureus, Escherichia coli, Candida albicans and…
- A robust stability programme includes accelerated (40°C/75% RH for 3 months minimum, often 6), real-time (25°C/60% RH at 3, 6, 9, 12, 18, 24 months), freeze-thaw…
ISO 11930:2019 sets the global reference method for PET, while stability protocols draw on ISO/TR 18811:2018 and Colipa/Cosmetics Europe guidelines. This guide covers protocol design, acceptance criteria, the Period After Opening (PAO) decision, and how the stability/PET dossier feeds the Cosmetic Product Safety Report (CPSR) and the Responsible Person's record. It is written for formulation, QC and regulatory leads at cosmetics manufacturers and brand owners.
Why stability and PET are the linchpin of the safety dossier
EU Annex I Part A of 1223/2009 explicitly requires data on microbiological quality (including PET) and on physical/chemical stability of the cosmetic product in its packaging. The UK PIF inherits the same requirements.
More on why stability and PET are the linchpin of the safety dossier
MoCRA Section 608 does not name PET specifically but expects 'adequate substantiation of safety,' which in practice means a stability programme and a PET result. Retailers (Sephora, Ulta, Boots, Watsons) routinely demand both as a condition of shelf space. Audit findings cluster in three places: PET not repeated after preservative system changes, stability protocol that doesn't represent the marketed packaging, and PAO assigned without supporting data.
ISO 11930: the PET method
ISO 11930:2019 specifies inoculation of the cosmetic with five test organisms — Pseudomonas aeruginosa, Staphylococcus aureus, Escherichia coli, Candida albicans and Aspergillus brasiliensis — at a target inoculum of 10^5–10^6 CFU/g (bacteria) and 10^4–10^5 CFU/g (mould). Recovery counts are taken at 7, 14 and 28 days, with an optional re-challenge at 28 days.
More on iSO 11930: the PET method
Acceptance criteria distinguish 'criteria A' (logarithmic reduction equivalent to USP <51>) and 'criteria B' (a slightly lower reduction permitted when risk assessment supports it). Choice of criteria A vs B is a documented decision in the report, not an afterthought. Re-PET is required after any change to preservative system, surfactant level, pH or primary packaging contact surface.
Stability protocol design and the marketed-packaging rule
A robust stability programme includes accelerated (40°C/75% RH for 3 months minimum, often 6), real-time (25°C/60% RH at 3, 6, 9, 12, 18, 24 months), freeze-thaw cycles, light exposure where relevant, and centrifuge testing for emulsions. The non-negotiable rule: stability must be run in the actual marketed primary packaging, not in glass jars or surrogate containers.
More on stability protocol design and the marketed-packaging rule
The interaction between formula and packaging — leachables, permeation, headspace oxidation, fragrance migration — is the failure mode auditors look for. Acceptance criteria cover appearance, colour, odour, pH, viscosity, microbiological quality and active ingredient content where applicable.
Period After Opening (PAO) and minimum durability
EU Article 19 and UK equivalent require either a 'best before end of' (minimum durability) date on products with a stability under 30 months, OR a Period After Opening symbol (the open-jar icon) on products with a stability over 30 months. PAO is the period during which the product remains safe and functional after first opening.
More on period After Opening (PAO) and minimum durability
The value is determined by combining real-time stability data with an 'in-use' study — the product is opened and used representatively over its PAO, then tested at the end. Assigning PAO without supporting data is one of the most common OPSS and EU competent authority findings.
Tying the dossier to the PIF, CPSR and MoCRA file
Stability and PET reports are not standalone artefacts — they are referenced in the CPSR Part A (safety information), summarised in CPSR Part B (safety assessor's reasoning), and held in the PIF for ten years. For the US, the same reports are held under MoCRA Section 608 safety substantiation records (six years, three for small businesses).
More on tying the dossier to the PIF, CPSR and MoCRA file
A single dossier per SKU that survives an EU competent authority inspection will also satisfy UK OPSS and FDA MoCRA inspections; running three separate dossiers is the inefficient default.
A 60-Day Readiness Path
- Days 1–10
inventory current stability and PET reports against the top 30 SKUs; flag SKUs with reports older than the last formula change or packaging change.
- Days 11–30
re-run PET per ISO 11930 on the highest-risk SKUs (aqueous, surfactant-based, leave-on); validate acceptance criteria A vs B per SKU.
- Days 31–45
re-design stability protocols to match actual marketed packaging; start the in-use study for any SKU with PAO printed but no backing data.
- Days 46–60
roll the refreshed studies into the PIF/CPSR/MoCRA dossier; freeze the baseline.
Questions
Do we still need PET if the product is anhydrous?
ISO 11930 explicitly allows a justified exclusion for products that, by formulation, do not support microbial growth — typically anhydrous (water activity below ~0.6), high-alcohol (>20%), or extreme pH products. A risk assessment must be documented in the PIF; the exclusion is not automatic. Re-confirm if formula or packaging changes, and consider an in-use study for products that contact wet skin (e.g. anhydrous balms applied with fingers).
How does ISO 11930 relate to USP <51> and Ph. Eur. 5.1.3?
USP <51> (US Pharmacopeia) and Ph. Eur. 5.1.3 are pharmaceutical preservative efficacy methods; ISO 11930 was written specifically for cosmetics and is now the harmonised reference under EU 1223/2009 GMP guidance. ISO 11930 criteria A correspond closely to USP <51> Category 2 (topical) acceptance levels. A study run to USP <51> is typically acceptable for a cosmetic CPSR if the report demonstrates equivalence; running ISO 11930 from the outset is cleaner.
How long should real-time stability run before a SKU launches?
Industry practice is to launch on the basis of 3 months accelerated (40°C/75% RH) plus at least 3 months real-time data, with the full real-time programme continuing post-launch and the shelf-life claim updated as data accrues. Some markets and retailers require 6 months real-time before launch. Always document the launch criteria and the continuing study in the PIF — launching on accelerated data alone, without a planned real-time programme, is the common audit gap.
Does FDA accept ISO 11930 results for MoCRA safety substantiation?
MoCRA does not prescribe a specific PET method. ISO 11930 is widely accepted as 'evidence or information that experts qualified by scientific training and experience would consider sufficient' under Section 608. Pair the PET result with stability data and a finished-product safety assessment from a qualified toxicologist; that triad is the de facto MoCRA standard until FDA's cosmetic GMP final rule prescribes more specifically.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
The Cosmetics Manufacturing Guide
The right formula. Stable batches. Traceable jars.
- MoCRA, EU 1223/2009 and Canada
- Formulas, water and materials
- Phases, bulk tests and microbiology holds
- Filling, codes, complaints and recall
Plus Evidence map and four worksheets.
Get the cosmetics guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Cosmetics Manufacturing Guide
The right formula. Stable batches. Traceable jars.
Keep reading
Global Cosmetics Regulatory Readiness: EU, UK, US, ISO 22716
EU Fragrance Allergen Labelling: Regulation 2023/1545 Readiness- Cosmetic Microbiological Quality (ISO 17516) Readiness Guide
EU Cosmetics Regulation 1223/2009: Responsible Person, Safety Report, PIF and CPNP
ISO 22716 Cosmetics GMP Guide: Structure, EU Role and Practical Controls
MoCRA Guide: US Cosmetics Registration, Listing, Adverse Events and GMP Status