Guide
EU 1223/2009: The Cosmetics Regulation, Decoded for 2026
Regulation (EC) 1223/2009 is the single legal framework for placing cosmetic products on the EU market. It sets out the role of the Responsible Person (RP), the Product Information File (PIF), the Cosmetic Product Safety Report (CPSR), notification through the Cosmetic Products Notification Portal (CPNP), labelling rules, restricted substances (Annexes II–VI), and post-market surveillance including the Serious Undesirable Effects (SUE) reporting duty. This guide walks the structure, the recurring inspection findings, and a practical path to a defensible EU cosmetics file. It is written for QA, regulatory, and Responsible Persons at cosmetics brands and contract manufacturers.
Start free trial Free trial, no credit card, onboard in days, not months.
The Responsible Person and the PIF
Article 4 designates a Responsible Person established in the EU for every product placed on the market. The RP holds the Product Information File (Article 11) — formula, manufacturing data, CPSR, evidence of claims, animal-test declaration, packaging and labelling — for ten years after the last batch is placed on the market and produces it within days when a competent authority asks. The recurring finding is a PIF that exists conceptually across five systems but cannot be assembled to inspection-ready form inside the legal window.
CPSR, safety assessor and CPNP notification
Annex I sets out the two-part Cosmetic Product Safety Report: Part A (safety information — formula, physical/chemical properties, microbiological quality, impurities, normal/foreseeable use, exposure) and Part B (safety assessment — reasoned conclusion, warnings, qualifications of the safety assessor under Article 10). Notification via CPNP must precede market placement and must be updated when formulation, labelling or the RP changes. Mismatches between the CPNP record, the PIF and the production formula are the most common audit finding.
Annexes II–VI, claims and labelling
Annex II lists prohibited substances; Annex III restricts use with conditions; Annexes IV (colourants), V (preservatives) and VI (UV filters) are positive lists. Article 20 plus Regulation 655/2013 set out common claims criteria — truthful, evidence-supported, fair, honest. Article 19 specifies mandatory labelling: RP name and address, country of origin for imports, nominal content, durability, precautions, batch number, function, INCI list, and language requirements per Member State. A claims dossier that does not survive a competent authority challenge is now a routine reason products are withdrawn.
Post-market: SUE, cosmetovigilance and recall
Article 23 obliges the RP and distributors to report Serious Undesirable Effects to the competent authority of the Member State where the SUE occurred, without undue delay. Article 25 sets out the corrective action and recall powers of competent authorities. Routine cosmetovigilance — trend analysis of all undesirable effects, not only the serious ones — is the test of whether the RP is actually monitoring the market rather than waiting for the regulator to call.
A 60-day readiness path
Days 1–10: PIF reconstructability test on the top ten SKUs; CPNP record vs production formula reconciliation. Days 11–25: close CPSR gaps, refresh safety assessor sign-off, align labelling to current Annex changes (notably Annex III and V updates in 2024–2026). Days 26–45: cosmetovigilance trend review, SUE drill, recall rehearsal from documentation alone. Days 46–60: claims dossier hardening, internal audit against Articles 4, 10, 11, 13, 19, 20, 23, and ISO 22716 GMP linkage; freeze the baseline for inspection.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Industries this hits hardest
Frequently asked
Who can be the Responsible Person?
A natural or legal person established in the EU — typically the manufacturer if EU-based, an EU importer, or a third party mandated in writing by either. The RP carries personal regulatory liability and must be named on the label.
Is ISO 22716 enough to satisfy 1223/2009?
ISO 22716 satisfies the GMP requirement of Article 8 but not the rest of the regulation — CPSR, PIF structure, CPNP, labelling, claims, cosmetovigilance and SUE reporting are all additional obligations carried by the RP.
Does Brexit affect EU 1223/2009 compliance?
Yes — the UK now operates a parallel UK Cosmetics Regulation with its own SCPN notification portal and UK-based RP requirement. EU 1223/2009 still applies fully to products placed on the EU/EEA market; a separate UK file and UK RP are required for the GB market.
How are claims policed in practice?
Competent authorities run themed market surveillance sweeps (anti-ageing, sun protection, free-from claims). A claim without a contemporaneous evidence record in the PIF is treated as non-compliant regardless of how widely the claim is used in the category.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.