Global Cosmetics Regulatory Readiness: EU, UK, US and ISO 22716 on One Spine
Cosmetics brands sold across the EU, UK and US sit under three legal frameworks (EU 1223/2009, the UK Cosmetics Regulation, and MoCRA) plus one de facto GMP standard (ISO 22716).
In Short
- EU 1223/2009 requires an EU-established Responsible Person per product.
- EU and UK both require a Product Information File (PIF) — formula, manufacturing data, Cosmetic Product Safety Report (CPSR), claims evidence, animal-test…
- EU 1223/2009 Article 8 cites ISO 22716 as the harmonised GMP standard.
The obligations rhyme — Responsible Person, dossier, notification, safety assessment, labelling, post-market — but each regime puts the burden on a different entity, with different portals, different retention rules and increasingly divergent ingredient and allergen lists. This hub guide stitches the four into a single operating model and links to the deep dives. It is written for QA, regulatory and Responsible Persons at multi-market cosmetics brands and contract manufacturers.
Three Responsible Persons, one product
EU 1223/2009 requires an EU-established Responsible Person per product. The UK Cosmetics Regulation requires a UK-established Responsible Person and parallel SCPN notification.
More on three Responsible Persons, one product
MoCRA designates the Responsible Person as the manufacturer, packer or distributor whose name appears on the US label. The same SKU sold in all three markets needs three RPs, three notifications (CPNP, SCPN, FDA product listing) and three label variants. Most failures are not technical — they are stale RPs, unsynced notifications, and labels updated in one market and not the others.
The dossier: PIF in EU/UK, safety substantiation in US
EU and UK both require a Product Information File (PIF) — formula, manufacturing data, Cosmetic Product Safety Report (CPSR), claims evidence, animal-test declaration — produced to a competent authority on request and held for ten years after the last batch. MoCRA does not use the term PIF, but Section 608 requires records 'supporting adequate substantiation of the safety' of each product.
More on the dossier: PIF in EU/UK, safety substantiation in US
In practice a single composite dossier covers all three: ingredient assessments, finished-product safety assessment, stability, preservative-efficacy, claims evidence, novel-ingredient risk assessments. The audit gap is almost always the same — the dossier exists conceptually but cannot be assembled to inspection-ready form inside the legal window.
ISO 22716 as the common GMP backbone
EU 1223/2009 Article 8 cites ISO 22716 as the harmonised GMP standard. The UK Cosmetics Regulation inherits the same reference.
More on iSO 22716 as the common GMP backbone
MoCRA's GMP rule, proposed in 2024 and expected to finalise in 2026–2027, draws heavily on ISO 22716 with US-specific deltas (adverse-event reporting, facility registration, product listing). A site already running a credible ISO 22716 programme is the closest most cosmetics manufacturers can get to a single global GMP baseline. ISO 22716's 17 chapters — personnel, premises, equipment, raw materials, production, finished products, QC lab, OOS, wastes, subcontracting, deviations, complaints, recalls, change control, internal audit, documentation — map cleanly to QMS modules.
Labelling, claims and the diverging allergen lists
EU Article 19 sets mandatory label content; Article 20 plus Regulation 655/2013 polices claims. The UK runs a parallel regime under Schedule 34.
More on labelling, claims and the diverging allergen lists
MoCRA Section 609 requires the Responsible Person's domestic contact on-pack and directs FDA to issue fragrance allergen disclosure rules — converging toward the EU list, which itself expanded from 26 to over 80 allergens in 2023 with a 2026 implementation deadline. Multi-language matrices (EU 27 official languages, UK English, US English + bilingual states) compound the artwork problem. A claim-evidence record that does not survive a competent authority challenge is now a routine reason products are withdrawn in all three markets.
Post-market: SUE, MoCRA adverse events, recall
EU Article 23 requires SUE reporting to the competent authority of the Member State where the SUE occurred. UK SUEs route to OPSS.
More on post-market: SUE, MoCRA adverse events, recall
MoCRA requires serious adverse events to FDA within 15 business days, with a six-year retention rule (three years for small businesses). Routine cosmetovigilance — trend analysis of all undesirable effects, not only serious ones — is the test of whether the RP is actually monitoring the market. Recall capability is now mandatory in all three regimes (FDA gained mandatory recall authority under MoCRA Section 605 in 2023). Reconstructing downstream distribution within 24 hours of a request is the realistic bar.
A 90-Day Multi-Market Readiness Path
- Days 1–15
RP identity and notification reconciliation across CPNP, SCPN and FDA listing for the top 20 SKUs.
- Days 16–35
PIF/substantiation reconstructability test, ISO 22716 gap close on production, finished products and OOS.
- Days 36–55
labelling refresh against the EU 2023 allergen update, UK Schedule 34 and the latest MoCRA contact-on-pack guidance; claim dossier hardening.
- Days 56–75
cosmetovigilance trend report, SUE/serious AE drill, mock recall against live data with 24-hour reconstruction target.
- Days 76–90
internal audit covering all 17 ISO 22716 chapters plus EU Articles 4/10/11/19/20/23, UK equivalents and MoCRA Sections 605/606/608/609; freeze baseline.
Questions
Do we really need three Responsible Persons for one product?
If you sell into the EU, UK and US, yes — one RP established in the EU for CPNP, one established in the UK for SCPN, and one US Responsible Person whose name and contact appear on the US label per MoCRA. They can be the same legal entity only if it has the necessary establishment in each jurisdiction; most brands use an EU RP service, a UK RP service and an in-house US Responsible Person.
Is ISO 22716 certification enough to satisfy MoCRA GMP?
Not on its own. FDA's proposed cosmetic GMP rule draws heavily on ISO 22716 but adds US-specific obligations — facility registration, product listing, adverse-event reporting linkage, and explicit recordkeeping for safety substantiation. ISO 22716 gets you 80–90% of the way; track the FDA final rule for the remaining US deltas.
Did Brexit really create a separate UK regime?
Yes. The UK Cosmetics Regulation runs parallel to EU 1223/2009 with its own SCPN notification portal, UK-established RP requirement, UK Annexes (which can and do diverge from EU Annexes), and OPSS as competent authority. Products placed on the GB market need a separate UK file; Northern Ireland still follows the EU regime under the Windsor Framework.
How do the EU's 2023 fragrance allergen update and FDA's pending rule interact?
The EU expanded the labelled allergen list from 26 to over 80 substances in Regulation 2023/1545, with a 31 July 2026 cut-off for placing on the market and a 31 July 2028 cut-off for selling through. FDA is expected to require disclosure of a US fragrance allergen list under MoCRA Section 609. The two lists will not be identical. Brands collecting fragrance-allergen data per ingredient from fragrance houses now (not at artwork time) are the ones who will hit both deadlines without scrap.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
The Cosmetics Manufacturing Guide
The right formula. Stable batches. Traceable jars.
- MoCRA, EU 1223/2009 and Canada
- Formulas, water and materials
- Phases, bulk tests and microbiology holds
- Filling, codes, complaints and recall
Plus Evidence map and four worksheets.
Get the cosmetics guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Cosmetics Manufacturing Guide
The right formula. Stable batches. Traceable jars.
Keep reading
EU Fragrance Allergen Labelling: Regulation 2023/1545 Readiness
Cosmetic Microbiological Quality (ISO 17516) Readiness Guide- Cosmetic Stability and Preservative Efficacy (ISO 11930)
EU Cosmetics Regulation 1223/2009: Responsible Person, Safety Report, PIF and CPNP
ISO 22716 Cosmetics GMP Guide: Structure, EU Role and Practical Controls
MoCRA Guide: US Cosmetics Registration, Listing, Adverse Events and GMP Status