Guide

Global Cosmetics Regulatory Readiness: EU, UK, US and ISO 22716 on One Spine

Cosmetics brands sold across the EU, UK and US sit under three legal frameworks (EU 1223/2009, the UK Cosmetics Regulation, and MoCRA) plus one de facto GMP standard (ISO 22716). The obligations rhyme — Responsible Person, dossier, notification, safety assessment, labelling, post-market — but each regime puts the burden on a different entity, with different portals, different retention rules and increasingly divergent ingredient and allergen lists. This hub guide stitches the four into a single operating model and links to the deep dives. It is written for QA, regulatory and Responsible Persons at multi-market cosmetics brands and contract manufacturers.

Start free trial Free trial, no credit card, onboard in days, not months.

Three Responsible Persons, one product

EU 1223/2009 requires an EU-established Responsible Person per product. The UK Cosmetics Regulation requires a UK-established Responsible Person and parallel SCPN notification. MoCRA designates the Responsible Person as the manufacturer, packer or distributor whose name appears on the US label. The same SKU sold in all three markets needs three RPs, three notifications (CPNP, SCPN, FDA product listing) and three label variants. Most failures are not technical — they are stale RPs, unsynced notifications, and labels updated in one market and not the others.

The dossier: PIF in EU/UK, safety substantiation in US

EU and UK both require a Product Information File (PIF) — formula, manufacturing data, Cosmetic Product Safety Report (CPSR), claims evidence, animal-test declaration — produced to a competent authority on request and held for ten years after the last batch. MoCRA does not use the term PIF, but Section 608 requires records 'supporting adequate substantiation of the safety' of each product. In practice a single composite dossier covers all three: ingredient assessments, finished-product safety assessment, stability, preservative-efficacy, claims evidence, novel-ingredient risk assessments. The audit gap is almost always the same — the dossier exists conceptually but cannot be assembled to inspection-ready form inside the legal window.

ISO 22716 as the common GMP backbone

EU 1223/2009 Article 8 cites ISO 22716 as the harmonised GMP standard. The UK Cosmetics Regulation inherits the same reference. MoCRA's GMP rule, proposed in 2024 and expected to finalise in 2026–2027, draws heavily on ISO 22716 with US-specific deltas (adverse-event reporting, facility registration, product listing). A site already running a credible ISO 22716 programme is the closest most cosmetics manufacturers can get to a single global GMP baseline. ISO 22716's 17 chapters — personnel, premises, equipment, raw materials, production, finished products, QC lab, OOS, wastes, subcontracting, deviations, complaints, recalls, change control, internal audit, documentation — map cleanly to QMS modules.

Labelling, claims and the diverging allergen lists

EU Article 19 sets mandatory label content; Article 20 plus Regulation 655/2013 polices claims. The UK runs a parallel regime under Schedule 34. MoCRA Section 609 requires the Responsible Person's domestic contact on-pack and directs FDA to issue fragrance allergen disclosure rules — converging toward the EU list, which itself expanded from 26 to over 80 allergens in 2023 with a 2026 implementation deadline. Multi-language matrices (EU 27 official languages, UK English, US English + bilingual states) compound the artwork problem. A claim-evidence record that does not survive a competent authority challenge is now a routine reason products are withdrawn in all three markets.

Post-market: SUE, MoCRA adverse events, recall

EU Article 23 requires SUE reporting to the competent authority of the Member State where the SUE occurred. UK SUEs route to OPSS. MoCRA requires serious adverse events to FDA within 15 business days, with a six-year retention rule (three years for small businesses). Routine cosmetovigilance — trend analysis of all undesirable effects, not only serious ones — is the test of whether the RP is actually monitoring the market. Recall capability is now mandatory in all three regimes (FDA gained mandatory recall authority under MoCRA Section 605 in 2023). Reconstructing downstream distribution within 24 hours of a request is the realistic bar.

A 90-day multi-market readiness path

Days 1–15: RP identity and notification reconciliation across CPNP, SCPN and FDA listing for the top 20 SKUs. Days 16–35: PIF/substantiation reconstructability test, ISO 22716 gap close on production, finished products and OOS. Days 36–55: labelling refresh against the EU 2023 allergen update, UK Schedule 34 and the latest MoCRA contact-on-pack guidance; claim dossier hardening. Days 56–75: cosmetovigilance trend report, SUE/serious AE drill, mock recall against live data with 24-hour reconstruction target. Days 76–90: internal audit covering all 17 ISO 22716 chapters plus EU Articles 4/10/11/19/20/23, UK equivalents and MoCRA Sections 605/606/608/609; freeze baseline.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

MoCRA

2022 US law that put cosmetics under FDA oversight — facility registration, product listings, adverse-event reporting.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Cosmetics QMS

EU, UK, US and ISO 22716 on one spine.

PIF & substantiation dossier

One composite, three markets.

Label design

Market-specific RP block + allergen data per SKU.

Cosmetovigilance & AE

EU SUE, UK OPSS, MoCRA 15-day clock.

Recall management

24-hour distribution reconstruction.

Industries this hits hardest

Cosmetics Consumer products

Frequently asked

Do we really need three Responsible Persons for one product?

If you sell into the EU, UK and US, yes — one RP established in the EU for CPNP, one established in the UK for SCPN, and one US Responsible Person whose name and contact appear on the US label per MoCRA. They can be the same legal entity only if it has the necessary establishment in each jurisdiction; most brands use an EU RP service, a UK RP service and an in-house US Responsible Person.

Is ISO 22716 certification enough to satisfy MoCRA GMP?

Not on its own. FDA's proposed cosmetic GMP rule draws heavily on ISO 22716 but adds US-specific obligations — facility registration, product listing, adverse-event reporting linkage, and explicit recordkeeping for safety substantiation. ISO 22716 gets you 80–90% of the way; track the FDA final rule for the remaining US deltas.

Did Brexit really create a separate UK regime?

Yes. The UK Cosmetics Regulation runs parallel to EU 1223/2009 with its own SCPN notification portal, UK-established RP requirement, UK Annexes (which can and do diverge from EU Annexes), and OPSS as competent authority. Products placed on the GB market need a separate UK file; Northern Ireland still follows the EU regime under the Windsor Framework.

How do the EU's 2023 fragrance allergen update and FDA's pending rule interact?

The EU expanded the labelled allergen list from 26 to over 80 substances in Regulation 2023/1545, with a 31 July 2026 cut-off for placing on the market and a 31 July 2028 cut-off for selling through. FDA is expected to require disclosure of a US fragrance allergen list under MoCRA Section 609. The two lists will not be identical. Brands collecting fragrance-allergen data per ingredient from fragrance houses now (not at artwork time) are the ones who will hit both deadlines without scrap.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →