CPSR, PIF and CPNP: The Three Documents Behind Every Cosmetic Sold in the EU

How the three fit together

Brands often treat the three as a checklist of equal items. They are not. They are nested. The CPSR is one chapter of the PIF. The PIF is the file your Responsible Person keeps and the authorities inspect. The CPNP notification is the public record that a product with this name, this Responsible Person and this frame formulation is on the market. Get the order right and the rest follows: tests first, then the safety report, then the file, then the notification, then the shipment.

The Cosmetic Product Safety Report

Article 10 of the regulation requires the Responsible Person to ensure that the product has undergone a safety assessment before it is placed on the market, and that a safety report is drawn up according to Annex I. The report has two parts, and the difference between them is the difference between data and judgement.

Part A: the safety information

Part A collects the evidence. The quantitative and qualitative composition with the function of every ingredient. The physical and chemical characteristics and the stability of the product under reasonably foreseeable storage conditions. The microbiological quality, including the result of a preservation efficacy test, often called the challenge test. Impurities, traces and the relevant characteristics of the packaging material. The normal and reasonably foreseeable use. The exposure to the product and to each substance, calculated from how much is applied, how often, on what skin area and whether it is rinsed off. The toxicological profile of each substance. Undesirable effects already observed. And any other information, for example the results of patch tests or studies on similar products.

Most of Part A cannot be written at a desk. Stability, compatibility with the packaging, microbiological quality and the challenge test are laboratory work on your actual product in its actual pack. The toxicological profiles come from supplier documentation and published data, and the exposure calculations follow the current SCCS Notes of Guidance. A report that lists "no data available" against half of these points is not a safety report, however nicely it is formatted.

Part B: the assessment

Part B is the assessor's reasoning and conclusion. It states whether the product is safe under normal and reasonably foreseeable use, lists the warnings and instructions that must appear on the label, explains the scientific reasoning, including the margin of safety for the critical ingredients, and ends with the name, address, proof of qualification and signature of the assessor.

Who may sign

Article 10(2) is specific. The assessor must hold a diploma or other evidence of formal qualification awarded on completion of a university course in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a member state. A chemist with a cosmetics background, a formulator or a consultant without that degree may prepare Part A but may not sign Part B. When you buy a CPSR, ask who signs it and in which country they are qualified. German authorities will ask the same.

Kept up to date

The regulation says the report shall be kept up to date in view of additional relevant information generated after the product is placed on the market. In practice that means a review whenever the formula changes, whenever the packaging changes, whenever an annex to the regulation changes for one of your ingredients, and whenever undesirable effects are reported. The last three years have produced more annex changes than the ten before them: the retinol limits under Regulation (EU) 2024/996 with the final deadline of 1 May 2027, the 56 additional fragrance allergens under Regulation (EU) 2023/1545 that apply to new products since 31 July 2026, the PFHxA restriction under REACH from 10 October 2026, and the next round of CMR bans in Annex II expected to apply from February 2027. Each of these is a reason to reopen Part B. A CPSR signed in 2022 and never touched is a liability, not an asset.

The Product Information File

Article 11 lists what the PIF must contain, and the list is shorter than most brands fear:

1. A description of the cosmetic product that links the file clearly to the product on the shelf: name, formula reference, pack sizes, the artwork.
2. The Cosmetic Product Safety Report described above.
3. A description of the method of manufacturing and a statement of compliance with Good Manufacturing Practice. The harmonised standard is ISO 22716. The regulation asks for a statement, not a certificate, but German retailers and marketplaces increasingly ask to see the manufacturer's certificate, so get a copy when you sign the production contract.
4. Where justified by the nature or effect of the product, proof of the effect claimed. If the pack says "reduces wrinkles in 28 days" or "48 hours of hydration", the test that supports it belongs here. The common criteria for claims under Regulation (EU) No 655/2013 apply, and since 27 September 2026 the German Act against Unfair Competition adds its own rules on environmental claims.
5. Data on animal testing performed by the manufacturer, its agents or suppliers, including any testing done to meet the legislation of non-EU countries. The EU ban under Article 18 is absolute for products and ingredients tested in the EU; the file documents what happened elsewhere.

Two rules decide where and how long. The file is kept at the address of the Responsible Person that is printed on the label, in electronic or other format, for ten years after the date on which the last batch was placed on the market. And it must be readily accessible to the competent authority of the member state where the file is kept, in a language which can be easily understood by that authority. For Germany, authorities in our experience accept a file in English, while the label itself must be in German. For France, expect to be asked for French.

The practical consequence that surprises brands from the UK, the US and Korea: the PIF cannot sit at your head office in Manchester, Austin or Seoul. It sits with your EU Responsible Person. If your Responsible Person is a service provider, they hold it. If it is your distributor, the distributor holds it, which is one more reason to think carefully about who takes the role. The guide on the EU Responsible Person covers that decision.

The CPNP notification

The Cosmetic Products Notification Portal is the Commission's online system. Article 13 requires the Responsible Person to submit the following before the product is placed on the market: the category and name of the product; the name and address of the Responsible Person where the PIF is accessible; the country of origin if imported; the member state in which the product is first placed on the market; a contact person; the presence of nanomaterials with their identification and exposure conditions; the name and CAS or EC number of any substance classified as carcinogenic, mutagenic or toxic for reproduction in category 1A or 1B; and the frame formulation, so that poison centres can give medical advice in an emergency. When the product is actually placed on the market, the Responsible Person adds the original labelling and a legible photograph of the packaging.

Three things about the CPNP that brands misunderstand:

• It is free, and it is not an approval. Nobody at the Commission reviews your submission. The product may be sold the moment the notification is submitted. The notification does not make an unsafe or mislabelled product legal; it only records that you placed it on the market and who is responsible.
• It is done by the Responsible Person, with an EU Login account linked to that company. A brand outside the EU cannot notify its own products. If you change Responsible Person, the notification is updated to the new one.
• Distributors who translate the label must notify too. Under Article 13(3), a distributor that makes a product available in a member state and translates any element of the labelling on its own initiative must submit its own notification with the product name in the original and the translated language, the member state and its own details, and the details of the Responsible Person. This is common in DACH, where a UK or French label gets a German sticker from the importer.

Nanomaterials follow a separate route. Under Article 16, products containing nanomaterials must be notified six months before being placed on the market, with the identification, specification, quantity, toxicological profile, safety data and exposure conditions of the nanomaterial. Mineral sunscreens with nano titanium dioxide or zinc oxide, and some pigments, fall under this. The six months are the Commission's window to ask the Scientific Committee for an opinion. Plan for them.

One more practical point. German retailers and marketplaces often ask for the CPNP reference number in their listing forms, and Amazon's cosmetics compliance process asks for the Responsible Person and may ask for proof of notification. Keep the reference numbers per product in one place where your sales team can find them.

The UK and Switzerland

Since 1 January 2021, Great Britain has its own version of all three. A UK Responsible Person, a UK PIF held at a UK address, and a notification in the Submit Cosmetic Product Notification service run by the Office for Product Safety and Standards instead of the CPNP. A UK CPSR is a strong starting point for the EU, because the structure is identical, but it must be checked against the EU annexes, which have diverged, and the assessor must be willing to sign it under EU law. Northern Ireland continues to apply the EU rules.

Switzerland has no notification portal. The Swiss Ordinance on Cosmetics mirrors the EU rules on safety assessment and the product information file, and requires a responsible person with a Swiss address on the label. There is nothing to notify, but the file must exist and be available to the cantonal authorities on request. The guide on selling cosmetics in Germany covers the Swiss points in more detail.

How long it takes and what it costs

Brands ask us for a number, so here is how the time breaks down for a typical leave-on skincare product that has never been assessed for the EU. These are experience values, not legal deadlines.

Run in sequence this is five to six months. Run in parallel, with the stability study started on the day the formula is frozen, it is three to four. The study that most often sits on the critical path is stability, because it cannot be shortened and because brands tend to start it late. If you already sell the product at home and have stability and challenge data from your own launch, the EU report can be ready in six to eight weeks.

On cost, the same logic applies as for the Responsible Person: the fee for writing the report is the small part, the tests are the large part, and the spread between quotes is usually explained by what has been left out. A quote for a CPSR that does not ask for your stability and challenge data is a quote for Part B without Part A.

The seven mistakes we see most often

1. Reusing a UK or US safety file without an EU review. The structure looks the same. The annexes do not. Ask the assessor to confirm the version of the EU annexes the report was checked against, in writing.
2. A desk CPSR. A report written from the INCI list alone, without stability, challenge test or microbiological data. It is cheap, it looks complete, and it fails the first time a German authority asks for Part A.
3. Shipping before notifying. Stock lands in the EU warehouse, the launch date is fixed, and the CPNP notification is done a week later. The notification takes a day, so there is no reason for this, but it happens whenever the Responsible Person is appointed last.
4. Claims with no file behind them. The pack promises a measurable effect and the PIF contains no test. Retailers in Germany check this more carefully than they used to, and the September 2026 rules on environmental claims make unsupported "sustainable" and "climate-neutral" wording a legal risk on top of a regulatory one.
5. The PIF at head office. The file exists, but it is in Manchester, not at the address of the Responsible Person printed on the label.
6. A frozen CPSR. The formula was tweaked in 2024, the packaging changed in 2025, the allergen rules changed in 2026, and the report still says 2022.
7. Nanomaterials discovered late. The mineral sunscreen is ready to ship and nobody has done the Article 16 notification six months earlier.

The file checklist before you ship to Germany

• Safety assessor named, qualified under Article 10(2), and willing to sign under EU law.
• Stability, packaging compatibility, microbiological quality and challenge test results on the final formula in the final pack.
• Toxicological profiles and exposure calculations for all ingredients, including impurities and allergens, against the current annexes.
• CPSR Part A and Part B complete, signed and dated this year or reviewed this year.
• Product description, manufacturing method and GMP statement (ISO 22716) in the PIF, with the manufacturer's certificate attached where available.
• Evidence for every claim on the pack and in the online listing.
• Animal testing data documented, including testing done for non-EU markets.
• PIF held at the EU Responsible Person's address and accessible in English or the local language.
• CPNP notification submitted per product, with the German label artwork uploaded when the product goes on sale.
• Nanomaterial notification submitted six months before launch where relevant.
• CPNP reference numbers recorded and available to your sales team for retailer listing forms.

Questions brands ask us

Tity Sonko

Founder and Managing Director of SONKO Consulting GmbH in Leverkusen, Germany. Tity works with international prestige beauty brands on their entry into Germany, Austria and Switzerland, from the first compliance check to the first retail order. She writes the weekly newsletter The DACH Prestige Signal.