In order to ensure the safety of the cosmetic products placed on the EU and UK markets, cosmetic products should be produced according to the good manufacturing practice (GMP).

Various GMP standards exist, but the one applicable in the EU is ISO 22716. This standard gives guidance for the production, control, storage and shipment of cosmetic products, and it affects manufacturers, as well as suppliers, retailers, brand holders and retailers of cosmetic products.

Each product placed on the EU and UK markets needs to have a product information file (PIF) compiled. PIF is a set of various documents and tests relating to the finished product, raw materials, packaging specifications, manufacturing process etc. The content of the PIF is described in Article 11 of the EU cosmetics regulation, where it is written that the PIF shall contain the following information and data:

1. A description of the cosmetic product which enables the product information file to be clearly attributed to the cosmetic product

2. The cosmetic product safety report referred to in Article 10(1)

3. A description of the method of manufacturing and a statement on compliance with good manufacturing practice referred to in Article 8

4. Where justified by the nature or the effect of the cosmetic product, proof of the effect claimed for the cosmetic product

5. Data on animal testing performed by the manufacturer, his agents or supplier, relating to the development or safety assessment of the cosmetic products of its ingredients, including any animal testing performed to meet the legislative or regulatory requirements of third countries.

Product information file has to be kept by the responsible person, at one single address within the EU (which has to be specified on the label), readily accessible for the competent authority of the member state where the responsible person is keeping the PIF even for 10 years after the last batch of the product has been placed on the market.

Documents in the PIF have to be in language which is easily understood by the competent authority of the member state where the PIF is kept.

CPNP stands for Cosmetic Products Notification Portal. It is an EU online notification system, where responsible persons submit certain information about the cosmetic products that they place or make available on the EU market. This information is then made available to the EU member states' competent authorities and poison centres.

SCPN stands for Submit Cosmetic Product Notifications. It is a Great Britain (GB) online notification system, where responsible persons submit certain information about the cosmetic products that they place or make available on the GB market. This portal is operated by Office for Product Safety and Standards (OPSS).

Since 11 July 2013 the applicable legislation for cosmetic products in the EU is the EU cosmetics regulation 1223/2009.

Since Brexit the UK has its own cosmetic legislation. On 1.1.2021 the Product Safety and Metrology etc. (Amendment etc.) (EU Exit) Regulations 2019 came into force, sometimes also simply referred to as the UK Cosmetics Regulation 1223/2009 (based on the EU Regulation that is it based on).

EU cosmetics regulation 1223/2009 provides a definition of the cosmetic products in the EU: “'cosmetic product' means any substance or mixture intended to be placed in contact with the external parts of the human body (epidermis, hair system, nails, lips and external genital organs) or with the teeth and the mucous membranes of the oral cavity with a view exclusively or mainly to cleaning them, perfuming them, changing their appearance, protecting them, keeping them in good condition or correcting body odours”.

Before placing any cosmetic product on the EU market, the responsible person has to ensure that the product has undergone a safety assessment. Cosmetic product safety assessment is part B of the cosmetic product safety report (CPSR). In the safety assessment, the safety assessor checks whether the product is compliant with the EU cosmetics regulation and whether it is safe for use or not. Safety assessment is based on the information and tests compiled in part A of the CPSR.

EU cosmetics regulation 1223/2009 says that the safety assessor can be a person with the following qualifications: “The cosmetic product safety assessment, as set out in Part B of Annex I shall be carried out by a person in possession of a diploma or other evidence of formal qualifications awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State.”

Responsible person (RP) is a legal or a natural person, who has to be established within the EU.

The primary task of the RP is to ensure compliance of the cosmetic product placed on the market with the EU cosmetics regulation. More specifically, the RP has to ensure compliance of the product with no less than 16 different articles from the regulation. Among these, the RP has to ensure that the product is produced according to the relevant GMP standard, that the safety assessment has been carried out, that the product information file (PIF) for the product is compiled and is compliant with the regulation, that no animal testing has been performed, ensure compliance with the articles on sampling and analysis and restricted substances, RP has to perform the notification to the CPNP, ensure that the product labels are according to the regulation and that the claims made are substantiated, provide access to the information for the public (if necessary) and communicate any undesirable or serious undesirable effects to the competent authorities.

RP acts as the contact point for any EU competent authorities (usually different ministries of health) and has to keep the product information file at the address specified on the labels. If case of any non-conformity, the RP has to take appropriate measures, including product recall from the market or taking any corrective action to bring the product info conformity. On request of the competent authorities, the RP has to cooperate with them to eliminate any risk posed by the cosmetic product.

There can be only one responsible person per product for the whole of the EU.

The regulation says that the responsible person can be any legal or natural person who is based within the EU. Therefore, if the manufacturer is from the EU, they usually act as the RP themselves. Cosmetics manufacturers from outside of the EU, on the other hand, can't act as the RP themselves, unless they also have a branch in the EU. They have an option to appoint their importer, their distributor, or a third person or a company to act as the RP. This person or a company must accept this role in writing.

The regulation says that the responsible person can be any legal or natural person who is based within the UK. Therefore, if the manufacturer is from the UK, they usually act as the RP themselves. Cosmetics manufacturers from outside of the UK, on the other hand, can't act as the RP themselves, unless they also have a branch in the UK. They have an option to appoint their importer, their distributor, or a third person or a company to act as the RP. This person or a company must accept this role in writing.

Each product placed on the EU and UK markets needs to have a responsible person assigned. The regulation established this obligation by saying: “Only cosmetic products for which a legal or natural person is designated within the Community as 'responsible person' shall be placed on the market.”

CPSR stands for “cosmetic product safety report”. Cosmetic product safety report content is described in Annex I of the EU cosmetics regulation 1223/2009. It consists of 2 parts: cosmetic product safety information and cosmetic product safety assessment. CPSR is an essential part of the product information file (PIF).