In short: the CPSR is the cosmetic product safety report required by Article 10(1) of Regulation (EC) No 1223/2009, and it forms the safety core of the product information file the responsible person must keep. The file holds five elements and must stay readily accessible for ten years after the last batch. The safety assessment itself can only be signed by a qualified safety assessor.
Two documents, and which one contains what
The product information file and the cosmetic product safety report are often spoken about as if they were the same thing. They are not: the PIF is the container, and the CPSR is the safety evidence inside it.
Article 11(1) of the Regulation requires the responsible person to keep a product information file for each cosmetic product placed on the market, and to keep it for ten years following the date on which the last batch of the product was placed on the market (Consolidated text of Regulation (EC) No 1223/2009 — EUR-Lex).
Article 11(2) then lists what the file must contain, and it is a short list:
| PIF element | What it is | Who normally produces it |
|---|---|---|
| (a) Product description | Enough to attribute the file unambiguously to the product | Brand / responsible person |
| (b) Cosmetic product safety report | The Article 10(1) report, structured per Annex I | Safety assessor, from supplier data |
| (c) Manufacturing method + GMP statement | Description of manufacture and compliance with good manufacturing practice (Article 8) | Manufacturer |
| (d) Proof of the effect claimed | Required where justified by the nature or effect of the product | Brand, with test data |
| (e) Animal testing data | Any animal testing by the manufacturer, its agents or suppliers relating to development or safety assessment | Manufacturer and its suppliers |
Two points on that table are easy to underestimate. Element (d) is conditional — it applies “where justified by the nature or the effect of the cosmetic product”, so a claims-driven product carries a heavier file than a plain one. Element (e) reaches your supply chain: it covers testing performed by the manufacturer’s agents or suppliers, and it expressly includes testing performed to meet the requirements of third countries.
What Annex I actually asks for
Annex I sets out the CPSR in two parts, and the split matters because they have different authors.
Part A — Cosmetic product safety information. The ten headings are:
- Quantitative and qualitative composition of the cosmetic product
- Physical/chemical characteristics and stability of the cosmetic product
- Microbiological quality
- Impurities, traces, information about the packaging material
- Normal and reasonably foreseeable use
- Exposure to the cosmetic product
- Exposure to the substances
- Toxicological profile of the substances
- Undesirable effects and serious undesirable effects
- Information on the cosmetic product
Part B — Cosmetic product safety assessment. This part contains the assessment conclusion (a statement on the safety of the product in relation to Article 3), the statement on labelled warnings and instructions of use under Article 19(1)(d), the reasoning, and the name, address, proof of qualification, date and signature of the safety assessor.
Part B is not a formality anyone on the team can complete. Article 10(2) requires the assessment set out in Part B of Annex I to be carried out by a person holding a diploma or other evidence of formal qualifications awarded on completion of a university course of study in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State. The Commission’s guideline on Annex I is explicit that the guidelines are not meant to replace the knowledge and expertise of that assessor, who “should remain the only professional allowed to carry out the cosmetic product safety assessment as described in Part B of Annex I” (Commission Implementing Decision 2013/674/EU, guidelines on Annex I).
The paragraph a fragrance buyer should read twice
The 2013/674 guidelines contain one provision that decides what a fragrance house owes the brand. On fragrance compounds it states:
Where any fragrance (or flavour) compound comprising a mixture of fragrance (or flavour) ingredients and functional components with olfactory, odour-enhancing, odour-protecting or blending properties is formulated and intentionally added to a cosmetic product to impart a scent (or flavour) or to cover a malodour, its identification is to include the name and code number as well as the identity of the supplier. Qualitative and quantitative information about regulated substances in the fragrance (or flavour) compound and information relevant for a safety assessment should be disclosed to the responsible person and the safety assessor, and should be included in the safety report.
Read it as a deliverables list. From the compound supplier, the brand’s file needs:
- the compound’s name and code number, and the identity of the supplier;
- qualitative and quantitative information on the regulated substances in that compound;
- the supporting information the safety assessor needs to complete the toxicological profile and exposure sections.
This is why the composition data conversation belongs at the development stage rather than at artwork approval. A brand that receives a compound without the code number and without quantitative data on regulated substances cannot complete Part A, and the assessor cannot conclude Part B.
The guidelines also close a common loophole. Where a Part A item is not relevant or necessary for a given product type — a preservation challenge test, for example — the absence of that data has to be clearly justified in Part A, and that justification has to be repeated and validated by the safety assessor in the reasoning in Part B. A missing item is a documented decision, not a silent gap.
Where the file lives, and in what language
Article 11(3) requires the responsible person to make the product information file readily accessible in electronic or other format at the address indicated on the label, to the competent authority of the Member State in which the file is kept. The information must be in a language that the competent authorities of that Member State can easily understand.
Enforcement can come from more than one direction. Under the Regulation, the competent authority of any Member State where the product is made available may ask the competent authority of the Member State where the file is kept to verify whether the file satisfies Article 11(2) and whether the information in it provides evidence of the product’s safety.
The file is also live, not archival. The guidelines state that the product information file should be updated when necessary, and that the responsible person must ensure the cosmetic product safety report is kept up to date in the light of additional relevant information emerging after the product has been placed on the market. Reformulation, a new allergen declaration, a change of fragrance supplier — each is a reason to reopen the file.
One more scope point: Article 11(4) applies these requirements equally to cosmetic products that were notified under the previous Directive 76/768/EEC. A long-established product line is not grandfathered out of the file requirement.
The notification element is separate
Keeping the file is not the same as notifying the product. Article 13 of the Regulation requires responsible persons — and, in certain circumstances, distributors — to submit information about the products they place or make available on the European market through the cosmetic products notification portal (CPNP), which is free of charge. Once a product is notified in the CPNP, no further notification at national level within the EU is needed. Products containing nanomaterials carry an additional module under Article 16, notified in addition to the Article 13 submission (European Commission — Cosmetic product notification portal).
The CPNP distributes that information electronically to competent authorities, for market surveillance, market analysis, evaluation and consumer information, and to poison centres for medical treatment purposes.
The animal testing element, and why it reaches a Chinese supply chain
Element (e) of the PIF is the one that most often surprises non-EU manufacturers, because the underlying prohibition has dates attached to it.
The testing ban on finished cosmetic products has applied since 11 September 2004, and the testing ban on ingredients or combinations of ingredients since 11 March 2009. The marketing ban has applied since 11 March 2009 for all human health effects with the exception of repeated-dose toxicity, reproductive toxicity and toxicokinetics — and since 11 March 2013 for those three, irrespective of the availability of alternative non-animal tests (European Commission — Ban on animal testing).
The practical consequence for a brand sourcing fragrance or a finished product from outside the EU is that animal testing carried out to satisfy another market’s requirements still has to be reported in the PIF. The data element asks for testing performed by the manufacturer, its agents or suppliers, including testing performed to meet the legislative or regulatory requirements of third countries. Whether that testing is compatible with your EU route is then a question for the assessor and your responsible person — but it is a question you should be able to answer, which means you need to know what your suppliers have done.
FAQ
What is the difference between the PIF and the CPSR?
The product information file is the whole dossier required by Article 11(1); the cosmetic product safety report is the safety element inside it, required by Article 10(1) and structured by Annex I. The PIF contains four other elements besides the report.
Who can sign the CPSR?
Part B of the report must be carried out by a person with a diploma or equivalent formal qualification from a university course in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State. The Commission’s guidelines state that this assessor remains the only professional allowed to carry out the Part B assessment.
How long must the file be kept?
Ten years following the date on which the last batch of the cosmetic product was placed on the market, and it must be readily accessible in electronic or other format at the address shown on the label.
What must a fragrance supplier hand over?
The compound’s name and code number and the identity of the supplier, plus qualitative and quantitative information about the regulated substances in the compound and the information the safety assessor needs. The 2013/674 guidelines require that this be disclosed to the responsible person and the assessor and included in the safety report.
Where must the file be kept, and in which language?
At the address of the responsible person indicated on the label, accessible in electronic or other format, in a language the competent authorities of the Member State where the file is kept can easily understand.
What if a Part A item is not relevant to my product?
The absence of that data must be clearly justified in Part A, and the safety assessor has to repeat and validate that justification in the reasoning in Part B. An omitted item without a documented justification is a gap.
Building a file that survives a request
Most of the work in a PIF is data collection, and most of the delay comes from the fragrance documentation arriving after the artwork rather than before it. Senti manufactures private-label and custom fragrance in Guangzhou, and we supply the composition and regulatory data the safety assessor needs as part of development.
Our guide for brands choosing a private-label perfume manufacturer sets out the launch sequence, and the OEM, ODM and OBM comparison explains which model fits which stage. The custom perfume service covers development from brief to bottle. Three companion guides cover adjacent obligations: fragrance allergen labelling, SCPN notification and the UK responsible person, and ASEAN registration through BPOM and NPRA.
Tell us the product type and the market, and we will assemble the fragrance-side data pack your assessor and responsible person will ask for. Contact our team.
