EU Regulation 1223/2009 is the single legal instrument that governs every cosmetic product placed on the European Union market. Adopted in 2009 and fully applicable since July 2013, it replaced the earlier Cosmetics Directive 76/768/EEC and consolidated the previous patchwork of national rules into one directly applicable regulation across all 27 member states (plus the EEA countries Norway, Iceland, and Liechtenstein, and Switzerland through bilateral agreement). For non-EU cosmetic brands, EU Regulation 1223/2009 is not a reference document — it is the binding legal framework that dictates whether a product can legally enter the European market and remain on shelves.
Scope of EU Regulation 1223/2009 and what counts as a cosmetic
The regulation applies to any cosmetic product made available on the EU market, defined in Article 2 as any substance or mixture intended to be placed in contact with external parts of the human body or with the teeth and the mucous membranes of the oral cavity with a view exclusively or mainly to cleaning them, perfuming them, changing their appearance, protecting them, keeping them in good condition, or correcting body odours. This scope covers skincare, makeup, haircare, fragrances, toothpastes, mouthwashes, deodorants, and personal hygiene products.
Products falling outside this definition are regulated under different frameworks — oral medicines are regulated as pharmaceuticals under Directive 2001/83/EC, medical devices under Regulation 2017/745, biocides under Regulation 528/2012, and food supplements under Directive 2002/46/EC. Borderline products — such as anti-acne formulations, whitening products, and certain sunscreens — require careful case-by-case classification. A product sold as a cosmetic in the United States may be classified as a medicinal product in the EU if it makes therapeutic claims, and vice versa. Getting this classification wrong means filing under the wrong regulatory framework entirely, which is a far larger compliance problem than a simple documentation error.
The Responsible Person requirement under EU Regulation 1223/2009
Article 4 of EU Regulation 1223/2009 requires that only cosmetic products for which a legal or natural person has been designated as the Responsible Person within the European Community may be placed on the EU market. For non-EU brands, the Responsible Person must be a legal entity physically established within the EEA — a distributor in Dubai, a manufacturer in South Korea, or a brand owner in the United States cannot serve as the Responsible Person. The appointment must be in writing and accepted by the appointed entity, creating a binding legal relationship governed by EU law.
The Responsible Person's obligations are extensive. Under Articles 5 and 6, they are legally accountable for the product's compliance with all safety, labeling, GMP, claim substantiation, and notification requirements. They must hold the Product Information File for 10 years after the last batch was placed on the market, must report serious undesirable effects to the competent authority of the member state where the effect occurred within 20 calendar days, must cooperate with market surveillance authorities, and must take corrective action — including product withdrawal or recall — if a product is found to be non-compliant. These obligations are not administrative formalities. They are legally enforceable duties backed by administrative penalties in each member state's transposition legislation.
Product Information File and Cosmetic Product Safety Report
Article 11 of EU Regulation 1223/2009 requires a Product Information File (PIF) for every cosmetic product placed on the EU market. The PIF must be kept at the address of the Responsible Person indicated on the label, must be made available to the competent authority of the member state in which the PIF is kept upon request, and must be readily accessible in electronic or other format. The PIF must contain: a description of the cosmetic product such that the PIF can be clearly attributed to the product, the Cosmetic Product Safety Report (CPSR) referred to in Article 10, a description of the method of manufacturing and a statement on compliance with GMP, proof of the effect claimed where justified by the nature or the effect of the cosmetic product, and data on any animal testing performed in the course of developing or assessing safety.
The Cosmetic Product Safety Report is the technical core of the PIF. Annex I of the regulation specifies the structure in detail. Part A — Cosmetic Product Safety Information — must include quantitative and qualitative composition, physical and chemical characteristics and stability, microbiological quality, impurities and traces of substances, information on the packaging material, normal and reasonably foreseeable use, exposure to the cosmetic product, exposure to the substances contained in the cosmetic product, toxicological profile of the substances, undesirable effects and serious undesirable effects, and information on the cosmetic product. Part B — Cosmetic Product Safety Assessment — contains the assessment conclusion, the labeled warnings and instructions of use, the reasoning leading to the conclusion, and the assessor's credentials and final approval.
CPNP notification and labeling under EU Regulation 1223/2009
Article 13 of EU Regulation 1223/2009 requires the Responsible Person to submit specific information to the Commission through the Cosmetic Products Notification Portal (CPNP) before placing a cosmetic product on the EU market. This is not a product approval — the CPNP does not review or approve products. It is a mandatory notification that populates the EU-wide database used by market surveillance authorities and poison control centers. Any change in the product category, brand name, member state of first placement, contact details of the Responsible Person, or composition requires an updated notification before the revised product can be sold.
Labeling requirements under Article 19 are prescriptive. The label must show the name and address of the Responsible Person (not the manufacturer, not the US distributor), the country of origin for imported cosmetics, the nominal content at the time of packaging, the date of minimum durability for products that can be kept for less than 30 months (otherwise the period-after-opening symbol), particular precautions to be observed in use, the batch number of manufacture or reference for identifying the cosmetic product, the function of the product (unless clear from presentation), and the INCI list of ingredients. All information must be indelible, easily legible, and visible. Mandatory information must appear in the language(s) required by each member state where the product is sold — a single English-only label is almost never sufficient.
How EU Regulation 1223/2009 differs from US MoCRA
Non-EU brands — particularly those entering Europe after establishing themselves in the US market — often assume that compliance work done under MoCRA provides a foundation for EU entry. The overlap is smaller than it appears. MoCRA does not require a Responsible Person; EU Regulation 1223/2009 does. MoCRA does not require a Cosmetic Product Safety Report signed by a qualified safety assessor; EU Regulation 1223/2009 does. MoCRA does not require a Product Information File held in the EU; EU Regulation 1223/2009 does. MoCRA's adverse event reporting uses a 15-business-day timeline and goes to the FDA; EU reporting uses a 20-calendar-day timeline and goes to each member state competent authority.
The ingredient rules differ as well. EU Regulation 1223/2009 Annex II prohibits roughly 1,700 substances from cosmetic use. Annex III restricts specific substances under defined conditions. Annexes IV, V, and VI list permitted colorants, preservatives, and UV filters exclusively — a substance not on these lists cannot be used as a colorant, preservative, or UV filter, even if it is safe. The US regulatory approach is more permissive and does not operate through positive lists for most categories. A US-compliant formulation can contain ingredients that are prohibited in the EU, and reformulating for EU entry is often necessary rather than optional.
How FDABridge handles EU Regulation 1223/2009 compliance
FDABridge manages full EU Regulation 1223/2009 compliance for non-EU cosmetic brands — from Responsible Person appointment through Product Information File preparation, Cosmetic Product Safety Report coordination, CPNP notification, and ongoing compliance as product portfolios evolve. Visit fdabridge.com/eu-cosmetics to see our EU cosmetics services or fdabridge.com/apply/eu-cosmetics to start your filing.
Need help entering the EU market?
See our EU cosmetics page for Responsible Person assignment and CPNP registration support.