Cosmetic PIF: what the Product Information File must contain under EU Regulation 1223/2009

• The Product Information File (PIF) is the mandatory technical dossier required per product under Article 11 of Regulation (EC) 1223/2009: it must exist from the moment of market placement and be retained for 10 years from the last batch.
• The Cosmetic Product Safety Report (CPSR) is the core element inside the PIF — not a separate obligation. Without a valid CPSR the PIF is incomplete.
• The Responsible Person maintains the PIF. The AEMPS reviewed 1,764 cosmetic products in 2024 and adopted measures in 14% of cases, with safety report deficiencies among the most frequent non-conformities.

1. What is the PIF and why is it mandatory?

The Product Information File — referred to in Article 11 of Regulation (EC) No 1223/2009 — is the technical and regulatory dossier that documents compliance for every cosmetic product placed on the EU market. The official English text of the Regulation uses the term "product information file"; the abbreviation PIF is universally accepted across the industry.

The obligation derives from Article 11(1): "The responsible person shall ensure that, for the purpose of market surveillance, the following information about the cosmetic product is kept available, in an accessible manner, at an address indicated on the label, to the competent authorities of the Member State where that address is located."

This obligation falls on the Responsible Person — the same entity that manages CPNP notification and guarantees product safety. The PIF and the CPNP are complementary but independent obligations: the CPNP notification indicates where the PIF is kept, but does not transmit its contents to the portal.

Three practical consequences of this obligation:

• The PIF must exist from the moment the product is placed on the market, not retrospectively.
• Its absence or incompleteness makes the product non-compliant, regardless of whether the product is actually safe.
• It must be accessible to national authorities at the Responsible Person's address shown on the label.

2. What the PIF must contain: the 5 items of Article 11(2)

Article 11(2) sets out the five mandatory items of the dossier:

Note on item 3 (GMP / ISO 22716): Article 8(1) requires that cosmetic products be manufactured in compliance with good manufacturing practice (GMP). Article 8(2) states that compliance with GMP is presumed where the manufacturing process follows the relevant harmonised standards published in the Official Journal. ISO 22716 is the primary harmonised standard for cosmetic GMP — it is not named in Article 8 itself, but is the standard that provides the presumption of conformity through the harmonised standards mechanism.

Note on item 4 (proof of claimed effects): This requirement only applies "where the nature or effect of the product justifies it." It is not a universal requirement; its scope depends on the claims the product makes. The EU Cosmetics Regulation Annexes provide the framework for verifying which ingredients may be included and under what conditions.

3. The CPSR as the core element of the PIF

The Cosmetic Product Safety Report (CPSR) is item (b) of Article 11(2) and, in practice, the most extensive and technically demanding component of the PIF. It is not a separate obligation from the PIF: it is its core.

Article 10(1) requires the Responsible Person to ensure that "a safety assessment of the cosmetic product is carried out and a cosmetic product safety report" is established in accordance with Annex I before placing the product on the market.

The CPSR is divided into two parts:

• Part A: product safety information (quantitative and qualitative composition, physical/chemical characteristics, microbiological quality, foreseeable exposure, toxicological profile of substances, undesirable effects, among others).
• Part B: the safety assessment itself, containing the conclusion, reasoning and the assessor's signature.

Only a person meeting the qualification requirements of Article 10(2) — holding at minimum a university degree in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State — may sign Part B.

When the PIF is incomplete or the CPSR is outdated, the issue is not merely documentary: the product becomes non-compliant because the Responsible Person cannot demonstrate that safety was verified under the current conditions of commercialisation.

4. Where, how long, and in what language

Retention period

Article 11(1) states:

"The information shall be kept available for a period of 10 years following the date on which the last batch of the cosmetic product was placed on the market."

The count does not start from the first batch or from the CPNP registration date: it starts from the last batch placed on the market. In practice, as long as the product remains in an active catalogue, each new production run renews the retention period.

Location

The file must be available "at an address indicated on the label" — meaning at the Responsible Person's address as shown on the product labelling. If the product is sold across multiple Member States, there is still a single address of custody.

Article 11(3) confirms the file may be kept "in electronic or other format" — there is no requirement for a paper-based physical dossier.

Language

Article 11(3) requires the information to be available "in a language which can be easily understood by the competent authorities of the Member State." In Spain, Royal Decree 85/2018 (BOE-A-2018-2693) specifies that the file must be in Spanish when the product is commercialised in Spain.

5. The update obligation

Article 11(1) adds that the information "shall be updated as necessary." This brief clause has wide practical scope.

The situations that typically trigger a PIF update include:

• Product reformulation: any change to the composition requires revisiting the CPSR (Part A, at minimum) and updating the product description.
• Supplier change for a raw material: if ingredient specifications differ, the toxicological assessment may need revision.
• New safety evidence: a new SCCS opinion, a restriction under Annex II or III, or post-market cosmetovigilance data.
• Regulatory change affecting the product's ingredients: an amendment to the Regulation's Annexes may alter the conditions of use for an ingredient already in the CPSR.

An outdated PIF is treated by authorities as equivalent to no PIF for compliance purposes: the obligation under Article 11 is not satisfied by having had the file at some point in the past, but by keeping it current.

6. Who can request the PIF and what they do with it

Competent authorities

The PIF is a document reserved for authorities — it is not accessible to the public or to third-party commercial entities. Article 22 of the Regulation governs market surveillance: national authorities are empowered to review documents (including the PIF) and conduct physical and laboratory controls. Member States must report their surveillance activities every four years.

In Spain, the AEMPS (Agencia Española de Medicamentos y Productos Sanitarios) is the competent authority. Article 24 adds a specific access mechanism: where there are well-founded doubts about the safety of a substance, the authority may request from the Responsible Person a list of all cosmetic products containing it, including their concentration.

The 2024 enforcement data

In 2024, the AEMPS evaluated 1,764 cosmetic products and adopted measures in 14% of cases. The most frequent non-conformities included:

• Deficiencies in the CPSR or safety report.
• Prohibited ingredients in the formula.
• Labelling errors.
• CPNP notification failures.
• Microbiological contamination.

These figures confirm that PIF review is not an exceptional event: it is a routine activity of the competent authority. Checking ingredients in the CosIng database provides a concrete starting point for reducing non-conformity risk.

7. The relationship between the PIF, GMP, and the manufacturing statement

Article 11(2)(c) requires the PIF to include "a description of the manufacturing method" and "a statement that the manufacturing method complies with Article 8." Article 8 requires that cosmetic products be manufactured in compliance with good manufacturing practice.

ISO 22716 is the international reference standard for cosmetic GMP. Although Article 8 does not cite the standard number explicitly, the European Commission has published the references of harmonised standards in the Official Journal, and ISO 22716 is the standard that provides the presumption of conformity with Article 8. Certification is not strictly mandatory, but it provides the most robust evidence for the statement that must be included in the PIF.

GMP compliance directly affects Part A of the CPSR (microbiological quality, impurities, packaging material information). A well-documented manufacturing process facilitates PIF preparation and reduces the likelihood of non-conformities during an inspection.

For a detailed look at the Regulation's Annexes and their relationship to the ingredient verification process that feeds into the PIF and CPSR, that post covers all six Annexes in depth.

8. Checklist: is your PIF complete?

Before finalising the dossier, verify the following:

• Art. 11(2)(a): the product description unambiguously links the dossier to the product on the market.
• Art. 11(2)(b): the CPSR is present, with both Part A and Part B. Part B is signed by a person meeting the Article 10(2) qualifications. The assessment reflects the current formula.
• Art. 11(2)(c): a description of the manufacturing method and a GMP compliance statement (ISO 22716) are included. The current manufacturer is identified in the file.
• Art. 11(2)(d): if the product makes efficacy claims, substantiating evidence is present.
• Art. 11(2)(e): animal testing data (or a declaration of absence) from the manufacturer, agents and suppliers is documented.
• Language: the file is in a language easily understood by the competent authority of the relevant Member State (Spanish in Spain, per Royal Decree 85/2018).
• Retention period: the date of the last batch has been documented and the 10-year window is tracked.
• Currency: the CPSR, product description and GMP statement reflect the current formula and current suppliers.

To verify that each ingredient in the product remains within the limits of Annexes II–VI, the updated CosIng database allows you to check the regulatory status of each INCI ingredient by entry number and annex.

9. Frequently asked questions

What is a cosmetic PIF? The Product Information File (PIF) is the mandatory technical and regulatory dossier required for every cosmetic product placed on the EU market, under Article 11 of Regulation (EC) No 1223/2009. It is maintained by the Responsible Person.

What must a cosmetic PIF contain? Five mandatory items under Article 11(2): a product description, the Cosmetic Product Safety Report (CPSR — Parts A and B), a description of the manufacturing method and a GMP compliance statement, proof of claimed effects (where the nature or effect of the product justifies it), and animal testing data.

How long must a cosmetic PIF be kept? 10 years from the date the last batch of the cosmetic product was placed on the market (Article 11(1) of Regulation (EC) No 1223/2009).

Is the CPSR the same as the PIF? No. The Cosmetic Product Safety Report (CPSR) is a required element inside the PIF — specifically item (b) of Article 11(2). The PIF is the complete dossier that contains the CPSR together with four other mandatory documents.

What language does the PIF need to be in? In a language "which can be easily understood by the competent authorities of the Member State" (Article 11(3) of Regulation 1223/2009). In Spain, Royal Decree 85/2018 (BOE-A-2018-2693) requires the PIF to be in Spanish.

When must the PIF be updated? Article 11(1) states the file "shall be updated as necessary." Any reformulation, supplier change, new safety evidence, or change to the applicable Annexes triggers an update obligation. Authorities treat an outdated PIF as non-compliant.

Who can access the PIF? Competent authorities of the Member State where the file is kept. In Spain: the AEMPS (Agencia Española de Medicamentos y Productos Sanitarios). The legal framework governing this access is Articles 22 and 24 of Regulation 1223/2009.