Responsible Person obligations in EU cosmetics: the complete legal checklist under Regulation 1223/2009

• Every cosmetic placed on the EU market must have a Responsible Person established in the EU. No exceptions.
• Regulation (EC) 1223/2009 assigns five core obligations: product safety, PIF maintenance, CPNP notification, ingredient compliance and cosmetovigilance.
• One product is manageable. Twenty products, without a systematic process, is where compliance gaps quietly open up.

1. Who can be a Responsible Person?

Article 4 of Regulation (EC) 1223/2009 defines this clearly. Only a natural or legal person established in the European Union can hold the role — no workarounds. If the manufacturer is based outside the EU, someone inside must take on the obligation before the product reaches the market.

Four profiles are eligible:

• A manufacturer established in the EU who markets products under their own name or brand.
• An authorised representative explicitly designated in writing by a non-EU manufacturer.
• An importer who places the product on the EU market.
• A distributor who markets the product under their own name or brand, or who modifies a product already on the market in a way that may affect its compliance.

What the Regulation does not allow is ambiguity. The designation must be documented, unambiguous, and in place before the product enters the market. You cannot fix this retroactively.

2. The five core obligations

Article 5 is the umbrella: it makes the Responsible Person legally accountable for ensuring the product complies with Articles 3 and 8 to 24 of the Regulation.

2.1. Ensuring product safety and the CPSR (Art. 10)

This is the most technically demanding obligation. Article 3 sets the general principle that every cosmetic product must be safe for human health under reasonably foreseeable conditions of use; that safety is documented in the Cosmetic Product Safety Report (CPSR) required by Article 10.

The CPSR has two parts: the product safety information and the safety assessment itself. Only a qualified person — holding at minimum a university degree in Pharmacy, Toxicology, Medicine or an equivalent discipline, plus demonstrable relevant experience — can sign off the assessment.

A few things to keep in mind:

• The CPSR must be updated whenever the formula changes, a raw material supplier changes, or new safety data emerges for any ingredient.
• An outdated safety assessment makes the product non-compliant, full stop.
• Revising a CPSR always costs less than managing a recall.

2.2. Maintaining the Product Information File (PIF) (Art. 11)

The PIF is the complete compliance dossier for the product. It must be available to national authorities for 10 years from the date the last batch was placed on the market, and it must be kept at the address of the Responsible Person within the EU.

Mandatory PIF contents:

• Description of the cosmetic product.
• Complete CPSR (both parts).
• Description of the manufacturing method and Good Manufacturing Practice compliance statement (ISO 22716 or equivalent).
• Evidence substantiating any efficacy claims made for the product.
• Data on animal testing, if any, within the applicable legal framework.

The PIF is not a create-once-and-archive document. When you reformulate, change a supplier, or new safety evidence emerges for an ingredient, the PIF changes with it. Keeping an outdated PIF is functionally equivalent to not having one.

2.3. CPNP notification before market placement (Art. 13)

Before the product reaches the market, the Responsible Person must notify it on the Cosmetic Products Notification Portal (CPNP) maintained by the European Commission. There is no grace period: the notification is prior to market placement, not simultaneous or after the fact.

What gets notified in the CPNP:

• Product category and commercial name.
• Name and address of the Responsible Person.
• Country of commercialisation.
• Emergency contact details — this must be a reachable person, not a generic mailbox.
• Presence of substances in the form of nanomaterials, with their identification and chemical name (IUPAC).
• Name and CAS or EC number of any substances classified as CMR (carcinogenic, mutagenic or toxic for reproduction, category 1A or 1B).
• The original labelling and, where reasonably legible, a photograph of the packaging.

Any subsequent change to this information requires an update in the CPNP. Notifying a reformulated product as if it were the original version is a common and costly compliance error.

2.4. Compliance with prohibitions and restrictions (Annexes II–VI)

Regulation (EC) 1223/2009 includes six Annexes governing which ingredients can be used, under what conditions, and at what maximum concentrations:

• Annex II: prohibited substances — more than 1,600 entries.
• Annex III: restricted substances — permitted only under specific conditions.
• Annex IV: authorised colorants.
• Annex V: authorised preservatives.
• Annex VI: authorised UV filters.

The Responsible Person must verify every ingredient in every formula against these Annexes before placing the product on the market. The operational challenge is that the Annexes are updated through Commission Regulations published in the Official Journal of the EU (OJ EU) — there is no notification system. You either track the OJ proactively or you miss it.

An ingredient in Annex III (restricted) today could move to Annex II (prohibited) six months from now. If your PIF and formula are not updated before that date, your product becomes non-compliant the moment the restriction takes effect — regardless of when you find out about it.

2.5. Cosmetovigilance (Art. 23)

The Responsible Person is the official recipient of adverse effects reported by consumers or healthcare professionals, and must report serious undesirable effects (SUEs) to the competent national authorities.

What Article 23 requires:

• When a consumer or healthcare professional reports a SUE, the Responsible Person forwards the information to the authorities in the country where the effect occurred.
• When the SUE implies a serious safety risk, the competent authority may extend the notification to other Member States.
• All adverse effect information — serious and non-serious — must be kept on record and accessible to authorities on request.

Cosmetovigilance is not just reactive. It means having a process to receive complaints, classify them correctly (undesirable effect vs. serious undesirable effect), and assess whether the volume or pattern of non-serious effects should trigger a CPSR review.

3. Ongoing operational responsibilities

Beyond the five core obligations, the Responsible Person carries a set of continuous duties with no expiry date:

• Communication with the national authority: in Spain, this is the AEMPS. In an inspection or urgent procedure, the standard response window is 72 hours.
• Labelling compliance under Art. 19: ingredients listed in descending order of weight (INCI), batch number, expiry date or PAO (Period After Opening), product function if not self-evident, Responsible Person name and address, country of manufacture if outside the EU.
• Change control for formula and suppliers: any change to composition triggers a CPSR review, and a significant change requires updating the CPNP notification.
• Notification of reformulated products: a material reformulation cannot be marketed under the original CPNP notification without updating it first.
• Active regulatory surveillance: tracking the OJ EU for amending Commission Regulations, monitoring SCCS opinions, Safety Gate alerts, and DG SANTE communications on ingredients under review.

4. The cost of getting it wrong

Articles 25–27 of the Regulation lay out the corrective measures available to authorities: from commercial restrictions and labelling modifications through to mandatory market withdrawal. The framework is clear, and national authorities do use it.

Administrative sanctions are set at the Member State level. In Spain, the General Public Health Act classifies infringements as minor, serious and very serious, with fines that can reach 600,000 euros for the most serious cases, plus the possibility of temporary establishment closure.

But the most immediate and expensive consequence is often not the fine. It is the recall: tracking down every distributed batch, coordinating returns through the distribution chain, managing consumer communications, and absorbing the cost of withdrawn stock. For products with high distribution volume, that bill frequently exceeds the fine itself.

And then there is the Safety Gate effect. When authorities flag a product in the EU rapid alert system, the report is public and searchable by product name and brand. A distributor, a retailer or a journalist can find it without effort. A poorly managed withdrawal leaves a traceable record for years.

5. How this scales for a Responsible Person managing multiple products

One product is manageable. Ten becomes team work. Twenty or more — that is a process problem.

The bottleneck is rarely willingness to comply. It is information flow. The Responsible Person needs to know when the Annexes change, when a new SCCS opinion lands on an ingredient in their portfolio, when a Safety Gate alert involves one of their suppliers, when the OJ EU publishes a Commission Regulation affecting UV filters or preservatives.

Manual tracking — Google alerts, weekly OJ review, SCCS RSS feeds — works up to a point. Beyond a certain portfolio size and ingredient diversity, you need a system that filters the noise and delivers only what actually applies to your specific catalogue.

That is what BD-API automates: capturing regulatory changes across OJ EU, SCCS, Safety Gate and DG SANTE, cross-referencing them against the CosIng INCI inventory linked to your product catalogue, and delivering structured, actionable information to your regulatory team. Not replacing human judgement — giving back the hours currently spent reviewing sources one by one.

6. Compliance checklist — answer these now

Before you close this page, answer five questions with a clear yes or no:

• Do you have an up-to-date CPSR for every product, signed by a person meeting the Art. 10 qualifications?
• Is your PIF complete, accessible and current for each product, with a documented change history?
• Is every product correctly notified in the CPNP, with formula updates reflected?
• Do you have a documented process for verifying every new ingredient or reformulation against Annexes II–VI before commercialising?
• Do you have an active cosmetovigilance process that captures adverse effects, classifies them correctly and notifies authorities when required?

If your team cannot answer all five with a confident yes, there is work to do. That is not a criticism — it is the common reality when a portfolio grows faster than the processes supporting it. The good news is that every one of these five points has a workable operational solution.