How Often Do You Get Audited? How Long Must a PIF Be Kept and Where?
Share
Spectra cosmetic compliance
For what the file must contain, see our guide to what goes into a PIF. Here we focus on keeping it correctly.
The retention period: ten years
A PIF must be kept for ten years following the date on which the last batch of the product was placed on the market, per Regulation (EC) No 1223/2009. This is the key figure to remember. The clock does not start at first launch, and it does not stop when you cease production it runs from when the final batch was made available, ensuring the file remains available well after the product has left the market.
This ten year rule reflects the reality that safety questions or claims can arise long after a product is discontinued. A consumer might report a reaction, or the Office for Product Safety and Standards (OPSS) or an EU competent authority might investigate, years after the last unit sold. The retention period ensures the evidence of the product's safety and compliance is still on hand if needed.
Why the period runs from the last batch
Tying the retention period to the last batch placed on the market, rather than to the first, is deliberate. Products can remain in use, and on shelves, for a considerable time after they are last manufactured. By running the clock from the final batch, the rule ensures the file outlives the product's actual presence in the market and the period during which issues might surface.
In practice, this means a brand needs to track when the last batch of each product was placed on the market, and retain the file for a full decade after that point. For a business with many products over time, keeping clear records of these dates is part of sound compliance housekeeping.
Where the PIF must be held
The PIF must be kept at the address of the Responsible Person indicated on the product label. This links the file to a specific, findable location the same address a consumer or authority can read on the packaging. It means the file cannot simply be held in some undisclosed place; it must be associated with the RP address that appears on the label.
This connection between the label and the file's location is important. It gives authorities a clear point of contact and a clear place to direct a request. If the Responsible Person's address changes, the labelling and the file's accessibility need to be managed accordingly.
Accessibility to the competent authority
The file must be readily accessible to the competent authority. This means it must be available in a form and within a timeframe that allows the authority to review it without undue obstacle. A file that technically exists but cannot be produced promptly, or is scattered and incomplete, does not satisfy the requirement of ready accessibility.
The emphasis on accessibility is why organisation matters as much as content. A well structured, complete file that can be produced quickly on request is what the regulation envisages. Brands should be able to lay hands on any product's PIF without a scramble.
Electronic or physical format
The PIF may be held electronically or in another format, provided it is readily accessible. There is no requirement for a paper file in a physical cabinet; a well organised digital file is perfectly acceptable and, for most brands, far more practical. What matters is that the complete file can be accessed and produced when required.
For most modern businesses, an electronic PIF securely stored, backed up, and organised so each product's file is complete and retrievable is the sensible approach. It also makes keeping the file up to date and producing it on request considerably easier than managing paper.
Language requirements
The PIF must be available in a language which can be easily understood by the competent authority of the market concerned. For a product sold in a particular country, this generally means the file or at least the parts the authority needs should be in a language that country's authority can readily work with. This is a practical requirement, ensuring the authority can actually review the file.
For brands selling across multiple markets, this can mean considering the language in which key parts of the file are held. It is one of several reasons a brand selling into different countries needs to think about compliance market by market, not just once.
Whose responsibility it is
Keeping the PIF correctly is the duty of the Responsible Person. They must ensure the file is complete, up to date, held at the right address, accessible, and retained for the full period. Distributors also have certain obligations for example to be able to identify the Responsible Person and to act if they believe a product is non compliant but the primary duty to hold the PIF rests with the RP.
This is one of the core reasons the Responsible Person role carries real weight. It is not a nominal title but a set of genuine legal duties, of which maintaining an accessible PIF for the full retention period is central. Our Responsible Person guide covers the role in full.
PIF Compliance Fails Without Fast Retrieval Here's Why
The retention and accessibility rules only matter because of what happens when an authority asks. If a competent authority requests the PIF following a complaint, a market surveillance check, or a routine inspection and the Responsible Person cannot produce a complete, current file promptly, that is itself a compliance failure, quite apart from any question about the product's safety.
In practice, this means the ability to retrieve any product's file quickly is not a nicety but part of the obligation under Regulation (EC) No 1223/2009. An authority whether the OPSS in the UK or an EU member state's regulator does not accept "we have it somewhere" as compliance. A brand that has let files lapse, lost track of retention dates, or stored files in a disorganised way can find itself non-compliant on the paperwork even where the underlying product is perfectly safe an avoidable and frustrating position.
The lesson is that retention is about readiness. Keeping a clear, organised, well-indexed set of files, with retention dates tracked, means that whenever a request comes, the right file can be produced in full and on time. That readiness is the whole point of the retention and accessibility requirements.
Unsure whether your files meet the retention and accessibility rules? Spectra helps brands hold and maintain compliant, audit-ready PIFs for every product across the UK and EU.
Frequently asked questions
How long must a PIF be kept?
Ten years following the date on which the last batch of the product was placed on the market. The period runs from the final batch, not the first launch, so the file remains available after the product has left the market.
Where must the PIF be kept?
At the address of the Responsible Person indicated on the product label. This links the file to the same findable address that appears on the packaging.
Can I keep the PIF electronically?
Yes. The PIF may be held electronically or in another format, provided it is readily accessible to the competent authority. A well organised digital file is perfectly acceptable and usually more practical.
Does the retention period start at launch?
No. It starts from when the last batch was placed on the market, not first launch, and runs for ten years from that point so you need to track when each product's final batch went to market.
What language must the PIF be in?
A language that can be easily understood by the competent authority of the market concerned. Brands selling in multiple markets should consider the language of the key parts of the file.
What does 'readily accessible' mean?
The file must be available in a form and timeframe that lets the authority review it without undue obstacle. A file that exists but can't be produced promptly, or is incomplete, doesn't meet the requirement.
Who is responsible for keeping the PIF?
The Responsible Person, who must ensure it is complete, current, correctly located, accessible and retained for the full period. Distributors have related but secondary obligations.
What if I can't produce the PIF when asked?
That's a compliance failure in itself, separate from any safety question. Authorities don't accept 'we have it somewhere' the complete, current file must be retrievable promptly, which is why organised, ready-to-produce files matter.
References: Regulation (EC) No 1223/2009, Article 11 (EUR-Lex); UK Cosmetics Regulation as retained; OPSS guidance. General information only, not legal advice.