How the EU Cosmetics Regulation (EC) 1223/2009 Is Structured

Spectra Cosmetic Compliance

This is our hub for the EU regime; it links to guides on specific amendments including Omnibus 2 (Reg 2026/909). Here we set out the structure of the base regulation.

One regulation for the whole EU

Regulation (EC) No 1223/2009 has applied since 2013. It's directly applicable across all EU member states meaning it takes effect as law in each country automatically, with no separate national legislation needed. That creates one harmonized framework: a cosmetic compliant under the regulation can, in principle, be sold anywhere in the EU. It's the cornerstone of the entire EU cosmetics market.

The regulation replaced an earlier patchwork of national rules and consolidated everything into one instrument. It sets out:

• Who's responsible for a product (the Responsible Person)
• What safety assessment is required (the CPSR)
• How products are notified (via CPNP)
• What may and may not go into a formula
• How products must be labelled
• How the market is policed

The articles set out the legal obligations; the annexes carry the technical detail permitted and banned ingredients, colourants, preservatives, and UV filters.

The Responsible Person (Articles 4–5)

At the heart of the regulation is the Responsible Person. Article 4 requires that every cosmetic placed on the EU market has a Responsible Person established within the EU, and Article 5 sets out their obligations. The Responsible Person is the legal entity accountable for the product's compliance ensuring the safety assessment is done, the file is held, the product is notified, and the labelling is correct.

This concept is central because it locates responsibility with a specific, identifiable party in the market. Everything else in the regulation flows through the Responsible Person, who must ensure the obligations are met. Our Responsible Person guide explains the role in detail.

The safety assessment (Article 10)

Article 10 requires that, before a product is placed on the market, its safety is assessed and a Cosmetic Product Safety Report (CPSR) is drawn up in line with Annex I. The assessment must be carried out by a suitably qualified professional. This is the safety core of the regulation the requirement that every product be demonstrably safe before sale.

The CPSR is where the regulation's safety philosophy takes concrete form: rather than approving products in advance, the regulation requires industry to assess and document their safety. Our guide to what a CPSR is covers this in depth.

The Product Information File (Article 11)

Article 11 requires the Responsible Person to hold a Product Information File (PIF) for each product a dossier containing the CPSR, a product description, manufacturing and GMP information, evidence of claimed effects, and animal testing data. The file must be kept accessible to the authorities for ten years after the last batch is placed on the market.

The PIF is the regulation's mechanism for accountability: the evidence that a product is safe and compliant, held ready for inspection. It is the practical embodiment of the self responsibility model, with the CPSR at its core.

Notification (Article 13)

Article 13 requires products to be notified to the European Commission through the Cosmetic Products Notification Portal (CPNP) before being placed on the market. A single CPNP notification covers the whole EU. This gives authorities and poison centres information about products on the market, without constituting an approval.

Notification is a pre market registration, distinct from the safety assessment. Our guide to SCPN vs CPNP explains it, and contrasts the EU's CPNP with the UK's separate SCPN system introduced after Brexit.

Substance restrictions (Articles 14–17)

The regulation controls which substances may be used through a set of provisions and annexes. Article 14 links to the annexes listing prohibited and restricted substances, permitted colourants, preservatives and UV filters. Article 15 deals with CMR substances those classified as carcinogenic, mutagenic or toxic for reproduction which are generally prohibited. Article 16 governs nanomaterials, and Article 17 covers traces of prohibited substances.

These provisions are the most frequently updated part of the regulation, because the lists of restricted substances change as scientific assessment advances. The regular 'Omnibus' amendments that add or tighten restrictions operate through these articles and annexes.

Labelling and claims (Articles 19–20)

Article 19 sets out the labelling requirements the mandatory information every product must carry, including the ingredient list, Responsible Person, quantity, durability, warnings and batch code. Article 20 governs claims, requiring that what is said about a product is truthful, evidence-based and not misleading.

Together these articles ensure consumers get accurate information about what a product contains and what it does. They are the consumer facing expression of the compliance built behind the scenes, and they connect directly to the CPSR, which specifies the warnings that must appear.

Animal testing and market surveillance (Articles 18, 22 25)

Article 18 establishes the animal testing bans prohibiting both testing finished cosmetics and their ingredients on animals, and marketing products so tested a defining feature of the EU (and UK) regime. Articles 22 to 25 provide for market surveillance: the powers of national authorities to check products, and the obligations to report and act on non compliance and serious undesirable effects.

These provisions close the loop: they ensure the rules are enforced and that products are monitored throughout their life on the market. Market surveillance is how the self responsibility model is policed, giving the regulation practical effect.

The annexes

Much of the regulation's technical substance lives in its annexes. Annex I sets out the CPSR structure. Annex II lists prohibited substances; Annex III restricted substances with their conditions; Annex IV permitted colourants; Annex V permitted preservatives; and Annex VI permitted UV filters. Further annexes cover labelling symbols and analytical methods.

These annexes are where compliance is checked substance by substance, and where most regulatory change happens. When an ingredient is banned or restricted, it is these annexes that are amended. Knowing which annex governs which type of substance is essential to navigating the rules.

How the regulation is kept current

Regulation 1223/2009 is not a static text. It is regularly amended, chiefly through changes to its annexes, as scientific understanding of ingredients advances. The most significant of these are the 'Omnibus' amendments, which revise the rules for multiple substances at once, and adaptations that follow new hazard classifications under EU chemicals law. Through this process, the lists of prohibited, restricted, preserved and UV-filter substances are continually updated.

This constant evolution is a defining feature of cosmetic compliance. A product compliant when it launched can become non compliant when an amendment restricts one of its ingredients, requiring reassessment and sometimes reformulation. Keeping track of amendments, and knowing which of your products they affect, is therefore an ongoing obligation rather than a one off exercise at launch.

For brands, this means treating regulatory monitoring as a continuous activity. Each amendment has to be read against the portfolio to identify affected products and act within the transitional deadlines. It is one of the main reasons brands work with compliance partners to stay ahead of a stream of changes that can otherwise catch a range out.

The regulation and the UK

Because the UK's cosmetics regime is built on this same regulation, retained after Brexit, the two systems share the structure described above the same articles, the same annexes, the same core concepts. A brand that understands Regulation 1223/2009 already understands most of the Great Britain regime, and the underlying safety science is common to both.

The difference is that, since Brexit, the EU regulation applies in the EU (and, via the Windsor Framework, in Northern Ireland), while Great Britain amends its own retained version independently. So while the framework is shared, the specific substance rules can diverge over time.