Regulatory & Compliance
The CPNP notification is the mandatory electronic submission, required by Article 13 of Regulation (EC) No 1223/2009, through which the Responsible Person notifies the European Commission that a cosmetic product is about to be placed on the EU market.
The mechanics are simple enough.
The CPNP is still the single point of failure that catches brands after months of formulation, testing, and documentation.
The Cosmetic Products Notification Portal (CPNP) is a centralized online system managed by the European Commission. One notification covers the entire EU market plus Norway, Iceland, and Liechtenstein, with Northern Ireland continuing under the Windsor Framework.
The notification itself is free.
After 30 years in the hair and beauty sector, most recently in private label cosmetics, the CPNP is where I see founders discover they are not ready to launch.
For the broader global compliance picture and the EU cosmetics regulation framework, see those guides.
Important disclaimer: I am not a lawyer or regulatory affairs professional. This is practical industry perspective, not legal advice. For specific questions, work with your Responsible Person.
This guide covers what the CPNP is, Article 13 requirements, the workflow, nanomaterial and CMR declarations, and the errors that end in enforcement findings and marketplace suspensions.
It helps to know why the CPNP exists and what happens to the data once it is submitted.
The portal has two primary functions, and between them they explain why certain information is mandatory and why the system is built the way it is.
Pre-market regulatory notification. Article 13 of Regulation 1223/2009 requires that every cosmetic product be notified to the European Commission before being placed on the EU market. The notification fulfills the "market access" trigger. Without a valid CPNP notification, the product is not legally on the market, regardless of whether it is physically in a warehouse or on a retail shelf.
Toxicological response support. The data submitted to the CPNP is made available to national poison centres and similar medical bodies across the EU so that, in case of a medical emergency involving a cosmetic product, emergency personnel can quickly retrieve the composition information needed to respond. This is why the frame formulation or full composition is a mandatory field.
The market surveillance purpose and the medical emergency purpose drive most of what the portal asks for. The CPNP is built for regulators and emergency responders rather than for consumers.
Three clarifications that prevent a lot of confusion.
The CPNP is not a product approval. Submitting a notification does not mean the European Commission has reviewed or approved your product. The CPNP is a declarative system. You submit the information, you get a reference number, and the legal responsibility for the product’s compliance remains entirely with the Responsible Person.
The CPNP is not the PIF. The Product Information File is the full dossier held by the Responsible Person, containing the CPSR, manufacturing data, claims substantiation, and supporting documents. The CPNP receives a subset of that information. The two are related but distinct.
The CPNP is not country-by-country. Under the Cosmetics Directive that preceded Regulation 1223/2009, brands had to notify each member state individually. The CPNP replaced that fragmented system in 2013. One notification, one portal, access to the entire EU plus EEA market.
Only two categories of user can submit notifications.
The Responsible Person profile is used by the legal or natural person established in the EU who holds the PIF, is named on the product label, and carries compliance liability.
For non-EU brands, this is typically a contracted Responsible Person service based in an EU member state.
The Distributor profile is used in the specific case Article 13(3) describes: a distributor makes available in one member state a product already placed on the market in another, and "translates, on his own initiative, any element of the labelling of that product in order to comply with national law". Both conditions carry weight. A translation the Responsible Person asked for is not the distributor’s own initiative, and a translation made for commercial reasons rather than to satisfy national law does not put you in this profile either.
The distributor profile is narrower than most brands realize and does not replace the Responsible Person notification.
A brand based outside the EU cannot submit directly. The notification must be made by or on behalf of the EU-established Responsible Person. This is the most frequent misunderstanding I see in founders trying to handle their own EU launch.
The CPNP is not a form you can improvise.
Every data field has a specific regulatory basis, and the information you enter will be cross-checked against the rest of your compliance documentation.
Article 13(1) of Regulation 1223/2009 specifies the information the Responsible Person must submit before placing a cosmetic product on the market.
Product category and name. The product must be assigned to one of the CPNP’s predefined category codes (skin care, hair and scalp products, oral hygiene, etc.). The trade name must allow specific identification of the product, including brand, line, and variant where relevant.
Name and address of the Responsible Person. This must match the address printed on the product label and the address where the PIF is made readily accessible. Any discrepancy is an immediate compliance finding.
Country of origin for imported products. The country where the product was manufactured, for products imported from outside the EU.
Member State in which the product is to be placed on the market. The specific EU member states targeted at launch. This can be updated later but should reflect the genuine market rollout plan.
Contact details of a physical person to contact in the case of necessity. Article 13(1)(e) uses that wording, and it is wider than an authority contact point: the person has to be reachable whenever the need arises, which in practice includes a poison centre handling a medical emergency, not only a competent authority sending an information request. Give a route that is answered, not a mailbox.
CMR substance declarations. The name and CAS or EC number of any substances classified as carcinogenic, mutagenic, or toxic for reproduction (CMR) of Category 1A or 1B under Part 3 of Annex VI to the CLP Regulation (EC) No 1272/2008, where such substances are present in the product under the specific exceptions allowed by Article 15 of the Cosmetics Regulation.
Nanomaterial declarations. The presence of any substance in the form of a nanomaterial, as defined by Article 2(1)(k) of the regulation, with its identification (including the chemical name, IUPAC) and its reasonably foreseeable exposure conditions. This Article 13(1) field carries no carve-out of its own. The separate Article 16 notification, and the carve-outs written into that article, are covered below.
Frame formulation or exact composition. A reference to a predefined frame formulation template, an exact qualitative and quantitative composition, or a composition with ranges. The level of detail required is sufficient for poison centre toxicological response.
Original labeling and packaging photograph (Article 13(2), not 13(1)). A copy of the label as it appears on the product, plus a photograph of the packaging where reasonably legible. Unlike everything above, this one is notified when the product is placed on the market, not before.
For most small and mid-sized brands, the frame formulation approach is the pragmatic choice.
The CPNP provides predefined frame formulation templates for common product categories.
The frame formulation identifies the ingredient categories and approximate concentration ranges typical for that product type, sufficient for a poison centre to understand what the product contains without the brand disclosing its exact proprietary formula.
When a frame formulation is used, the Responsible Person links the notification to the appropriate template and declares any ingredients that fall outside the template’s typical range.
If the product’s formula does not fit a frame formulation, the full exact or ranged composition must be entered.
I have seen brands delay launches by a month arguing with a regulatory consultant about whether their new serum qualifies for a standard frame formulation or requires a full ingredient declaration. Usually it is a ten-minute call with the safety assessor. Treating these as big decisions is what makes the launch slow.
The pragmatic default: use the frame formulation when the product fits, enter the full composition when it does not, and spend your decision energy on the claims and labeling instead.
Once the notification is validated and submitted, the portal generates a unique CPNP reference number.
This number is the proof of compliance for the notification component. Amazon and other major EU marketplaces require the CPNP reference during product listing setup for any cosmetic category. Customs authorities use it to verify compliance on incoming shipments in some contexts. Retailers ask for it in their supplier onboarding documentation.
A missing or invalid CPNP reference number is one of the most common reasons cosmetic product listings get suspended on Amazon.de, Amazon.fr, Amazon.it, and the other EU marketplaces. The reference number connects back to the full notification record, and any marketplace compliance check can verify it in seconds.
The CPNP workflow has been consistent since 2013, with periodic interface updates. The steps below reflect the process as of April 2026.
CPNP access begins with an EU Login account, the authentication system used across most European Commission online services.
The Responsible Person’s designated user registers an EU Login account with name, organization email, and basic identification.
This is a personal account, not an organization account. One person per EU Login.
Once the EU Login exists, the user logs into SAAS, the EU Commission’s authorization management application, and requests access to the CPNP for the organization.
The request specifies the profile type (Responsible Person or Distributor), the organization name, and the organization’s regulatory role.
The request is reviewed and validated by the CPNP administration, typically within a few business days for simple requests.
After access is granted, the Responsible Person organization is created in the CPNP, with its legal name, EU address, and the contact details of the physical person to contact in the case of necessity.
Multiple users from the same organization can be associated with the profile.
For a Responsible Person service handling many client brands, this is where client brands become part of the service’s CPNP infrastructure.
With the organization set up, individual product notifications can be created. For each product, the Responsible Person enters:
the product category from the CPNP’s predefined list, the trade name with brand, product line and specific product name, the intended member states of distribution, the country of origin for imported products, the physical person to contact in the case of necessity, the CMR substance declarations where applicable, the nanomaterial declarations where applicable, the frame formulation reference or the exact composition, the label artwork upload, and the packaging photograph upload.
Before final submission, the notification goes through a review within the portal. Some fields generate validation warnings if inconsistent (frame formulation that does not match declared CMR substances, missing nanomaterial data where the composition flags one, label that does not show the Responsible Person’s address clearly). These warnings should be resolved before submission.
Once submitted, the portal generates the CPNP reference number.
From this point, the product is legally notified.
Article 13(7) of the regulation requires the Responsible Person (or the distributor, for the information it has notified) to update the notification without delay whenever the information submitted under paragraphs 1, 3 and 4 changes.
Triggers for update include: reformulation that changes the composition, packaging change affecting the product, new trade name or renamed variant, addition or removal of member states from the distribution plan, change of Responsible Person address, and any CMR or nanomaterial status change.
The portal also distinguishes between an update (a genuine change in product information from a particular date forward) and a correction (fixing previously incorrect data in the existing record). The distinction matters because it affects how poison centres view the notification history.
For a brand starting from zero, with no existing Responsible Person service, creating the EU Login, completing SAAS access, onboarding the organization, and filing the first notification runs typically 2 to 6 weeks, most of which is the access request and onboarding layer.
For a brand already using a Responsible Person service with an active CPNP infrastructure, a new product notification can be filed in 1 to 3 business days once the PIF and label artwork are final.
The notification is the fast part. Getting to the point where you can file is the slow part.
Two categories of ingredient trigger additional requirements beyond the standard Article 13 notification.
When a product contains nanomaterials as defined by Article 2(1)(k) of the regulation, an additional Article 16 notification is required on top of the standard Article 13 notification. Two carve-outs are written into the article itself: Article 16 does not apply to nanomaterials used as colorants, UV-filters or preservatives regulated under Article 14, unless expressly specified (Article 16(2)), and the six-month notification does not apply to products containing nanomaterials that comply with the requirements set out in Annex III (Article 16(3)).
Article 16 requires that the Responsible Person notify the Commission six months before placing the product on the market. The six-month window lets the Commission look at the nanomaterial and, where it has safety concerns, ask the SCCS (Scientific Committee on Consumer Safety) for an opinion. It is not a clearance window: the SCCS has six months of its own to answer, so that procedure can run past the launch date.
The Article 16 data set includes the nanomaterial’s identification (including IUPAC name), specifications, an estimate of the annual quantity of the nanomaterial placed on the EU market in cosmetic products, the toxicological profile of the nanomaterial, its safety data, and its reasonably foreseeable exposure conditions.
Practical implication for brands. For every raw material in nano form, one question decides it: does the Annex entry name the nano form? The carve-out follows the entry, not the substance name, because Annexes III to VI do not cover nanomaterials except where specifically mentioned. Annex VI lists Titanium Dioxide (nano) and Zinc Oxide (nano) as entries in their own right, so those UV-filter grades sit outside Article 16, and so does Carbon Black (nano), Annex IV entry 126a, used as a colorant. The iron oxides appear in Annex IV with no nano form, and that does not leave the six-month notification as the route: Article 14 admits only the colorants listed in Annex IV, so a nano iron oxide used as a colorant is not authorised at all, and what closes the point is a non-nano pigment grade rather than a filing. Settle this with your manufacturer before you lock the formula: discovering an Article 16 nanomaterial six weeks before launch means the launch is delayed by at least four months.
Article 15 of the regulation prohibits substances classified as CMR Category 1A, 1B, and 2 under the CLP Regulation from use in cosmetic products, with limited exceptions.
When such a substance is present under one of the exceptions allowed by Article 15, the CPNP notification must declare the substance by name and CAS or EC number. For category 2 the SCCS evaluation is the route on its own. For category 1A and 1B the door is narrower than that: Article 15(2) requires four conditions to be fulfilled together, not just a favourable opinion. The substance has to comply with the food safety requirements of Regulation 178/2002, there has to be no suitable alternative available as documented in an analysis of alternatives, the application has to be for a particular use of the product category with a known exposure, and the SCCS has to have evaluated it and found it safe in view of overall exposure and vulnerable population groups.
Practical implication. CMR declarations in the CPNP are cross-checked against the published exceptions. A CMR substance declared in the notification without a valid exception is an immediate compliance issue. Your safety assessor reviews the CMR status of every substance in Part A of the CPSR, so if the CPSR is complete, the CMR notification data is already known.
For products consisting of multiple components not marketed separately (hair coloring kits, exfoliation sets, two-step skincare systems), the CPNP treats the kit as a single notification with linked component records.
For products with the same formula but multiple pack variants, one notification can cover several pack sizes: the CPNP user manual asks you to attach the original labeling and the photograph of the most legible pack, usually the biggest one, rather than to file each size on its own. Shade variants of the same makeup product typically do not require separate notifications either, provided the shade-to-shade differences are within the range of the filed composition.
When the same product is imported into the EU by several different importers, each with their own country-of-origin chain, each import chain requires its own notification. The Responsible Person can be the same, but the notification needs to reflect the multiple origin paths.
This is a technical point that matters for brands using multiple fulfillment partners across the EU. Clarify the import chain before filing to avoid amendments later.
The CPNP itself does not reject submissions, but the data it contains is continuously cross-checked by national authorities during market surveillance, and the most common compliance findings against cosmetic brands trace back to CPNP errors.
Failure to update after reformulation. Article 13(7) requires the notification to be kept current. Brands adjust a preservative level, swap a raw material supplier, or revise a claim, and the CPNP notification is not updated. When an authority inspects the product and cross-references the notification, the mismatch is visible.
Responsible Person address mismatch. The address on the product label must match the Responsible Person’s registered address in the CPNP and the address at which the PIF is made readily available. Any discrepancy generates a finding.
Missing or late nanomaterial declaration. A product containing a nanomaterial that falls within the scope of Article 16, meaning its nano form is not listed in the Annexes as a colorant, UV-filter or preservative regulated under Article 14 and is not covered by Annex III, and that was not declared or was declared without respecting the six-month window, is placed on the market non-compliantly regardless of safety.
Frame formulation mismatch. The frame formulation chosen does not reflect the product’s actual composition, or declared CMR substances do not align with the frame formulation’s typical ingredient profile.
Label and notification inconsistency. The label declares an ingredient, a claim, or a PAO (period after opening) that does not match the information in the CPNP record.
Incomplete label upload. The label artwork submitted to the portal is a draft that does not match the final printed label on the product.
Packaging photograph quality. The packaging photograph is unreadable or does not show the full product information required for poison centre reference.
A missing or invalid CPNP notification is the simplest enforcement finding. The product is not on the market legally, and the enforcement action is immediate.
The penalties vary by member state. Article 37 of Regulation 1223/2009 leaves the amounts entirely to national law, so there is no European figure to quote. Italy’s Legislative Decree 204/2015 sets 1,000 to 6,000 euros for a missing or defective Article 13 notification (Article 9 of the decree). Germany, France, and Spain set their own penalties, each with its own structure and its own amounts. (All penalty and cost ranges in this article are indicative estimates; verify the current statutory figures in the relevant jurisdiction before relying on them.)
Beyond the fines, the operational fallout is often more severe: the affected product comes off the market, the non-compliance is published in the national alert feed and potentially on Safety Gate, and retailer and marketplace relationships are lost. Amazon and other platforms suspend cosmetic listings immediately when the CPNP reference is missing or invalid.
The CPNP looks simple from the outside. A form, a reference number, done. The founders who treat it that way are the ones who discover in month three after launch that their Amazon listings have disappeared because the notification was filed with the wrong Responsible Person profile. The ten minutes saved at filing cost ninety days of sales recovery.
The discipline that protects brands is to treat the CPNP as the final compliance gate, filed only when the PIF, CPSR, label, and manufacturing chain are genuinely ready. Filing early only amplifies whatever gaps exist in the rest of the documentation.
Cosmetic brands in 2026 operate in an enforcement environment that extends well beyond national market surveillance authorities.
Amazon EU requires the CPNP reference number during product listing creation for all cosmetic categories. Listings without a valid reference are rejected or suspended.
Shopify, Etsy, and major EU e-commerce platforms increasingly require compliance documentation including CPNP proof during merchant onboarding or during category-specific reviews.
Retailer buyers (Sephora, Douglas, Boots, and regional chains) include CPNP reference verification in their standard supplier onboarding package.
Customs authorities in several member states verify CPNP notification status on cosmetic imports, particularly for non-EU-origin products.
The CPNP has become de facto infrastructure for EU cosmetic commerce. A product that is technically safe but not correctly notified is operationally non-viable. Getting the CPNP right is a commercial prerequisite.
What is the CPNP and why do I need to notify my cosmetic product?
The Cosmetic Products Notification Portal (CPNP) is the European Commission’s online system where every cosmetic product sold in the EU must be notified by the Responsible Person before market placement. It is mandated by Article 13 of Regulation (EC) No 1223/2009 and has been the single EU notification point since the regulation became applicable on July 11, 2013. One notification covers all 27 EU member states plus Norway, Iceland, and Liechtenstein, with Northern Ireland continuing to use CPNP under the Windsor Framework. The notification itself is free. It serves two purposes: pre-market regulatory notification for market surveillance authorities, and composition data for national poison centres in case of medical emergencies involving the product. Without a valid CPNP notification, a cosmetic product is not legally on the market regardless of physical distribution.
Who can submit a CPNP notification?
Only the EU-established Responsible Person, or a Distributor acting under the specific conditions defined in Article 13(3) of the regulation, can submit notifications. A brand based outside the EU cannot submit directly. Non-EU brands must appoint a Responsible Person established in an EU member state who holds the PIF, is named on the product label, and carries compliance liability. The Responsible Person can be the EU manufacturer if established in the EU, the EU importer, or a contracted Responsible Person service. Contracting a Responsible Person service typically costs 500 to 2,000 euros per year for a small catalog. The Responsible Person submits notifications through the Responsible Person profile in the CPNP, accessed via an EU Login account and authorized through the SAAS application.
What information does the CPNP notification require under Article 13?
Article 13(1) requires the cosmetic product’s category and name enabling specific identification, the name and address of the Responsible Person where the PIF is accessible, the country of origin for imported products, the member states where the product will be placed on the market, and the contact details of a physical person to contact in the case of necessity, which is the act’s own wording and is not limited to authority queries. It also requires the name and CAS or EC number of any CMR Category 1A or 1B substances present under Article 15 exceptions, plus the presence of any nanomaterials with their identification and their reasonably foreseeable exposure conditions (and an additional Article 16 notification six months before market placement, unless the Article 16(2) or 16(3) carve-outs apply, which turns on whether the Annexes list that nano form). Finally, Article 13(1) requires the frame formulation or exact qualitative and quantitative composition. The original labeling and, where reasonably legible, a photograph of the packaging sit in Article 13(2) instead, due when the product is placed on the market rather than before it. The composition data is required for poison centre toxicological response in case of medical emergencies.
How much does a CPNP notification cost?
The CPNP notification itself is free of charge. There is no filing fee to the European Commission for standard Article 13 notifications or Article 16 nanomaterial notifications. The costs that a brand actually incurs are for the prerequisites: the Responsible Person service (500 to 2,000 euros per year for a small catalog), the PIF preparation (500 to 1,800 euros per product), the CPSR (300 to 800 euros per product, typically bundled into the PIF), stability testing (500 to 2,000 euros per formulation), and claims substantiation where required (2,000 to 25,000 euros depending on the claim). For a brand launching three to five products in the EU, total compliance cost including all prerequisites and the Responsible Person service runs 3,500 to 12,000 euros, with the CPNP notification itself adding nothing to the bill.
What is a frame formulation and should I use one?
A frame formulation is a predefined composition template that identifies the ingredient categories and approximate concentration ranges typical for a given product category (moisturizing cream, shampoo, toothpaste, etc.). The CPNP provides these templates so that the Responsible Person can reference the appropriate template without disclosing the exact proprietary formula. Frame formulations are sufficient for poison centre toxicological response. For most small and mid-sized cosmetic brands, the frame formulation approach is the pragmatic choice, saving time and protecting formula confidentiality. When the product’s actual composition falls outside the range covered by any available frame formulation, the exact qualitative and quantitative composition must be entered instead. Your safety assessor or Responsible Person can identify the appropriate frame formulation during the CPSR and PIF preparation, so this decision is not a separate step.
What happens if my CPNP notification is missing or incorrect?
Enforcement consequences scale with severity. A missing notification means the product is not legally on the market. Enforcement actions include market withdrawal orders, national financial penalties whose amounts are set by each member state under Article 37 and not by the Regulation (Italy, for example, sets 1,000 to 6,000 euros for a missing Article 13 notification), and publication in the national alert feed and potentially on Safety Gate. Beyond direct penalties, the operational fallout is often more damaging: immediate suspension of listings on Amazon and other major EU marketplaces (which require the CPNP reference number during product setup), loss of retailer relationships, and brand reputation damage. An incorrect notification (wrong Responsible Person address, outdated formula, mismatched label, missing nanomaterial declaration) generates compliance findings that must be corrected under a regulator-set deadline, typically 30 to 90 days.
Does the UK still use CPNP after Brexit?
Great Britain (England, Scotland, Wales) no longer uses the CPNP. Since January 1, 2021, Great Britain cosmetic notifications are submitted through the Submit Cosmetic Product Notification (SCPN) portal operated by the UK Office for Product Safety and Standards (OPSS). Brands selling into Great Britain need a UK-based Responsible Person, a Great Britain PIF (content largely mirroring the EU PIF), and an SCPN notification. Northern Ireland continues to follow the EU Cosmetics Regulation under the Windsor Framework, so products placed on the Northern Ireland market are notified through the EU CPNP with an EU Responsible Person. Brands selling across the EU and GB operate dual compliance infrastructure: two Responsible Persons, two PIFs, two notification systems. For the UK-specific framework, see the UK cosmetics regulations guide.
Keep reading
Complete independent guide to cosmetics import/export documentation in 2026. EU, USA, and Great Britain customs requirements, HS codes, certificates of free sale, IOSS changes, MoCRA obligations, and the operational traps that cost founders the most. From 30 years in the industry.
Complete independent guide to cosmetic brand trademark protection in 2026. EUIPO, USPTO, UKIPO, and the Madrid System compared, Nice classes 3 and 5 explained, costs and timelines. From 30 years in the industry. Not legal advice.
Complete independent comparison of cosmetic label requirements across the EU, USA, and Great Britain in 2026. Mandatory elements, symbols, language rules, printing technique constraints, and a pre-production checklist. From 30 years in the industry.
