Regulatory & Compliance
The Cosmetic Product Safety Report (CPSR) is the signed expert assessment, required by Article 10 of Regulation (EC) No 1223/2009 and structured according to Annex I, that formally states whether a cosmetic product is safe for human health under normal or reasonably foreseeable conditions of use.
Behind that definition is a simple job.
The CPSR is the document that decides whether your product gets a green light or stays in a lab.
Where the Product Information File is the dossier, the CPSR is the verdict.
No CPSR, no lawful product.
After 30 years in the hair and beauty sector, most recently in private label cosmetics, I have watched CPSRs become the choke point where a launch either picks up speed or slows to a crawl.
For the broader global compliance picture and the EU cosmetics regulation framework, see those guides.
Important disclaimer: I am not a lawyer, regulatory affairs professional, or qualified safety assessor. This is practical industry perspective, not legal or scientific advice. For every specific safety question, work with a qualified assessor.
This guide covers what the CPSR contains, who can sign it, how assessors evaluate safety, timelines and costs, and what to expect from the process.
The CPSR is a structured scientific evaluation, not a form you fill in.
The structure itself is prescribed in detail.
Annex I of Regulation 1223/2009 divides the CPSR into two mandatory parts.
Part A: Cosmetic Product Safety Information. This is the evidence layer. Ten headings are required, covering the quantitative and qualitative composition of the product, the physical and chemical characteristics and stability of the cosmetic product and its ingredients, the microbiological quality, the impurities, traces, information about the packaging material, the normal and reasonably foreseeable use, exposure to the cosmetic product, exposure to the substances it contains, the toxicological profile of each substance, undesirable effects and serious undesirable effects data, and any other relevant information.
Part B: Cosmetic Product Safety Assessment. This is the reasoning layer. It contains four required elements: the assessment conclusion on product safety, the labeled warnings and instructions for use justified by the assessment, reasoning for the assessor’s conclusion based on the Part A data, and the credentials of the assessor plus proof of qualification, date, and signature.
Part A is compiled. Part B is reasoned. You can assemble Part A from supplier data and manufacturer records. Part B requires scientific judgment from a qualified person who takes legal responsibility for the conclusion.
The CPSR is mandatory under Article 10(1) of the regulation, which requires that the Responsible Person ensure a safety assessment has been conducted and a CPSR set up "in accordance with Annex I" before placing a cosmetic product on the EU market.
The CPSR is one module of a larger file.
It lives inside the Product Information File, which the Responsible Person keeps for a period of ten years following the date on which the last batch of the product was placed on the market.
The CPSR feeds into the CPNP notification. Article 13 lists what has to be notified on its own terms, and nothing in it makes the notification conditional on a finished CPSR: they are parallel obligations of Chapter III, not one subordinate to the other. What the Regulation does forbid is placing the product on the market without the safety assessment (Article 10), so a notification filed ahead of a complete CPSR buys nothing. In practice the figures typed into the CPNP form (frame formulation, CMR substance declarations, nanomaterial declarations) are the ones the assessor established in Part A, which is why the sensible order is CPSR first, notification second.
Three distinctions that save a lot of confusion later.
The CPSR is not a Certificate of Analysis. A Certificate of Analysis (CoA) is a batch-specific technical record confirming that a specific production lot meets defined specifications. The CPSR is a product-level safety evaluation that applies across all conforming batches.
The CPSR is not a generic safety statement. A "this product has been assessed as safe" letter on the manufacturer’s letterhead is not a CPSR. Authorities will not accept it.
The CPSR is not transferable between products. Each distinct formula, each distinct packaging system that could affect product stability, and sometimes each distinct claim set is assessed on its own. The Regulation does not spell out when a new pack or a new claim set forces a new report: Annex I asks Part A to cover the relevant characteristics of the packaging material, and Article 10(1)(c) expects the existing assessment to be kept up to date, so where the line falls is the assessor’s call. Minor variations (color shade, fragrance variant) can sometimes share a CPSR with proper justification, but this is an assessor’s decision, not a default.
The CPSR’s legal weight comes from who signs it.
Article 10(2) of Regulation 1223/2009 defines who can conduct the safety assessment, and Annex I Part B point 4 is what requires that person’s dated signature on Part B.
The assessor must hold a diploma or other evidence of formal qualification, awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine, or a similar discipline, or a course recognized as equivalent by a member state.
The key element is "or a similar discipline, or equivalent by a member state." Different EU countries apply the discretion differently. In Italy, chemists and biologists with specific additional training can qualify. In France, the recognition path historically favors pharmacists and toxicologists. Germany leans on toxicologists with specific cosmetic expertise. Each member state’s competent authority publishes its own guidance on acceptable qualifications.
What remains consistent across all member states: the assessor must be a named individual whose qualification can be verified, not a company or an anonymous "quality team." Part B carries that specific person’s signature and credentials.
The assessor is expected to exercise independent scientific judgment.
In practice, that means the Responsible Person and the brand cannot push them toward a specific conclusion.
The common practical workflow: the Responsible Person commissions the assessment, supplies Part A inputs through the manufacturer and the brand, and receives the signed CPSR. If the assessor concludes the product cannot be signed off as safe under the claimed conditions, the Responsible Person’s options are to reformulate, revise the claims, change the packaging, or abandon the product. There is no option to "override" the assessor’s refusal.
The most productive briefs I have sent to safety assessors include an explicit note: please tell us what will not pass before we build around it. The worst moment in a project is when stability testing completes, claims are decided, the label is printed, and the assessor raises an issue that forces re-testing and relabeling. A twenty-minute conversation at the concept stage prevents the three-month rework loop.
This is why I tell founders to treat the safety assessor as a scientific advisor whose early input shapes what the product can be, not as a vendor who hands over a document. Treating the CPSR as a last-step formality is the single most expensive compliance mistake I see.
The Responsible Person owns the PIF and the CPSR but is not necessarily the assessor. Some Responsible Person services include safety assessment in-house. Others outsource to named assessors on their network. For a brand, it does not matter which model the Responsible Person uses, as long as the named assessor’s credentials are verifiable and the signature is genuine.
For cluster context, the broader breakdown of who does what in EU cosmetic compliance covers the full actor map.
The methodology matters because it explains why certain formulations take longer to assess, cost more, or fail outright.
The reference document every EU safety assessor works from is the SCCS Notes of Guidance for the Testing of Cosmetic Ingredients and their Safety Evaluation, currently in its 12th revision (SCCS/1647/22), adopted May 15, 2023, with corrigendum 1 of October 26, 2023 and corrigendum 2 of December 21, 2023.
The 12th revision introduced several updates that affect how safety assessments are conducted in 2026. Updated guidance on New Approach Methodologies (NAMs) replaces animal testing approaches for several endpoints. Defined Approaches for Skin Sensitisation (DASS) and Defined Approach for eye irritation (DAL) provide structured in vitro testing paths. Threshold of Toxicological Concern (TTC) methodology is clarified, including internal TTC (iTTC). Aggregate exposure considerations for CMR Category 1A and 1B substances require the assessor to account for exposure from multiple sources (cosmetics plus food, pesticides, industrial chemicals, and other contributors).
For brand founders, the practical takeaway is that modern CPSRs are built on a much more detailed methodological base than ten years ago. An assessor working from the 12th revision is applying an updated standard. This is why older "template" CPSRs circulating in the market are not reliable for 2026 launches.
The central quantitative concept in every cosmetic CPSR is the Margin of Safety (MoS).
In simple terms: the assessor calculates the systemic exposure to each substance of toxicological concern resulting from normal or reasonably foreseeable use of the product, then compares that exposure to the No Observed Adverse Effect Level (NOAEL) established through toxicological testing or literature.
MoS = NOAEL / systemic exposure dose.
A generally accepted MoS threshold for cosmetic ingredients is 100 or above, applied as a default safety factor covering interspecies extrapolation and intraspecies variability.
A calculated MoS below 100 typically means the assessor cannot conclude the product is safe at the proposed concentration and use pattern.
For brand founders, the implication is concrete: the MoS calculation depends on the ingredient concentration, the product application area, the amount applied per use, the frequency of use, and the retention factor (leave-on versus rinse-off). An "anti-aging serum" and a "shower gel" containing the same ingredient at the same concentration will have radically different MoS calculations because the exposure profile differs.
Most founders find out about the Margin of Safety only when their assessor tells them a concentration is too high for the proposed product type. By then the formula is locked and the packaging artwork is ordered. If you ask the assessor to run a quick MoS estimate on your two or three hero actives before you commit, you spend a hundred euros and save the reformulation loop.
The habit worth building is to treat any "active" ingredient above one percent as a flag for an early MoS check. The calculation is fast for an experienced assessor. The surprise at CPSR stage is expensive.
Part A inputs go beyond the ingredient-by-ingredient toxicological profile.
Physical and chemical characteristics and stability. The product must remain safe and functional through its shelf life. The assessor reviews stability data to confirm no degradation products or preservative failure will compromise safety over time.
Microbiological quality. Challenge testing (preservative efficacy testing, typically to ISO 11930) confirms the preservative system prevents microbial contamination. The assessor reviews the test protocol and results.
Packaging compatibility. Some actives degrade on contact with certain plastics. Some packaging leaches plasticizers into the product. The assessor considers container compatibility as part of the overall safety profile.
Exposure profile under normal and foreseeable use. This includes children’s accidental exposure (for products not marketed to children), inhalation exposure for aerosols, dermal contact area for leave-on products, and eye exposure for facial products.
Undesirable effects data. Post-market data from previous batches or comparable products, when available, informs the risk assessment.
The assessor is not expected to re-run every toxicological test.
They review existing data, identify gaps, request additional testing where needed, and issue their conclusion based on the weight of evidence.
The CPSR is the single largest cost element inside the PIF for most products, and the single variable most affected by project discipline.
For a simple product with complete Part A inputs (full raw material safety data sheets, complete stability data, microbiological test results, defined claims), the CPSR build runs 2 to 4 weeks from assessor engagement to signed Part B.
For a complex product with gaps in Part A (missing raw material documentation, incomplete stability data, novel ingredients requiring additional literature review, claims requiring instrumental substantiation), the CPSR build runs 6 to 12 weeks before the assessor can sign off.
For a product with borderline ingredients (substances close to Annex III concentration limits, recently added CMR considerations, nanomaterials, CBD (SCCS final opinion April 2026, max 0.19% recommended, not yet a binding Annex limit), botanical extracts without an established toxicological profile), expect additional back-and-forth. Timelines can extend to 3 to 6 months when the assessor requests specific additional testing.
The CPSR itself, when priced separately from the broader PIF build, typically runs 300 to 800 EUR/USD per product. (All cost figures in this article are indicative estimates that vary by provider, region, and project scope.)
At the lower end sit simple products with clean inputs and standard claims, from a brand that already has assessor relationships.
The upper end is complex formulations, multi-language requirements, or a first-time engagement with a new assessor who must understand the brand’s positioning from scratch.
Additional costs that flow through the CPSR but are separate line items include stability testing (500 to 2,000 euros per formulation), challenge testing (300 to 600 euros), and claims substantiation (2,000 to 25,000 euros depending on the claim type and evidence required).
Five factors consistently extend CPSR timelines beyond the baseline.
The assessor already has the context, and some Part A elements carry straight over.
Early assessor engagement. A safety assessor consulted at the concept stage, before the formula is locked and the claims are finalized, identifies risks before they become expensive. The cost of that early consultation is typically 200 to 500 euros and saves significantly more in avoided rework.
Understanding the mechanical workflow helps brands avoid the mistakes that cause most delays.
What is a Cosmetic Product Safety Report and why is it required?
The Cosmetic Product Safety Report (CPSR) is the signed expert assessment stating whether a cosmetic product is safe for human health under normal or reasonably foreseeable conditions of use. It is required by Article 10 of EU Regulation 1223/2009 (and equivalent UK cosmetics law) and must be structured according to Annex I of the regulation. The CPSR consists of Part A (compiled safety information including formula, toxicology, exposure, and stability) and Part B (the assessor’s signed conclusion and reasoning). The CPSR sits inside the Product Information File, which must be kept for a period of ten years following the date on which the last batch of the product was placed on the market. Without a valid CPSR, a cosmetic product cannot legally be sold in the EU or UK.
Who can legally conduct a CPSR assessment?
Under Article 10(2) of Regulation 1223/2009, the safety assessor must hold a university diploma or other formal qualification in pharmacy, toxicology, medicine, or a similar discipline (or a discipline recognized as equivalent by a member state). The specific qualifications recognized vary slightly by member state: in Italy, chemists and biologists with specific additional training may qualify; in France, pharmacists and toxicologists dominate the recognition path; in Germany, toxicologists with cosmetic expertise are typical. The assessor must be a named individual whose qualification can be verified, not a company or anonymous quality team. Part B of the CPSR carries the assessor’s personal signature, credentials, and date, plus legal responsibility for the conclusion.
How long does it take to complete a CPSR?
For a simple product with complete inputs (full raw material documentation, complete stability data, completed microbiological testing, defined claims), 2 to 4 weeks from assessor engagement to signed Part B. For a more complex product with gaps in inputs (missing raw material data, incomplete stability, novel ingredients, unsubstantiated claims), 6 to 12 weeks. For products with borderline ingredients (CBD (SCCS-recommended 0.19% ceiling, not yet a binding Annex limit), nanomaterials, substances under current SCCS re-evaluation), timelines can extend to 3 to 6 months when the assessor requests additional testing or literature review. The biggest timeline variable is whether stability testing is complete when the CPSR build starts; accelerated stability alone takes 3 to 6 months.
How much does a CPSR cost?
The CPSR itself, when priced separately from the broader PIF build, typically runs 300 to 800 euros per product. Simple products with clean inputs sit at the lower end; complex formulations with multi-language requirements or first-time engagements sit at the upper end. This is the assessor’s fee only. Additional costs that flow through the CPSR but are separate line items include stability testing (500 to 2,000 euros per formulation), challenge testing for preservative efficacy (300 to 600 euros), and claims substantiation when required (2,000 to 25,000 euros depending on the claim type). For most first-time brands, the ones that do not need claims substantiation, those costs add up to a total "CPSR-and-related-testing" budget of 1,100 to 3,400 euros per product.
What is the Margin of Safety and why does it matter?
The Margin of Safety (MoS) is the central quantitative output of the safety assessment. In simple terms, the assessor calculates the systemic exposure to a substance resulting from normal use of the product, then compares that exposure to the No Observed Adverse Effect Level (NOAEL) established through toxicological data. MoS = NOAEL divided by systemic exposure dose. A generally accepted MoS threshold for cosmetic ingredients is 100 or above, reflecting default safety factors for interspecies and intraspecies variation. A calculated MoS below 100 typically means the assessor cannot conclude the product is safe at the proposed concentration and use pattern. The same ingredient at the same concentration can produce different MoS results in different product types because exposure depends on application area, amount applied, frequency of use, and whether the product is leave-on or rinse-off.
What happens if my CPSR is incomplete or incorrect when authorities inspect?
Consequences scale with severity. Minor issues (missing signature date, outdated SCCS guidance reference) typically trigger a compliance notice with a corrective deadline. Major deficiencies (no signed Part B, formula mismatch between CPSR and production, template-based CPSR, unsubstantiated conclusions) can trigger market withdrawal orders, product recalls, national penalties, and publication in national alert feeds. Regulation (EC) No 1223/2009 fixes no fine and no prison term: Article 37 hands penalties to the member states, requiring only that they be effective, proportionate and dissuasive, which is why both the amount and the nature of the penalty, administrative or criminal, differ from one country to the next. Systematic non-compliance across multiple products is handled product by product under Article 25, which lets the authority order corrective action, withdrawal or recall and restrict making the product available. There is no authorisation to act as Responsible Person, so there is none to lose: what a brand loses is market access for the products concerned until the documentation is rebuilt. Authorities can identify template-based CPSRs during inspection, and the consequences in that scenario are typically severe.
Is the CPSR the same in the UK as in the EU?
Structurally, yes. The UK Cosmetics Regulation retained the EU 1223/2009 framework post-Brexit, including the CPSR requirement, the Part A and Part B architecture, and the qualified assessor standard. In practice, the EU and Great Britain CPSRs are legally separate documents because a UK Responsible Person is required for the Great Britain market (England, Scotland, Wales) and that Responsible Person holds a Great Britain PIF containing the Great Britain CPSR. Content is largely interchangeable, but the files, the addresses, and the Responsible Persons are distinct. Brands selling into both the EU and Great Britain carry dual infrastructure for compliance. Northern Ireland continues to follow EU rules under the Windsor Framework and uses the EU CPNP plus EU Responsible Person.
Keep reading
Complete independent guide to cosmetics import/export documentation in 2026. EU, USA, and Great Britain customs requirements, HS codes, certificates of free sale, IOSS changes, MoCRA obligations, and the operational traps that cost founders the most. From 30 years in the industry.
Complete independent guide to cosmetic brand trademark protection in 2026. EUIPO, USPTO, UKIPO, and the Madrid System compared, Nice classes 3 and 5 explained, costs and timelines. From 30 years in the industry. Not legal advice.
Complete independent comparison of cosmetic label requirements across the EU, USA, and Great Britain in 2026. Mandatory elements, symbols, language rules, printing technique constraints, and a pre-production checklist. From 30 years in the industry.
