The Product Information File (PIF) is the complete technical and safety dossier for a cosmetic product, required by Regulation (EC) No 1223/2009 for every cosmetic sold in the European Union and by equivalent provisions in the UK Cosmetics Regulation.
It reads like bureaucracy, and it is.
The PIF is also the single document that decides whether your product can legally be sold.
Article 11 makes it simple.
What it says is that when a cosmetic product is placed on the market, the responsible person shall keep a product information file for it, at the address printed on the label, readily accessible to competent authorities, for ten years following the date on which the last batch was placed on the market. Nobody checks the file before you sell: the obligation attaches the moment you place the product, which in practice means the file has to exist by then, and an inspection years later asks for it as it should have been on day one.
After 30 years in the hair and beauty sector, most recently in private label cosmetics, I have watched PIFs become the most consistent failure point for first-time brands.
For the global compliance picture and the broader EU cosmetics regulation framework that the PIF sits inside, see those guides.
Important disclaimer: I am not a lawyer or regulatory affairs professional. This is practical industry perspective, not legal advice. For specific questions, work with a qualified safety assessor and Responsible Person.
This guide covers what the PIF contains, who builds it, how much it costs, common mistakes, and what happens during inspection.
Article 11 of Regulation 1223/2009 sets out the minimum content.
Every PIF must include the same core elements, regardless of product type.
Section 1: product description. Article 11(2)(a) asks for one thing here: "a description of the cosmetic product which enables the product information file to be clearly attributed to the cosmetic product". It does not list the fields. In practice that description carries the product name, brand, reference or internal code, product category (skincare, haircare, makeup, fragrance, etc.), intended use and target consumer, and most companies add a photograph of the finished product. The photograph is good practice in the PIF rather than a requirement of Article 11: the Regulation asks for one at notification, where Article 13(2) requires the responsible person to notify "a photograph of the corresponding packaging" when reasonably legible.
Section 2: the Cosmetic Product Safety Report (CPSR). The core of the PIF. This is the signed safety assessment of the product under the declared conditions of use. The CPSR is covered in its own dedicated guide, but understand that it is not a separate document from the PIF. It sits inside the PIF as the safety-evaluation module.
Section 3: manufacturing method and GMP compliance. A description of how the product is manufactured plus evidence of Good Manufacturing Practice compliance. In practice, this is the manufacturer’s ISO 22716 certificate (or equivalent GMP statement) plus a description of the production process sufficient to demonstrate traceability from raw material to finished product. For deeper context on how manufacturers demonstrate GMP compliance, there is a dedicated guide on the site.
Section 4: proof of claimed effects. When the nature or the effect of the product justifies it, evidence supporting the claims made on the label or in advertising. An "anti-aging" claim requires instrumental, clinical, or consumer-perception data proportionate to the claim. A "moisturizing" claim requires less rigorous support but still requires something.
Section 5: animal testing data. Data on any animal testing performed by the manufacturer, its agents, or its suppliers, in relation to the development or the safety assessment of the product or its ingredients, including any animal testing performed to meet the legislative or regulatory requirements of third countries. This section often reads "no animal testing performed on this product or its ingredients for cosmetic purposes in line with Article 18 of Regulation 1223/2009," which is the standard EU-compliance position.
Section 6 (not a legal item): formulation, specifications, and supporting data. The full qualitative and quantitative formula expressed in INCI nomenclature, the technical specifications of each raw material, the safety data sheets of raw materials, the specifications of the packaging materials in contact with the product, microbiological data, stability test results, and challenge test results where applicable. Article 11(2) lists five items, (a) to (e), and sections 1 to 5 above are those five. This sixth folder is the formulation and specification data that Annex I, Part A requires inside the safety report, kept together because that is how a usable file is organized.
Two clarifications that save founders from confusion.
The PIF is not the CPNP notification. The CPNP notification is the online submission to the regulator’s portal. The PIF is the much larger underlying dossier that makes the notification possible. You need both. They are different documents with different purposes.
The PIF is not held by the authorities. It lives with the Responsible Person, at the address printed on the product label. The authorities do not collect PIFs pre-market. They request access to PIFs during inspections or when a concern is raised.
The regulation allows the PIF to be kept in paper or electronic format.
Almost all PIFs today are electronic, held in structured folders (one per product), with versioned sub-documents.
The practical constraint is that the PIF must be "readily accessible" to authorities in a language they understand. In France, that typically means French (English is often accepted in addition but French is the safer primary). In Germany, German. In Italy, Italian. A Responsible Person based in Spain cannot keep the PIF only in English if the Spanish competent authority expects Spanish.
This language requirement is a cost driver most founders miss.
Translating a full PIF into an additional language runs 400 to 1,200 euros per product depending on volume. (All cost figures in this article are indicative estimates that vary by provider, region, and project scope.)
Building a PIF takes more than one desk.
It is a coordinated workflow involving the Responsible Person, the safety assessor, the manufacturer, and sometimes specialized testing laboratories.
The Responsible Person owns the PIF and is legally accountable for its completeness.
They coordinate inputs from other parties, maintain the master file, update the PIF when any element changes (formula revision, new label, new manufacturer, new claim), and make the file accessible to authorities.
The safety assessor prepares the CPSR, which is the largest and most technical section.
The assessor reviews the full formula, each ingredient’s toxicological profile, the product’s exposure profile, microbiological quality, stability data, and the claims, then issues the signed Part B conclusion.
The manufacturer supplies the raw material safety data sheets, the manufacturing method description, the ISO 22716 certificate or equivalent GMP statement, stability and challenge test results when they are performed in-house, and the batch records referenced in the PIF.
Specialized testing laboratories conduct stability, compatibility, preservative efficacy (challenge test), and microbiological testing when these are outsourced rather than performed by the manufacturer.
The brand provides product-level information: intended positioning, target consumer, claims to be substantiated, label artwork, and the evidence backing any performance claims.
For a first-time brand building its first PIF from scratch, expect four to six weeks from brief to signed PIF, assuming stability data and microbiological testing are already available. If those tests have to be commissioned as part of the PIF build, add two to six months because accelerated stability testing alone runs three to six months.
For a brand launching multiple products simultaneously, the second and subsequent PIFs are faster than the first.
Common raw material documentation is reused, the manufacturing method description is shared, and the safety assessor becomes familiar with the brand’s formulation approach.
The PIF is not a linear build. Stability testing happens in parallel with safety assessor review. Claims substantiation happens in parallel with label design. Manufacturing documentation is collected in parallel with raw material specification gathering.
The first PIF is always the slow one. The brand is still defining claims, the manufacturer is still organizing paperwork, the safety assessor is asking clarification questions, and the whole workflow stops at the weakest link. After three or four PIFs, the same team can close a new PIF in half the time. The infrastructure matters as much as the document.
This is why I always recommend that founders treat their first three product launches as investment in the process, not just in the products.
The team, the workflow, and the documentation standards you build on those first launches become the foundation for everything that follows.
The total cost of building and maintaining a PIF varies significantly with formula complexity, testing status, and whether the Responsible Person is your own entity or a contracted service.
First-time PIF for a simple product: 500 to 1,000 euros when the formula is simple, stability data is provided by the manufacturer, and claims are modest.
First-time PIF for a complex product: 1,000 to 1,800 euros for products with multiple active ingredients, specific performance claims requiring substantiation, or formulas approaching regulatory concentration thresholds.
PIF update: 150 to 400 euros for changes that do not require re-evaluation of safety (new label language, minor claim adjustment, packaging change that does not affect product stability). A formula change that requires CPSR revision effectively restarts part of the first-time PIF cost.
PIF translation into an additional language: 400 to 1,200 euros per product, depending on volume.
Five factors consistently push PIF cost toward the top of the range.
Stability testing not yet complete. If accelerated stability data is not in hand when the PIF build starts, the safety assessor cannot finalize Part A. Either the build pauses until testing finishes, or the brand pays for expedited testing.
Claims requiring instrumental or clinical substantiation. Anti-aging, anti-wrinkle, whitening, scalp-treatment, and similar performance claims require structured evidence. Instrumental testing on a panel of subjects runs 2,000 to 8,000 euros. Clinical testing runs 5,000 to 25,000+ euros. These costs sit outside the PIF build fee but flow through the PIF as evidence.
Raw material documentation gaps. When the manufacturer cannot quickly produce complete safety data sheets, allergen data, or CoA (certificate of analysis) for every raw material, the PIF build stalls. Resolution can involve chasing suppliers through the manufacturer, which adds days to weeks.
Novel or borderline ingredients. Ingredients recently added to Annex III with specific conditions of use, nanomaterials, CBD (for which the SCCS issued its final safety opinion in April 2026, SCCS/1685/25, recommending a maximum of 0.19%, a threshold not yet transposed into a binding Annex limit), botanical extracts without an established toxicological profile. Any of these pushes the safety assessor’s workload up and often requires additional literature review or external toxicological opinion.
Multi-language PIF from day one. A brand targeting five EU markets with five Responsible Person jurisdictions may need the PIF in five languages from the start. This is unusual for first-time launches but common for brands entering the EU with existing multi-market ambitions.
Three factors consistently reduce PIF cost.
A manufacturer with a strong regulatory desk. Some manufacturers provide pre-compiled "PIF-ready" documentation for every white label or base formula in their catalog. The brand’s PIF build becomes an assembly job, not a research job. This is one of the meaningful differences between a well-organized manufacturer and a less mature one.
Reuse across product lines. A brand launching a five-SKU line with shared raw materials, shared packaging families, and shared claims pays less per product than five separate launches.
The shared documentation compounds value across the portfolio.
Claims decided early. A brand that decides its claims strategy early, chooses substantiable claims, and collects evidence during development pays less than a brand that finalizes claims after the formula is locked and then discovers additional testing is needed.
Early planning is free. Retroactive testing is not.
Authorities inspect PIFs two ways: routine market surveillance and triggered inspection following a Safety Gate alert or consumer complaint.
The failure patterns in both are similar.
PIF kept at the wrong address. The address on the product label is the address where the PIF must be available. When brands move offices, change Responsible Person services, or consolidate operations, the label sometimes lags behind the actual PIF location. An inspector arriving at the labeled address and finding no PIF generates immediate non-compliance.
PIF not updated after a formula change. A manufacturer adjusts a preservative level or swaps a raw material supplier, the Responsible Person is not informed, and the PIF now references a formula that is no longer in production. Article 11 requires the PIF to be kept current. This is the single most common deficiency I see.
Incomplete claims substantiation. The label says "48-hour hydration" but the PIF contains only a general moisturization reference. Claims requiring specific evidence must have that evidence in the PIF. General literature references do not substitute for product-specific data.
Missing raw material specifications. The formula is correct but the PIF lacks the full specification for one or two raw materials. This is often a manufacturer communication issue rather than a Responsible Person oversight, but the liability lands on the Responsible Person.
Allergen disclosure mismatches. The PIF declares one allergen profile, the label declares another. The expanded fragrance allergen list of Commission Regulation (EU) 2023/1545 runs on two dates and in one direction only: a product that does not meet the new entries could be placed on the Union market until July 31, 2026, and stock already placed may still be made available on the Union market until July 31, 2028. That makes this likely to become the most frequent finding during 2026 and 2027 inspections.
PIF in the wrong language. The file exists, but the authority cannot read it. The regulation does not require translation into every EU language, but it does require a language the local competent authority understands. An English-only PIF at an address in rural Italy or southern France may not satisfy the requirement.
No cosmetovigilance records. The Responsible Person has received customer complaints but has not logged them in a retrievable register. Annex I, Part A, point 9 requires all available data on undesirable and serious undesirable effects to sit in the safety report inside the PIF; Article 23 separately requires serious undesirable effects to be notified to the competent authority without delay. Missing records are an immediate finding.
The consequences scale with severity.
Minor issues trigger a compliance notice with a deadline for corrective action, typically 30 to 90 days.
Major deficiencies can lead to market withdrawal orders, product recalls, national financial penalties, and publication in the national regulator’s alert feed. Regulation 1223/2009 fixes no amount for those penalties: Article 37 leaves them to each member state, so the exposure depends on where the finding is made.
Systematic non-compliance across multiple products escalates the enforcement response: repeated withdrawal orders, product-by-product bans on making the goods available, and national penalties. There is no EU authorization to hold PIFs that can be revoked; what a brand loses in practice is the willingness of a Responsible Person service to keep the mandate, and the market access of every product found non-compliant.
Italy’s enforcement framework under Legislative Decree 204/2015 sets 500 to 4,000 euros for non-compliant labeling and a criminal fine of 10,000 to 100,000 euros where the Article 11 PIF obligations are breached or the product is placed on the market without a safety assessment. Germany is built differently: breaching the Article 11 PIF obligations is an administrative matter under Section 9(2) of the Kosmetik-Verordnung, with a fine of up to 50,000 euros and no statutory floor, while placing a product on the market without the Article 10 safety assessment is criminal, punishable by up to one year in prison or an income-based day fine, with no euro range at all. France’s ANSM and DGCCRF can issue market withdrawal orders within days when serious risk is identified.
A PIF audit is a formal inspection with a legal basis, and the outcome lives in the public domain. Brands that treat the PIF as a file to check once at launch and ignore thereafter are brands I watch disappear from retail shelves six to twelve months later. Good PIFs are boring maintenance work. Boring is the correct target.
The structural lesson is that the PIF is ongoing. It is a compliance artifact that has to move with the product across its entire commercial life.
The PIF build is roughly 40 percent of the lifetime effort. The remaining 60 percent is maintenance.
The regulation requires the PIF to remain current. In practice, this means updating the file whenever any of the following changes.
Formula change. Any modification to the quantitative or qualitative formula, including a change of raw material supplier where the specifications differ. This typically requires CPSR revision.
Manufacturing site change. A new manufacturer, a new facility, or a significant change in the manufacturing method requires an updated manufacturing method description and often a fresh stability assessment.
Packaging change that affects the product. New primary packaging material, new container shape that changes the headspace, or a new closure system. These can affect stability and preservative performance and may require re-testing.
Label change. New claims, updated warnings, new allergen declarations, new target consumer (e.g., a product reformulated for children), or new market-specific language. Each requires a corresponding PIF update.
New regulatory requirement. A Commission amendment that adds a new warning, restricts a substance, or expands allergen disclosure. The EU Cosmetics Regulation is amended multiple times per year, and not all amendments affect every product, but each amendment should be reviewed against the portfolio.
Cosmetovigilance event. A serious undesirable effect reported after market placement may require the CPSR to be re-reviewed and updated.
For a small catalog (one to ten products), the practical cadence is a quarterly review with the Responsible Person, plus immediate update for any triggered change from the list above.
For a larger catalog, the quarterly review becomes a rolling quarterly review where one-fourth of the portfolio is reviewed each quarter, so every product is touched at least once per year.
The review should cover: any regulatory amendments since the last review, formula or manufacturing changes, cosmetovigilance entries, claims adjustments, and label updates. Thirty to sixty minutes of structured review per product, done regularly, is what prevents the expensive surprise when an inspection happens.
Article 11 requires the PIF to be kept for ten years after the last batch of the product is placed on the market.
In practical terms: the clock starts when the last batch is first made available on the EU market, not when the last unit reaches a consumer. A product whose last batch was placed on the market in 2026 requires PIF retention until 2036, even if units are still selling through in 2027. This is often the moment when a founder discovers that the Responsible Person service they contracted does not include post-discontinuation archival, and negotiates a separate archival fee. Verify this in the contract at the start, not ten years later.
What is a Product Information File and why is it required?
A Product Information File (PIF) is the complete technical and safety dossier that must exist for every cosmetic product sold in the European Union and the United Kingdom. It is required by Article 11 of Regulation (EC) No 1223/2009 (and the equivalent UK Cosmetics Regulation). Article 11(2) lists five items: the product description, the signed Cosmetic Product Safety Report, the manufacturing method with the statement on good manufacturing practice, proof of the claimed effect where the nature or the effect of the product justifies it, and animal testing data, third country testing included. The full formulation and its supporting specifications sit inside the safety report, where Annex I, Part A puts them. The file is held at the address of the Responsible Person printed on the product label, must be readily accessible to competent authorities, and must be kept for a period of ten years following the date on which the last batch of the product was placed on the market. Article 11 does not make the file a precondition that someone verifies before sale: it obliges the responsible person to keep it from the moment the product is placed on the market. The practical effect is the same for a brand that is inspected, but the difference matters when you plan, because there is no approval step to wait for and no authority that will tell you the file is incomplete before a customer, a retailer or an inspector does.
Who is responsible for creating and maintaining the PIF?
The Responsible Person, as defined by Article 4 of Regulation 1223/2009, is legally accountable for ensuring the PIF is complete, current, and accessible. For EU-established manufacturers this is typically the manufacturer itself; for non-EU brands it is a contracted Responsible Person service or the EU importer. The Responsible Person does not build every section personally. The safety assessor prepares the CPSR, the manufacturer provides raw material and manufacturing documentation, testing labs provide stability and microbiological data, and the brand provides claims evidence and label artwork. The Responsible Person coordinates these inputs and maintains the master file. Cost for a contracted Responsible Person service with PIF coordination runs 500 to 2,000 euros per year for a small catalog, scaling with complexity and number of products.
How much does a Product Information File cost to build?
A first-time PIF for a single product runs 500 to 1,800 euros depending on complexity. Simple products with plain claims and complete manufacturer documentation sit toward the lower end. Complex products with multiple actives, performance claims requiring substantiation, novel ingredients, or multi-language requirements sit toward the top. The Cosmetic Product Safety Report component (signed by a qualified safety assessor) is 300 to 800 euros per product and is typically bundled into the total PIF fee. Additional costs that flow through the PIF but are not part of the PIF build itself include stability testing (500 to 2,000 euros per formulation), claims substantiation (2,000 to 25,000 euros depending on the claim and evidence required), and translation into additional languages (400 to 1,200 euros per product per language).
What happens if my PIF is incomplete when authorities inspect?
Consequences scale with the severity of the deficiency. Minor issues (a missing document, outdated label reference) typically trigger a compliance notice with a deadline (usually 30 to 90 days) for corrective action. Major deficiencies (no CPSR, formula mismatch, missing safety assessment) can trigger market withdrawal orders, product recalls, national financial penalties (set by each member state under Article 37, not by the Regulation), and publication in national alert feeds. Systematic non-compliance across multiple products escalates: under Article 25 the authority orders corrective action, withdrawal or recall within a stated time limit, and it acts itself, prohibiting or restricting the product, when the health risk is serious or that deadline passes. National penalties sit on top. No EU authorization of the Responsible Person exists to be revoked. The financial cost of a Safety Gate alert is rarely limited to the direct inventory loss; retailer and marketplace relationships, brand reputation, and reorders are often the larger impact.
How often does the PIF need to be updated?
Whenever anything material changes: formula composition, raw material supplier (when specifications differ), manufacturing site or method, packaging material in contact with the product, label claims, warnings, allergen disclosures, or target consumer. In addition, the PIF should be reviewed against any Commission amendment that restricts a substance, adds a warning, or expands disclosure requirements. For a small brand, a practical cadence is a quarterly review with the Responsible Person plus immediate update for any triggered change. Failing to keep the PIF current is the deficiency I see most often, and Article 11 requires the PIF to be kept current.
Can I use a single PIF for multiple EU markets?
Yes. One PIF per product, held at the Responsible Person’s single EU address, covers the entire EU single market, and the CPNP notification submitted through the portal using that PIF is valid across all 27 EU member states plus EEA countries. However, two cautions apply. First, the PIF must be in a language the competent authority of the member state where the Responsible Person is established can read, which means brands choosing a Responsible Person in a non-English-speaking country may need native-language documentation. Second, Great Britain post-Brexit requires a separate GB PIF held by a UK-based Responsible Person, notified through the SCPN portal, even though the content largely mirrors the EU PIF. Brands selling into both the EU and Great Britain carry dual infrastructure.
What is the difference between the PIF and the CPSR?
The PIF is the complete dossier for the product; the CPSR (Cosmetic Product Safety Report) is the specific safety-assessment module that sits inside the PIF. The CPSR is prepared and signed by a safety assessor with a university qualification in pharmacy, toxicology, medicine or a similar discipline, or from a course a Member State recognizes as equivalent (Article 10(2) of the regulation), and consists of Part A (compilation of safety information) and Part B (the assessor’s reasoned conclusion on the product’s safety). The PIF contains the CPSR plus the product description, the manufacturing method with the statement on good manufacturing practice, proof of the claimed effect where the nature or the effect of the product justifies it, and animal testing data; the formulation and its supporting specifications sit inside the safety report. You cannot have a valid PIF without a CPSR, and you cannot substitute the CPSR for a full PIF. Both are required. For a deeper dive on the Cosmetic Product Safety Report, see the dedicated guide.
Keep reading
Complete independent guide to cosmetics import/export documentation in 2026. EU, USA, and Great Britain customs requirements, HS codes, certificates of free sale, IOSS changes, MoCRA obligations, and the operational traps that cost founders the most. From 30 years in the industry.
Complete independent guide to cosmetic brand trademark protection in 2026. EUIPO, USPTO, UKIPO, and the Madrid System compared, Nice classes 3 and 5 explained, costs and timelines. From 30 years in the industry. Not legal advice.
Complete independent comparison of cosmetic label requirements across the EU, USA, and Great Britain in 2026. Mandatory elements, symbols, language rules, printing technique constraints, and a pre-production checklist. From 30 years in the industry.
