Direct Answer
EU and UK cosmetics compliance for a private-label brand rests on four pillars that must be finished before the first unit sells: an appointed Responsible Person established in the market, a Product Information File (PIF) with a safety assessment, a notification in the correct portal — CPNP for the EU and Northern Ireland, UK SCPN for Great Britain — and a label that meets each market's rules. The EU rulebook is Regulation (EC) No 1223/2009; the UK operates a domestic regime that mirrors it. Non-EU and non-UK brands, including US and ASEAN manufacturers selling through their own labels, carry the same obligations and simply add a local Responsible Person. Compliance is a pre-market gate, not a post-launch fix.
Opening Hook
A US brand's first EU order cleared customs — then sat in a distributor's warehouse because the product had no EU Responsible Person, no CPNP notification number, and a label whose ingredient list used the wrong nomenclature. Restocking cost the brand its launch window and its retailer. At ubitglow, our belief is unchanged — the EU and UK do not inspect cosmetics for approval before sale; they hold the Responsible Person accountable after sale, which makes the pre-market file the only shield a brand has. Here is the compliance map we walk through with every private-label brand entering Europe.
Regulation 1223/2009 in One Paragraph
The EU Cosmetics Regulation is the backbone: every cosmetic placed on the EU market must be safe, must have a Responsible Person, must be supported by a Product Information File, must be notified through CPNP, and must comply with labeling and ingredient rules. The UK left the EU but kept the architecture: Great Britain operates under a domestic version of the same regulation with its own Responsible Person requirement and its own notification portal, while Northern Ireland continues to follow EU rules.
| Obligation | EU | UK (Great Britain) |
|---|---|---|
| Core law | Regulation (EC) No 1223/2009 | UK Cosmetics Regulation (mirrors EU) |
| Notification portal | CPNP | UK SCPN |
| Responsible Person | EU-established | UK-established |
| Northern Ireland | CPNP applies | Follows EU regime |
The Responsible Person: Your Legal Anchor in the Market
The Responsible Person (RP) is the single most misunderstood role in private-label compliance. The RP is not the manufacturer and not the brand owner's lawyer — it is the entity established in the EU (or UK) that answers for the product.
- Duties — keeps the PIF, ensures notification, verifies labeling and claims, reports serious undesirable effects to authorities, and cooperates on corrective actions.
- Who can be RP — the brand's local subsidiary, an EU distributor, or a professional compliance service. For US and Asian brands, a compliance-service RP is the common path.
- Post-Brexit reality — an RP established in the EU cannot serve Great Britain, and a UK RP cannot serve the EU; brands selling in both need both, plus the correct notification in each portal.
| RP Option | Best Fit | Note |
|---|---|---|
| Brand's local subsidiary | Brands with EU operations | Full control, highest cost |
| Distributor / retailer | Single-market brands | Contract must assign RP duties in writing |
| Compliance service | US / Asian brands | Common path; one provider, many SKUs |
The Product Information File: Evidence Before Marketing
The PIF is the product's complete evidence file and must be available to authorities on request from the day of placement. A private-label PIF typically contains:
- Product description — formula, specifications, and the label artwork.
- Safety assessment — a formal cosmetic safety report by a qualified safety assessor, covering each ingredient, impurities, and the finished product.
- Manufacturing details — GMP compliance and batch information.
- Evidence of claims — substantiation for every efficacy statement on the label and in advertising.
CPNP and UK SCPN: Two Markets, Two Notifications
Notification is the step brands forget first. It is a portal submission, not an approval — but without the notification number, the product cannot lawfully be on the market.
| Portal | Covers | Submitted By | Timing |
|---|---|---|---|
| CPNP | EU member states + Northern Ireland | Responsible Person | Before first placement |
| UK SCPN | Great Britain (England, Scotland, Wales) | UK Responsible Person | Before first placement |
The notification includes the product category, the responsible person details, the formula, and the label images. Each new SKU — including each flavor or shade variant of the same base — is a separate notification, so a lip balm line of five flavors means five notifications per market.
For brands that also sell in Asia, our skincare export regulatory guide compares the EU file with other markets' requirements, and the skincare co-manufacturing guide explains what documentation to demand from the OEM so the PIF can be assembled.
Ingredient Annexes and the Positive-List Logic
The EU regulates cosmetics by annexes, and private-label brands must run their full INCI against them:
- Annex II — prohibited substances; anything listed here cannot appear at any level.
- Annex III — restricted substances, each with maximum concentrations and labeling conditions (salicylic acid is a familiar example).
- Annex IV / V / VI — positive lists for colorants, preservatives, and UV filters: an ingredient in these functions must be on the list to be used at all.
- CMR substances — carcinogenic, mutagenic, or reprotoxic substances are prohibited by default with narrow exceptions.
| Ingredient Type | EU Rule | Private-Label Action |
|---|---|---|
| Preservatives | Annex V positive list | Confirm each preservative is listed |
| UV filters | Annex VI positive list | Critical for sunscreen SKUs |
| Colorants | Annex IV positive list | Check every dye and pigment |
| Restricted actives | Annex III limits | Salicylic acid, hydroquinone-class, etc. |
Labels, Claims, and the Language of Compliance
The label is where compliance becomes visible to the buyer and the inspector.
- INCI ingredient list — the EU/UK requires the International Nomenclature of Cosmetic Ingredients; a US label written in US-style nomenclature does not transfer automatically.
- Language — mandatory information must appear in the official language(s) of the member state where the product is sold.
- Mandatory fields — name and address of the Responsible Person, country of origin, nominal content, batch number, period after opening (PAO), and warnings for restricted ingredients.
- Claims — the EU requires substantiation for claims; the UK mirrors this, and the FTC separately polices claims that reach US consumers, so a global label must satisfy the strictest market in its claim set.
For brands positioning around sustainability and certifications, our clean beauty certification guide maps which certification claims survive EU scrutiny and which are marketing overreach.
The Bottom Line
EU and UK compliance for a private-label brand is a pre-market gate with four keys: an appointed Responsible Person in each market you sell, a Product Information File holding the safety assessment and claim evidence, a CPNP notification for the EU and Northern Ireland plus a UK SCPN notification for Great Britain, and labels that meet INCI, language, and annex rules. The annexes decide what may go in; the PIF proves what is in; the RP answers for it; the notification number makes it legal. Build the file before the first unit sells — in European cosmetics, the file is the license to trade.
Europe does not approve your product in advance — it holds your file accountable afterward. Make the file something you are proud to defend.