CPSR, CPNP, PIF and Responsible Person: what a brand outside the EU actually needs

Brands in Korea, China and the US often search for "CPNP certification" because at home a regulator issues a document at the end. The EU works differently. Nobody approves your product before it is placed on the market. The Responsible Person takes legal responsibility for it, and inspectors check the file afterwards, often only when there is a complaint or a market survey. That is why the quality of the safety report matters more than any number on a portal.

The four elements at a glance

What is a Responsible Person, and why can't the brand notify itself?

The Responsible Person is the legal entity that answers for the product in the EU. Article 4 of Regulation (EC) 1223/2009 says that only products for which a Responsible Person is designated within the EU may be placed on the market. A brand registered in Seoul, Shanghai or Los Angeles cannot be its own RP.

Two common set-ups:

• Your EU importer or distributor is the RP. This is the default for imported products. It works if you have one main importer, but every new importer creates a new chain, and your formulas end up in a partner's files.
• You appoint an independent RP service. The RP holds your PIF, answers authorities and notifies your products. You keep control when you change distributors.

The CPNP portal itself is free. It accepts notifications only from an account registered to an EU entity, which is why a non-EU brand always works through its RP.

What is a CPSR?

The Cosmetic Product Safety Report is the core document. Annex I of the Regulation sets its structure: Part A collects the data (composition, stability, microbiology, impurities, packaging, exposure, toxicological profile of every ingredient, undesirable effects), and Part B is the assessor's reasoning, conclusion, warnings for the label and signature.

Three things decide whether a CPSR protects you or only looks like it does:

1. Who signs it. Article 10(2) requires a diploma in pharmacy, toxicology, medicine or a similar discipline. A report without a qualified signatory is not a CPSR in the legal sense.
2. Whether every ingredient is assessed. A real report calculates the systemic exposure and margin of safety for each relevant ingredient, using a point of departure with a source, following the SCCS Notes of Guidance.
3. Whether it matches the product on the label. The formula, the shade, the fragrance, the claims and the warnings must be the same in the CPSR, the PIF and on the pack.

We explain the structure section by section in What is in a CPSR.

What is a PIF, and how is it different from the CPSR?

The PIF is the folder an inspector asks for. The CPSR is the largest document inside it, but not the only one. Under Article 11 the PIF contains:

• a description of the product that links the file to the product on the shelf;
• the CPSR;
• a description of the manufacturing method and a statement of compliance with good manufacturing practice (in practice, ISO 22716);
• proof of the effects claimed on the label or in advertising;
• data on any animal testing done for the product or its ingredients.

The RP must keep it available at the address on the label, in a language the national authority understands. Many EU authorities accept English for the PIF; check the country where your RP is registered.

What is a CPNP notification?

CPNP is the European Commission's Cosmetic Products Notification Portal. Before the product is placed on the market, the RP enters the product category, the frame formulation or exact composition, the presence of CMR substances and nanomaterials, the country of origin, the label and a photo of the packaging. National authorities and poison centres then see this information.

The portal does not check your formula or your report, so a notification is not an approval. The notification number proves only that the entry exists. Some marketplaces and distributors ask for it, and most of them ask for the CPSR as well. Nor can the notification replace the CPSR: the RP needs the finished report to fill in the notification correctly, and an inspector who opens the notification will ask for the PIF.

Products containing nanomaterials need an additional notification six months before they are placed on the market (Art. 16), unless the nanomaterial is a colourant, preservative or UV filter already listed in Annexes IV–VI.

In which order does a brand outside the EU do this?

1. Choose the Responsible Person. Your importer or an RP service. Sign the mandate.
2. Collect the product documents. Exact formula, raw material specifications, fragrance allergen declaration, stability and microbiology results, packaging information, label artwork. Our document checklist lists them.
3. Get the CPSR. The safety assessor checks the package, asks for anything missing, calculates exposure and margins of safety, decides on warnings and signs Part B.
4. Adjust the label. The CPSR often changes the label: warnings, allergens, INCI names under the 2025 glossary, nominal content, the RP address.
5. Compile the PIF and hand it to the RP.
6. Notify in CPNP. The RP (or someone working in the RP's account) submits the notification.
7. Place the product on the market. Keep the PIF updated when the formula, supplier, label or the law changes.

Steps 2 and 3 take the most time. With a complete document package a CPSR takes 2–4 weeks. When the package arrives in parts, the same report can take three to six months, because each missing document restarts the conversation.

What can be done for you, and what stays with your RP

We prepare the CPSR in English, compile the PIF, check the EU label and claims, and complete the CPNP notification in your Responsible Person's account. The notification stays in the RP's account and under the RP's responsibility, which is how the Regulation intends it.

Complex categories (sunscreens, hair dyes, aerosols, products for children and the eye area, acid peels) are quoted individually. See how CPSR pricing works.