Private label founders, cross-border sellers, and exporters based outside Europe carry these duties themselves. Your supplier can hand you the documents, but the legal seat of compliance is the responsible person you name inside the EU. Below are the six filings every product must clear before a single unit lands in a EU warehouse, plus the borderline call that catches aftercare brands out and the REACH rules that govern the ink under the skin.
At a glance: Six filings clear every product for the EU. You need a responsible person, a CPNP notification, the PIF with its safety report, GMP under ISO 22716, local-language labels, and a system for recording serious reactions. The borderline call on fresh-tattoo claims and the REACH ink limits sit on top of those.
One Rulebook Covers the Whole EU Market
The EU does not treat cosmetics as a self-certified category you list and forget. EU cosmetic compliance runs as a regulated system with named obligations, and aftercare sits in one of the trickier corners of that system.
The United States under MoCRA is still building its enforcement bones, while the EU has run a single, directly applicable rule since 11 July 2013. That rule, Regulation (EC) No 1223/2009, applies in every member state without each country passing its own law. A brand in Berlin and a brand in Lisbon follow the same book.
For a private label operator sourcing from outside Europe, one set of obligations covers the whole market, with no state-by-state patchwork to hide in. The notification you file is valid across the bloc, and the responsible person you name answers for the product everywhere it sells. You cannot launch in Germany and sort the paperwork later for France. That single fact is why EU cosmetic compliance rewards brands that file early.
Key point: One notification covers the whole bloc. There is no state-by-state licence to chase, so the work you do for your first market counts for all of them.
The Six Things Every EU Cosmetic Must Meet
The regulation lays out six obligations. None are optional, and most must be in place before the first unit ships.
| Requirement | What it covers |
|---|---|
| Responsible person | An EU-established entity holds legal accountability for the product. |
| CPNP notification | Free portal registration before the first sale, with category, formula outline, and label. |
| PIF and CPSR | The safety dossier plus the assessor-signed cosmetics product safety report. |
| GMP under ISO 22716 | Manufacturing follows the cosmetic good-manufacturing-practice standard. |
| Local-language labels | Each market gets ingredients and warnings in its own language. |
| Adverse-effect system | Serious reactions are recorded and flagged through the RAPEX rapid-alert network. |
Note: Two details surprise first-time exporters. Nanomaterials need an extra notification six months before the product goes on sale. The product information file has to be kept for 10 years after the last batch is sold. Neither breaks a launch on day one, but both surface when a distributor asks for proof and finds nothing.
Pick a Responsible Person Based in the EU
The responsible person is the legal anchor of EU cosmetic compliance. It must be a company or individual established inside the EU who takes on legal responsibility for the product. If your brand is registered in Shenzhen or New Jersey, you cannot be the responsible person yourself. You appoint one.
This role is not a rubber stamp. The responsible person keeps the product information file, ensures the safety assessment exists, makes sure labelling is correct, and acts as the contact point for EU authorities. Many brands use a consultancy or their EU distributor. Without a named responsible person, your product is not legal to sell, full stop.
Notify Every Product Through CPNP
CPNP is the EU's online portal where every cosmetic product must be registered before it reaches the market. CPNP stands for Cosmetic Products Notification Portal. The notification is free, but it is mandatory, and it has to be done before you sell anything, not after.
You submit the product category, the responsible person details, the formulation outline, and the label. Authorities and poison centres use this data if a product is linked to an adverse reaction. A common mistake is treating CPNP as a formality to file once sales prove themselves. By then you have already broken the rule, because the notification must precede the first sale.
Keep the PIF and CPSR on File
The product information file, or PIF, is the dossier behind every product. It holds the formulation, manufacturing data, safety assessment, and labelling. Inside it sits the CPSR, the cosmetics product safety report, which a qualified assessor signs to confirm the product is safe for its intended use.
For a private label brand, the PIF is where your factory's documentation earns its keep. The 10-year retention rule means this file outlives the product's shelf life, so build it properly the first time.
Tip: Ask your factory for the MSDS, COA, and formula record up front. A supplier that treats these as available on request turns a two-week CPSR into a quarter of delays.
For the wider paperwork picture, the walk through the GMP and ISO expectations distributors check before they stock you.
The Borderline That Redraws Your Whole Path
Here is the part most aftercare write-ups skip. Tattoo aftercare does not automatically count as a cosmetic under EU law.
The EU's Borderline Manual, updated to version 5.5 in August 2025, added a specific section on tattoo aftercare. Its position is clear: products intended to heal or prevent infection on fresh tattoos are not cosmetics. A fresh tattoo is broken skin. A product pitched as healing that wound, or stopping it from getting infected, steps into the territory of medicines or medical devices, where the rules are stricter and different.
This matters because the difference changes your entire compliance path. A balm marketed for everyday moisturising of healed tattoos sits comfortably in cosmetics. The same balm described as heals your new tattoo and prevents infection may need to clear a medicines regulator instead. The claims on your label decide the category, not the ingredients.
The fix: Write your claims for the cosmetic lane and keep them there. Say moisturises and supports the look of healed skin, not treats or heals. The borderline manual is the reference your responsible person should check against your draft label before notification.
The cost of getting this wrong is not theoretical. A single healing claim on a label has sunk distributor deals, and rewriting artwork plus re-notifying costs far less than a blocked shipment at a EU border.
REACH Limits on Ink and Hardware
Cosmetics compliance is only half the story for tattoo aftercare, because the ink under the skin has its own rulebook. REACH is the EU's chemicals regulation, and it restricts substances in tattoo ink and permanent make-up through Annex XVII, Entry 75.
Entry 75 has applied since 4 January 2022. It limits more than 4,000 substances in tattoo ink and PMU, covering carcinogens, mutagens, reproductive toxins, and a long list of sensitising and skin-irritating compounds. If your brand also sells or specifies ink, or if your aftercare sits alongside an ink line, this restriction is squarely in scope.
That is why many private label brands now audit their ink supplier's batch certificates before listing a product, since one banned pigment can pull an entire line from sale.
A second limit reaches the hardware you ship.
Note: Nickel release from skin-contact items, including jewellery sold as aftercare accessories, is capped at 0.5 micrograms per square centimetre per week. A piece of kit hardware that sheds nickel above that threshold fails, regardless of how clean the rest of your line is.
Where EU and US Rules Diverge
Brands splitting their launch across the Atlantic often assume the two systems are close cousins. They are not. The table below shows where EU cosmetic compliance and the US MoCRA framework diverge on the points that affect a launch timeline.
| Requirement | EU (Regulation 1223/2009) | US (MoCRA) |
|---|---|---|
| Pre-market notification | CPNP, mandatory before sale | Product listing, phased in |
| Accountable party | EU responsible person, required | Responsible person, required |
| Safety assessment | CPSR by qualified assessor, mandatory | Requires safety substantiation |
| Labelling | Local language per market | English, federal rules |
| Adverse events | Serious effects recorded, RAPEX alerts | Adverse event reporting required |
| Ink limits | REACH Entry 75, 4,000+ substances | No federal ink restriction yet |
The pattern is consistent. The EU front-loads the work: notify, assess, name a person, then sell. The US asks for substantiation and listing but leaves more of the structure to be built out.
Takeaway: Plan the EU side as a fixed sequence with hard deadlines. The US side is looser, which makes the EU the side that actually gates your launch date.
If you want the US side of the same question, the from the EU framework on the points that affect a launch timeline.
Your Pre-Shipment Compliance Checklist
Compliance feels lighter once it is a list. Before your first EU shipment, work through these:
Name your responsible person before you notify anything. Have a signed agreement with an EU-established entity in place first.
Build the PIF and CPSR now. Pull the formulation, MSDS, COA, and manufacturing record from your factory before a distributor asks for them.
File CPNP before the first unit sells, including label and category.
Check the borderline. Have your responsible person review your claims against the August 2025 Borderline Manual. Keep healing and infection language off cosmetic labels.
Audit ink and hardware. If you touch ink or skin-contact accessories, confirm REACH Entry 75 and the nickel release limit.
Label in local languages. Plan German, French, and any other market language before artwork is locked.
Tip: A CPSR alone can take three to four weeks once the formula is locked. Open the file while the product is still in sampling, not after the first purchase order lands.
None of these are exotic. They are administrative discipline, and EU cosmetic compliance is easiest when treated as part of sourcing rather than a hurdle after launch. The brands that plan for it up front are the ones that actually ship.
FAQs
What Is CPNP?
CPNP is the EU's Cosmetic Products Notification Portal, the free online system where every cosmetic must be registered before it is sold in the EU. You submit the product category, responsible person, formulation outline, and label so authorities and poison centres can act on adverse reactions. File it before your first sale, not after.
Can Brands Sell Tattoo Aftercare in Europe?
Yes, provided the product meets EU cosmetic compliance and is treated as a cosmetic rather than a healing product. You need an EU responsible person, a CPNP notification, a safety file, and labels in the local language. Claims that suggest healing or infection prevention on broken skin can pull the product outside cosmetics and into a stricter approval path.
Is Tattoo Aftercare a Cosmetic Under EU Law?
It depends on the claims and the skin state. Aftercare for healed tattoos, sold for moisturising or appearance, is a cosmetic. Aftercare intended to heal a fresh tattoo or prevent infection on broken skin is not a cosmetic under the August 2025 Borderline Manual, and may be regulated as a medicine or medical device instead. The label wording, not the ingredients, decides the category.
Who Is the Responsible Person for EU Cosmetics?
The responsible person is the EU-based company or individual who holds legal accountability for a cosmetic product. A brand outside the EU must appoint one, because it cannot be the responsible person itself. This party keeps the product information file, confirms the safety assessment, verifies labelling, and answers to EU authorities. Many brands use a consultancy or their distributor for this role.
Does REACH Apply to Tattoo Aftercare?
REACH applies where ink or skin-contact items are involved. Annex XVII, Entry 75 limits more than 4,000 substances in tattoo ink and permanent make-up, in force since 4 January 2022. REACH also caps nickel release from skin-contact accessories at 0.5 micrograms per square centimetre per week. If your line includes ink or aftercare hardware, these limits sit alongside the cosmetics rules.
What Happens Without CPNP Notification?
Selling without a CPNP notification is illegal in the EU, and authorities can block the product, pull it from sale, and fine the responsible person. Because notification must precede the first sale, a late filing means every unit already sold was non-compliant. Distributors routinely check CPNP status before stocking, so a missing notification also kills the deal at the door.
An EU-ready aftercare line starts with a factory that already runs GMP and ISO 22716. A supplier with a clean document chain, from formula records to certificates of analysis, makes the PIF and CPSR far easier to assemble. If you want a sourcing partner that understands the file and not just the formula,
