Cosmetics and the CPNP: What UK Beauty Brands Get Wrong Before They Even Ship
If you run a UK cosmetics brand and you have been looking at the EU market, you have probably worked through the obvious questions. Which countries do we launch in first? What does shipping cost? Do we need to hold stock in Europe?
The question most founders do not think to ask until it becomes urgent is this one: have our products been notified to the EU authorities?
That notification is called the CPNP — the Cosmetic Products Notification Portal — and it is a legal prerequisite for placing any cosmetic product on the EU market. Not a nice-to-have, not a later-stage formality. A prerequisite. A product that has not been notified on the CPNP cannot legally be sold in the EU. Not on your own website, not via a European distributor, not on Amazon.de.
This article explains what the CPNP is, what complying with it actually requires, and why the answer for UK brands is more complicated — and in one important way, more straightforward — than most people realise.
What the CPNP Actually Is
The Cosmetic Products Notification Portal is the European Commission's centralised online system for notifying cosmetic products before they are placed on the EU market. It operates under EU Regulation (EC) No 1223/2009, which governs cosmetic products across all 27 EU member states, plus Norway, Iceland, and Liechtenstein.
The practical function of the CPNP is twofold: it gives competent authorities across the EU visibility of every product on the market, and it gives poison centres — the emergency services that handle accidental ingestion and exposure calls — access to product composition data so they can respond to incidents quickly. It is, in that sense, a consumer safety system as much as a regulatory compliance system.
Notification is free of charge. There is no fee to submit a product to the CPNP. But the preparation required to notify correctly is not free, and the cost of getting it wrong — in the form of market withdrawal, delayed launch, or regulatory action — is significant. A single successful CPNP notification covers all EU member states. You do not need to repeat the process country by country.
The Responsible Person: The Role UK Brands Cannot Hold
Here is the first thing that surprises most UK founders: you cannot notify your own products on the CPNP if you are based in Great Britain.
The CPNP is managed by an entity called the Responsible Person (RP). Under EU Regulation 1223/2009, the Responsible Person must be legally established in the EU or, under the Windsor Framework's specific provisions, in Northern Ireland. A company or individual based solely in England, Scotland, or Wales cannot act as Responsible Person for EU-market products.
The Responsible Person is not an administrative convenience. They carry legal liability for the product's compliance. That means:
- Ensuring the product meets EU ingredient restrictions and prohibitions (Annexes II through VI of the Regulation)
- Commissioning and holding the product safety assessment
- Maintaining the Product Information File (PIF) for ten years after the last batch is sold
- Notifying the product on the CPNP before it enters the EU market
- Reporting any Serious Undesirable Effects (SUEs) — adverse reactions requiring hospitalisation or medical treatment — to national authorities
- Being available as the contact point for regulatory inspections
For UK brands, this means one of three things: appointing a third-party EU-based compliance firm to act as RP, partnering with an EU distributor willing to take on the RP role, or — and this is the route most relevant to the NI path — using an RP established in Northern Ireland.
What a CPNP Notification Actually Requires
Before any product can be submitted to the CPNP, the following documentation and preparation must be in place. This is not a checklist to complete the morning before launch. For a typical cosmetics brand with ten to thirty SKUs, this process takes weeks.
| Requirement | What it means in practice |
|---|---|
| Cosmetic Product Safety Report (CPSR) | A two-part scientific document. Part A contains the safety information: ingredient profiles, toxicological data, exposure assessment, physical and chemical specifications, and microbiological quality. Part B is the safety assessment itself — a signed conclusion from a qualified safety assessor confirming the product is safe for its intended use. You cannot write your own CPSR. EU law requires it to be prepared and signed by a person with a degree in pharmacy, medicine, toxicology, or an equivalent discipline. |
| Product Information File (PIF) | The full compliance dossier for the product. It includes the CPSR, a product description, the manufacturing method and GMP compliance statement, evidence supporting any claims made (clinical tests, consumer studies, literature), and records of any animal testing. The PIF must be accessible to EU authorities at the Responsible Person's address and must be maintained for ten years after the last batch of the product is placed on the market. |
| INCI ingredient list with concentrations | Every ingredient listed by its INCI (International Nomenclature of Cosmetic Ingredients) name, with the concentration of each. This is submitted to the CPNP and used by poison centres for emergency response. Concentrations are kept confidential from competitors — only competent authorities and poison centres can access them. |
| Compliant EU label | The product label must meet Article 19 of the Regulation. Required elements include: the name and address of the Responsible Person in the EU, the country of origin for imported products, the nominal content, the durability date or PAO (Period After Opening) symbol, precautions and warnings, the INCI list, and the product's function. For UK brands, "Made in UK" must appear on the label for products manufactured in Great Britain. |
| GMP compliance statement | Confirmation that the product was manufactured in compliance with Good Manufacturing Practice (ISO 22716). Your manufacturer typically provides this. Without it, the PIF is incomplete. |
| Nanomaterial notification (if applicable) | If any ingredient is classified as a nanomaterial under EU definitions, a separate notification must be submitted to the European Commission six months before the product is placed on the market. This is in addition to the standard CPNP notification under Article 13 and is required under Article 16 of the Regulation. |
Shade Variants, Reformulations, and When You Need a New Notification
One CPNP notification covers one product formulation. If you change the formula, you need to update or resubmit the notification. If you launch a new shade of a colour cosmetic — a lipstick in five shades, for example — you may be able to submit a single multi-component notification where only the colorants differ, which reduces the administrative burden. But if the base formula changes significantly between variants, separate notifications are required.
The practical implication for brands with large SKU counts is that CPNP compliance is an ongoing programme, not a one-time project. Every new product, every reformulation, and every meaningful labelling change that affects mandatory information triggers a notification update. The PIF must reflect the current version of the product at all times.
The Northern Ireland Angle: Why This Matters for NI Routing
Here is where the CPNP picture gets both more complex and more useful for UK brands using Northern Ireland as their EU entry point.
Under the Windsor Framework, Northern Ireland operates under EU Regulation (EC) No 1223/2009 — not the UK's post-Brexit cosmetics regulation. This is confirmed by GOV.UK guidance: cosmetics placed on the NI market must be notified on the CPNP, and the Responsible Person must be established in the EU or in Northern Ireland. A GB-only Responsible Person is insufficient for NI.
This creates a specific compliance structure for brands using the NI route:
- Products routed through NI for EU distribution require CPNP notification via an EU or NI-based RP — the same notification that covers the rest of the EU
- Products sold into Great Britain through an NI hub require a separate UK Responsible Person and notification on the UK's SCPN (Submit Cosmetic Product Notifications) portal
- The same physical stock in an NI warehouse can fulfil both EU and UK orders — but the compliance documentation and portal notifications split by destination market
The important commercial point is this: a brand that establishes CPNP compliance via an NI-based Responsible Person has effectively unlocked all 27 EU member states plus the EEA with a single notification process. That is the same compliance outcome as establishing an EU Responsible Person in, say, Germany or the Netherlands — but with the added advantage that the RP is in the same jurisdiction as the fulfilment partner routing the stock.
The Most Common Compliance Gaps We See
Based on what we see when brands come to us after attempting to navigate EU entry independently, these are the failures that cause the most disruption:
Qualification gap — CPSR signed by an unqualified assessor. The EU specifies minimum qualification requirements for safety assessors. A document signed by someone without the right academic background is not a valid CPSR, regardless of how thorough it looks. This is the most expensive mistake to fix late because it means the entire safety assessment must be redone.
Wrong RP jurisdiction — GB-based RP appointed for NI or EU distribution. A company established only in England cannot act as RP for products sold into the EU or into Northern Ireland. We regularly see brands that have invested in packaging, stock, and carrier contracts before discovering that their compliance setup does not cover the market they are entering.
Incomplete notification — INCI concentrations missing from CPNP submission. The CPNP requires ingredient concentrations, not just INCI names. Brands that submit ingredient lists without concentrations have incomplete notifications. The product is not legally notified until the submission is complete and accepted.
PIF inaccessibility — PIF held only at manufacturer location outside the EU. The PIF must be accessible to EU authorities at the Responsible Person's address within the EU. A PIF held only at a factory in the UK or the US does not satisfy this requirement. The RP must maintain a copy accessible in the EU or NI at all times.
Stale notification — no update submitted after reformulation. CPNP notifications reflect the product as it was at the time of submission. If the formula changes — a preservative swapped, a fragrance adjusted, an active ingredient concentration altered — the notification must be updated before the reformulated product enters the market. Selling a product that no longer matches its CPNP notification is a compliance breach.
What This Means for Your EU Expansion Timeline
CPNP compliance is not a two-day process. For a brand entering the EU market for the first time with a range of ten products, a realistic timeline from starting the process to having valid notifications in place looks like this:
| Stage | Typical timeframe | Notes |
|---|---|---|
| Appoint Responsible Person | 1–2 weeks | Contracting, mandate signing, onboarding to CPNP portal |
| Formula review and ingredient screening | 1–2 weeks | RP checks INCI list against Annexes II–VI; identifies any restricted or prohibited substances |
| CPSR preparation | 3–6 weeks | Longest stage; depends on completeness of your ingredient data and how quickly your safety assessor works. Rush services are available at higher cost. |
| PIF compilation | 1–2 weeks | Gathering GMP statements, claims evidence, product descriptions, label artwork |
| CPNP submission | 2–5 business days | Electronic submission; CPNP reference number issued upon validation |
| Total (10 products) | 8–14 weeks | Assuming no ingredient issues requiring reformulation. Complex ranges or regulated categories (SPF, nanomaterials) extend this. |
The implication is straightforward: CPNP compliance needs to be started the moment a UK cosmetics brand decides it is going to enter the EU market — not once the operational setup is in place. Brands that treat it as a final-stage task routinely delay their launch by two to three months.
The CPNP is one of several compliance layers that cosmetics brands need to work through before EU launch. How it interacts with your NI routing strategy, your choice of Responsible Person, and your product labelling for different markets is specific to your product mix. Getting it right at the start is significantly cheaper than correcting it later.
Is your range ready for the EU market?
North Channel Logistics works with cosmetics brands to map the full compliance picture before any operational decisions are made. If you are planning EU entry in the next six to twelve months, the right time to understand the CPNP requirement is now.
Book a free 30-minute call or take our NI Route Readiness Audit to get a structured assessment of your compliance position and the fastest route to market.
This article is intended as a practitioner overview and does not constitute legal or regulatory advice. Specific compliance obligations vary by product category, ingredient composition, and target market. Brands should work with a qualified safety assessor and EU Responsible Person to confirm requirements for their product range.