A CPSR, or Cosmetic Product Safety Report, is a mandatory document that proves a cosmetic product is safe for human use before it can be sold in the European Union or the United Kingdom. Required under EU Regulation 1223/2009 (and its UK equivalent), a CPSR must be completed for every cosmetic product placed on the market, from moisturizers and shampoos to makeup and deodorants. Without one, selling your product is illegal.
The report is split into two parts: one compiles the raw safety data about the product, and the other is a formal expert assessment that ultimately answers a single question: is this product safe? Here’s what goes into each part, what testing you’ll need, and how the process works in practice.
What a CPSR Covers
Part A of the report is the evidence base. It contains structured, factual data about the product itself. At minimum, it must include the full quantitative and qualitative formula (every ingredient, its function, and its concentration), the product’s physical and chemical characteristics, stability data, microbiological quality, information about impurities and traces from raw materials, details about the packaging material, and a description of how the product will normally be used.
The toxicology section within Part A is especially detailed. It compiles hazard data for each ingredient across endpoints like irritation, sensitisation, phototoxicity, and reproductive toxicity. For each ingredient, the assessor identifies a safe threshold from existing human or animal data, then calculates a margin of safety by comparing that threshold to the estimated amount a person would actually absorb during normal use. A wide margin means the ingredient poses minimal risk at the concentration used; a narrow margin flags ingredients that need closer scrutiny.
Part B is where a qualified safety assessor reviews all of Part A and writes their expert evaluation. This section includes a discussion of hazards and safety margins, an identification of uncertainties or tight margins, the assessor’s reasoning, any required label warnings, and a final conclusion stating whether the product is safe for its intended use. The assessor must also provide their credentials and formally approve Part B. Regulators expect Part B to demonstrate genuine engagement with the data, not just a rubber stamp.
Testing Required Before a CPSR Can Be Issued
You can’t produce a CPSR from paperwork alone. Several categories of lab testing feed directly into the report.
Stability testing confirms that the product holds up over time. This includes real-time studies, accelerated aging tests, and in-use testing to support the claimed shelf life, storage conditions, and any “period after opening” symbol on the label. If a product degrades or separates before its stated expiry, it can’t pass safety assessment.
Microbiological testing ensures the product resists contamination. For water-containing products, or those used around the eyes, on infants, or on compromised skin, this is critical. The standard preservative challenge test (ISO 11930) introduces five specific microorganisms, including common bacteria like E. coli and Staphylococcus aureus plus fungi like Candida albicans, into the product. The product is then incubated for 28 days at 32.5°C to simulate real shelf-life conditions. To pass, the preservation system must reduce microbial levels to predefined acceptable limits.
Packaging compatibility is another area that requires testing. The assessor needs data on whether the packaging leaches chemicals into the product or absorbs active ingredients out of it, both of which could change the product’s safety profile over time.
Which Products Need a CPSR
Any product that meets the legal definition of a cosmetic requires a CPSR. In both the EU and UK, a cosmetic is any substance or mixture intended to be placed in contact with external parts of the body (skin, hair, nails, lips, external genitalia) or with the teeth and mucous membranes of the mouth, with the purpose of cleaning, perfuming, changing appearance, protecting, or keeping them in good condition.
Products that claim to treat, cure, or prevent a disease, or that are intended to affect the structure or function of the body, cross into pharmaceutical territory and fall under different regulations entirely. A moisturizer is a cosmetic; a cream that claims to treat eczema is a drug. Similarly, products that qualify as true soaps (made entirely from fats and alkali, with no additional claims beyond cleansing) may fall outside cosmetic regulation depending on jurisdiction. The line between categories depends on the product’s intended use and its claims, not just its ingredients.
EU and UK Requirements After Brexit
The core CPSR requirements are nearly identical in the EU and the UK. Both require the same two-part structure, the same categories of safety data, and the same type of qualified assessor to sign off on Part B. Both also require ongoing post-market surveillance, meaning the responsible person must continue monitoring product safety after launch and update the CPSR if new risks emerge.
The practical difference is administrative. You need a separate responsible person established in the EU for EU sales and one in the UK for UK sales. A single CPSR can serve as the scientific foundation for both markets, but regulatory submissions and product notifications go through different portals. EU products are notified through the CPNS (Cosmetic Products Notification Portal), while UK products go through the SCPN (Submit Cosmetic Product Notification) system. If your formula is the same for both markets, you won’t need to redo safety testing, but you will need to ensure your documentation and responsible person arrangements satisfy each jurisdiction independently.
Who Prepares the Report
Part A can be compiled by the manufacturer, the brand owner, or a regulatory consultant. It’s essentially a data-gathering exercise: pulling together formulation details, test results, supplier documentation, and exposure calculations into the required format.
Part B must be completed by a qualified safety assessor. EU and UK regulations specify that this person needs a university-level qualification in pharmacy, toxicology, medicine, or a similar discipline. The assessor’s name, qualifications, and contact details are recorded in the report, and they are personally accountable for the safety conclusion. Most small and mid-sized cosmetic brands outsource this step to specialist consultancies, with costs typically varying based on the complexity of the formula and the number of ingredients.
How Long It Takes and What It Costs
Timeline depends heavily on how prepared you are. If you already have stability data, challenge test results, and complete ingredient documentation from your suppliers, a safety assessor can often complete Part B within a few weeks. If you’re starting from scratch, stability testing alone can take several months for real-time data, and accelerated studies typically run 8 to 12 weeks. Gathering certificates of analysis and safety data sheets from ingredient suppliers adds more time if your supply chain isn’t well organized.
The cost of having a qualified assessor complete the CPSR varies widely. Simple rinse-off products with well-known ingredients cost less to assess than leave-on products with novel ingredients or tight safety margins. Many brands budget for both the lab testing and the assessment as a single line item when developing a new product, treating it as a non-negotiable part of bringing a cosmetic to market.
What Happens Without One
Selling a cosmetic product in the EU or UK without a valid CPSR is a regulatory violation. Enforcement authorities can order product recalls, issue fines, and in serious cases pursue criminal prosecution against the responsible person. Retailers, distributors, and online marketplaces increasingly ask for proof of a valid CPSR before listing cosmetic products, so the document functions as both a legal requirement and a practical gatekeeping tool for market access.
The CPSR also isn’t a one-time document. It must be updated whenever the formula changes, when new safety data becomes available for any ingredient, or when post-market surveillance reveals adverse reactions. Regulation 1223/2009 itself continues to be amended, with updates to banned and restricted ingredient lists as recently as May 2025, which can trigger the need to revisit existing reports.