EU Regulation 1223/2009 has not changed since 2013. What has changed is enforcement, the speed of Annex amendments, and the arrival of the Green Claims Directive. A beauty brand launching into the European Union in 2026 has to think about three things at once: the rules that have been there for a decade, the rules that updated last quarter, and the rules that are about to.
Here is the checklist we run with founders inside LaunchOS when the launch involves Europe.
1. CPNP notification before first sale
The Cosmetic Product Notification Portal is the single point of submission for any cosmetic product placed on the EU market. Notification must be made before the product is sold, not after. The notification covers identity, formulation at the level of frame formulation, packaging, the appointed Responsible Person, and the cosmetovigilance contact.
Notification is per product, per market. A change in formulation or label artwork requires the notification to be updated.
CPNP submissions are filed by the Responsible Person, not the brand directly. If your RP is a third-party agency, they handle the submission. If you are based in the EU and acting as your own RP, you submit yourself.
2. EU Responsible Person with an EU address
The Responsible Person must be a legal or natural person established within the European Union. Post-Brexit, this excludes the UK. Switzerland is not in the EU. Northern Ireland sits in a complicated dual-status arrangement, but for product placed on the EU market it cannot serve as the RP.
For UK and US founders launching into the EU, the practical move is to appoint a specialist RP service in Ireland, the Netherlands, Germany, or France. Costs typically run €500 to €2,000 per product per year.
The RP carries legal responsibility for compliance. They sign the CPSR, manage cosmetovigilance, and handle communication with the regulator. They are not a postbox. They review.
3. Cosmetic Product Safety Report (CPSR)
The CPSR is the heart of the Product Information File. It is written by a qualified safety assessor and includes the toxicological profile of every ingredient at its in-product concentration, given the product's intended exposure.
The brand does not write the CPSR. The brand commissions it. Costs typically £500 to £2,000 per product depending on complexity.
A CPSR is not portable across formulations. If you reformulate, the CPSR is updated.
4. INCI labelling and allergen disclosure
Ingredient declaration must be in INCI nomenclature, descending by weight, with allergens listed individually above thresholds.
The EU's eighty-allergen list (Regulation EU 2023/1545 amending Annex III) requires individual disclosure of named fragrance allergens above 0.001 per cent for leave-on products and 0.01 per cent for rinse-off products. This took effect in 2026.
Most indie brands sourcing fragrance compounds from a third-party supplier need to ask explicitly for the allergen breakdown. Without it you cannot label correctly. With it, the label runs longer than founders expect. Plan packaging artwork accordingly.
PAO symbol where shelf life is over thirty months. Manufacturer's lot code on every unit.
5. Claims under Regulation 655/2013
The EU's claims regulation sets six common criteria: legal compliance, truthfulness, evidential support, honesty, fairness, and informed decision-making.
In practice this is the rulebook that catches brands out. Claims like "natural", "free from", and "hypoallergenic" each have specific guidance. "Free from parabens" claims, for example, are restricted because they imply parabens are unsafe (a regulatory finding the EU has not made).
Comparative claims are tightly regulated. Before-and-after imagery is permitted but heavily caveated. "Clinically proven" requires a clinical study with the actual product, not just an active ingredient.
Most indie brands do not have the substantiation file the regulation expects. The fix is to write claims that are truthful and supported, then build the substantiation file as part of the PIF.
6. Green Claims Directive readiness
The EU's Green Claims Directive (provisional agreement reached 2024, transposition through 2025-2026) requires environmental claims to be independently verified before use. "Sustainable", "eco-friendly", "carbon neutral", "biodegradable" all need substantiation against a recognised standard.
Most indie beauty brands are not ready for this. Greenwashing has been the default marketing position for the last five years and the directive is the correction. By 2027 most member states will have transposed.
If your brand uses environmental claims as a positioning pillar, plan the verification work into the launch budget. Ecocert COSMOS, Soil Association, ClimatePartner, Provenance, and 1% for the Planet are common verification routes.
7. Animal testing claims
EU Regulation 1223/2009 prohibits testing finished cosmetics on animals (since 2004) and ingredients on animals for cosmetic use (since 2009-2013). Marketing language about cruelty-free is therefore baseline, not differentiating.
Where it gets tricky: if you sell into mainland China through a route that requires animal testing, you cannot make a global cruelty-free claim. The cross-border eCommerce route into China that does not require testing is the only path that preserves the claim. Document which route you use.
8. Annex monitoring as a recurring task
The EU updates the Cosmetic Regulation's annexes roughly every three months. Annex II (banned substances), Annex III (restricted substances), Annex IV (colourants), Annex V (preservatives), and Annex VI (UV filters) all get amendments.
Each amendment can affect a SKU you have notified. The brand has to monitor and update the PIF accordingly. Most indie brands do not have a process for this. The most common failure mode: a launch is compliant in March, an Annex update in June restricts an ingredient at the concentration the product uses, the brand finds out the following March when a retailer's annual due diligence flags it.
The fix is a quarterly Annex review tied to the PIF. We bake this into LaunchOS for any client selling into the EU.
9. Cosmetovigilance and adverse event reporting
The Responsible Person must operate a cosmetovigilance system. Serious undesirable effects must be reported to the competent authority of the member state where they occurred, without delay. Records are retained for ten years.
This means a complaint intake, a triage rule for serious vs non-serious, and a documented escalation path. "Reply to the customer service email" is not a system.
What this means for indie launches
The EU is not "Europe minus the UK". It is its own integrated regulatory market with active enforcement and a forward-leaning posture on green claims, fragrance allergens, and ingredient restrictions. Indie founders who treat compliance as a one-time setup get caught two quarters later when an Annex update or a retailer audit lands.
Inside LaunchOS, EU compliance sits across the Brand Brain (claim substantiation), the Retail and Ops review (PIF, RP, CPSR), and the recurring weekly review (Annex monitoring tied to the brand's actual ingredient list).
If your launch involves the European Union in the next six months, take the Launch Readiness Audit or speak to us. The compliance work is procedural, but the cost of getting it wrong - delayed launch, blocked shipment, retailer rejection - compounds quickly.
This post is not legal advice. For binding regulatory guidance, speak to a qualified EU Responsible Person or cosmetics compliance consultant.