Launching a private label beauty brand sounds simple: choose a formula, add your logo, and start selling. But compliance is where many founders get caught out. The biggest misconception is that the manufacturer handles everything. In reality, if your brand name appears on the packaging, regulators expect you to ensure the product is safe, documented, and legally compliant.
That means understanding CPSR for private-label cosmetic requirements, your responsibilities under EU private-label cosmetics compliance rules, and what your supplier must provide. Whether you work with a contract manufacturer, source white label products, or develop an OEM formulation, compliance obligations sit with the brand owner.
In this guide, you will learn:
- Who legally owns the CPSR and why access matters
- What your contract manufacturer must provide
- How the CPSR, PIF, Responsible Person, and CPNP fit together
- When a new CPSR is required for variations or formula changes
- Common mistakes that put private label brands at risk
What is CPSR for Private Label Cosmetics?
What Is a CPSR?
A Cosmetic Product Safety Report (CPSR) is a legally required document proving your product is safe for human use before sale. Without one, your product cannot legally be sold in the EU or UK. It contains two parts:
- Part A Safety Information: Formula data, ingredient concentrations, raw material specs, stability results, and microbiological data
- Part B Safety Assessment: A qualified toxicologist’s conclusion that the product is safe as formulated and intended
Both parts are required. Part A alone is not a valid safety report.
Why Private Label Brands Need One
The moment your brand name appears on the packaging, EU and UK law hold you responsible for that product’s safety. This means:
- You need a CPSR covering the exact formula sold under your brand
- The CPSR must be accessible to you, not held solely by the manufacturer
- Regulatory authorities can request it at any time
The Legal Basis
The requirement comes from EU Regulation 1223/2009, Articles 10 and 11. The UK retained this post-Brexit under the UK Cosmetics Regulation.
Who Owns the CPSR in a Private Label Cosmetics Business?
The Manufacturer’s Role
Your contract manufacturer typically holds the original formula data and may commission a CPSR for their base formulation. However, that CPSR is written for their version of the product. Once it carries your brand name, you are the legally responsible entity.
The Brand Owner’s Responsibilities
As the brand owner, you are almost certainly the Responsible Person (RP), the legal entity named on EU or UK product notifications. As RP, you must:
- Ensure a valid CPSR exists for every product you sell
- Hold or have access to the complete Product Information File (PIF)
- Keep documentation for at least 10 years after the last batch is sold
- Respond to market surveillance authority requests
The RP must be physically based in the EU or UK. If your business is registered outside these markets, appoint a specialist RP service provider in the relevant jurisdiction.
Why Having Access to the CPSR Matters
Some suppliers confirm a CPSR exists without providing a copy. If an authority requests your documentation, “my supplier has it” is not acceptable. Before purchasing any white label or OEM product, ask in writing:
- Can I receive a copy of the CPSR for this exact formulation?
- Is it valid for the formula I am buying, not a different version?
- Will it be updated if the formula changes?
If the supplier refuses or is evasive, treat that as a serious red flag.
Understanding the CPSR Process for Private Label Cosmetic Compliance EU
| Step | What Happens |
| 1. Formula Review | The assessor receives the full quantitative formula from the manufacturer |
| 2. Safety Assessment | Toxicologist reviews ingredients against EU Annexes and SCCS guidelines |
| 3. PIF Assembly | CPSR combined with product description, labelling, and claims evidence |
| 4. CPNP Notification | RP submits to the EU portal before the first sale |
| 5. SCPN (UK only) | Separate UK notification if selling in the UK market |
If you are based outside the EU or UK, appoint your RP service provider before starting this process. Their name and address must appear on the product label.
What Information Must a Contract Manufacturer Provide?
Before placing an order, request all of the following in writing.
Full Ingredient Composition
The complete INCI formula with exact percentage concentrations. A safety assessor cannot complete Part A without this.
Raw Material Specifications
- Safety Data Sheets (SDS) or Technical Data Sheets (TDS)
- Certificate of Analysis (CoA) from each raw material supplier
- Purity and contaminant data were relevant
Stability and Compatibility Data
Accelerated stability test results covering the intended shelf life. Challenge testing is also required for water-containing formulations.
Microbiological Testing Results
Preservative efficacy (challenge) test results confirming the product meets the microbiological standards in EU Regulation 1223/2009, Annex I.
Questions to Ask Your Private Label Manufacturer Before You Launch
Most brand owners focus on MOQs, pricing, and lead times. Compliance capability is just as important, and far more costly to fix later.
Can You Share the Full Quantitative Formula?
Without it, you cannot independently commission a valid CPSR. A non-disclosure agreement is a reasonable compromise; a flat refusal means you are entirely dependent on their compliance arrangements with no ability to verify them.
Will You Provide Stability and Microbiological Test Data?
Ask for the actual reports, not just confirmation that testing was done.
Who Pays for CPSR Updates?
If the manufacturer changes a preservative or a raw material source, your CPSR may need to be revised. Clarify upfront who commissions and funds updates, and whether you will be notified before changes are made.
What Is Your Formula Change Notification Process?
A responsible supplier has a documented procedure for alerting brand owner clients before reformulations occur. No clear answer is itself a warning sign.
White Label Cosmetics Compliance: Common Misunderstandings
My Supplier Handles Everything: Your supplier’s CPSR covers their product, not yours. Unless your brand is the named entity in that document, it does not fulfil your legal obligation.
One CPSR Covers Every Product: One CPSR covers one formulation. Ten products generally mean ten CPSRs. Limited exceptions exist for size variants of the same formula.
Changing the Label Doesn’t Affect Compliance: Changing intended use, for example, repositioning a body lotion as a face cream, changes the exposure assumptions and may invalidate the existing safety assessment.
Natural Products Don’t Need a CPSR: Natural, organic, and plant-based products face the same legal requirements as conventional cosmetics, and some natural ingredients require closer scrutiny, not less.
OEM Cosmetics CPSR EU Requirements
OEM vs Private Label: What’s the Difference?
| Term | Meaning |
| Private Label | Your brand applied to an existing ready-made formula |
| OEM | You commission a manufacturer to produce a formula to your specification |
In both cases, you are the brand owner and the Responsible Person. The compliance obligations are identical.
How Formula Ownership Affects Compliance
If you commissioned a bespoke formula, you likely own it outright, meaning you control changes, commission the CPSR directly, and hold the PIF independently.
If you are buying an existing white label formula, the manufacturer controls it. Any changes they make could affect your CPSR without your knowledge. Supply agreements should contractually require notification of any formula changes before implementation.
What Is Included in a Cosmetic Product Safety Report?
Part A Safety Information
- Qualitative and quantitative formulas
- Physical and chemical characteristics
- Microbiological quality data
- Impurities, traces, and packaging information
- Normal and reasonably foreseeable use
- Toxicological profiles of substances
- Undesirable effects data
Part B Safety Assessment
The assessor’s signed conclusion must:
- Confirm the product is safe under normal and foreseeable conditions
- Reference all Part A data
- Include any required warnings or conditions of use
Who Can Sign a CPSR?
Under EU Regulation 1223/2009, Article 10(2), the signatory must hold a degree in pharmacy, toxicology, medicine, or a related discipline. Always verify qualifications before commissioning
Can One CPSR Cover Multiple Private Label Products?
Different sizes: Yes, an identical formula in different container sizes is covered by one CPSR.
Different fragrances: No, different fragrance blends change the ingredient profile. Allergen limits under Annex III apply at the finished-product level, so each scent variant typically requires its own CPSR.
Different shades: Colour cosmetics can sometimes use a “may contain” approach for colourants, covering multiple shades under one CPSR, provided the base formula is identical and each colourant is assessed. Confirm with your assessor before assuming this applies.
Formula changes: Any ingredient addition, removal, concentration change, or preservative swap requires a new CPSR or formal amendment. No exceptions.
CPSR, PIF and CPNP: Understanding the Difference
| Document | What It Is |
| CPSR | The safety assessment proves the product is safe |
| PIF | The full compliance dossier containing the CPSR plus labelling, manufacturing info, and claims evidence |
| CPNP | The EU online portal where the RP notifies products before sale |
All three are required. Having a valid CPSR does not automatically complete your CPNP notification, and the PIF must be kept for 10 years and producible to authorities on request.
Common Compliance Mistakes Private Label Cosmetic Brands Make
- Relying entirely on suppliers: Supplier compliance covers the supplier, not you. Always obtain documentation in writing.
- Selling before notification: CPNP notification must be completed before the first product reaches the market, regardless of whether the CPSR is in place.
- Missing Responsible Person details on labels: Absent or incorrect RP information is one of the most commonly cited non-conformities in market surveillance inspections.
- Using unsupported claims: “Clinically tested,” “hypoallergenic,” and “SPF 30” all require documented substantiation. This is a separate requirement under EU Regulation 655/2013 and is not covered by the CPSR.
CPSR Rejection Reasons: Why Your Cosmetic Safety Report Gets Refused
What Happens If Your Manufacturer Changes the Formula?
This is one of the most common real-world compliance problems in private label cosmetics, and one of the least discussed. Manufacturers change formulas more often than brand owners realise, including when:
- A raw material supplier discontinues an ingredient
- A preservative is restricted under the updated EU Annexes
- A fragrance component is reclassified as an allergen
- The manufacturer sources a cheaper alternative
When a CPSR Review Is Required
- Adding or removing any ingredient → new assessment required
- Changing a concentration → new assessment required
- Changing a raw material source → assessor review to confirm equivalence
- Swapping the preservative system → full reassessment likely required
PIF Update and Re-Notification
If the CPSR is revised, the PIF must be updated. Depending on the change, re-notification on the CPNP may also be required; confirm with your RP or assessor before assuming it is not.
Protecting Yourself Contractually
Your supply agreement should include:
- Written notification before any formula change is made
- A minimum 30–60-day notice period
- An obligation for the manufacturer to provide updated technical documentation at their cost
- Your right to approve changes before implementation
Without these protections, your product could be reformulated without your knowledge, leaving your CPSR invalid and your product non-compliant on the market.
How Much Does a CPSR Cost for Private Label Cosmetics?
| Scenario | Approximate Cost |
| Simple formula, all data provided | £200 – £400 |
| Standard formulation, some data gaps | £400 – £700 |
| Complex formula (actives, novel compounds) | £700 – £1,500+ |
| Additional variants under one CPSR | £50 – £150 per variant |
Costs increase with missing raw material data, regulated actives, SPF claims, rush requests, or dual EU and UK assessment. A cheap CPSR from an unqualified assessor is not legally valid.
How Long Does the CPSR Process Take?
| Stage | Timeframe |
| Information gathering from the manufacturer | 1 – 3 weeks |
| Safety assessor review (Part A) | 1 – 2 weeks |
| Part B assessment and sign-off | 1 – 2 weeks |
| PIF compilation | 3 – 5 days |
| CPNP notification | 1 – 3 days |
Realistic total: 4 – 8 weeks. The most common delays are missing formula data, outdated SDS documents, incomplete stability data, and supplier response times. Do not order packaging print runs before your CPSR process is underway.
Final Checklist for Private Label Cosmetic Compliance EU
CPSR completed, qualified assessor, exact formula being sold
PIF prepared, CPSR, product description, labelling, manufacturing info, claims evidence
Responsible Person appointed, EU or UK legal entity, details on the label
Labels reviewed, INCI list, RP details, batch code, PAO or expiry, warnings
CPNP notification completed (EU), before first sale
SCPN notification completed (UK), if selling in the UK market
Claims substantiation on file
Supplier documentation secured, formula, specs, stability, microbiological results
Market surveillance readiness, PIF producible within 3 days if requested
Formula change protocol in the supply contract
Frequently Asked Questions
What is CPSR for cosmetics?
A mandatory safety document under EU Regulation 1223/2009 and equivalent UK law. Part A covers formula safety information; Part B is a qualified toxicologist’s conclusion that the product is safe for its intended use.
How much does a CPSR cost?
Between £200 and £700 for most standard private-label products, with data supplied. Complex formulations with regulated actives or SPF claims can reach £1,500 or more.
How long does it take to get a CPSR?
Typically 4 to 8 weeks end-to-end. The process moves faster when the manufacturer provides complete formula and testing data upfront.
Is Kylie Cosmetics a private label?
Early Kylie Cosmetics products were widely reported to have been produced by third-party contract manufacturers. Regardless of the manufacturing model, the brand owner carries Responsible Person obligations in the EU and UK, including ensuring a valid CPSR exists for each product.
Does every private label cosmetic need its own CPSR?
Generally yes, one per formulation. Size variants of an identical formula are the main exception. Different fragrances, active concentrations, or intended uses each require a separate assessment.
Who is legally responsible for a private label cosmetic in the EU?
The Responsible Person, almost always the brand owner. Non-EU brands must appoint an EU-based RP service. RP details must appear on the product label.
What happens if a cosmetic is sold without a CPSR?
Product withdrawal, fines, marketplace delistings (Amazon and others actively enforce this), and potential criminal liability. EU market surveillance enforcement has increased significantly, including on cross-border e-commerce.
Do I need a new CPSR if my manufacturer changes the formula?
Any change to ingredients, concentrations, raw material sources, or the preservative system alters the product’s toxicological profile. The existing CPSR is no longer valid for the reformulated product. Supply contracts should require manufacturers to notify you before making any changes.
