The rules governing cosmetics are frequently described either as non existent, by people who want you to fear the shelf, or as comprehensive, by people who want you to trust it. Both descriptions are wrong in the same way: they treat a specific and quite technical framework as a general attitude. Here is the framework itself.
The instruments that apply
- The retained cosmetics regulation. Regulation (EC) No 1223/2009 as it forms part of UK domestic law, setting the substantive requirements. See the text on legislation.gov.uk.
- The Cosmetic Products Enforcement Regulations 2013. The enforcement layer, creating offences, powers and penalties.
- General product safety law. Providing a safety net where specific rules do not reach.
- Consumer protection law. Covering misleading practices, now including the consumer provisions of the Digital Markets, Competition and Consumers Act 2024.
- Advertising codes. Administered by the ASA, governing what may be claimed.
- Chemicals legislation. UK REACH and related regimes, applying to substances rather than to finished cosmetics.
The obligation set, in order
| Requirement | What it involves | Who holds it |
|---|---|---|
| A responsible person | A named legal entity established in the UK, identified on the label | The brand, importer, distributor or a designated third party |
| Safety assessment | A Cosmetic Product Safety Report signed by a qualified assessor | Commissioned by the responsible person, signed by the assessor |
| Product information file | Composition, safety report, manufacturing method, GMP statement, claim evidence, animal testing data | Held by the responsible person at the label address |
| Good manufacturing practice | Manufacture under a documented quality system, typically to the harmonised standard | The manufacturing site |
| Substance compliance | No prohibited substances, restricted substances within limits, permitted colourants, preservatives and UV filters only | Formulation, checked in the safety assessment |
| Labelling | Responsible person, quantity, durability, precautions, batch, function, ingredient list | The responsible person |
| Notification | Submission of required product information before placing on the market | The responsible person |
| Claims compliance | Common criteria for cosmetic claims, plus advertising law | The responsible person and the advertiser |
The annexes, which are the real substance
Most of the practical content of cosmetic regulation lives in its annexes, which are lists. There is a list of substances prohibited in cosmetic products. A list of substances subject to restriction, with maximum concentrations and conditions of use. A list of permitted colourants. A list of permitted preservatives. A list of permitted ultraviolet filters.
These lists are the reason a formulator's options are narrower than the chemistry allows, and they are updated as scientific opinion develops. Scientific advice at European level comes from the Scientific Committee on Consumer Safety, and UK decisions are informed by their own scientific advisory processes. When a substance is restricted or banned, existing products have to be reformulated or withdrawn on a defined timetable.
Approved by regulators
Very little, in the cosmetic context. There is no approval or authorisation step for a cosmetic product before sale. Compliance is self declared: the responsible person ensures requirements are met, holds the file and notifies the product.
Specific substances such as colourants, preservatives and UV filters are permitted by being listed in the annexes, which is where the word approved has a real referent.
It does not mean a regulator examined the product. It does not mean anyone outside the business read the safety assessment. It does not mean the product was tested by an authority. There is no cosmetic licence, no marketing authorisation and no pre market approval, and notification is a submission of information rather than an approval.
The accurate statement is that the product has been notified and complies with the applicable requirements, which is what every legally sold cosmetic can say. Where a specific ingredient is listed in an annex, the brand can accurately say that the substance is permitted for that use at that level, which is a real and checkable statement.
Notification, and what it is not
Before a cosmetic is placed on the UK market, information about it must be submitted, including the category and name of the product, the responsible person's details, the country of origin for imports, the frame formulation and information required for poison centre response, and details of substances present in nanomaterial form or classified as carcinogenic, mutagenic or toxic for reproduction where permitted by derogation. Guidance on the process is published at GOV.UK.
Notification is a submission, not a permission. Nobody assesses it before the product goes on sale. Its function is to make information available to authorities and to poison centres, and it creates a record against which enforcement can work.
Labelling, in one paragraph
The label must carry the name and address of the responsible person, the nominal content at the time of packaging, the date of minimum durability or the period after opening symbol, particular precautions for use, the batch number or identifying reference, the function of the product where not clear from presentation, and the list of ingredients using international nomenclature in descending order of weight down to one per cent. How to read all of that is set out in how to read a cosmetic label in order.
Self declaration, and who it suits
A notification regime is cheaper and faster than an approval regime for everybody: for businesses placing products, and for a state that would otherwise have to assess many thousands of products a year. It puts the assessment burden on the party with the information, which is sensible, and it makes enforcement reactive, which is the trade off.
The people it suits least are consumers trying to distinguish a rigorously compliant product from a nominally compliant one, because both look identical on a shelf and neither carries a mark indicating which it is.
- Established businesses. Get speed to market and proportionate cost for a well run compliance function
- Nominal compliers. Face little pre market friction, and are caught only when something surfaces
- Enforcement bodies. Work reactively with finite resource across an enormous product population
- Consumers. Cannot see the difference between the first two groups at the point of purchase
A description of the trade offs in a notification based regime, which is the model used across most of the world for cosmetics.
What the regulation does not do
- It does not assess efficacy. A cosmetic need not work to be legal.
- It does not approve products. There is no pre market authorisation.
- It does not require disclosure of concentrations. Only order down to one per cent.
- It does not name the manufacturer. Only the responsible person.
- It does not govern advertising in detail. That is the advertising codes and consumer protection law.
- It does not reach every seller equally. Direct overseas selling is the hardest area to enforce.
Using this as a reader
The practical value of knowing the framework is that it tells you which claims are meaningless because they describe compliance, and which questions have real answers. Safety tested, approved and GMP made are all descriptions of the floor. Who the responsible person is, whether an ingredient is within its permitted use, and whether a claim has published substantiation are all questions with answers.
It also tells you where to go when something is wrong, which is the most useful thing regulation gives an individual. The routes are set out in what happens when a cosmetic is recalled.