/
A formula built from allowed ingredients is where cosmetic development starts, not where it ends. A brand checks every INCI name against the prohibited list, finds nothing in Annex II, keeps each restricted substance under its limit, and concludes that the product can go on sale. The Regulation does not follow that logic, and it says so itself: Article 14(1), the provision that bans the listed substances, opens with the words «without prejudice to Article 3», the requirement that the product as a whole be safe. After almost twenty years assessing the safety and conformity of cosmetics and food supplements, this is an assumption we meet often, and it is costly when it surfaces late.
What allowed ingredients means in Regulation (EC) No 1223/2009
Article 14(1) draws the line in five places. A cosmetic product may not contain substances listed in Annex II, restricted substances in Annex III that are not used within their restrictions, or colourants, preservatives and UV filters other than those listed in Annexes IV, V and VI, nor listed ones used outside the conditions of those annexes. The logic differs by annex. Annex II is a negative list: what is not on it is not banned on that ground. Annexes IV, V and VI are positive lists: a colourant, preservative or UV filter that is not on the relevant list cannot be used in that function. Article 15 adds its own rules for substances classified as carcinogenic, mutagenic or toxic for reproduction.
These lists move. Regulation (EU) 2026/909, adopted in April 2026, amended the rules on the use of several substances, and we cover it separately in our article on the 2026/909 amendment (in Spanish). The point of this article is different: even a formula that matches today’s lists exactly is only the input to the product.
The test is the finished product, not the ingredient list
Article 3 states that cosmetic products made available on the market must be safe for human health under normal or reasonably foreseeable conditions of use, taking into account in particular the presentation, the labelling, the instructions for use and disposal, and any other indication given by the responsible person. Every item on that list describes the product as sold and used, not its raw materials. The last sentence closes a common shortcut: the presence of warnings does not exempt the operators concerned from the other obligations of the Regulation.
So the question is not whether each ingredient is allowed, but whether these allowed ingredients, in this pack, used this way, add up to a safe product. Four things separate the two questions. The first is exposure. Annex I asks for the place and area of application, the amount applied, the duration and frequency of use, the routes of exposure and the target population, and calculates the margin of safety on the NOAEL, with any omission duly justified. Article 10(1)(a) speaks of the anticipated systemic exposure to the individual ingredients of the final formulation. The same substance at the same percentage is not the same exposure in a leave-on face cream and a rinse-off shampoo.
The second is interaction and impurities. Annex I directs attention to the impurities of the substances and raw materials used and to the interaction of the substances, and Article 17 tolerates trace amounts of a prohibited substance only if technically unavoidable in good manufacturing practice and compatible with Article 3. The third is stability and microbiological quality: the report covers stability under reasonably foreseeable storage conditions and the results of the preservative efficacy test. A preservative from Annex V used within its conditions does not show that this product resists contamination; the test does. The fourth is the packaging, whose relevant characteristics, in particular purity and stability, belong to the same assessment.
The safety assessment turns a formula into a product
Article 10(1) requires, before a cosmetic product is placed on the market, a safety assessment based on the relevant information and a cosmetic product safety report drawn up under Annex I. Part A collects the data described above. Part B is the assessor’s conclusion, with the reasoning, the statement on the warnings and instructions the label must carry, and due account of how stability affects safety. It has to be carried out by a person with a university qualification in pharmacy, toxicology, medicine or a similar discipline, or studies recognised as equivalent by a Member State (Article 10(2)), and it carries the assessor’s name, proof of qualification, date and signature. At ASC that step is carried out and signed by a qualified safety assessor. The structure of the report is explained in our guide to the cosmetic product safety report.
Nor does the report end at launch: Article 10(1)(c) requires it to be updated with relevant information generated after the product reaches the market.
Made under good manufacturing practice
Article 8 requires cosmetic products to be manufactured in line with good manufacturing practice (GMP), and presumes conformity when manufacture follows the relevant harmonised standards published in the Official Journal. The Commission lists EN ISO 22716 among the harmonised standards under the Regulation. Its scope is production, control, storage and shipment, and it expressly excludes research and development and the distribution of the finished product. Development work on the formula therefore sits outside the standard, which starts at production. The product information file must contain a description of the manufacturing method and a declaration of conformity with GMP (Article 11(2)(c)). If a contract manufacturer makes the product, ask how it applies the standard: ISO 22716 has a chapter on subcontracting.
Labelled and notified before it is sold
Article 19(1) lists what must appear on the container and packaging, among others: the name and address of the responsible person, with the country of origin for imported products; the nominal content; the batch number; the function; the list of ingredients; and the precautions for use, at least those set out in Annexes III to VI. Two items depend directly on the safety assessment. The date of minimum durability is the date until which the product, stored under suitable conditions, keeps fulfilling its initial function and complying with Article 3, so it has to be consistent with the stability data in the report; and Part B of the report states which warnings the label needs. Under Article 19(5), the language of several of these mentions is set by the law of each Member State where the product is made available to the end user.
Notification is the last gate. Under Article 13, before the product is placed on the market, the responsible person submits electronically to the Commission, in practice through the Cosmetic Products Notification Portal, the product category and name, the name and address of the responsible person, the country of origin for imports, the Member State of introduction, a contact person, the presence of nanomaterials, any CMR substances of categories 1A or 1B, and a framework formulation for prompt medical treatment. Those data should be consistent with what the file and the label say.
Someone in the Union has to answer for it
Article 4(1) allows only products for which a natural or legal person within the Union is designated as responsible person. For an imported product the importer holds that role, and may designate by written mandate another person established in the Union who accepts it in writing (Article 4(5)). Article 5(1) makes the responsible person answerable for compliance with, among others, Articles 3, 8, 10, 11 and 13, and Article 11(1) requires the product information file to be kept for ten years after the last batch was placed on the market. What the role involves in practice is covered in our guide to the responsible person.
A working order before you call the formula finished
Once the formula meets the annexes, settle the intended use and target population; confirm the packaging the product will be filled in; obtain stability and preservative efficacy results for the product in that packaging; have a qualified assessor complete Parts A and B; check that the manufacturer works to GMP; write the label from the assessor’s warnings and the stability data; and appoint the responsible person before notifying.
Questions we are asked
If my formula only uses allowed ingredients, do I still need a safety report?
Yes. Article 10(1) applies to every cosmetic product before it is placed on the market. The composition of the formula does not create an exemption.
Can a warning on the label cover a doubtful formula?
No. The last sentence of Article 3 says that the presence of warnings does not exempt the operators concerned from the remaining obligations.
Can I rely on my supplier’s safety data instead of an assessment?
Supplier data are an input, not a substitute. Annex I requires the toxicological profile of each substance, with the source clearly stated, and Article 10(1)(b) requires a weight-of-evidence approach across all existing sources, in the safety assessment of the product.
If your formula is settled and the rest of the file is not, write to us through our contact page and tell us the product, the pack and the markets you plan to sell in. If what you still need is the formula itself, our cosmetic formulation service covers that step only: the safety report, the label and the notification are separate services.