noticias archivos - ASC Services

ISO 22716 audits: the points cosmetic companies fail most often

Posted on octubre 9, 2026 by adminarya

An ISO 22716 audit often starts in the document room: the auditor has been there for two hours and has not yet set foot on the production floor. That is the usual shape of it. Findings rarely come from the machinery or the formula. They come from whether your records can show, with signed and traceable evidence, that what the procedure says is what actually happens. After almost twenty years assessing the safety and conformity of cosmetics, we keep seeing the same few clauses behind the major findings.

EN ISO 22716:2007 is the good manufacturing practice (GMP) guideline for cosmetics, and in practice it is not optional reading. Regulation (EC) No 1223/2009 requires in Article 8(1) that cosmetic products are manufactured in accordance with good manufacturing practice. Article 8(2) presumes conformity when manufacture follows the relevant harmonised standards whose references are published in the Official Journal, and the European Commission lists EN ISO 22716:2007 among the harmonised standards for cosmetics.

Three other provisions explain why someone will ask you for evidence. The Responsible Person has to ensure compliance with Article 8 (Article 5(1); see who can act as Responsible Person). The Product Information File must contain a description of the manufacturing method and a declaration of conformity with good manufacturing practice (Article 11(2)(c)), alongside the Cosmetic Product Safety Report and, where the product justifies it, the evidence for the claimed effect. And under Article 22, Member States also supervise compliance with the principles of good manufacturing practice.

What an ISO 22716 audit really covers

The standard has seventeen clauses. Clause 1 sets the scope and clause 2 the definitions, so the auditable content runs from clause 3 (personnel) to clause 17 (documentation): fifteen clauses in all. The text is guidance, written with “should”, so the auditor judges whether your system meets the intent of each clause and whether you can prove it. Note the boundaries: it covers production, control, storage and shipment, and clause 1 excludes research and development and the distribution of the finished product.

Not every clause weighs the same in a real ISO 22716 audit. In our experience, formulation and analysis are rarely where a company fails. Findings pile up where the system must prove that control exists: training, subcontractors, deviations and the procedure version on the wall.

The clauses that fail most often

Personnel (clause 3). The standard asks you to identify the training needs of all staff, whatever their level or seniority, and to run a programme that covers them (3.4.2.2). New starters need GMP training plus training in their own tasks (3.4.3), and knowledge should be assessed during or after training (3.4.4). The auditor then asks for evidence: date, content, attendees. The second problem is the organisation chart (3.2.1), which should show that the quality units are independent of the rest of the plant (3.2.1.3). If a procedure is signed by a manager who left the company two years ago, or the chart does not match who really approves documents, the finding writes itself.

Subcontracting (clause 12). Clause 12.1 calls for a written, controlled contract or agreement between the contract giver and the contract acceptor. The list of subcontracted activities in 12.2 is wider than most companies expect: manufacturing, packing and analysis, but also cleaning and disinfection of premises, pest control, and equipment and premises maintenance. The contract giver should assess the subcontractor’s competence and capacity, including its ability to follow the guideline (12.3.1), and for contracted operations both sides should agree how complaints are handled (14.1.3). Operators who come to us after a request from an authority or a customer almost always have the commercial contract. What they lack is the technical assessment.

Deviations (clause 13) and out-of-specification products (clause 10). Having deviations is normal. The gap is in how they are handled. Clause 13.1 says deviations from specified requirements should be authorised on the basis of sufficient data, and 13.2 asks for corrective action to prevent recurrence. For rejected or out-of-specification material, quality personnel should approve the decision to destroy or to reprocess (10.1.2), the reprocessing method should be defined and approved (10.2.2), and the reprocessed product should be checked against the acceptance criteria (10.2.3). A deviation with no documented decision and no closure reads as an unresolved quality problem.

Documentation (clause 17). In our experience this is the most repeated finding. Clause 17.3.3 asks that documents are approved, signed and dated by authorised staff before use, are referenced so that obsolete documents are not used, and are withdrawn from the work area when they are no longer current. Revisions carry a revision number and the reason for the change is recorded (17.4). Handwritten records should be legible, in permanent ink, signed and dated, and corrected without hiding the original entry, with the reason where appropriate (17.3.4). A 2019 procedure still pinned up in the packing room while the current edition dates from 2025 is among the easiest findings to make and the hardest to defend.

Three more clauses that are easy to overlook

Calibration (5.4): instruments that matter for product quality are calibrated periodically, and if a result falls outside the acceptance criteria the instrument is identified and withdrawn, and you investigate the impact on product quality. Change control (clause 15): changes that could affect quality are approved and carried out by authorised personnel on the basis of sufficient data, for example when you bring in a new supplier or replace equipment. Internal audit (clause 16): it should be run by competent, designated and independent staff, regularly or on request, with the observations evaluated and shared with the people responsible, and a follow-up that confirms the corrective action is really implemented (16.3).

Why these failures stay hidden until audit day

The question to ask is not “do we have the procedures?” but “can we show, with a dated and signed record, that they were followed the last time they applied?” Most documentary systems are designed well and then deteriorate: a person changes role, a machine is replaced, a supplier is swapped, and the record is not updated. The problem is rarely a missing procedure. It is the lack of a mechanism that forces periodic review.

Checklist before an ISO 22716 audit

Whether the audit is internal, from a customer or for certification, review these points in the order an auditor will take them:

A way to show which edition of each procedure is current, checked against what is physically at the workstation.
Training records for the last twelve months, with date, specific content and the attendee’s signature, plus a check that the knowledge was assessed.
Written contracts and a technical assessment for every subcontractor, including cleaning, pest control and maintenance providers.
Deviation and out-of-specification records, open and closed, each with the authorising decision, its supporting data and the corrective action.
Calibration certificates for quality-relevant instruments, available on the day, with the action taken for any out-of-criteria result.
An organisation chart that matches the people who actually sign the live procedures.
The last internal audit report and the evidence that its corrective actions were closed.

None of this needs new equipment. It is documentary discipline, but reviewing it with an external auditor’s depth takes time that a team busy with daily production rarely has.

If you already have an open non-conformity

An authority or a customer is not worried that a non-conformity exists. What worries them is a company that cannot correct it with a specific action and a date. The standard frames it the same way: corrective action should prevent recurrence (13.2) and the follow-up should confirm it was implemented (16.3). In our experience, the findings that close at the next review are those whose correction changes the procedure, the record or the control, not only the single instance. So do not start by rewriting the quality manual: close each finding with the evidence the report asks for.

Frequently asked questions

Is ISO 22716 certification mandatory?

The Regulation does not require a certificate. It requires that manufacture follows good manufacturing practice (Article 8), and following the harmonised standard gives a presumption of conformity.

How often should the system be audited?

The standard sets no interval: internal audits should be carried out regularly or on request (16.2.1). If you are certified, the cycle depends on the scheme of the certification body.

My contract manufacturer is not certified. Is that a problem?

The responsibility does not go away. Under clause 12.3.1 the contract giver should evaluate the subcontractor’s competence and its ability to follow the guideline, certificate or not, and keep the evidence of that assessment.

I import finished cosmetics and do not manufacture them. Does this concern me?

Article 8 concerns manufacture, but as Responsible Person you must ensure compliance with it (Article 5(1)) and the Product Information File must hold a declaration of conformity with good manufacturing practice (Article 11(2)(c)). That declaration is only as good as its evidence: in practice a certificate or audit report of the manufacturing site, or your own audit of it.

If you manufacture cosmetics, or commission their manufacture, and your quality system has not been audited in the last year, the risk is real. At ASC Services we can review your quality system against the standard. See the ISO 22716 implementation scope on our cosmetics services page, and to know where your system stands before someone else audits it, write to us through the contact page.

Safety Gate Notification: What a RAPEX Alert Means for Your Product

Posted on octubre 7, 2026 by adminarya

A Safety Gate notification rarely arrives as a warning. In our experience, it shows up as a removed marketplace listing, a customs hold, or an email from a market surveillance authority asking what you intend to do about a product you already sold. By the time that email lands, a Member State has already decided your product is dangerous and told every other Member State about it — and the response deadlines described below have already started running.

From RAPEX to Safety Gate: the same system, a new name

Safety Gate is not a new tool. It is the renamed, modernised version of RAPEX, the EU’s rapid alert system for dangerous non-food products that ran for over two decades under Directive 2001/95/EC. Regulation (EU) 2023/988 on general product safety (GPSR), which has applied since 13 December 2024, kept the mechanism and gave it a name consumers can recognise. The system now has three connected parts: the internal Rapid Alert System «Safety Gate», through which national authorities and the Commission exchange information on corrective measures; the public Safety Gate portal, where an extract of each alert is published for consumers; and the Safety Business Gateway, the channel through which an economic operator reports a dangerous product on its own initiative, at the Safety Business Gateway portal.

What makes a product qualify for a Safety Gate notification

Not every defect reaches Safety Gate. The GPSR defines a serious risk as one that, based on a risk assessment and the normal or foreseeable use of the product, is judged to require rapid intervention by market surveillance authorities — including cases where the risk has no immediate effect. A product that fails that test is, by definition, a «dangerous product»: anything that is not a «safe product», meaning it does not stay within minimal, acceptable risks under normal or reasonably foreseeable conditions of use, including realistic duration. The distinction matters in practice: a labelling gap or a missing instruction leaflet is a compliance problem you can usually fix quietly. A choking hazard, a thermal risk or a chemical that migrates beyond a safe margin is a different category, and it is the one Safety Gate exists for.

The four-business-day clock you do not control

Once a national authority adopts a corrective measure on a product presenting a serious risk, it must notify it through the Safety Gate rapid alert system without delay and, in any case, within four working days of adopting that measure. The Commission then has a further four working days to check the notification and pass it on to the other Member States. In other words, the decision that your product is dangerous is usually made, validated and shared across the Union before you have had a real chance to respond to the authority that raised it. If you only find out once the product appears in the public Safety Gate database, you have already lost the time you would have wanted to prepare your reply.

What a Safety Gate notification requires from you, immediately

The obligation does not wait for the authority to tell you what to do. Under Article 9(8) of the GPSR, a manufacturer who considers, or has reason to believe, that a product already placed on the market is dangerous must immediately take the necessary corrective action — including withdrawal or recall — inform the affected consumers, and inform the market surveillance authorities of every Member State where the product was marketed, through the Safety Business Gateway. Article 11(8) places four duties on the importer: inform the manufacturer, ensure the necessary corrective action is taken, ensure the affected consumers are informed, and inform the market surveillance authorities of every Member State where the product was marketed. Only the corrective-action duty is conditional on the manufacturer not having already acted — informing the manufacturer, ensuring consumers are informed and informing the authorities through the Safety Business Gateway are the importer’s own obligations regardless of what the manufacturer has done. For a company that imports finished goods without a manufacturing presence in the EU, this means the obligation lands on the importer by default, not as a fallback.

The recall notice is not a form letter

When consumers must be told in writing, Article 36 of the GPSR sets out exactly what the recall notice has to contain: a title that clearly identifies it as a product safety recall, a clear description of the product with its image, name and batch or serial numbers, a clear description of the hazard, and a clear description of what the consumer must do, starting with stopping use of the product immediately. The regulation is explicit about what cannot appear in that description: language that softens the consumer’s perception of risk, such as «voluntary», «as a precaution», «at your discretion», «in rare situations» or a statement that no accident has been reported. A notice that reads like routine customer service copy, rather than a safety recall, fails the standard before anyone reads past the headline.

What you owe the consumer: repair, replacement or refund

A recall is not resolved by withdrawing stock from shelves. Article 37 requires the economic operator responsible for the recall to offer the consumer an effective, free and timely remedy, giving them a choice between at least two of three options: repair, replacement with a safe product of equivalent value, or an adequate refund. The consumer never bears the shipping cost either way, and if the chosen remedy is not delivered within a reasonable time and without major inconvenience, the right to a refund applies regardless. A single remedy is only acceptable when the others are genuinely impossible or disproportionately costly — not simply more convenient for the operator.

How we solve it

We do not stop at confirming that a product has been notified. When a Safety Gate case lands on a client’s desk, we build the file the regulation actually demands: the internal risk assessment and corrective action record under Article 9(8) or 11(8), a recall notice drafted to the Article 36 checklist, the Safety Business Gateway filing to every Member State authority involved, and the remedy plan the consumer is legally owed under Article 37. A qualified technician reviews and signs the response: if an authority follows up, we answer for the file, not a disclaimer that leaves the exposure with you. The same team also handles the conformity work that keeps a product off Safety Gate in the first place — our product conformity review for the EU market and, when the shipment itself is the problem, our customs documentation management service. If the GPSR side of your file — the EU responsible person, the technical documentation, the traceability — is still unresolved, that is the starting point: see our guide to GPSR for importers selling in the EU.

Frequently asked questions

Does a Safety Gate notification only apply to products carrying CE marking?

No. The GPSR covers any product supplied to, or reasonably foreseeable to be used by, consumers, whether or not it carries CE marking or falls under separate harmonised legislation. A kitchen gadget, a toy accessory or a private-label electronic item with no CE requirement at all can still be notified through Safety Gate if it presents a serious risk. Our GPSR guide for importers covers who counts as the responsible party when the product has no CE marking to begin with.

Can I check whether my product has already been notified?

Yes. The Commission publishes an extract of every alert on the public Safety Gate portal, searchable by product category, risk type and notifying country, specifically so consumers and businesses can check before a complaint or a customs hold brings the news. If your product also got held at the border on its way in, our article on releasing goods retained at customs covers the parallel process you may be facing at the same time.

Treating the Safety Business Gateway filing, the recall notice and the consumer remedy as one coordinated file, rather than three separate fires handled by three different people, is what separates a fast recovery from a drawn-out one. If your product has been notified, or you want the corrective-action file built before an authority asks for it, contact our team and tell us which Member State raised the case.

Food supplement formulas: what makes a formula legal in the EU before you manufacture

Posted on octubre 1, 2026 by adminarya

A food supplement formula is legal in the EU or it is not, and the answer has nothing to do with how well the product sells elsewhere. It depends on what is in the capsule: each ingredient, in the form you use, at the amount you use, in this category of food. The cheapest moment to find out is before you order raw materials from a contract manufacturer; the most expensive is after the first production run, with the labels printed and the pallets waiting.

No authority approves your formula before you launch, so the check is yours. In our experience a food supplement formula fails for a short list of reasons: a vitamin salt that is not on the list, a restricted plant extract, a novel food, or an additive that is not permitted in supplements. Our guide to selling food supplements in the EU covers the route to market, from notification to labelling; here we stay on the formula itself.

What a legal food supplement formula has to pass

First, what the product is. Directive 2002/46/EC defines food supplements as foods that supplement the normal diet and consist of concentrated sources of nutrients or other substances with a nutritional or physiological effect, sold in dose form and delivered to the consumer pre-packed. If your product fits, run five checks on the recipe: vitamins and minerals, other substances, novel food status, additives, and the national rules for botanicals. Claims and notification come afterwards and do not change what the formula may contain.

Vitamins and minerals: the substance and the form

Under Article 4(1) of the Directive, only the vitamins and minerals listed in Annex I may be used, and only in the forms listed in Annex II. Annex I names the nutrients; Annex II names the chemical sources you may buy (magnesium bisglycinate and magnesium oxide are on it, for example). A raw material that supplies the right nutrient in an unlisted source is not a legal ingredient, however common it is in the United States or Asia, and the European Commission notes that trade in such products has been prohibited since 1 August 2005.

Do not rely on a supplier’s specification sheet instead of the current list: Annex II has been amended many times, and the consolidated text of 26 November 2025 already includes changes adopted on 5 November 2025. Some entries also carry a footnote that points to the Union list of novel foods (calcidiol monohydrate and magnesium L-threonate are two), so you need to read the entry there as well.

The amount is part of the formula too. Article 5 provides for maximum and minimum amounts of vitamins and minerals per recommended daily dose, but the Directive itself contains no figures, so check whether an EU measure setting them has been adopted before you rely on a national limit. Where there is no EU measure, national provisions apply (Article 11(2)). So fix the daily dose first, calculate every nutrient against it, and check the result against the rules of your first market.

Other substances: Annex III of Regulation 1925/2006

Amino acids, coenzymes, plant extracts and similar ingredients fall outside the Directive’s positive lists. Regulation (EC) No 1925/2006 excludes food supplements from its vitamin and mineral rules (Article 1(2)), but not from its rules on other substances. Under Article 8, a substance ingested in amounts far above a normal diet, or that carries another health risk, can be entered in Annex III: Part A prohibits it, Part B allows it only under conditions, and Part C places it under Union scrutiny.

The entries are concrete. In the consolidated text of 26 November 2025, Part A includes Ephedra herbs, Yohimbe bark and their preparations. Part B covers green tea extracts containing EGCG, with less than 800 mg of EGCG per daily portion and mandatory warnings, and monacolins from red yeast rice, with less than 3 mg per daily portion, also with warnings. Annex III changes, so check the current text. Natural is not a defence, and a formula that says only «green tea extract» is incomplete: the rule attaches to the EGCG content.

Beyond Annex III there is no EU list of permitted «other substances»: Article 4(8) of the Directive only asked the Commission to report on whether to create one. National law fills the gap. Spain’s Royal Decree 1487/2009 allows, in Article 3(2), the substances in its annex (fatty acids, amino acids, coenzymes, flavonoids and carotenoids among them), with maximum daily amounts and, for some, a mandatory label warning. If your ingredient is not in that annex, do not assume it is allowed (the consolidated text we checked was last amended in 2018, so confirm the current annex).

Novel food: the check that can end a project

Regulation (EU) 2015/2283 defines a novel food as any food not used to a significant degree for human consumption in the Union before 15 May 1997, in one of several categories that include food from microorganisms, fungi or algae, material of mineral origin, and plants or parts of plants, with limited exceptions. The test is consumption inside the EU, so a plant with a long tradition in Asia or South America can still be new here.

Article 4 puts the duty on you: check whether the food falls within the Regulation and, if you are unsure, consult the Member State where you first intend to market it. Article 6(2) sets the consequence: only novel foods on the Union list may be sold, under the conditions of use and labelling requirements it specifies. The list, Implementing Regulation (EU) 2017/2470, gives for each novel food the food categories where it may be used, a maximum content, extra labelling requirements and a specification. Read the entry, not just the name: your extract has to meet the specification and your dose has to stay inside the limit. The Commission’s Novel Food Catalogue helps as a first orientation, but the legal test is Article 3(2)(a). Our Spanish-language guides on importing supplement ingredients and on novel food controls go deeper.

Additives and excipients: the part people forget

Sweeteners, colours and many other excipients added for a technological purpose are food additives (the definition in Article 3(2)(a) has exceptions, so check each excipient), and Regulation (EC) No 1333/2008 allows only those on its Union list, under the conditions stated there (Article 4(1)). Food supplements have their own category (17 in Annex II, Parts D and E), solid or liquid, excluding those for infants and young children. Conditions attach to individual additives: some are limited to chewable supplements, some to syrups, and E 410, E 412, E 415, E 417 and E 425 cannot be used in dehydrated supplements meant to be rehydrated on ingestion. Additives can also arrive inside a vitamin premix, and Annex III of the same Regulation lists those allowed in nutrients and other additives (Article 4(2) and (4)), so ask suppliers for the full composition of every premix.

Botanicals: no EU list, so check by country

For plants, no harmonised positive list exists at EU level: the Directive contains positive lists for vitamins and minerals only. Ask three questions of every botanical: is the plant, or the part you use, a novel food; is the substance in Annex III; and what does the country of sale say about that plant, that part and that type of extract? We are not reproducing a list of allowed plants here: lists that circulate online go out of date and differ between countries, and a food supplement formula built on one of them can be illegal in the market you actually want.

What the formula does not settle: claims and notification

A legal formula does not tell you what you may say about it. Under Regulation (EC) No 1924/2006, health claims are prohibited unless authorised and included in the lists provided for in Articles 13 and 14. Notification is separate too: Article 10 of the Directive lets Member States require it, and in Spain Article 9 of Royal Decree 1487/2009 requires it, with a copy of the label, before or at the first placing on the market, from the manufacturer, the person responsible for that first placing or, for third-country products, the importer. Omitting it is classed as a serious infringement, and the label copy has to match the formula you manufactured.

Frequently asked questions

Is a formula that is legal in the US or Asia legal in the EU?

Not automatically. The permitted forms of vitamins and minerals, Annex III, the novel food list and the additive list are EU-specific, so each ingredient has to be checked against them.

Does my contract manufacturer check this for me?

A manufacturer will typically confirm that it can produce the formula, which is not the same as confirming it is legal in your market. Ask for the full composition of every raw material and check the food supplement formula before the purchase order.

How ASC Services helps with the formula

If you want to start the conversation with your manufacturer from a defined formula, our cosmetic formulation service, which also covers food supplement formulas, delivers the formula only: ingredients with percentages, checked against current EU rules by a technician before it reaches you. Labelling, claims and market notification are separate. After almost twenty years assessing the safety and compliance of cosmetics and food supplements, our advice is to run these checks before the first purchase order. To discuss your product, write to us through our contact page.

Traces of prohibited substances in a cosmetic: what Article 17 allows

Posted on octubre 1, 2026 by adminarya

Traces of prohibited substances are a question a safety assessor has to be able to answer in writing. Picture a brand that has sold a cream for months, made abroad by a contract manufacturer with an ethoxylated surfactant from a supplier it trusts. During the review of the safety report someone asks about dioxane. Nobody put it in the formula, but it is on Annex II of Regulation (EC) No 1223/2009, the list of substances banned in cosmetics, and ethoxylated ingredients can carry it as a process impurity. So what now?

What Article 17 says about traces of prohibited substances

Article 17 of the Cosmetics Regulation allows the non-intended presence of a small quantity of a prohibited substance in one case: it comes from impurities in natural or synthetic ingredients, from the manufacturing process, from storage or from migration out of the packaging, and it is technically unavoidable under good manufacturing practice. The Article then adds a last condition. That presence must comply with Article 3, which means the product still has to be safe under normal or reasonably foreseeable conditions of use. These are three requirements that add up, and if one of them fails, the exception does not apply.

What the Article does not define

Article 17 sets no numerical limit for what counts as a small quantity, and it does not list the documents that show a trace is unavoidable. What does spell out the obligation is Annex I, Part A, point 4, headed impurities, traces and information about the packaging material. The safety report must state the purity of the substances and mixtures and, for traces of prohibited substances, give evidence of their technical unavoidability. It must also describe the relevant characteristics of the packaging material, in particular its purity and stability. The duty to prove is written down. The method is not, at least in the Regulation itself.

The Commission did adopt guidelines on Annex I, Implementing Decision 2013/674/EU, which are listed on its cosmetics legislation page and are the next document to read. This article does not go beyond the text of the Regulation.

When the legislator does set a number: DHHB

Sometimes the number is written into the law. Commission Regulation (EU) 2026/909 of 27 April 2026 gives a recent example with the UV filter DHHB. The new wording of entry 28 in Annex VI says that di-n-hexyl phthalate (DnHexP), which is on the Annex II list, must not exceed 10 ppm as an unavoidable trace impurity in DHHB. The recitals explain how that figure was reached. The SCCS, the Commission’s scientific committee on consumer safety, considered a trace level of 260 ppm safe and noted that it could be brought down to 1 ppm. The Commission and the Member States then agreed on 10 ppm, taking into account the economic impact on sunscreen manufacturers. From 1 January 2027, products containing DHHB that do not meet the condition can no longer be placed on the EU market, and from 1 July 2028 they can no longer be made available on it. If DHHB is in your sunscreen, you will need to be able to show, for instance with the certificate of analysis of your raw material, that it complies.

What we check when we review a safety report

When we review a safety report we look for the purity and the certificate of analysis of every raw material, we compare the impurities the supplier declares with Annex II, and, where traces of prohibited substances exist, we look for the proof of inevitability that Annex I requires. If it is missing, we say so in the report itself, as documentation the Responsible Person has to add to the file. The strongest proof is also the most demanding one: an explanation of why that trace cannot be reduced further with what is available, whether from another supplier, in another purity grade or through another process. On good manufacturing practice, Article 8 presumes conformity when manufacture follows the relevant harmonised standards published in the Official Journal, and ISO 22716 is the good-practice reference the sector uses.

Where the trace goes in the report, and why exposure matters

The Responsible Person must make sure the product has been through a safety assessment and that a report is drawn up under Annex I (Article 10.1), and must keep the product information file available for the competent authority (Article 11.3). Part B of the report is carried out by a person holding a degree in pharmacy, toxicology, medicine or a similar discipline, as Article 10.2 requires. The trace has to show up in two places: in Part A, with its proof of inevitability, and in the reasoning of Part B, because Article 17 only protects the product if it is still safe with that trace inside.

That is where exposure weighs in. Article 10.1(a) requires the intended use and the anticipated systemic exposure to the ingredients of the final formulation to be taken into account. The same trace does not weigh the same in a rinse-off gel as in a leave-on cream, in a product for children under three or in one for external intimate hygiene, for which Annex I, Part B, requires a specific assessment.

Three mistakes, and what to do if you cannot prove it

The first mistake is invoking Article 17 for a substance that was added on purpose. The exception covers what is incidental, not what is intended. The second is stating that the product is free of prohibited substances with no data behind the claim. The third is treating the proof as permanent. The Regulation requires the safety report to be kept up to date (Article 10.1(c)) and the same goes for the product information file (Article 11.2), and a change of supplier or of packaging is exactly the moment to look at the trace again.

If you cannot prove that a trace is unavoidable, Article 17 does not cover it and Article 14.1(a) applies: without prejudice to Article 3, cosmetic products must not contain substances listed in Annex II. The practical way out is to cut the trace at source, with a higher purity grade of the raw material, another supplier or a change in the process, and to document the change with new certificates. It is better to do that before the next batch is made than with the product already on the market.

If you import cosmetics from outside the EU

If you bring cosmetics into the Union from a third country, you are the Responsible Person for each product you place on the market (Article 4.5), unless you appoint, by written mandate, a person established in the Union who accepts the role in writing. The safety file, and the proof about traces of prohibited substances, is then yours or your appointee’s. Your foreign manufacturer usually holds the certificates of the raw materials, but you need to ask for them before you place the product on the market, not after the first complaint. Notifying the product in the CPNP is a step for the same person, but it does not show that the file is complete; our step-by-step guide to CPNP notification explains what it does and does not prove.

If your company makes or imports cosmetics and your safety report does not say which traces of prohibited substances your raw materials or your packaging can carry, write to us before your next production run. We quote you the review of one reference, so that you know which proof is missing, and the work is reviewed and signed by an ASC technician. You can see how we prepare the cosmetic product safety report and what the role of the Responsible Person in the EU involves, or contact us directly.

Reliability of toxicological data in a CPSR: what the SCCS guidance says

Posted on octubre 1, 2026 by adminarya

The reliability of toxicological data decides what a cosmetic product safety report is worth. A margin of safety can be calculated to three decimals and still be wrong if the value it starts from comes from a study nobody checked, or from a summary table that never named its source. This article goes through what Regulation (EC) No 1223/2009 and the SCCS Notes of Guidance say about that starting value, and what the person reading a CPSR (a Responsible Person, a brand owner, a buyer’s quality team) can reasonably ask of it.

What the Regulation says about the reliability of toxicological data

Three provisions carry most of the weight. Annex I, Part A, point 8, asks for the toxicological profile of each substance and for a margin of safety (MoS) based on the no observed adverse effect level (NOAEL); leaving out the MoS has to be duly justified. The same point adds two sentences that matter here: any read-across between substances must be documented and justified, and the source of the information must be clearly identified. Article 10(1)(b) makes the responsible person ensure that an appropriate weight-of-evidence approach is used to review data from all existing sources. And Article 10(3) requires the non-clinical safety studies referred to in the safety assessment and carried out after 30 June 1988 to assess the safety of a cosmetic product to comply with EU legislation on good laboratory practice (GLP) in force when the study was run, or with other international standards that the Commission or ECHA recognises as equivalent.

There is no scoring scale in the Regulation, no ranking of study types and no rule for choosing between two conflicting NOAELs. The Regulation sets the frame and leaves the choice inside it to the safety assessor, which is where a weak CPSR and a strong one part ways.

What the SCCS Notes of Guidance are, and what they are not

The Notes of Guidance (SCCS/1647/22, 12th revision) were written for the safety dossiers on Annex substances that companies submit to the SCCS. Their introduction says they were not written for substances outside the Annexes, that they can nevertheless be of practical use when compiling the Product Information File of a finished product, and that they are not a prescriptive procedure. We use them in that spirit: as a detailed technical reference on how the Committee looks at data quality, not as a requirement of the Regulation. Where a point below is professional judgement and not the text of the guidance or of the Regulation, we say so.

The starting value: NOAEL, LOAEL or BMDL

The guidance calls the value from which extrapolation to low doses begins the point of departure (PoD) and notes that in most SCCS opinions it has been a NOAEL. For substances with a threshold it can also be a LOAEL, the lowest observed adverse effect level, or a BMDL, the lower limit of a benchmark dose. For its own opinions the SCCS considers the benchmark dose (BMD) approach preferable where usable in vivo data exist: it uses the whole dose-response curve and allows the uncertainty to be quantified. A CPSR built on a NOAEL is not wrong for that reason, since Annex I itself names the NOAEL. What is wrong is a bare figure: a value in mg/kg/day with no study, no endpoint and no document behind it.

Age and origin matter too. The guidance recalls that the ban on testing finished cosmetic products has applied since 11 September 2004 and the ban on testing ingredients since 11 March 2009, with the marketing ban applying from 11 March 2009, or from 11 March 2013 for repeated-dose toxicity, reproductive toxicity and toxicokinetics. It also says that animal data generated before those dates, or for other legislation such as food, medicines or biocides, may still support the assessment of a cosmetic ingredient. Many values in circulation therefore come from studies run for another purpose, so ask where a given value was obtained.

Scoring the quality of a study

To assess the quality of a toxicological study, the guidance says the Klimisch score could be used, for example, and points to ToxRTool, a software tool developed by the EU Reference Laboratory for the Validation of Alternative Methods (EURL ECVAM) that determines the Klimisch score in a systematic way and also works for in vitro studies. The guidance names the score but does not reproduce its scale, which comes from the 1997 paper it cites. It also says that when data are taken from the scientific literature, a systematic search and review following pertinent standards (PRISMA is the example given) should be performed and documented: search engine, key words, and the reason each study was included or excluded.

A CPSR does not need a full systematic review for every ingredient. The underlying idea is the best answer to the question «how do you know there is no better study?»: a search that another person could repeat. Two further points are our own criteria, not rules. A study scored as unreliable should not, on its own, carry a signed margin of safety. And because Article 10(3) applies to studies run after 30 June 1988 to assess the safety of a cosmetic product, the report should state how compliance with good laboratory practice was checked, and not leave the reader to assume it. On deviations from GLP, the guidance is explicit for the data it receives: they must be indicated, explained and scientifically justified.

Read-across and in silico predictions: support, not substitute

Models are useful and the guidance is demanding about them. A (Q)SAR model is considered appropriate for regulatory use only if it was developed under the OECD validation principles: a defined endpoint, an unambiguous algorithm, a defined applicability domain, appropriate measures of goodness-of-fit, robustness and predictivity, and, where possible, a mechanistic interpretation. The QSAR Model Reporting Format (QMRF) exists to summarise that information for each model. The guidance also quotes the 2014 report of the International Cooperation on Cosmetics Regulation (ICCR), which concluded that in silico approaches for cosmetic ingredients were largely limited to internal decision-making and not yet a mainstream alternative to testing.

Read-across gets similar treatment. Structural similarity alone is not enough: the guidance, citing ECHA, asks that similarity in physicochemical properties, toxicokinetic and toxicodynamic behaviour and toxicological effects also be considered, and that analogues be selected impartially and not by picking a few on personal judgement. Put next to Annex I, Part A, point 8, the practical reading is that a prediction or an analogue is one piece of the weight of evidence, documented and justified, and not the only foundation of a margin.

Four questions to put to any CPSR

The reliability of toxicological data in a report comes down to whether, for each substance with a calculated margin of safety, you can answer four things. Which value was used and of what type: NOAEL, LOAEL or BMDL. Which document exactly it comes from, because «SCCS» on its own is not a source and Annex I asks for the source to be clearly identified. How reliable the study was judged to be and by what method. And what the position on good laboratory practice is. That value is then set against the systemic exposure the intended use produces, which Article 10(1)(a) requires to be taken into account, and Annex I, Part B, point 3, asks for the margins of safety, where relevant, to be assessed and discussed in the reasoning. An error in the input travels through all of it without any formula noticing. If there is no valid value at all, the report has to justify the absence, and that is a different thing from filling the gap with the number of a similar substance.

Frequently asked questions

Does the SCCS guidance apply to my CPSR?

Not as a legal requirement. It is written for SCCS dossiers, and it describes itself as an approach to adapt case by case. It is nonetheless a detailed public account of how the Committee weighs data, so it is a sound benchmark for the reliability of toxicological data in a report signed by a safety assessor.

Can I use the NOAEL of a similar substance?

Only as support inside a weight-of-evidence analysis, with the similarity justified and the source identified. The assessor should not present it as the value of the substance being assessed.

What if a REACH registration dossier lists several studies?

Then the report should say which study carries the assessment and why, instead of defaulting to the first one found. Which one to choose is a professional judgement; the Regulation only asks that it be justified.

When does a value need to be revisited?

When new relevant information appears. Article 10(1)(c) requires the safety report to be kept up to date with information generated after the product is placed on the market, and a new SCCS opinion on an ingredient is exactly that.

Who answers for the value chosen?

The responsible person ensures the safety assessment is done (Article 10(1)), and Part B is carried out by a person with the qualifications set out in Article 10(2), whose name, proof of qualification, date and signature appear in the report (Annex I, Part B, point 4).

If you place cosmetics on the EU market and want to check the reliability of toxicological data behind your safety report, write to us through our contact page. You can also read our guide to the Cosmetic Product Safety Report, our note on the Responsible Person for cosmetics, our cosmetics advisory service, or the Spanish version of this article.

Allowed ingredients do not make a safe product: what comes after the formula

Posted on septiembre 30, 2026 by adminarya

A formula built from allowed ingredients is where cosmetic development starts, not where it ends. A brand checks every INCI name against the prohibited list, finds nothing in Annex II, keeps each restricted substance under its limit, and concludes that the product can go on sale. The Regulation does not follow that logic, and it says so itself: Article 14(1), the provision that bans the listed substances, opens with the words «without prejudice to Article 3», the requirement that the product as a whole be safe. After almost twenty years assessing the safety and conformity of cosmetics and food supplements, this is an assumption we meet often, and it is costly when it surfaces late.

What allowed ingredients means in Regulation (EC) No 1223/2009

Article 14(1) draws the line in five places. A cosmetic product may not contain substances listed in Annex II, restricted substances in Annex III that are not used within their restrictions, or colourants, preservatives and UV filters other than those listed in Annexes IV, V and VI, nor listed ones used outside the conditions of those annexes. The logic differs by annex. Annex II is a negative list: what is not on it is not banned on that ground. Annexes IV, V and VI are positive lists: a colourant, preservative or UV filter that is not on the relevant list cannot be used in that function. Article 15 adds its own rules for substances classified as carcinogenic, mutagenic or toxic for reproduction.

These lists move. Regulation (EU) 2026/909, adopted in April 2026, amended the rules on the use of several substances, and we cover it separately in our article on the 2026/909 amendment (in Spanish). The point of this article is different: even a formula that matches today’s lists exactly is only the input to the product.

The test is the finished product, not the ingredient list

Article 3 states that cosmetic products made available on the market must be safe for human health under normal or reasonably foreseeable conditions of use, taking into account in particular the presentation, the labelling, the instructions for use and disposal, and any other indication given by the responsible person. Every item on that list describes the product as sold and used, not its raw materials. The last sentence closes a common shortcut: the presence of warnings does not exempt the operators concerned from the other obligations of the Regulation.

So the question is not whether each ingredient is allowed, but whether these allowed ingredients, in this pack, used this way, add up to a safe product. Four things separate the two questions. The first is exposure. Annex I asks for the place and area of application, the amount applied, the duration and frequency of use, the routes of exposure and the target population, and calculates the margin of safety on the NOAEL, with any omission duly justified. Article 10(1)(a) speaks of the anticipated systemic exposure to the individual ingredients of the final formulation. The same substance at the same percentage is not the same exposure in a leave-on face cream and a rinse-off shampoo.

The second is interaction and impurities. Annex I directs attention to the impurities of the substances and raw materials used and to the interaction of the substances, and Article 17 tolerates trace amounts of a prohibited substance only if technically unavoidable in good manufacturing practice and compatible with Article 3. The third is stability and microbiological quality: the report covers stability under reasonably foreseeable storage conditions and the results of the preservative efficacy test. A preservative from Annex V used within its conditions does not show that this product resists contamination; the test does. The fourth is the packaging, whose relevant characteristics, in particular purity and stability, belong to the same assessment.

The safety assessment turns a formula into a product

Article 10(1) requires, before a cosmetic product is placed on the market, a safety assessment based on the relevant information and a cosmetic product safety report drawn up under Annex I. Part A collects the data described above. Part B is the assessor’s conclusion, with the reasoning, the statement on the warnings and instructions the label must carry, and due account of how stability affects safety. It has to be carried out by a person with a university qualification in pharmacy, toxicology, medicine or a similar discipline, or studies recognised as equivalent by a Member State (Article 10(2)), and it carries the assessor’s name, proof of qualification, date and signature. At ASC that step is carried out and signed by a qualified safety assessor. The structure of the report is explained in our guide to the cosmetic product safety report.

Nor does the report end at launch: Article 10(1)(c) requires it to be updated with relevant information generated after the product reaches the market.

Made under good manufacturing practice

Article 8 requires cosmetic products to be manufactured in line with good manufacturing practice (GMP), and presumes conformity when manufacture follows the relevant harmonised standards published in the Official Journal. The Commission lists EN ISO 22716 among the harmonised standards under the Regulation. Its scope is production, control, storage and shipment, and it expressly excludes research and development and the distribution of the finished product. Development work on the formula therefore sits outside the standard, which starts at production. The product information file must contain a description of the manufacturing method and a declaration of conformity with GMP (Article 11(2)(c)). If a contract manufacturer makes the product, ask how it applies the standard: ISO 22716 has a chapter on subcontracting.

Labelled and notified before it is sold

Article 19(1) lists what must appear on the container and packaging, among others: the name and address of the responsible person, with the country of origin for imported products; the nominal content; the batch number; the function; the list of ingredients; and the precautions for use, at least those set out in Annexes III to VI. Two items depend directly on the safety assessment. The date of minimum durability is the date until which the product, stored under suitable conditions, keeps fulfilling its initial function and complying with Article 3, so it has to be consistent with the stability data in the report; and Part B of the report states which warnings the label needs. Under Article 19(5), the language of several of these mentions is set by the law of each Member State where the product is made available to the end user.

Notification is the last gate. Under Article 13, before the product is placed on the market, the responsible person submits electronically to the Commission, in practice through the Cosmetic Products Notification Portal, the product category and name, the name and address of the responsible person, the country of origin for imports, the Member State of introduction, a contact person, the presence of nanomaterials, any CMR substances of categories 1A or 1B, and a framework formulation for prompt medical treatment. Those data should be consistent with what the file and the label say.

Someone in the Union has to answer for it

Article 4(1) allows only products for which a natural or legal person within the Union is designated as responsible person. For an imported product the importer holds that role, and may designate by written mandate another person established in the Union who accepts it in writing (Article 4(5)). Article 5(1) makes the responsible person answerable for compliance with, among others, Articles 3, 8, 10, 11 and 13, and Article 11(1) requires the product information file to be kept for ten years after the last batch was placed on the market. What the role involves in practice is covered in our guide to the responsible person.

A working order before you call the formula finished

Once the formula meets the annexes, settle the intended use and target population; confirm the packaging the product will be filled in; obtain stability and preservative efficacy results for the product in that packaging; have a qualified assessor complete Parts A and B; check that the manufacturer works to GMP; write the label from the assessor’s warnings and the stability data; and appoint the responsible person before notifying.

Questions we are asked

If my formula only uses allowed ingredients, do I still need a safety report?

Yes. Article 10(1) applies to every cosmetic product before it is placed on the market. The composition of the formula does not create an exemption.

Can a warning on the label cover a doubtful formula?

No. The last sentence of Article 3 says that the presence of warnings does not exempt the operators concerned from the remaining obligations.

Can I rely on my supplier’s safety data instead of an assessment?

Supplier data are an input, not a substitute. Annex I requires the toxicological profile of each substance, with the source clearly stated, and Article 10(1)(b) requires a weight-of-evidence approach across all existing sources, in the safety assessment of the product.

If your formula is settled and the rest of the file is not, write to us through our contact page and tell us the product, the pack and the markets you plan to sell in. If what you still need is the formula itself, our cosmetic formulation service covers that step only: the safety report, the label and the notification are separate services.

Who answers for a new cosmetic formula in the EU

Posted on septiembre 29, 2026 by adminarya

Every new cosmetic formula involves several people: the brand that wants the product, the chemist who balances the ingredients, the plant that runs the first batch, the professional who signs the safety assessment. Regulation (EC) No 1223/2009 does not ask who wrote the formula. It asks a different question, about the finished product: who answers for it in the Union? For a brand outside the EU, or an importer launching its first product, the answer is less obvious than it looks, and it is cheaper to settle before the formula is fixed than after the first batch.

Who is who around a new cosmetic formula

The Regulation defines roles by what a party does with the product, not by who designed it. The manufacturer under Article 2 is whoever makes a product, or has it designed or made, and markets it under its own name or trademark. A brand that commissions a laboratory to develop the formula and a plant to produce it is therefore the manufacturer for legal purposes, while for a contract plant that only produces for the brand the definition is not something to assume: settle in the contract, in writing, who acts as the manufacturer and who as the responsible person.

The importer is a person established in the Union who places a product from a third country on the market; the distributor is any other party in the supply chain that makes the product available. Around them sit the Responsible Person and the safety assessor, two further roles that are often confused with the others.

Whose name goes on the label when the brand is outside the EU

Article 4(1) allows a cosmetic product on the market only if a natural or legal person has been designated as its Responsible Person in the Union. The rest of the article tells you who that is. If the product is made in the EU and not exported and re-imported, the manufacturer established in the EU is the Responsible Person, and it may designate someone else by written mandate that the other accepts in writing. If that manufacturer is established outside the EU, Article 4(4) obliges it to designate, by written mandate, a person established in the EU who accepts in writing. For imported products, Article 4(5) makes each importer the Responsible Person for the specific product it places on the market, with the same option of a written mandate. A distributor becomes the Responsible Person if it places a product on the market under its own name or trademark, or modifies one in a way that could affect compliance; translating the product information is expressly not such a modification.

Take a concrete case. A brand based outside the EU commissions the formula and the production from an EU laboratory. The brand is the manufacturer under Article 2 and it is established outside the Union, so Article 4(4) applies: it needs a written mandate to a person in the EU, accepted in writing. The laboratory does not become the Responsible Person by default. Change one fact, production in Asia and import by a Spanish company, and the importer is the Responsible Person by default. Our guide to the Responsible Person covers the role in full.

The safety obligation and the person who assesses it

Article 3 sets the standard: a cosmetic must be safe for human health under normal or reasonably foreseeable conditions of use, taking into account its presentation, labelling, instructions and any other information the Responsible Person provides. Warnings on the label do not relieve anyone of the other obligations in the Regulation.

Article 10 turns that standard into work. Before the product is placed on the market, the Responsible Person must ensure that a safety assessment has been carried out and that a safety report has been drawn up in line with Annex I. The assessment has to take into account the intended use and the anticipated systemic exposure to the individual ingredients of the final formulation, which is why it cannot be closed on a draft. Article 10(2) requires the assessment to be carried out by a person holding a university-level qualification in pharmacy, toxicology, medicine or a similar discipline, or a qualification a Member State recognises as equivalent.

Annex I sets the content. Part A covers composition, stability, microbiological quality, impurities, exposure, the toxicological profile of the substances with the margin of safety, and undesirable effects. Part B holds the conclusion, the warnings the label needs, the reasoning, and the assessor’s name, address, proof of qualification, date and signature. The assessor signs Part B; Article 10(1) puts the duty to make sure the assessment exists, and is updated with information generated after launch, on the Responsible Person. The Cosmetic Product Safety Report is that document.

The file and the notification that carry the formula

Under Article 11 the Responsible Person holds a Product Information File for ten years after the last batch was placed on the market. It contains a description of the product, the safety report, a description of the method of manufacture with a declaration of compliance with good manufacturing practice, proof of the claimed effect where justified, and data on animal testing. It must be available to the competent authority of the Member State where it is kept, at the address on the label, in a language the authority can readily understand.

Before launch, Article 13 requires the Responsible Person to notify the Commission electronically. The notification carries the category and name, the Responsible Person’s name and address, the country of origin for imports, any nanomaterials, the CMR substances of categories 1A and 1B, and the framework formulation that allows rapid medical treatment if something goes wrong. Changes must be updated immediately. Article 19(1)(a) puts the Responsible Person’s name and address on the packaging, plus the country of origin for imports. Our CPNP notification guide walks through the Commission’s portal.

The plant, good manufacturing practice and what the contract covers

Article 8 requires manufacture under good manufacturing practice and presumes conformity when it follows the relevant harmonised standards published in the Official Journal. The Commission lists EN ISO 22716:2007, the good manufacturing practice guidelines for cosmetics, among the harmonised standards for the Regulation, and two points from its text matter to a brand commissioning a new cosmetic formula. Its scope is production, control, storage and shipment; research and development, and distribution of the finished product, are outside it, so a plant’s GMP evidence tells you how the product is made, not whether the formula is safe. And clause 12 on subcontracting expects a written contract that specifies the respective duties of contractor and subcontractor. That contract is worth having, but Article 5(1) lists Article 8 among the provisions the Responsible Person must guarantee.

What a contract cannot move

You can move three things by contract: the manufacture, the assessment and the Responsible Person role itself, the last only by the written mandate Article 4 describes, accepted in writing by a person established in the Union. What you cannot do is leave the product without a Responsible Person, or push the duties of Article 5 onto the formulator, the plant or the assessor while the Responsible Person stays a name on the label.

Article 5 is specific. The Responsible Person guarantees compliance with Articles 3, 8 and 10 to 18, parts of Article 19, and Articles 20, 21, 23 and 24. If it has reason to think a product on the market does not comply, it must take corrective measures at once and, where there is a risk to human health, inform the national authorities immediately. On a reasoned request it must hand over the documentation showing conformity, in a language the authority understands, and Article 23 adds immediate notification of serious undesirable effects.

A supply agreement with your formulator or plant, including indemnities, allocates cost and recourse between the parties. It does not change the party the Regulation names to the authority. Nor does a warning on the label, as Article 3 says, and nor does the assessor’s signature. After almost twenty years assessing the safety and conformity of cosmetics and food supplements, we see three problems repeatedly: a brand that believes the contract plant is its Responsible Person because the plant issues the invoices; a formula adjusted at the plant after the assessment was signed; and a label that shows an address where nobody keeps the file.

A sensible order of decisions

Decide first who will be the Responsible Person and put the mandate in writing. Then choose the manufacturer, ask for its GMP evidence and agree the subcontracting terms. Fix the formula and give the assessor the final version. Only then build the file, notify and finalise the label; every later change of composition goes back to the assessor.

If you still need the formula itself, our cosmetic formulation service delivers the formula only: the ingredient list with percentages, checked against the annexes of the Regulation. Labelling, claims and the safety report are separate services.

Frequently asked questions

Can my contract manufacturer be my Responsible Person?

Yes, if it is established in the Union and accepts the role in writing under the mandate Article 4 describes. Accepting the role means accepting the Article 5 duties.

Next step

If you are about to launch a new cosmetic formula in the EU and are not sure who in your chain holds which role, write to us through our contact page before the first production order, and a technician at ASC will go through it with you.

How to commission a cosmetic formula: what to prepare and what you receive

Posted on septiembre 28, 2026 by adminarya

If you are going to commission a cosmetic formula for the EU market, the brief you write decides most of what follows: which ingredients are possible, what a manufacturer can produce and what the safety assessment will have to cover. Brands that arrive with a clear brief get a formula they can take straight to a manufacturer. Brands that arrive with “a good face cream” get a round of questions first. Here is what to have decided, what a formula delivery contains and leaves out, and what has to happen before you can sell.

What to have decided before you commission a cosmetic formula

Type of product and intended use. Regulation (EC) 1223/2009 defines a cosmetic by its purpose: a substance or mixture meant to be put in contact with the external parts of the human body (epidermis, hair system, nails, lips and external genital organs) or with the teeth and the mucous membranes of the mouth, with the exclusive or main purpose of cleaning them, perfuming them, changing their appearance, protecting them, keeping them in good condition or correcting body odours (Article 2(1)(a)). Name your product in those terms. A shampoo, a body lotion and a lip balm are different formulas, because the same ingredient can be allowed up to one limit in one product type and be subject to another limit, or to extra conditions, in another: Annex III, the list of restricted substances, sets its conditions by product type and by part of the body.

Who will use it, and how. The safety assessment is built on use. Annex I asks for the place and area of application, the amount applied, the duration and frequency of use, the routes of exposure and the target population, and its microbiological section singles out products used around the eyes, on mucous membranes or on damaged skin, and use by children under three, older people and people with an altered immune response. Adults or children, daily or occasional, face or body: settle it now, because the formula is designed for that use and the assessor will start from it (Article 10(1)(a)).

Presentation and characteristics. Cream, gel, serum, stick, powder or spray; texture, colour, fragrance or none. Presentation changes the exposure: Annex I tells the assessor to consider the unintended inhalation of aerosols and the effect of particle size, so a spray raises questions that a cream does not. Describe the product you want, not the promises you plan to print on the box: what you may say about a cosmetic is governed by Article 20, which forbids attributing to a product characteristics or functions it does not have, and it is a separate question from the formula.

Markets. Name the EU countries where you intend to sell. The notification records the Member State where the product is placed on the market (Article 13(1)(d)), and the language of several mandatory label particulars is set by the law of each Member State where the product reaches the end user (Article 19(5)). The formula is checked against EU rules; other markets keep their own lists of permitted ingredients and would need their own check.

What you receive when you commission a cosmetic formula

A formula proposal for the product you described: the list of ingredients, the percentage of each and the function each one performs. Before delivery, every ingredient is checked against the annexes of the Regulation: Annex II (prohibited substances), Annex III (substances allowed only with restrictions) and Annexes IV, V and VI, which list the admitted colourants, preservatives and UV filters. That is what our cosmetic formulation service delivers, and only that.

The first item of Annex I, Part A, the section every safety report must contain, is the qualitative and quantitative composition, with the chemical identity of each substance (INCI name, CAS number where possible) and its intended function. A formula with percentages and functions is the starting point of that section. You take it to your manufacturer, in the EU or in a third country, and ask for a quotation and a first sample. Who owns the formula and under what conditions you may use it are settled in our quotation, before you accept it.

What a formula does not include

A formula is a design on paper. Several things that brands assume come with it do not, and each has a different owner.

The label and the claims. Article 19 lists what must appear on the container and the packaging, among other particulars the name and address of the Responsible Person, the nominal content, the durability information and the ingredient list (which may appear on the packaging alone; small and unpackaged products have their own rules). Whatever you say about the product must be true, and when its nature or effect justifies it, the product information file must hold the evidence of the effect claimed (Article 11(2)(d)). Both are separate services.

The safety report (CPSR). Under Article 10(1), before a cosmetic is placed on the market the Responsible Person must make sure it has undergone a safety assessment and that a report has been drawn up in accordance with Annex I. A formula built on permitted ingredients is not, by itself, a safe product: the assessment looks at exposure, at the toxicological profile of each substance and at the margin of safety, and it must be carried out by a person holding a degree in pharmacy, toxicology, medicine or a similar discipline (Article 10(2)). Our guide to the cosmetic product safety report explains the document.

Stability, packaging compatibility and the challenge test. Annex I, Part A asks for the stability of the product under reasonably foreseeable storage conditions, its microbiological quality, including the result of the preservation efficacy test (the challenge test), and the relevant characteristics of the packaging material. All of it is measured on the real product in its real pack, so it can only exist once your manufacturer has made a sample. It stays with you and your manufacturer, and the results go into the safety report.

What comes after the formula

The order matters. First, a manufacturer that works to good manufacturing practice: Article 8 requires it, and in practice manufacturers show it through EN ISO 22716, so ask for evidence before you place an order. Second, the samples and the tests above. Third, the safety report on the final formulation, before any batch is sold. Fourth, the product information file that Article 11 requires the Responsible Person to hold, containing among other things the safety report, a description of the method of manufacture and a statement of good manufacturing practice. It is kept for ten years after the last batch was placed on the market (Article 11(1)).

Then the person and the portal. Only cosmetics for which a Responsible Person has been designated within the Union may be placed on the market (Article 4(1)). Who that is depends on where the product is made and who brings it in: the manufacturer established in the EU, the importer when the product is imported, or another person established in the EU designated by written mandate and accepting it in writing (Article 4(3) to (5)). If you have a product designed or made for you and sell it under your own name or trademark, the Regulation treats you as the manufacturer (Article 2(1)(d)). Our guide to the Responsible Person for cosmetics in the EU covers the role.

Before the product is placed on the market, the Responsible Person notifies it electronically through the Cosmetic Products Notification Portal (CPNP): category and name, name and address of the Responsible Person, country of origin for imports, Member State, a contact person and the frame formulation that allows rapid and appropriate medical treatment, among other data (Article 13(1)). The step-by-step CPNP guide walks through it.

Mistakes we see when brands commission a cosmetic formula

The most expensive is placing the production order before the safety assessment. A first batch is made, and only then does someone ask for the report. If the assessment finds that an ingredient level or a use does not hold up, the change means a new sample and, often, new stability tests. Assess first, produce second.

The second is a silent substitution. A raw material cannot be sourced, an equivalent takes its place and nobody tells the brand. A change of ingredient can change what the Regulation allows and the composition on which the safety report rests, so every substitution should come back for a check before it goes into production.

The third is a brief too vague to design from. “A moisturiser for sensitive skin” leaves open the use, the population, the presentation and the markets, which are exactly the questions above. Each one you leave open becomes a round of emails later.

Frequently asked questions

Do I need a manufacturer before I ask for a formula?

No. The formula does not depend on where it is made. Have your manufacturer review it before you place the order, because they confirm whether they can produce it with their equipment.

Can I change an ingredient after I receive the formula?

Any change in composition is handled as a new proposal: we tell you what it involves before we do it. It also changes the composition that the safety report and the notification are based on.

If you are planning a cosmetic for the EU market, tell us what product you have in mind through our contact page and we will send you a quotation for the formula, with ownership and conditions of use spelled out.

Fiabilidad de los datos toxicológicos en el CPSR: qué dice el SCCS

Posted on septiembre 28, 2026 by adminarya

La fiabilidad de los datos toxicológicos decide lo que vale un informe de seguridad cosmético. Se decide en un punto que casi nadie mira desde fuera: de dónde sale el valor con el que se calcula el margen de seguridad, y qué garantías tiene el estudio que lo produjo. Un informe es tan sólido como los datos toxicológicos que lo sostienen.

El punto de partida de la evaluación

Las Notes of Guidance del SCCS (SCCS/1647/22, duodécima revisión) están pensadas para los dosieres de ingredientes que se presentan al SCCS; aquí las usamos como referencia técnica de buenas prácticas, no como requisito del Reglamento. Llaman «punto de partida» (PoD) al punto de la relación dosis-respuesta desde el que arranca la extrapolación a dosis bajas, y señalan que en la mayoría de sus opiniones se ha usado el NOAEL, la dosis sin efecto adverso observado. El Anexo I, parte A, punto 8, del Reglamento pide precisamente que el margen de seguridad se calcule basado en el NOAEL. La guía añade que, para los dictámenes del SCCS, considera preferible expresar la dosis como BenchMark Dose (BMD) cuando hay datos in vivo utilizables, porque aprovecha toda la curva dosis-respuesta y permite cuantificar la incertidumbre. Que un CPSR use NOAEL no es un error; que no diga cuál usa ni de dónde sale, sí lo es.

Cómo se valora la fiabilidad de los datos toxicológicos

La guía indica que, para evaluar la calidad de un estudio toxicológico, puede usarse la puntuación de Klimisch, y menciona la herramienta ToxRTool, desarrollada por el laboratorio de referencia europeo para métodos alternativos (EURL ECVAM), que calcula esa puntuación de forma sistemática y sirve también para estudios in vitro. La escala clásica de Klimisch et al. (1997) va de 1, fiable sin restricciones, a 4, no asignable; esa escala no figura en el texto de la guía, que solo cita el método. Lo que sigue es criterio profesional, no norma: un estudio puntuado como no fiable no debería ser, por sí solo, el fundamento de un margen de seguridad firmado.

Buenas prácticas de laboratorio y valor de la evidencia

El Reglamento (CE) 1223/2009 pone dos condiciones adicionales. El artículo 10.1.b obliga a usar un enfoque apropiado sobre el valor de la evidencia para examinar los datos de todas las fuentes existentes: no basta con el primer valor que aparezca. Y el artículo 10.3 exige que los estudios no clínicos de seguridad realizados después del 30 de junio de 1988 cumplan la legislación comunitaria sobre buenas prácticas de laboratorio, o normas internacionales reconocidas como equivalentes por la Comisión o por la ECHA.

El papel de los modelos in silico y de las referencias cruzadas

Los modelos QSAR y las técnicas de extrapolación entre sustancias parecidas son útiles, pero la guía es exigente: un modelo solo se considera apropiado para uso regulatorio si se ha desarrollado conforme a los principios de validación de la OCDE, con un objetivo definido, un algoritmo sin ambigüedades, un dominio de aplicabilidad delimitado y medidas de ajuste, robustez y capacidad predictiva. Existe además un formato normalizado (QMRF) para resumir y comunicar la información de cada modelo. La guía recoge también la conclusión de un informe del ICCR de 2014, según la cual el uso de estos métodos en la evaluación de seguridad de ingredientes cosméticos se limitaba en gran medida a la toma de decisiones interna. El Anexo I, parte A, punto 8, añade que cualquier enfoque comparativo mediante referencias cruzadas estará debidamente documentado y justificado, y que la fuente de información se indicará claramente. En la práctica, una predicción sirve como apoyo dentro del conjunto de la evidencia y no como único fundamento.

Cómo se convierte en un margen de seguridad

El punto de partida no vale por sí solo: se compara con la dosis de exposición sistémica (SED) que resulta del uso real del producto. El Anexo I, parte B, punto 3, pide que, cuando proceda, los márgenes de seguridad se evalúen y analicen dentro del razonamiento científico de la evaluación. Si el punto de partida es débil, el margen, por bien calculado que esté, lo es también: un error en el valor de entrada se propaga a todo el informe sin que ninguna fórmula lo detecte.

Qué exigir sobre la fiabilidad de los datos toxicológicos de un CPSR

Un informe defendible permite responder cuatro preguntas para cada sustancia con margen de seguridad: qué valor se ha usado y de qué tipo es (NOAEL, LOAEL o BMDL), de qué documento concreto procede —«SCCS» a secas no es una fuente, y el Anexo I exige indicarla claramente—, qué fiabilidad tiene el estudio y si cumple buenas prácticas de laboratorio. Cuando no hay dato válido, lo honesto es dejar ese margen abierto y explicar qué se pide al proveedor, y no rellenarlo con un valor de otra sustancia parecida.

Preguntas frecuentes

¿Sirve el NOAEL de una sustancia parecida?

Solo como apoyo dentro de un análisis de valor de la evidencia y con la justificación de la similitud, porque el Anexo I exige documentar y justificar el enfoque comparativo; el evaluador no debería tomarlo como valor de la sustancia evaluada sin más.

¿Qué hago con un expediente de registro REACH?

Un dossier de registro puede contener varios estudios de dosis repetidas con valores distintos. La regla de práctica que seguimos es usar el valor que el registrante identifica como clave en su resumen, no el primero que aparece. Es una regla de trabajo, no un requisito del Reglamento.

¿Cuándo hay que revisar el valor?

Cuando aparece información nueva: el artículo 10.1.c exige actualizar el informe con la información pertinente que se genere tras la introducción del producto en el mercado, y una opinión nueva del SCCS sobre la sustancia es exactamente eso.

¿Quién decide qué valor se usa?

El evaluador de seguridad que firma la parte B. El Reglamento exige que sea una persona con la cualificación del artículo 10.2 y que su nombre, cualificación, fecha y firma consten en el informe.

Si tu empresa comercializa cosméticos y quieres saber de qué datos toxicológicos depende tu informe de seguridad, escríbenos antes de la próxima revisión de tu expediente y te presupuestamos el análisis de una referencia. Puedes ver nuestros servicios de consultoría regulatoria o leer cómo se aplica el informe de seguridad de producto cosmético (en inglés). El texto del Reglamento de cosméticos está en EUR-Lex.

AI tariff classification: who carries the liability when the code is wrong?

Posted on septiembre 22, 2026 by adminarya

AI tariff classification now returns a ten-digit code in seconds. If you make a product outside the EU and are about to send your first shipment to Europe, somebody will classify it and the data will go into a customs system: a broker, an online platform or a tool. The convenience is real, and it will improve. The question that matters is what happens when the code is wrong. Customs does not write to the software. It writes to a person.

A drug manufacturer’s defence: the AI never told me

If you have exported to the United States you will recognise this one. On 2 April 2026 the FDA sent Warning Letter 320-26-58 (MARCS-CMS 722591) to Purolea Cosmetics Lab, a drug manufacturer in Michigan. It is a drug cGMP case (21 CFR parts 210 and 211), not a cosmetics one, and US law. What matters is what the firm told the inspectors: it had used AI agents to create product specifications, procedures and master production records. The FDA’s position is short. If you use AI as an aid in document creation, you must review the output to make sure it is accurate and actually compliant, and failing to do so is a violation of 21 CFR 211.22(c). When investigators pointed out that the firm had not validated its process before distribution, it replied that it had not known the requirement, because the AI agent never told it. The letter adds that, if the firm resumes production and keeps using AI, any output or recommendation from an AI agent must be reviewed and cleared by an authorised human representative of its quality unit.

US customs said it in plain words: a tool is not a person

Closer to your shipment is CBP ruling HQ H350722, dated 16 January 2026. It examined a foreign online platform whose AI tool suggested tariff subheadings to importers. CBP did not ban the tool as such. It accepted it as general reference, disconnected from an actual importation and with a disclaimer that is genuinely implemented. The line is crossed when the tool suggests subheadings beyond six digits for goods that will be entered. At that point a licensed customs broker is needed. The ruling then states plainly that a tool is not a “person”, so the actual decision on the classification of imported merchandise must be made by a licensed broker. It also recalls, citing an earlier case, that a disclaimer does not rescue a company that classifies the specific goods its clients will import. Keep this in proportion. It is US law and does not apply in the EU. What travels across the Atlantic is the logic, not the rule.

AI tariff classification liability under EU law: it names a person

The EU does not need a ruling like that, because the Union Customs Code already assigns responsibility. Under Article 15(2) of Regulation (EU) 952/2013, whoever lodges a customs declaration is responsible for the accuracy and completeness of the information and for the authenticity, accuracy and validity of the supporting documents. If a customs representative lodges it, the representative carries the same responsibility. Article 77(3) adds the financial side: the declarant is the debtor of the customs debt and, where the representation is indirect, so is the person on whose behalf the declaration is made. Neither provision distinguishes by who, or what, produced the data. In our reading, an inspector will not ask which software you used. They will ask who accepted that code.

For a manufacturer with no EU presence this has a practical edge. Under the new Code, an indirect customs representative acting for a non-EU importer is treated as the importer (Article 33(3)), and recital 21 explains why: the indirect representative takes on all of the importer’s obligations, not only paying the debt but complying with the other rules customs enforces. Choosing who acts for you in the EU means choosing who carries that responsibility. We covered one version of this in the risks of letting your supplier handle the EU import.

The customs reform: the data goes in first-hand

Regulation (EU) 2026/2108 was published in the Official Journal on 19 September 2026. It will replace the 2013 Code as it comes into application and creates the EU Customs Authority and the EU Customs Data Hub. Most of the text applies from 21 September 2027. The Data Hub arrives in stages: distance sales from 1 July 2028, voluntary use for other operators from 1 March 2031, and mandatory use for all from 1 March 2034 (Article 285). The European Commission describes it as a single interface where businesses submit their import and export data. The reading is ours, but it follows: more data, supplied directly and visible to authorities across all Member States, gives a wrong entry a longer life.

How we work at ASC Services

We use AI for the mechanical part: extracting data from invoices and technical sheets, cross-checking against the regulations, preparing drafts. The tariff classification, the value and the regulatory paperwork are checked by a qualified technician against the source (the tariff, the standard, the test report), and the file leaves under that technician’s signature. The customs declaration itself is lodged by your broker or customs representative. What we prepare and sign is the regulatory and documentary file behind it. In our experience the usual failure is not an AI that invents a code. It is a figure nobody looked at again because it came out of a system. Before you rely on any tool, read its terms and look for one thing: does it take any responsibility for the result, or does it leave all of it with you? That is the difference between buying a tool and hiring an operated, signed service, backed by twenty years of files. For the wider picture see who validates and signs AI-generated regulatory files and, on the tariff side, our guide to TARIC classification.

Frequently asked questions

Is AI tariff classification safe to rely on?

As support, yes. Just do not treat it as the decision. Someone with judgement should check the proposal against the tariff and the real description of the product before it reaches the declaration, and that check should be recorded. The customs reform does not change this.

Does a consultant’s signature take the liability off me?

No. Being the importer, and the obligations that come with it, stay with you with or without a consultant. What changes is that behind the figure there is a professional who has checked it, can explain it to customs and answers for their own work.

If you plan to ship to the EU and today the code or the file comes out of a tool without a technician reviewing and signing it, get in touch through our contact page before the first shipment and we will explain how we work.