regulation

The Responsible Person for a cosmetic product — obligations under Regulation 1223/2009

August 20, 2026

Do you run a small cosmetics brand, or are you just planning to bring your first cream or massage candle to market? Then sooner or later you will come across the concept of the "Responsible Person". This is not a formality you can tick off and forget — it is a specific legal role with a list of obligations, and in Poland neglecting them carries financial penalties of up to PLN 100,000. In this article we explain in plain language who the Responsible Person is, what exactly they must do, and what these obligations look like in the everyday practice of a small brand.

This article is for information purposes only and does not constitute legal advice.

Who is the Responsible Person? (Article 4 of the Regulation)

The legal basis is Regulation (EC) No 1223/2009 of the European Parliament and of the Council on cosmetic products. Its Article 4(1) states plainly: only cosmetic products for which a Responsible Person has been designated within the Union may be placed on the market (in English-language documents you will see the abbreviation RP — Responsible Person).

Who is it in practice?

You manufacture in the EU under your own brand — the Responsible Person is the manufacturer, unless they designate in writing another person established in the EU (Article 4(3)).
You import cosmetics from outside the EU — the Responsible Person is the importer, i.e. you, for each product you place on the market (Article 4(5)).
You sell someone else's product under your own brand (private label) — the distributor becomes the Responsible Person when they place a product on the market under their own name or trademark, or modify the product in a way that affects its compliance with the applicable requirements (Article 4(6)).

That last point surprises many small brand owners: even if the cream is physically made for you by an external manufacturer, you — as the brand on the label — are the Responsible Person, with all the consequences that entails.

The Responsible Person's list of obligations (Article 5)

Article 5(1) of the Regulation is, in practice, the "table of contents" of your obligations — it lists a dozen or so articles whose compliance you must ensure. The most important of them:

1. Safety assessment and the CPSR (Article 10)

Before the product goes on sale, you must ensure that a safety assessment is carried out and a cosmetic product safety report is drawn up — known in the industry as the CPSR (Cosmetic Product Safety Report). Note: the assessment may only be performed by a person holding a diploma in pharmacy, toxicology, medicine or a similar discipline (Article 10(2)). If you do not have such qualifications, you commission it from an external safety assessor. Importantly — the report is not a "once and done" document: Article 10(1) requires it to be kept up to date after the product has been placed on the market.

2. The product information file, i.e. the PIF (Article 11)

For each product you keep a file — the so-called PIF (Product Information File). It contains, among other things, a description of the product, the safety report, a description of the manufacturing method together with a statement of compliance with good manufacturing practice (GMP — Good Manufacturing Practice), and proof of the effect claimed, if you promise anything on the label (Article 11(2)). You keep the file for 10 years from the date on which the last batch was placed on the market (Article 11(1)) and make it available to the supervisory authorities on request.

3. Notification via the CPNP (Article 13)

Before placing the product on the market, you notify it electronically to the European Commission via the CPNP portal (Cosmetic Products Notification Portal). You provide, among other things, the category and name of the product, your details, the country of origin in the case of import, information on nanomaterials, and the frame formulation (Article 13(1)). The portal itself is free of charge, and a CPNP notification is sufficient for the entire EU — there are no additional national notifications.

4. Post-market monitoring

The obligations do not end on launch day. The Responsible Person must continuously make sure the product remains compliant with the rules — and the rules change. The Commission regularly amends the annexes to the Regulation (including Annex II, listing prohibited substances, and Annex III, listing restricted substances). An ingredient that is legal today may, six months from now, have a new concentration limit or end up on the prohibited list. On top of that, there is the obligation to report serious undesirable effects to the authorities — without delay after becoming aware of them (Article 23(1)).

5. Corrective actions (Article 5(2) and (3))

If you consider or have reason to believe that your product is not compliant, you are obliged to immediately take corrective measures: bring the product into conformity, withdraw it from the market or recall it from consumers, and — where there is a risk to health — inform the competent authorities. You are also obliged to cooperate with the supervisory authorities and provide them with documentation on request.

What happens if you fail? Supervision and penalties in Poland

In Poland, supervision of compliance with Regulation 1223/2009 is exercised — pursuant to Article 14 of the Polish Act of 4 October 2018 on cosmetic products — by the bodies of the State Sanitary Inspection (Państwowa Inspekcja Sanitarna) and the Trade Inspection (Inspekcja Handlowa) (the Trade Inspection operates under the supervision of the President of UOKiK — the Polish Office of Competition and Consumer Protection). Supervision includes inspections, sampling and laboratory testing.

The Act provides for administrative financial penalties. Selected examples (maximum amounts):

Infringement	Basis (the Act of 4 October 2018)	Penalty up to
Placing a product on the market without a safety assessment (CPSR)	Article 27	PLN 100,000
Deficiencies in the product information file (PIF)	Article 30	PLN 100,000
Failure to report a serious undesirable effect	Article 39	PLN 100,000
Labelling deficiencies	Article 36	PLN 70,000
Failure to take corrective measures / failure to cooperate with the authorities	Article 28	PLN 50,000
Manufacturing without good manufacturing practice (GMP)	Article 26	PLN 50,000
No CPNP notification	Article 32	PLN 35,000
Failure to keep the documentation for the required period	Article 29	PLN 30,000

For a sole trader, these are amounts that can end a business — which is why it is better to treat the Responsible Person's obligations as an ongoing process, not a one-off project.

Post-market monitoring — what does it look like in practice?

The point that usually raises the most questions is "post-market monitoring", because the Regulation says what must be achieved, but not how. In practice it comes down to two streams of information:

1. Safety Gate — the EU rapid alert system for dangerous non-food products. The supervisory authorities of all Member States report detected dangerous products there — including cosmetics, e.g. those containing prohibited ingredients. In 2024 the system recorded 4,137 alerts — the highest number in its history. For the Responsible Person this is a source of two signals: whether someone has reported your product, and whether products containing the same ingredient as in your formulations are being reported.

2. Amendments to the annexes of the Regulation — successive amendments restrict or prohibit specific substances. Every change needs to be checked against your own INCI lists (the international nomenclature of cosmetic ingredients on the label).

How to do it? Manually and for free: the European Commission offers a free e-mail subscription on the Safety Gate portal with weekly alert digests (with a product-category filter), and amendments to the annexes can be tracked on EUR-Lex. This requires discipline — every week you have to review the alerts and compare them with your own catalogue. Alternatively, the process can be automated with tools that cross-reference your product catalogue and INCI formulations against new alerts and annex amendments, and notify you only when something concerns your specific products — this is how BeautyGuard works, for example. The choice of method depends on the number of products and how much time you can devote to the weekly review.

FAQ — frequently asked questions

Can I be the Responsible Person if my products are made for me by an external manufacturer (private label)? Yes — and you usually are. Under Article 4(6) of the Regulation, a distributor who places a product on the market under their own name or trademark becomes the Responsible Person. A label with your brand means your obligations: PIF, CPNP, monitoring and corrective actions.

Do I need a toxicology degree to be the Responsible Person? No. The Regulation imposes no educational requirements on the Responsible Person. It is the person performing the product safety assessment who must hold the qualifications (a diploma in pharmacy, toxicology, medicine or a similar discipline) (Article 10(2)) — you commission that work from a specialist.

How much does notifying a product in the CPNP cost? The CPNP portal itself is free of charge — the Commission charges no notification fees. The cost on your side is preparing the data (frame formulation, labelling, packaging photo) or the fee of a company you commission to do it. A CPNP notification is valid throughout the EU.

How long do I have to keep the product information file (PIF)? For 10 years from the date on which the last batch of the product was placed on the market (Article 11(1) of the Regulation). Failure to keep the documentation for the required period carries a penalty of up to PLN 30,000 in Poland (Article 29 of the Polish Act on cosmetic products).

Sources

You can do post-market monitoring manually with the Commission's free newsletter — or automatically: see how BeautyGuard crosses your catalog against Safety Gate alerts and the 1223/2009 annexes.

safety gate

1223/2009

compliance

Back to blog