What is a Product Information File?
The dossier that demonstrates a cosmetic product is safe and compliant before it reaches the market: what belongs in it, who must hold it, and how it is kept alive.
A Product Information File (PIF) is the dossier that demonstrates a cosmetic product is safe for human health under reasonably foreseeable conditions of use, and that it complies with Regulation (EC) No 1223/2009. It holds the qualitative and quantitative formula, the Cosmetic Product Safety Report, the manufacturing method and GMP statement, the evidence substantiating the claims, and the animal-testing data. It must be made available to the competent authority in electronic or other format at the address of the Responsible Person, without delay.
In the EU and the UK, every cosmetic product placed on the market requires one, and it must be retained for ten years from the date the last batch was placed on the market. Other markets request comparable evidence under different names, so a brand selling across regions usually maintains several aligned versions of the same technical documentation.
Why the PIF exists
The PIF is the mechanism by which EU law requires a brand to demonstrate, not merely assert, that a product is safe. The obligation sits in Article 11 of Regulation (EC) No 1223/2009, and is mirrored in the UK Cosmetics Regulation (Schedule 34 to the Product Safety and Metrology etc. (Amendment etc.) (EU Exit) Regulations 2019).
There is no pre-market authorisation for cosmetics. The Responsible Person notifies the product through the Cosmetic Products Notification Portal (CPNP), holds the PIF, and must be able to answer for it under inspection at any time. From a safety assessor's standpoint, this is the critical point: the file is not a formality assembled after launch — it is the evidence base that must exist before the product is placed on the market, because Article 10 requires the safety assessment to be completed first.
- Who is accountable:the Responsible Person — a legal or natural person established in the Union (or in the UK, for the UK market).
- Where it is held:at the address of the Responsible Person indicated on the label, accessible to the competent authority.
- For how long:ten years from the date the last batch was placed on the market.
- Language:a language readily understood by the competent authorities of the Member State concerned. Note that some authorities will insist on the national language, particularly for Part B.
- Public?No. It is disclosed to competent authorities on request. Only the information listed in Article 21 is publicly accessible.
What goes inside a PIF
Article 11(2) sets out five components. The safety report, drawn up in accordance with Annex I, carries the greatest technical weight.
| Part | What it contains |
|---|---|
| Product description | Description enabling the PIF to be clearly attributed to the product on the shelf — name, formula, packaging, intended function |
| Safety report (CPSR) | The safety assessment, in two parts per Annex I (see below) |
| Manufacturing method | Description of the manufacturing process and a statement of compliance with GMP (presumption of conformity through ISO 22716) |
| Proof of claimed effects | Evidence substantiating the effect claimed, where justified by the nature or the effect of the product — assessed against Regulation (EU) No 655/2013 Common Criteria |
| Animal-testing data | Data on any animal testing performed by the manufacturer, agents or suppliers relating to the development or safety evaluation, including testing performed to meet the requirements of third countries |
The CPSR is where most files are found wanting at inspection. Part A compiles the safety information: quantitative and qualitative composition, physicochemical characteristics and stability, microbiological quality (including preservative efficacy testing), impurities, traces and information on the packaging material, normal and reasonably foreseeable use, exposure to the product and to the substances, and the toxicological profile of each substance. Part B is the assessor's reasoning and conclusion: the assessment of the product's safety — typically expressed through the Margin of Safety derived from the NOAEL and the systemic exposure dosage, where a systemic endpoint is relevant — any warnings and instructions of use required on the label, and the reasoning that leads from the Part A data to the conclusion, together with the assessor's credentials and signature.
A point assessors repeat often: Part A is the brand's responsibility to supply, Part B is the assessor's responsibility to reason. A Part B written without complete, reliable Part A data is not a safety assessment.
Who needs one, and where
Any company placing cosmetic products on the EU or UK market needs a PIF for each product, whether sold in retail or online. A brand established outside these markets must designate a Responsible Person established within them, by written mandate accepted in writing. Other jurisdictions require comparable evidence under different names.
| Market | What is required |
|---|---|
| EU | A Product Information File under Article 11, with a CPSR compliant with Annex I, plus CPNP notification |
| UK | A Product Information File under the UK Cosmetics Regulation, held by a UK Responsible Person, plus SCPN notification |
| US | No document termed a PIF. Under MoCRA, the responsible person must maintain records supporting an adequate substantiation of safety, and complete FDA facility registration and product listing |
| Asia-Pacific | A PIF or equivalent dossier covering ingredient origin, formula and manufacturing records. Requirements and timing vary considerably by country, and several markets operate positive or pre-approval lists that the EU does not |
Common findings at inspection
- Treating the file as static.A change in formula, raw material supplier, specification, packaging, claim or applicable regulation can invalidate the assessment. The CPSR must be updated and, where the change is material, re-signed.
- Assessing against one market only.A substance unrestricted in one jurisdiction may be restricted or prohibited in another. Annexes II to VI are amended regularly, and CMR reclassifications under CLP flow through to cosmetics automatically.
- Disregarding concentration and product type.Most Annex III entries are conditional on maximum concentration, product category, and whether the product is rinse-off or leave-on. A compliant INCI list is not evidence of a compliant formula.
- Insufficient toxicological data.Missing or substituted toxicological profiles, unjustified read-across, or reliance on supplier declarations without underlying data are among the most frequent deficiencies.
- No qualified assessor.Part B must be carried out by a person holding a diploma or other evidence of formal qualifications in pharmacy, toxicology, medicine or a similar discipline, as required by Article 10(2).
- Fragmented documentation.Certificates of analysis in email threads and multiple uncontrolled versions of one specification make the file indefensible when a competent authority sets a deadline.
Frequently asked questions
- What is the difference between a PIF and a CPSR?
- The CPSR is one component of the PIF. The PIF is the complete dossier required by Article 11; the CPSR is the Annex I safety report contained within it.
- Who can act as Responsible Person?
- The manufacturer or importer established in the Union, or a third party designated by written mandate and accepted in writing. That person bears the obligations of Articles 5, 10 and 11, including holding the PIF.
- Does the US require a PIF?
- Not under that designation. Under MoCRA, the responsible person must maintain records demonstrating adequate substantiation of safety and complete FDA facility registration and product listing. The evidence overlaps substantially with a CPSR, but the legal construction differs.
- Can I prepare the safety report myself?
- You can compile Part A — that is the brand's own data. Part B, the assessment and conclusion, must be carried out and signed by a person meeting the qualification requirements of Article 10(2).
- When must a PIF be updated?
- Whenever anything bearing on safety or compliance changes: formula, raw material supplier or specification, manufacturing site or process, packaging, conditions of use, a claim, or an amendment to the Annexes or to CLP classification. Article 11(2) requires the PIF to be kept up to date — a file that reflects a superseded formula is a non-compliance in itself.