PIF vs CPSR
The CPSR is one component of the PIF. How the two differ, who signs each, and what competent authorities ask to see.
The CPSR is one component of the PIF. The Product Information File (PIF) is the complete dossier demonstrating that a cosmetic product is safe and compliant. The Cosmetic Product Safety Report (CPSR) is the safety assessment within it, drawn up in accordance with Annex I and signed by an assessor qualified under Article 10(2). Every PIF contains a CPSR; a CPSR alone does not constitute a PIF.
PIF vs CPSR at a glance
| Question | PIF | CPSR |
|---|---|---|
| What is it? | The complete dossier for one product | The safety assessment within that dossier |
| What does it demonstrate? | That the product is safe and meets the requirements of the Regulation | That the product is safe for human health under normal and reasonably foreseeable conditions of use |
| What does it contain? | Product description, safety report, manufacturing method and GMP statement, claim substantiation, animal-testing data | Part A, the safety information, and Part B, the assessor's reasoning and conclusion |
| Who is accountable? | The Responsible Person | The Responsible Person, with the assessment carried out by a qualified safety assessor |
| Who signs? | No signature of its own | The qualified safety assessor signs Part B |
| Where is it held? | At the address of the Responsible Person indicated on the label | Within the PIF |
| For how long? | Ten years from the date the last batch was placed on the market | As part of the PIF, and kept up to date for that period |
| When is it required? | Before the product is placed on the market | Before the product is placed on the market |
| Where is it required? | EU and UK | EU and UK, as a component of the PIF |
| Legal basis | Article 11 | Article 10 and Annex I |
What the PIF is
The PIF is the dossier the Responsible Person must make readily accessible to the competent authority of the Member State in which it is kept. In the EU and the UK every cosmetic product placed on the market requires one, retained for ten years from the date the last batch was placed on the market. The obligation sits in Article 11 of Regulation (EC) No 1223/2009.
It comprises five components: the product description, the safety report, the manufacturing method with its GMP statement, the proof of claimed effect, and the animal-testing data. It is not published. It is produced to competent authorities on request; only the information listed in Article 21 is publicly accessible.
What the CPSR is
The CPSR is the safety component of the PIF, governed by Article 10 and drawn up in accordance with Annex I. It has two parts, and the second can be no more reliable than the first.
- Part A, the safety information.The dataset: quantitative and qualitative composition, physicochemical characteristics and stability, microbiological quality including preservative efficacy, impurities, traces and packaging material information, normal and reasonably foreseeable use, exposure to the product and to the substances, the toxicological profile of each substance, and data on undesirable effects. Most of it originates with the Responsible Person and its raw material suppliers.
- Part B, the safety assessment.The conclusion: whether the product is safe, the warnings and instructions for use required on the label, the reasoning that connects the Part A data to both, and the assessor's credentials, proof of qualification and signature. Where a systemic endpoint is relevant, the reasoning is typically expressed through a Margin of Safety derived from the NOAEL and the systemic exposure dosage.
The assessment evaluates evidence; it is not a testing programme. Following the Article 18 prohibitions, the assessor works from existing data, SCCS opinions and validated alternative methods.
How they fit together
The PIF is a dossier of five components; the CPSR is one of them. The other four neither substitute for it nor are substituted by it.
| PIF component | What it holds | Is it the CPSR? |
|---|---|---|
| 1. Product description | Name, formula and identification enabling the file to be clearly attributed to the product | No |
| 2. Safety report | Part A, the safety information, and Part B, the signed assessment | Yes — this is the CPSR |
| 3. Manufacturing method | Description of the process and a statement of compliance with GMP (ISO 22716) | No |
| 4. Proof of claimed effect | Evidence substantiating any claim requiring support, assessed against Regulation (EU) No 655/2013 | No |
| 5. Animal-testing data | Testing performed by the manufacturer, agents or suppliers, including testing performed to meet third-country requirements | No |
A product can have a technically sound CPSR and still have a deficient PIF — a missing GMP statement or absent claim substantiation is a non-compliance in its own right, and inspections commonly find them.
Who prepares, signs and holds each
The two instruments have different owners, which is a frequent source of confusion.
- The Responsible Person holds the PIF.A legal or natural person established in the Union, or in the UK for the UK market. The file is kept at the address indicated on the label, and that person answers for it on inspection.
- A qualified safety assessor signs the CPSR.Article 10(2) requires a university qualification in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State. The Responsible Person may compile Part A but cannot sign the assessment unless the signatory personally holds those qualifications.
- Software may assemble the dataset and draft the text.The toxicological reasoning and the conclusion must be reviewed and signed by a qualified person who accepts responsibility for them.
What about the US?
The US operates neither instrument under these names. Under MoCRA, the responsible person maintains records constituting adequate substantiation of safety and completes facility registration and product listing with the FDA. The underlying evidence often serves both systems, but the instruments differ — and in practice a complete CPSR carries most of the weight of US substantiation, while the reverse rarely holds.
Common findings
- Using the two terms interchangeably.A supplier stating that it "holds your PIF" may in fact hold only the CPSR, leaving three or four components unaccounted for.
- Assuming the CPSR suffices.A competent authority may request the entire file, including the GMP statement, the claim substantiation and the animal-testing data.
- Part B written without Part A.An assessment is only as sound as the dataset behind it. Gaps in toxicological profiles, unjustified read-across or supplier declarations without underlying data undermine the conclusion.
- The CPSR drifting from the formulation in production.A changed substance, concentration, supplier or specification requires the assessment to be revisited and the PIF reissued.
- An unqualified signatory.A signature from a person not meeting Article 10(2) exposes the report, and with it the compliance of the product.
- Storing the components separately.A CPSR in one location and the remainder of the PIF in another turns a routine request into an emergency, and the Regulation requires the file to be readily accessible.
Frequently asked questions
- Is a CPSR the same as a PIF?
- No. The CPSR is one component of the PIF. The PIF is the complete dossier; the CPSR is the safety report within it.
- Do I need both?
- In the EU and the UK, yes. Every PIF must contain a CPSR, so no product can have a complete PIF without one.
- Which one do competent authorities ask for?
- The PIF. Authorities may request the whole file, and the CPSR is generally the component examined most closely.
- Who signs each one?
- The PIF carries no signature of its own. The qualified safety assessor signs Part B of the CPSR.
- Does the US require a PIF or a CPSR?
- Not under those names. Under MoCRA, the responsible person must maintain records adequately substantiating safety and complete FDA facility registration and product listing.
- How long must they be retained?
- The CPSR sits within the PIF, so both are retained for ten years from the date the last batch was placed on the market, and kept up to date throughout.
- When must they be updated?
- Whenever anything bearing on safety or compliance changes: the formulation, a supplier or specification, the conditions of use, a claim, or an amendment to the Annexes or a CLP reclassification.