Compliance software vs a manual process
When a spreadsheet suffices, when software earns its place, and a neutral checklist to help you decide.
A manual process is defensible when you hold few products, supply one market and have regulatory expertise in house. Compliance software begins to earn its place as products, markets and regulatory amendments accumulate, because the work that scales fastest is document collation, substance screening and version control. Software accelerates that work. It does not substitute for a qualified safety assessor, it does not relieve the Responsible Person of accountability, and it files nothing on your behalf.
Side by side
| Task | Manual process | Compliance software |
|---|---|---|
| Collecting documents | Spreadsheets, shared folders and email threads | Uploaded once, classified into the required sections, with duplicates flagged |
| Identifying gaps | A checklist you maintain yourself | A live checklist of complete and outstanding sections |
| Screening substances | Look up each substance in each market's lists, at its concentration and for the product type | Screened automatically against the markets you supply |
| Generating the report | Assemble the dossier by hand | Generated from your dataset |
| Safety sign-off | Locate a qualified assessor and exchange files back and forth | Reviewed and signed by a qualified assessor within the same workflow |
| Tracking regulatory change | Monitor Official Journal amendments, SCCS opinions and CLP reclassifications, then work out which products they touch | Changes matched to the products on file |
| Record keeping | Multiple versions across folders and inboxes | One library holding every report, version and source document |
| Cost of adding a product or market | Grows with the work each one adds | Smaller, because the steps repeat |
| What you retain | Everything, at the cost of your time | The decisions and the sign-off, with the routine work automated |
Where a manual process works well
A manual process is a reasonable choice where volume is low and the regulatory position is stable.
- A small range.One or a few products, each with a settled formulation.
- One market.You know its requirements well and they seldom move for your product types.
- Expertise in house.Someone on the team already compiles the file and knows where each piece of evidence sits.
- Few changes.Formulations, raw material suppliers and claims remain constant from year to year.
Where that holds, the cost of adopting a new tool may exceed what it saves. A well-maintained folder and a disciplined checklist can be sufficient — the Regulation prescribes no format, only that the file be complete, current and readily accessible.
Where it begins to break down
The failures recur in the same places, and they are the ones that surface at inspection.
- More products.Each requires its own file, and each reformulation triggers another round of screening and a revised assessment.
- More markets.A substance unrestricted in one jurisdiction may be restricted or prohibited in another, and each market has its own instruments — a PIF and CPNP notification in the EU, facility registration and product listing under MoCRA in the US.
- Regulatory movement.An Omnibus act amending Annexes II to VI, a new SCCS opinion or a CMR reclassification under CLP can affect many products simultaneously, often with a transition period that expires sooner than expected. Identifying which products are caught is itself the slow part.
- Dispersed documentation.Reports in email threads and several versions of one specification turn an authority's request into an emergency, when the standard is readily accessible.
- Key-person dependency.When the one person who holds the process leaves, the reasoning behind each file leaves with them — and a CPSR must be defensible years after it was signed.
- Transcription error.A misspelled INCI name or a missed Annex III concentration limit is easy to make by hand and difficult to detect later, precisely because the name no longer matches the entry that governs it.
What software can and cannot do
Software absorbs the routine work. It does not absorb the accountability.
What it can do
- Classify your documents and show what is outstanding
- Extract composition tables and screen each substance against the restrictions applicable in your target markets, at concentration and by product type
- Draft the safety report and compile the dossier
- Monitor regulatory change and match it to the products on file
- Hold every report, version and source document in one place
What it cannot do
- Replace the qualified safety assessor.Article 10(2) requires the assessment to be carried out by a qualified person, and Part B carries that person's signature. Software cannot sign, and a conclusion nobody is prepared to defend is not an assessment.
- Replace the Responsible Person,who remains accountable under Articles 5, 10 and 11 in the EU, and under the equivalent UK provisions.
- Make a formulation compliant.It can identify where a limit is exceeded; the reformulation decision is yours.
- Repair poor source data.A tool can only work with the documentation it is given, and an incomplete Part A produces an unsupportable Part B.
With dermaGPT, you or your Responsible Person still submit any notification or filing yourselves.
A neutral checklist for deciding
Read both lists. The more of the second group describes your situation, the more likely a tool will help.
A manual process is probably sufficient if:
- You hold a handful of products whose formulations rarely change
- You supply one market whose requirements you know well
- Someone in house already compiles the file and has the time for it
- You could produce any report within a day of an authority asking
Software is probably worth examining if:
- You hold many products, or launch new ones frequently
- You supply two or more markets, or intend to
- Formulations, suppliers or claims change regularly
- Documentation sits across many folders, inboxes and people's memories
- You depend on one person who holds the process in their head
- You could not say quickly which products a regulatory amendment would affect
Whichever way you lean, test before committing: run one real product through the process you are considering and see how much of the work you recognise.
Common findings when switching
- Expecting software to replace the professionals.It accelerates the routine work. A qualified safety assessor and a Responsible Person remain necessary.
- Migrating unexamined data.Collect what you hold first and record what is missing before you start; raw material documentation is usually the longest lead item.
- Switching everything at once.Begin with one product, learn the workflow, then extend.
- Omitting the human review.Read the output, the composition table above all, before confirming it. An extraction error carried into the screening step propagates silently.
- Assuming it files for you.Notifications and filings with authorities remain the responsibility of you or your Responsible Person.
- Deciding on price alone.Weigh the time spent collating, screening and chasing documentation against it, and the cost of a non-compliance finding — withdrawal from the market is considerably more expensive than either option.
Frequently asked questions
- Do I need compliance software to sell cosmetics?
- No. The Regulation requires a complete, current and readily accessible file, not a particular tool. Software is a means of building and maintaining that file with less manual work.
- Can software replace a safety assessor?
- No. In the EU and the UK the assessment must be carried out and signed by a person meeting the qualification requirements of Article 10(2). Software can assemble data and draft the report; it cannot sign.
- Does software file my notifications for me?
- Not with dermaGPT. It compiles and maintains the file. You or your Responsible Person still submit notifications, such as the CPNP notification in the EU, and filings such as MoCRA facility registration and product listing in the US.
- When does a manual process stop being enough?
- Typically when products, markets or regulatory changes multiply, or when the process depends on one person. The checklist above can help you judge.
- Is it risky to rely on AI for compliance?
- AI performs routine, repeatable checks and drafting well. The risk lies in treating its output as final. Review the results, and keep a qualified person responsible for the conclusion — on inspection, the question is who reasoned to it, not what produced the text.
- Can I start with one product?
- Yes. Running one real product through the process is the most reliable way to see whether it fits how you work.