CPNP Notification for EU Cosmetic Launch — What Indie Brands Actually Have to File

A US-based or APAC-based indie brand looking to sell cosmetics into the EU encounters one mandatory regulatory step before the first sale: CPNP notification under Regulation (EC) No 1223/2009. The portal itself is free and the submission is not technically difficult, but the prerequisite framework — particularly the Responsible Person requirement and the Product Information File (PIF) — is non-trivial for brands without in-house regulatory infrastructure.

What CPNP is and isn't

The Cosmetic Product Notification Portal (CPNP) is a free online notification system maintained by the European Commission since 2013 under Article 13 of Regulation (EC) No 1223/2009. It is the single submission channel for selling a cosmetic in any EU member state, the UK (in transitional alignment), Switzerland, and the EEA (Norway, Iceland, Liechtenstein).

What CPNP is: - A notification system — you submit information about your product before placing it on the market - Mandatory before first sale in any covered jurisdiction - Free of charge - Provides immediate confirmation reference number - Centralized — one notification covers all EU/EEA member states

What CPNP is not: - Not an approval process — there is no review or sign-off; notification is acknowledgement, not authorization - Not a substitute for compliance with the underlying regulation - Not a Product Information File (PIF) repository — CPNP captures select information; the full PIF must be held separately by the Responsible Person - Not free of post-launch obligations — adverse event reporting, label updates, formula changes all trigger CPNP update requirements

Once a product is notified in CPNP, no further national notification within the EU is required.

The Responsible Person (RP) — the single most consequential concept

Under Article 4 of the Cosmetics Regulation, every cosmetic product placed on the EU market must have a designated Responsible Person — a natural or legal person established within the EU who takes responsibility for the product's compliance with the regulation.

The RP can be: - The manufacturer (if EU-established) - The importer (if importing from outside the EU; the importer is the RP by default unless they designate another EU-established entity) - A designated third party — an EU-established natural or legal person to whom the manufacturer/importer formally transfers RP responsibility through a written mandate

For a non-EU brand selling into the EU, the RP cannot be the brand itself unless the brand establishes an EU legal entity. The practical paths:

1. **Use a contract Responsible Person service** — specialized regulatory consultancies (often the same firms that handle CPNP submissions and PIF maintenance) act as RP for non-EU brands. Annual fees typically run several thousand euros per product line for routine cosmetics, more for complex or higher-risk products.
2. **EU-based distributor as RP** — some distributors take on the RP role bundled into their distribution agreement. The brand loses some flexibility in changing distributors but avoids a separate RP contract.
3. **Establish a small EU subsidiary** — for larger brands with sustained EU market commitment; one-time legal setup cost but no recurring per-product RP fee.

The Responsible Person: - Submits the CPNP notification (or authorizes a third party to submit on their behalf) - Holds the Product Information File and provides it to authorities on request - Receives all official correspondence on the product - Is legally liable for compliance breaches discovered post-launch

What's required to submit

For each cosmetic product, the CPNP notification captures:

• Category — the regulated product category (face care, sunscreen, hair care, etc.)
• Product name(s) — including alternative trade names if the same formula is sold under multiple brand names
• Responsible Person name and address
• Country of origin — where the product was manufactured
• Frame formulation — the categorized ingredient composition (not the full quantitative formula, but the framework)
• Specific ingredient information — any ingredients on Annex II (prohibited), Annex III (restricted), Annex IV (colorants), Annex V (preservatives), or Annex VI (UV filters) requires specific quantitative disclosure
• Nanomaterials — any nanomaterial-containing product requires a separate Article 16 notification 6 months prior to market launch
• Labelling — proposed label content including all warnings
• Photographs / product imagery — for identification purposes

Before submitting, the Responsible Person must have already: - Completed a Cosmetic Product Safety Report (CPSR) — Part A (data on the product) and Part B (safety assessment by a qualified safety assessor) - Assembled the full Product Information File - Verified that the product complies with all relevant annexes - Confirmed Good Manufacturing Practice (ISO 22716 or equivalent) at the manufacturing site

Timing — when to start

Realistic timing for a first-time-to-EU indie brand:

• 6-9 months before intended launch: identify and contract with Responsible Person; begin CPSR development (the safety assessment usually takes 3-6 weeks per product once data is gathered; gathering the data takes longer)
• 3-4 months before launch: complete CPSR; assemble PIF; finalize label artwork; submit CPNP notification
• Day of launch: notification reference must already be issued; product can be placed on market

There is no review/approval timeline — CPNP issues a reference number immediately on submission. But the prerequisite work (CPSR, PIF, RP designation, GMP verification) cannot be compressed without quality compromise. For products containing nanomaterials, add 6 months for the Article 16 notification.

What Pepoderma supports for EU-launching brand clients

Pepoderma supplies the cosmetic-grade peptide actives. The brand owns the finished-product responsibility, the label, the safety assessment, and the CPNP submission. What we provide:

• Per-active CPSR-ready documentation: INCI name, CAS, function, supplier safety data (TSE/BSE statement, allergen-free statement, heavy metal panel, microbiology specifications, stability data) packaged in CPSR-compatible format
• Frame formulation disclosure for any Pepoderma multi-component product (the peptide active in its delivery system; brands need to know the full composition to write the CPSR)
• Annex-flagging of any ingredient in our supply that triggers Annex II-VI specific disclosure
• EU-specific INCI confirmation matching the EU INCI glossary version current at time of brand launch
• CPSR-team contact references for indie brands needing a qualified safety assessor and a Responsible Person — we maintain a list of EU-based regulatory consultancies our clients have worked with successfully

The common failure mode to avoid

Indie brands routinely underestimate the CPSR. It is not a checklist — it is a substantive safety assessment by a qualified safety assessor (a pharmacist, toxicologist, dermatologist, or equivalent with appropriate qualification under Article 10 of the Regulation). The assessor evaluates the full formula in the context of the intended use, the target consumer, and the known toxicology of each ingredient.

Brands that try to short-cut the CPSR by using template language and unqualified assessors create products that pass CPNP submission but fail at the first regulatory inspection or adverse-event review. Budget for a properly-credentialed safety assessor early. The cost (€2,000-€8,000 per product line for the assessment work) is small compared to the cost of a post-launch enforcement action.