EU CPNP Registration: Selling Korean Cosmetics in Europe

Why EU Compliance Is the Hardest Cosmetic Regulatory Project

The EU operates the strictest cosmetic regulatory framework in the world — far stricter than the US, even after MoCRA. EU Regulation 1223/2009 governs cosmetic products in the EU and EEA, and it requires every product to be notified, every Responsible Person to be EU-based, every formulation to comply with detailed Annex restrictions, and every product to have a Product Information File on hand for inspection.

For brands sourcing from Korean OEM manufacturers, EU compliance is achievable but more involved than US compliance. The good news: established Korean OEMs with EU export experience handle most of the technical work. The bad news: the Responsible Person, the CPNP notification, and the PIF management sit on the brand side and require either in-house capability or a paid partner.

This guide walks through what EU compliance actually requires for Korean OEM cosmetics, who handles each piece, and the common mistakes that cause border rejections.

The Six Pillars of EU Cosmetic Compliance

EU cosmetic compliance has six core obligations:

Responsible Person designation — every product must have a Responsible Person physically based in the EU
CPNP notification — every product must be notified through the Cosmetic Products Notification Portal before sale
Product Information File (PIF) — comprehensive product safety dossier maintained by the Responsible Person
Cosmetic Product Safety Report (CPSR) — formal safety assessment by an EU-qualified safety assessor
Compliant labeling — multilingual ingredient lists, country-specific requirements, mandatory information
Annex compliance — formulation must comply with EU restrictions on banned and restricted substances

Each is non-trivial. We'll go through them.

Responsible Person: The Foundation of EU Compliance

The single most important EU compliance requirement is having a Responsible Person physically based in the EU or EEA. The Responsible Person is the entity legally accountable for the product on EU territory. They handle CPNP notification, maintain the PIF, respond to authority inquiries, and coordinate any recalls.

Korean OEM manufacturers cannot serve as the EU Responsible Person — they're outside the EU. Brands have three options:

Option 1: Establish an EU subsidiary. If you have business reasons for an EU presence (warehouse, distribution, retail), this is the cleanest path. Your EU subsidiary is the Responsible Person and goes on every label.

Option 2: Use an EU-based distributor as Responsible Person. If you're selling through a single EU distributor (or through Amazon EU as the seller of record), they can act as Responsible Person if they agree. This works for some brands and not others — many large distributors decline to act as Responsible Person because of the legal liability.

Option 3: Hire a Responsible Person service. Specialized regulatory consultancies offer Responsible Person services for €1,500–€5,000 per year per product line. They handle CPNP notification, PIF maintenance, and act as the EU contact point. This is the most common path for international brands without EU operations.

The Responsible Person's name and EU address must appear on the product label. Without it, the product cannot be legally sold in the EU.

CPNP Notification: Pre-Market Required

Unlike the US, where you list products with the FDA after launch, the EU requires pre-market notification through CPNP (the Cosmetic Products Notification Portal). Every product must be notified before it's placed on the EU market.

CPNP notification requires:

Product category and intended use
Frame formulation (composition, with proprietary actives at exact percentages)
Toxicological profile of substances
Original packaging and labeling
Safety report summary
Responsible Person identification

The notification is electronic and free. Submission takes a few hours per product if you have the inputs ready. Korean OEM manufacturers provide the formulation and toxicological data; the Responsible Person submits the notification.

Notification doesn't equal approval — there's no EU regulatory body that "approves" your cosmetic. CPNP is a registry that authorities can query if there's an issue. But sale without notification is illegal and can trigger immediate withdrawal.

Product Information File (PIF): The 6-Year Dossier

Every cosmetic product sold in the EU must have a Product Information File maintained by the Responsible Person and available for inspection by EU authorities. The PIF is the comprehensive technical and safety dossier — far more detailed than the CPNP notification.

A complete PIF includes:

Product description and composition
Physico-chemical and microbiological specifications
Method of manufacture and GMP compliance statement
Cosmetic Product Safety Report (CPSR) — see next section
Proof of advertised effects (efficacy claims must be substantiated)
Animal testing data (or confirmation that no animal testing was conducted, since the EU bans animal testing for cosmetics)

The PIF must be kept for at least 10 years after the last batch was placed on the market. Korean OEM manufacturers provide most of the technical content; the Responsible Person assembles, maintains, and stores the file.

Cosmetic Product Safety Report (CPSR): The EU-Qualified Assessor

The single most distinctive EU requirement is the CPSR — a formal safety assessment conducted by a qualified safety assessor. The assessor must hold specific qualifications recognized in the EU (typically a degree in pharmacy, toxicology, medicine, or chemistry plus relevant experience).

The CPSR has two parts:

Part A: Safety information — composition, exposure assessment, toxicological profile, microbiological quality, packaging compatibility
Part B: Safety assessment — the assessor's professional opinion on the product's safety under normal and reasonably foreseeable use

The CPSR is the most-cited reason brands hire a Responsible Person service: most international brands don't have an EU-qualified safety assessor in-house. CPSR preparation costs €500–€2,500 per product depending on complexity. For a 5-product line, expect to budget €3,000–€10,000 for safety assessment.

Korean OEM manufacturers with EU export experience provide the input data (stability, microbial, toxicological); the assessor writes the report.

Annex Compliance: Restrictions That Differ from Korea

EU Regulation 1223/2009 maintains six annexes listing prohibited and restricted substances:

Annex II — over 1,300 substances banned outright in cosmetics
Annex III — substances permitted only under restrictions (concentration limits, warning labels, intended-use restrictions)
Annex IV — permitted colorants
Annex V — permitted preservatives
Annex VI — permitted UV filters

This is where Korean OEM formulations occasionally need adjustment for EU export. Several common Korean cosmetic ingredients face EU restrictions:

Preservatives. Some preservatives common in Korean and US cosmetics (methylisothiazolinone, certain parabens, formaldehyde-releasers) face EU restrictions or bans. Korean OEM factories with EU export experience use EU-compliant preservative systems by default, but this is worth confirming explicitly.

UV filters. Some Asian-market UV filters aren't EU-permitted, and vice versa. For sunscreens specifically, Korean factories targeting EU export use bemotrizinol, Tinosorb S/M, and other EU-approved filters. See our Korean Sunscreen OEM Guide.

Colorants. Permitted colorants in Korean cosmetics may not be on EU Annex IV. This is rare for skincare but common for color cosmetics.

High-concentration acids. Salicylic acid above 2% and glycolic acid above 10% face EU restrictions or warning-label requirements.

Botanical extracts. Certain plant extracts face EU restrictions due to allergen content (some essential oils require allergen labeling).

A pre-export review of your formulation against EU Annexes is standard at established Korean export-OEM factories. Smaller domestic-focused factories may not run this check unless you ask.

Labeling: Stricter Than Any Other Market

EU cosmetic labeling has more mandatory elements than any other major market:

Product name in the language(s) of countries where sold
Function ("face cream," "lotion," "shampoo")
Manufacturer or Responsible Person name and EU address
Country of origin if outside the EU ("Made in Korea")
Net content in metric units
Date of minimum durability ("best before") for products with shelf life under 30 months, OR
Period after opening (PAO) symbol for products with shelf life over 30 months
Batch code
List of ingredients in INCI format, in descending order of weight
Warnings and precautions as required by Annex III
Allergen declarations for 26 specified fragrance allergens above 0.001% (leave-on) or 0.01% (rinse-off) — being expanded to 80+ allergens under updated rules

Multilingual labeling is required if you sell across multiple EU countries. Country-specific language requirements vary — France and Germany are particularly strict about national-language labeling.

Korean OEM manufacturers with EU export experience handle compliant labeling as standard, but the Responsible Person must verify final artwork before launch.

Brexit: UK Now Separate

Since Brexit, the UK operates its own cosmetic regulation (the "UK Cosmetics Regulation") which is functionally identical to EU 1223/2009 but separately administered. UK products must be notified through the SCPN (Submit Cosmetic Product Notifications) portal and require a UK Responsible Person with a UK address.

For brands selling in both the EU and UK, you'll typically need both an EU Responsible Person and a UK Responsible Person — and notification through both CPNP and SCPN.

What Korean OEMs Provide vs. What You Provide

Korean OEM provides:

Formulation and INCI list
Stability and microbial test data
GMP certificate (ISO 22716)
Toxicological profile of formulation
Product specification sheet
Allergen content data
Manufacturing facility documentation

Brand / Responsible Person provides:

EU-based Responsible Person registration and EU address
CPNP notification submission
PIF assembly and maintenance
CPSR preparation (via EU-qualified safety assessor)
Compliant labeling artwork
Multilingual translations
Ongoing PIF updates (10-year retention)
Adverse event monitoring

Most brands handle the brand-side work through a Responsible Person service unless they have EU operations.

Common Mistakes That Cause Border Rejection

A few patterns that consistently cause problems at EU customs or post-market inspection:

No EU Responsible Person on the label. This is the single most common rejection reason. The Responsible Person's EU address must be on every product.

Missing or incorrect PAO symbol. EU buyers and authorities expect to see the open-jar symbol with a number (12M, 24M, etc.). Korean factories sometimes default to a "best before" date instead, which is non-compliant for shelf life over 30 months.

Allergen labeling gaps. The 26 specified fragrance allergens (linalool, limonene, citronellol, etc.) must be declared if above the threshold. Korean factories using fragrance compounds need to provide allergen content data; the Responsible Person ensures it's on the label.

Non-compliant preservatives. Methylisothiazolinone is restricted in leave-on cosmetics in the EU. Some Korean formulations using common preservative systems need adjustment for EU export.

Marketing claims without substantiation. "Anti-aging," "lifts," "reduces wrinkles" — efficacy claims must be substantiated in the PIF. Korean OEMs provide stability and stability data; substantiation of consumer-perception claims may require additional consumer testing.

Cost Budget: What EU Compliance Actually Costs

Realistic budget for an international brand launching a 5-product line in the EU through Korean OEM:

Responsible Person service: €5,000–€15,000/year for the line
CPSR preparation (5 products): €3,000–€10,000 one-time
CPNP notifications: free (free portal, time investment)
PIF preparation and assembly: €2,000–€5,000 one-time, plus ongoing maintenance
Multilingual labeling translations: €500–€2,000 per language
Total first-year compliance budget: €10,000–€30,000

After the first year, ongoing costs drop significantly — only the Responsible Person retainer and any new product additions.

Getting Started

EU compliance is achievable but requires either in-house regulatory capability or a Responsible Person service partner. Most Korean OEM-sourced brands take the partner route — it's faster and lower-risk than building EU regulatory expertise from scratch.

Start by deciding on your Responsible Person setup, choosing a regulatory consultancy if needed, and confirming your Korean OEM has EU export experience and provides EU-format documentation packages.

Submit your RFQ here and we'll match you with Korean OEM manufacturers experienced in EU export with full CPNP-ready documentation. Free for buyers.