Can I appeal an enforcement notice?

Yes. Under regulation 14 the Responsible Person, a distributor or anyone with an interest in the product can apply to court within 21 days of the notice being served. The court can set it aside only if there was no breach or the measures were out of proportion, so fixing the underlying issue is usually the better route.

OPSS Enforcement: UK CPSR Fines & How to Avoid Them

The short answer

OPSS is the UK's national product safety regulator, but the day-to-day enforcement of cosmetics law in Great Britain is done by local Trading Standards. Most cases start with a written request for your Product Information File. Trouble follows when the CPSR is missing, out of date, or signed by someone without the qualification Article 10 requires, or when the product was never notified on SCPN. Officers can then require withdrawal or recall, seize stock and prosecute, and the courts can impose fines and, for the most serious breaches, up to twelve months in prison.

Key takeaways

OPSS sets national policy, runs SCPN and receives serious undesirable effect reports. Local Trading Standards does most of the checking and prosecuting.
Nearly every case starts with a request for the Product Information File, so a complete, current PIF is your best protection.
Penalties under regulation 13 of the Enforcement Regulations are criminal: fines and, for breaches such as unsafe products or a missing safety assessment, up to twelve months' imprisonment.
Failing to notify on SCPN or keep a proper PIF is an offence in its own right, even if the product is safe.
A formula or supplier change that never reached your safety assessor is the most common gap we find.
Northern Ireland follows EU rules, so it needs CPNP and a Responsible Person in Northern Ireland or the EU.

Most brands only find out how UK cosmetics enforcement works on the day a Trading Standards officer emails to ask for their Product Information File. By then the question is no longer whether the paperwork exists, but whether it matches the product sitting on the shelf. This guide walks through who actually enforces the rules, what starts an investigation, what the law allows officers to do, and the specific gaps that turn a routine document request into a withdrawal, a recall or a prosecution.

It covers Great Britain, where Regulation (EC) No 1223/2009 as retained in UK law works alongside the Cosmetic Products Enforcement Regulations 2013. Northern Ireland follows the EU rules under the Windsor Framework, which we come back to near the end.

Who enforces cosmetics law in the UK: OPSS or Trading Standards?

Both, but they do different jobs, and confusing them leads brands to worry about the wrong thing.

The Office for Product Safety and Standards (OPSS) sits within the Department for Business and Trade. It is the national product safety regulator. For cosmetics it publishes the GB guidance, runs the Submit Cosmetic Product Notifications (SCPN) service, receives reports of serious undesirable effects and coordinates national work on product safety.

The day-to-day enforcement, though, is local. Regulation 6 of the Enforcement Regulations puts the duty to enforce the Cosmetics Regulation, and to carry out market surveillance, on the enforcement authority, which in Great Britain means your local authority Trading Standards service. In practice the officer who asks for your PIF, buys a sample from your website or visits your unit will almost always be from Trading Standards, often the team covering the address on your label.

So when people talk about "OPSS enforcement", they usually mean the whole system: OPSS setting the rules and holding the national data, and Trading Standards checking products and taking action.

How an investigation usually starts

Very few cases begin with an officer picking a brand at random. The common triggers are more mundane:

A consumer complaint. Someone has a reaction, or simply notices the label has no Responsible Person address, and reports it to Citizens Advice or Trading Standards.
A serious undesirable effect report. A reaction serious enough to cause hospitalisation, lasting harm or temporary functional incapacity must be reported to OPSS, and that report points straight back to the product and its Responsible Person.
A market surveillance project. Trading Standards teams run sampling projects on product types such as skin lighteners, nail products or children's cosmetics, and test what they buy.
A missing notification. A product found on sale with no matching SCPN record is an easy flag to raise.
A competitor or marketplace query. Rival brands do report each other, and online marketplaces ask sellers for compliance details when listings are reported.

Whatever the trigger, the first written request is nearly always the same: show us the Product Information File, including the safety report, for this product.

What officers will ask to see

Under Article 11 the Responsible Person must keep a PIF for each product and make it readily accessible to the authorities, in electronic or other format, at the address on the label. It has to be kept for ten years after the last batch was placed on the market. It contains:

a description of the product, clear enough to link it to the file;
the Cosmetic Product Safety Report, Part A (safety information) and Part B (the assessor's conclusion and signature);
a description of the method of manufacture and a statement of compliance with good manufacturing practice;
proof of any effect claimed for the product;
data on any animal testing carried out by the manufacturer, its agents or suppliers.

An officer reading your file is really asking three questions. Does a signed safety report exist? Does it describe the formula that is actually in the jar? And can the person who signed Part B lawfully sign it? Article 10 requires the assessor to hold a diploma or similar formal qualification from a university course in pharmacy, toxicology, medicine or a similar discipline. A report signed by someone without that background fails at the first hurdle, however polished it looks. Our guide on who can sign a CPSR covers this in detail.

From the assessor's desk

The mismatch we see most often is not a missing report. It is a report written for last year's formula. A candle and soap maker swaps to a cheaper fragrance oil, or a skincare brand changes preservative supplier during a shortage, and nobody tells the assessor. The CPSR still lists the old ingredients and the old allergen calculation, so on paper the product on sale has never been assessed.

What the law lets enforcement officers do

The Enforcement Regulations give officers a graded set of tools. Which one they reach for depends on how serious the risk is and how the business responds.

Action	What it means for you
Written request for information	You are asked to produce the PIF or other documents and to cooperate. Most cases start and end here if the file is in order.
Notice requiring corrective action (Article 25)	The Responsible Person must bring the product into compliance, withdraw it or recall it within a set time. The notice must be in writing and give reasons.
Safeguard measures (Article 27)	Where a product that appears compliant still presents a serious risk to health, the authority can restrict it or have it withdrawn or recalled.
Seizure and detention	Officers can buy, seize and test samples, and detain stock while they investigate.
Prosecution	Breaching the key articles of the Regulation is a criminal offence, punishable by a fine and, for the most serious breaches, imprisonment.

You can challenge a notice. Regulation 14 lets the Responsible Person or distributor apply to court to vary or set it aside within 21 days of it being served. The court will only set it aside if there was no breach or the measures were out of proportion, so an appeal is not a substitute for fixing the file.

Fines and penalties: what the regulations actually say

Search results are full of large, round "OPSS fine" figures that do not come from the legislation. The real penalties sit in regulation 13 of the Cosmetic Products Enforcement Regulations 2013, and they are criminal penalties imposed by a court, not fixed fines issued by OPSS.

The most serious group covers breaches of Articles 3 (safety), 5 and 6 (Responsible Person and distributor duties), 7, 10 (the safety assessment), 14 and 15 (restricted and CMR substances), 18, 19 (labelling), 20 (claims) and 23 (serious undesirable effects). These can be tried in the magistrates' court, with a fine and up to three months' imprisonment, or in the Crown Court, with a fine and up to twelve months' imprisonment.
A second group covers Articles 11 (the PIF), 13 (notification), 16, 21 and 24. These are summary offences carrying a fine at level 5 on the standard scale and up to three months' imprisonment.

Two points surprise people. First, failing to notify a product, or failing to keep a proper PIF, is an offence in its own right, even if the product is perfectly safe. Second, the fine is often the smaller cost. Recalling stock, destroying it, relabelling, pausing sales and handling customer questions usually cost far more, and a public recall notice stays searchable long after the case is closed. Our step-by-step guide to withdrawing or recalling a cosmetic product explains what that process involves.

The Responsible Person carries the risk

Every cosmetic product placed on the GB market needs a Responsible Person established in the UK. If you make and sell your own products from a UK address, that is normally you. If you import from the EU, the US or anywhere else, you need a UK-based Responsible Person named on the label before the first unit is sold.

Enforcement letters go to the Responsible Person because Article 5 makes them answerable for safety, the safety assessment, the PIF, the notification, the label, the claims and reporting of serious undesirable effects. Distributors and retailers have their own, narrower duties under Article 6, such as checking the label and the language before selling. If you are not sure who holds the role for each of your products, read Responsible Person obligations and penalties before you need to.

Notification is a separate requirement from the CPSR

A valid safety report does not notify your product. Before a cosmetic is placed on the GB market, the Responsible Person must submit a notification through SCPN, the UK's own portal, which replaced the EU's CPNP for Great Britain after Brexit. The record includes the product category, name, Responsible Person details, frame formulation or exact formula, and details of any nanomaterials or CMR substances.

Brands that sell in both markets often assume their CPNP entry covers the UK. It does not. See what SCPN is for the details of each field.

Six gaps that turn a routine request into enforcement

1. The formula changed and the CPSR did not

Any change to the ingredients or their concentrations needs the assessor's sign-off, and a change of raw material supplier needs checking too, because a different grade or impurity profile can change the assessment. Keep a simple change log and send it to your assessor before the new batch goes on sale, not after.

2. The assessor is not qualified to sign

Low-cost reports bought online are sometimes signed by people without the Article 10 qualification, or by no named person at all. Ask for the assessor's name and qualification before you pay, and check that both appear in Part B.

3. Part A is thin

Part A must hold real data: quantitative composition, physical and chemical stability, microbiological quality and challenge test results for water-based products, impurities, packaging, exposure and the toxicological profile of each ingredient. Generic statements copied between products do not survive scrutiny. Our breakdown of CPSR Part A shows what each section should contain.

4. Small or online-only sellers assumed they were exempt

There is no volume threshold and no exemption for selling only online, at craft fairs or on social media. A single bath bomb sold to the public needs the same documents as a supermarket range.

5. The product was never notified

This is one of the quickest breaches to prove, because the authority can check SCPN in minutes. It is also one of the quickest to fix if you catch it first.

6. The label does not match the file

The Responsible Person name and address, the ingredient list in INCI names, the nominal content, the batch code, the date of minimum durability or period after opening, and any warnings set out in the CPSR all have to appear on the pack. A warning the assessor required that never made it onto the label is a common finding.

What changed in 2026, and what did not

The core framework is unchanged: the same Regulation, the same Enforcement Regulations, the same Responsible Person model. What keeps moving is the ingredient annexes. In Great Britain, the Cosmetic Products Regulation (EC) No 1223/2009 (Restriction of Chemical Substances) (Amendment and Transitional Provisions) (No. 2) Regulations 2026 do two things. From 15 August 2026, hexyl salicylate (a common fragrance ingredient) is restricted under Annex 3, with concentration limits that depend on product type. From 23 March 2027, a further group of substances classified as carcinogenic, mutagenic or toxic for reproduction (CMR) is banned under Annex 2, and products containing them that were placed on the market before that date can only be sold until the end of 22 September 2027.

Changes like these are why a CPSR is not a one-off purchase. A report that was correct when it was signed can fall out of date when an ingredient it relies on is banned or restricted. Checking your formulas against each new amending instrument is the cheapest form of enforcement protection there is.

How to prepare before anyone asks

None of this needs a legal team. It needs a file you can produce in an afternoon. For each product:

Keep the full PIF in one folder, with the signed CPSR, the GMP statement, the claims evidence and the SCPN reference.
Check the CPSR against the current formula and supplier list at least once a year, and every time either changes.
Compare the printed label with the CPSR's Part B warnings and conditions of use.
Keep a log of complaints and reactions, and know how to report a serious undesirable effect to OPSS.
Confirm who the Responsible Person is, and that their address on the label is where the PIF can be produced.
Diary a quick check against new GB amending regulations every few months.

If an officer does get in touch, reply promptly, send what was asked for, and keep a record of what you sent and when. Our article on what happens during a Trading Standards inspection walks through the visit itself.

Great Britain, Northern Ireland and the EU

Requirement	Great Britain	Northern Ireland and the EU
Law	Retained Regulation 1223/2009 as amended in GB, plus the Enforcement Regulations 2013	EU Regulation 1223/2009 as amended in the EU
Notification	SCPN	CPNP
Responsible Person	Established in the UK	Established in Northern Ireland or the EU
Who enforces	Local Trading Standards, with OPSS as national regulator	Local councils in Northern Ireland; national authorities in each EU member state

If you sell in more than one of these markets, you need a compliant setup in each. The safety assessment can often be prepared to cover both, but the notification, the Responsible Person and sometimes the ingredient rules differ. Our guide to selling cosmetics in Northern Ireland covers the Windsor Framework side.

The bottom line

UK cosmetics enforcement is not about one big fine. It is a process that starts with a document request and escalates only when the documents are missing, out of date or signed by the wrong person. Brands that keep a current, signed CPSR, a tidy PIF, a live SCPN notification and a label that matches the file rarely get past the first letter. If you are not sure your existing reports would hold up, have them reviewed now, while fixing them is still your choice and not an officer's deadline.

Myths we hear

Enforcement only targets large brands. Trading Standards acts against businesses of every size, and small brands are often less prepared.
OPSS issues fixed fines for cosmetic breaches. Penalties are criminal and set by a court under regulation 13. Notices to withdraw or recall usually come first.
Any CPSR is fine as long as it is signed. Part B must be signed by an assessor with the qualification Article 10 requires, and it must describe the formula you actually sell.
Our EU CPNP notification covers the UK. Great Britain needs its own SCPN notification and a UK Responsible Person.
Selling only online keeps us under the radar. Online sales are covered by the same rules, and complaints and marketplace reports often start investigations.

What to do this week

Pull the CPSR for each product and check that it matches the current formula and suppliers.
Confirm the assessor who signed Part B holds an Article 10 qualification.
Check every product has a live SCPN notification for Great Britain.
Compare each label with the warnings and conditions of use in the CPSR.
Put the full PIF where it can be produced quickly at the Responsible Person's address.
Check your formulas against new GB amending regulations, including SI 2026/109.

Frequently asked questions

What does OPSS do for cosmetics in the UK?

The Office for Product Safety and Standards is the national product safety regulator, part of the Department for Business and Trade. For cosmetics it publishes guidance for Great Britain, runs the SCPN notification service, receives reports of serious undesirable effects and coordinates national product safety work. Routine inspections and prosecutions are mostly handled by local Trading Standards.

Does OPSS fine cosmetic brands directly?

Not in the way the term suggests. Breaching the Cosmetics Regulation is a criminal offence under the Cosmetic Products Enforcement Regulations 2013, so penalties are imposed by a court after a prosecution, usually brought by Trading Standards. Before that stage, officers more often use written notices requiring corrective action, withdrawal or recall.

What are the penalties for selling non-compliant cosmetics in the UK?

Under regulation 13, breaches of key articles such as product safety, the safety assessment, labelling, claims and serious undesirable effect reporting can lead to a fine and up to three months' imprisonment in the magistrates' court, or a fine and up to twelve months in the Crown Court. Failures over the PIF or notification carry a fine and up to three months.

Do small or online-only cosmetic sellers need a CPSR?

Yes. There is no turnover threshold and no exemption for selling online, at markets or through social media. Every cosmetic product supplied to consumers in Great Britain needs a signed CPSR, a Product Information File, a UK Responsible Person and an SCPN notification.

Do I need a new CPSR if I change my formula or supplier?

Any change to the ingredients or their concentrations needs your safety assessor to update the report. A change of raw material supplier should also go to the assessor, because a different grade or impurity profile can affect the assessment. Whether it needs a full new report depends on what changed.

Official sources and legislation

#Compliance #CPSR #Fines and penalties #OPSS #Trading Standards #UK cosmetics enforcement #UK Cosmetics Regulation

Written by

Syed Muhammad Shamuel Shees

Founder & Lead Compliance Consultant

Phoenix Safety Consultants is a cosmetic compliance consultancy with offices in London, Tallinn and Pensacola. Our safety assessors and toxicologists prepare CPSRs, Toxicological Risk Assessments, PIFs, SDSs and UK/EU notifications for brands of every size. Talk to the team on WhatsApp or at compliance@phoenixcosmeticsafety.com.

This article is general information, not legal advice. Regulations change and product decisions depend on your exact formulation, claims and market. Have your product assessed by a qualified professional before sale.

OPSS Enforcement UK: CPSR Compliance, Fines & How to Avoid Penalties (2026)