PIF and CPSR are the two acronyms every new cosmetic brand meets in the same week, and they are confused constantly, not least by suppliers who sell one and call it the other. The confusion has consequences: makers buy a CPSR, believe they are compliant, and discover at a marketplace audit or a Trading Standards visit that they have no Product Information File. Both are required by Regulation (EC) No 1223/2009 and its UK equivalent, the Cosmetic Products Enforcement Regulations 2013, under different articles, and both must be available to the Office for Product Safety and Standards or an EU authority on request.

This article draws the line clearly: what each document is, what goes in each, who produces and keeps them, how long, how they relate to notification, and the mistakes that leave brands with one and not the other.

The relationship in one picture

Think of the PIF as a filing cabinet with five drawers and the CPSR as the largest and most important thing in the second drawer. The other four drawers hold the product description, the manufacturing method and GMP statement, the claims evidence, and the animal testing data. Take the CPSR out and the cabinet is useless; keep only the CPSR and you have no cabinet. The law asks for the cabinet, fully stocked.

What the CPSR is

The Cosmetic Product Safety Report is the scientific cosmetic safety assessment of the product, required by Article 10 and laid out in the format of Annex I. Part A collects the safety information: the quantitative and qualitative composition of the formula, physical and chemical characteristics, stability test results, microbiological quality, impurities, packaging material, normal and reasonably foreseeable use, exposure to the cosmetic product, the toxicological profile of each ingredient and any undesirable effects reported. Part B is the assessment: the qualified safety assessor's reasoning on systemic exposure, the margin of safety calculated for each ingredient, the assessment conclusion, any labelled warnings and instructions required on pack, and the safety assessor's credentials and signature. Only a person with a recognised qualification in pharmacy, toxicology, medicine or a similar discipline may carry out and sign Part B. Phoenix produces the CPSR as a single variant or multiple variant report.

Post-launch, the assessor's conclusions also guide how the Responsible Person handles feedback: the file should log any undesirable effects and serious injuries reported by users, and any serious undesirable effects must be reported to the competent authority and can trigger a CPSR review.

What the PIF is

The Product Information File is the complete compliance file for the product, required by Article 11. It contains the CPSR and four further categories of information: a description of the product that links the file to what is on the shelf, the method of manufacture with a statement of compliance with good manufacturing practice, proof of the effect claimed where the nature of the claim justifies it, and data on any animal testing. It is kept by the Responsible Person, at the address on the label, for ten years after the last batch is placed on the market, in a language the authority can read. Our Product Information File service assembles it, and our free PIF template shows the structure.

Side by side

Who does what

The division of labour is clear once the two are separated. The safety assessor writes the CPSR; they cannot write your PIF for you, because most of it is your own information: how you make the product, what you claim, what your suppliers have told you about animal testing, and what your label says. The Responsible Person, which may be you or an appointed service, assembles the PIF, holds it and keeps it current. If you use an external Responsible Person, you still have to supply them with the manufacturing records, claims evidence and label artwork; they cannot invent those either.

For makers selling in both the UK and EU, a Responsible Person established in each market must hold the file, which is what our UK and EU Responsible Person services provide.

Where notification fits

Notification is the third leg. Before a product is placed on the market it must be notified through SCPN in Great Britain and CPNP in the EU, with information including the product category, frame formulation, label and Responsible Person. Notification does not upload the CPSR or the PIF, but it presupposes both: you are declaring a product for which a safety assessment exists and a file is held. The notification references then go into the PIF's description section. A brand with a notification but no PIF, or a PIF with no notification, is non compliant either way.

How the two stay in step

Changes flow between them. Change a fragrance supplier and the CPSR needs an addendum covering the new fragrance allergens, the label may need new allergen declarations, and the PIF needs the new supplier documents, the new artwork and a change log entry. Add a claim to the packaging and the PIF's claims section needs evidence, and the assessor may need to confirm the claim is consistent with the assessment. A regulatory restriction on an ingredient you use triggers a CPSR review, which triggers a PIF update. Neither document is finished at launch.

Why the confusion exists

Part of the confusion is historical and part is commercial. Before the current regulation, some markets required only a safety assessment, and older guidance and forum posts still describe the CPSR as if it were the whole obligation. Commercially, the CPSR is the product that compliance providers sell and price, so it is the term that appears on quotes and invoices, while the PIF is largely the maker's own work and rarely appears as a line item. Some providers also deliver a CPSR in a binder labelled Product Information File, which is well intentioned but leaves the maker believing the file is complete when three or four sections are still theirs to fill. Knowing that the two are separate obligations, produced by different people, is the single most useful correction a new brand can make.

Which comes first: a practical sequence

New brands often ask whether to start with the PIF or the CPSR. Start with the raw materials for both. As you formulate, collect the Safety Data Sheets, specifications, IFRA certificates and allergen statements; these feed the CPSR and are filed in the PIF. Draft the label and list your claims, because the assessor needs them and the PIF needs evidence for them. Commission the CPSR. While the assessor works, write your manufacturing method, GMP statement and batch record template. When the signed CPSR arrives, finalise the label with the required warnings, file everything into the five section structure, sign the animal testing statement, notify through SCPN or CPNP, and record the references in the file. In practice the two documents are built in parallel and meet at the moment the CPSR is signed.

Cost and time for each

The CPSR is the professional service you pay for: a qualified assessor's time to review the formula, gather toxicological data, calculate exposure and margins of safety, and sign. Its cost scales with the complexity of the formula and the number of variants, and its timeline is driven by how complete your supplier documents are. The PIF costs mainly your own time, unless you have it assembled for you, and its timeline is set by how organised your records already are. Makers who treat the two as one purchase are usually surprised that the CPSR arrives and the file is still empty; makers who understand the split have the file three quarters built before the assessment is finished.

The Product Information File service exists for makers who would rather have the assembly done professionally, and it is priced separately from the CPSR for exactly this reason.

Private label brands: whose documents are they?

The split is sharpest for private label. A brand buying a finished product from a contract manufacturer and selling it under its own name is the Responsible Person, so the PIF is the brand's obligation. The manufacturer may already hold a CPSR for the base formula, but the brand must check that it covers the product as actually sold, with the brand's fragrance, packaging and label, and obtain either that report or a new one. The manufacturer supplies the manufacturing method, GMP statement and batch records; the brand supplies the label, claims evidence and notification. Agree all of this in the supply contract, because a manufacturer who will not share documents leaves the brand unable to build a compliant file.

What authorities and marketplaces actually ask for

A Trading Standards officer or OPSS will ask the Responsible Person for the Product Information File for a named product, and within it will look first at the CPSR, the label artwork and the claims evidence. A marketplace such as Amazon typically asks the seller for the CPSR and evidence of notification, and increasingly for the PIF or a declaration that it is held. A retailer's buying team may ask for all three as part of onboarding. The pattern is consistent: the CPSR is the document everyone recognises, but the request is for the file, and the CPSR on its own does not satisfy it.

A quick check: do you have both?

• You have a signed Part B from a qualified assessor covering every variant you sell. That is your CPSR.
• You have a file with a product description and artwork, the CPSR, a manufacturing method with GMP statement and batch records, a claims table with evidence, and an animal testing statement. That is your PIF.
• The file is at the Responsible Person's address on the label and has a dated change log. That is compliance.
• You have notified through SCPN or CPNP and recorded the references in the file. That completes the chain.

Common mistakes

• Buying a CPSR and stopping. The most common gap: a signed assessment, no file around it.
• Thinking the assessor's PDF is the PIF. Some providers deliver a CPSR labelled as a PIF; check it contains all five sections and your own records.
• Holding the PIF in the wrong place. It must be at the Responsible Person's address on the label, not on a laptop elsewhere.
• Never updating either. Both must reflect the product as sold today.
• Notifying without the documents. Notification is a declaration that the assessment and file exist; make sure they do.

The all in one compliance pack delivers CPSR, PIF and SCPN notification together, so the three legs are built to match from the start, and a label and packaging review confirms the artwork in the file matches the product on the shelf.

Related reading on the Phoenix blog

• TRA vs CPSR: which safety assessment does your product need?
• CPSR for body mist
• CPSR for whipped soap
• All regulatory compliance articles

Phoenix services mentioned in this article

• Product Information File, single product
• Cosmetic Product Safety Report, single variant
• Cosmetic Product Safety Report, multiple variants
• All in one compliance pack: CPSR, PIF, SDS, SCPN
• UK and EU Responsible Person services
• Label and packaging review
• Expert regulatory consultation
• Contact Phoenix

Official sources and legislation

• Regulation (EC) No 1223/2009 on cosmetic products, Article 11 and Annex I
• Cosmetic Products Enforcement Regulations 2013
• Office for Product Safety and Standards
• Submit cosmetic product notifications (SCPN)
• European Commission cosmetics pages

About the author

Disclaimer: This article is general information, not legal advice. Regulations change and product decisions depend on your exact formulation, claims and market. Have your product assessed by a qualified professional before sale.