Is There a CPSR Certificate? What a CPSR Is Not, and What It Does Not Cover

Every few weeks a client forwards us a version of the same email. A retailer or marketplace wants "your CPSR certificate and your OPSS approval number" before the listing can go live. The brand usually has a perfectly good safety report. What it does not have is a certificate or an approval number, because neither exists, and it has often lost days trying to get one.

That email sums up most of the confusion around the Cosmetic Product Safety Report. The report itself is well defined in law. The words people wrap around it are not. Suppliers advertise "CPSR approved" recipes, websites show "CPSR certified" badges, and makers who have paid for a report believe they now hold a licence. This guide goes through the misconceptions one by one: what a CPSR is not, what it leaves for you to do, and what you can actually send when someone asks for a certificate. If you want the basics first, start with our guide to what a CPSR is.

What the law actually asks for

Article 10 of Regulation (EC) No 1223/2009 says the Responsible Person must make sure, before a cosmetic is placed on the market, that it has undergone a safety assessment and that a cosmetic product safety report "is set up in accordance with Annex I". The GB version of the Regulation uses the same wording, and in Great Britain it is enforced through the Cosmetic Products Enforcement Regulations 2013, mostly by Trading Standards.

Annex I describes a report in two parts. Part A collects the safety information: composition, stability, microbiological quality, impurities and packaging, use and exposure, the toxicological profile of each substance, undesirable effects and any other relevant data. Part B is the assessment: a conclusion on safety, a statement on the warnings and instructions the label needs, the scientific reasoning, and the assessor's name, address, proof of qualification, date and signature. Article 10(2) sets the qualification: a university diploma in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent. Our article on who can sign a CPSR covers that in detail.

So the legal requirement is a report, written and signed by a qualified person and held by the Responsible Person. Everything below follows from that.

A CPSR is not a certificate

A certificate normally means a body you can name has checked something against a standard, issued a document with a number, and kept a register you can look it up in. None of that exists for a CPSR. There is no certifying body, no CPSR register, no mark, no accreditation and no status called "CPSR certified". The report is a piece of expert work owned by the Responsible Person and shown to the authorities when they ask for it.

That has two practical consequences. First, if a provider sells you a "CPSR certificate" on its own, ask what sits behind it. What matters is a full Annex I report, with Part A and a signed Part B, for your exact formula. A one page certificate with a logo is decoration. Second, a "CPSR certified" badge on your website suggests an external certification that does not exist. That is the kind of claim a Trading Standards officer, a marketplace reviewer or a competitor can pick apart.

Why the certificate mindset causes trouble later. People file certificates and forget them. A CPSR cannot be treated like that. Article 10(1)(c) requires the report to be kept up to date as new relevant information appears after the product goes on sale, and the Commission guidelines on Annex I (Implementing Decision 2013/674/EU) repeat the point. A new supplier, a reformulation, a new Annex III restriction or a complaint pattern can all mean the report needs revising. Our guide to CPSR updates and renewals explains when that happens.

Not a licence, a registration or a government approval

Nobody approves your cosmetic before you sell it. The UK and EU system has no pre-market approval for cosmetics at all. The Responsible Person carries the duty to hold the evidence of safety and to produce it on request, and nobody reads your report unless they come asking.

Notification is where most people get confused. Before sale, the Responsible Person submits product details through the CPNP in the EU or the Submit Cosmetic Product Notifications service (SCPN) in Great Britain. Article 13 lists what goes in, including the product category and name, the Responsible Person, the address where the PIF is kept, an emergency contact, nanomaterial and CMR details where relevant, and the frame formulation. The CPSR is not uploaded and nobody evaluates it. What you get back is a reference, not a licence. We cover this in why CPNP notification is not approval.

This is also a claims issue. The common criteria for cosmetic claims in Regulation (EU) No 655/2013, which also apply in Great Britain as assimilated law, say that claims indicating the product has been authorised or approved by a competent authority are not allowed. "OPSS approved" or "EU approved" on a pack is a non compliant claim as well as an untrue one.

Not a lab test

A CPSR is an assessment of evidence. The assessor may ask for tests to complete Part A, most often a preservative challenge test and stability data for water based products, and the challenge test result is named in Annex I itself. Those tests are inputs. A clean lab report is not a CPSR, and you cannot sell a cosmetic on test results alone. We have a separate article on whether a CPSR is a test, which explains which tests come up and how they affect your timeline, so we will not repeat it here.

Not a guarantee, and not insurance

Part B concludes that the product is safe for human health when used under normal or reasonably foreseeable conditions, as Article 3 requires. That conclusion holds for the product described in Part A. It does not promise that no customer will ever react, and it does not move legal responsibility to the assessor. Article 5 keeps the duties with the Responsible Person: compliance, corrective action, withdrawal or recall where needed, and cooperation with the authorities.

Nor is it a policy. Insurers usually want to see your CPSR before they quote for product liability cover, but the report pays nothing if a claim arrives. The two do different jobs, as our guide to CPSR and product liability insurance explains.

Not transferable to a different formula, supplier or market setup

A CPSR covers one product as described: the exact formula, the named raw materials, the packaging, the intended use and the warnings set out in Part B. The Commission guidelines ask for the exact quantitative composition, and say ranges should not be used unless justified. Change any of those and the report may no longer fit what you sell.

This matters most with ready made reports. Some providers sell a pre written CPSR for a standard recipe, such as a cold process soap or a basic lip balm, and the buyer licenses the right to rely on it. That can be legitimate and cheap, but only if you make the product exactly as specified. Swap the shea butter supplier, change the fragrance, add a mica, raise a percentage, use a different jar or add a claim the assessor never considered, and the report describes a different product. You also still need the PIF, the notification, a compliant label and your own Responsible Person arrangements, none of which come with the purchase. Check Part B for a named, qualified assessor exactly as you would for a bespoke report.

The same thinking applies to ranges and markets. Several shades or scents can sit in one report only if each variant is assessed in it; see one CPSR for all variations. A single report can serve both Great Britain and the EU, but only if it addresses both rule books, which have started to diverge; see one CPSR for the UK and EU. And a report written for the original brand owner does not automatically pass to a new private label owner; see private and white label compliance.

How a CPSR differs from the documents it gets confused with

Marketplaces, retailers and carriers often use the names of these documents loosely. Here is what each one is and whether it can replace the CPSR.

Document	What it actually is	Who produces it	Can it stand in for a CPSR?
CPSR	The Annex I safety report: Part A (safety information) and Part B (the assessor's signed conclusion)	A qualified safety assessor, for the Responsible Person	It is the CPSR
Product Information File (PIF)	The full technical file: product description, CPSR, manufacturing method and GMP statement, proof of claimed effects, animal testing data	The Responsible Person	No. It contains the CPSR
CPNP or SCPN notification	An online submission of product details before sale. It produces a reference, not an approval	The Responsible Person (and in some cases distributors)	No. It assumes the CPSR already exists
Toxicological Risk Assessment (TRA)	A safety assessment for non cosmetic consumer products such as candles, wax melts and room sprays	A toxicologist or assessor	No. Wrong legal framework for a cosmetic
Safety Data Sheet (SDS)	A 16 section hazard communication document for chemicals moving through the supply chain	The supplier of the substance or mixture	No. Finished cosmetics are outside the SDS duty
Certificate of analysis	A lab result for one batch of a raw material or product	A supplier or laboratory	No. It is an input to Part A
Challenge test report	A preservative efficacy result, usually to ISO 11930	A laboratory	No. It is an input to Part A
IFRA certificate	The fragrance supplier's statement of the maximum use level per IFRA category	The fragrance supplier	No. It is an input to Part A

Two of these cause the most trouble. The PIF under Article 11 contains the CPSR, so a CPSR on its own is not a PIF (see PIF vs CPSR and our PIF template and checklist). And the SDS duty under REACH does not apply to cosmetics in their finished state intended for the final user, because Article 2(6)(b) of REACH excludes them from Title IV. Marketplaces and carriers still ask for one for transport and hazmat screening, which is a commercial requirement, not a cosmetics law one. Our articles on whether cosmetics need an SDS and TRA vs CPSR cover those boundaries.

What a signed CPSR does not cover

Even a complete, well argued report leaves large parts of compliance with you, because they are not the safety assessor's job. These are the gaps we see most often after a report is signed.

• Good manufacturing practice. The assessment assumes the product is made hygienically and consistently to the stated formula. It does not inspect your process. The PIF needs a description of the manufacturing method and a statement of GMP compliance, and that is your work. Our plain English guide to GMP and ISO 22716 is a good starting point.
• Most of the label. Part B states which particular warnings and instructions of use the label needs. Everything else in Article 19 is yours to get right: the Responsible Person's name and address, the country of origin for imported products, the nominal content, the date of minimum durability or period after opening, the batch number, the function where it is not obvious and the ingredient list in the correct order. Fragrance allergen declarations come from the labelling rules and Annex III, not from Part B, although a good assessor will flag them. See our guide to a compliant cosmetic label.
• Proof of your claims. The assessor reads your claims because they affect use and exposure, for example "suitable for babies" or "use daily all over the body". Proving that a cream reduces the look of fine lines is a separate obligation. Article 11 puts the proof of the claimed effect in the PIF, and the evidence must meet the common criteria. See cosmetic claims and the common criteria.
• Notification. SCPN in Great Britain and the CPNP in the EU are separate submissions made before sale. See how to notify a cosmetic product.
• The rest of the PIF. The product description, manufacturing method and GMP statement, proof of effect and animal testing data all sit alongside the CPSR. The PIF has to be kept for ten years after the last batch is placed on the market, at the address given for it, in English for Great Britain and in a language the relevant EU authority can easily understand.
• Responsible Person duties. Keeping the file current, recording undesirable effects and reporting serious ones, answering authority requests and recalling products when needed are ongoing duties the report does not discharge. See cosmetovigilance and undesirable effect reporting.
• Other law. Packaging and waste rules, weights and measures, consumer protection law, transport rules for flammable products and marketplace policies all apply on their own terms.

Words to stop using, and what to say instead

This is not pedantry. A shopper who reads "CPSR certified" will reasonably assume an independent certification, and a maker who believes the product is "approved" behaves very differently from one who knows they hold the evidence and the responsibility.

What people write	The problem	What to write instead
CPSR certified, CPSR certificate	No certification scheme or certifying body exists, so the phrase implies something that is not there	"A CPSR has been completed by a qualified safety assessor" (in documents for buyers, not as a consumer claim)
CPSR approved, OPSS approved, EU approved	Common criterion 1 of Regulation (EU) No 655/2013 bars claims that a product has been authorised or approved by a competent authority	Nothing. There is no approval to mention
Registered with OPSS, CPNP registered	Products are notified, not registered or approved	"Notified on SCPN" or "notified on the CPNP", in trade documents
Safety tested, CPSR tested	The CPSR is an assessment, not a test, and "tested" claims need test evidence behind them	Name the actual test only if it was done and supports a claim
Safety assessed (as a selling point on pack)	Common criterion 1 also bars claims that present mere legal compliance as a special benefit. Every cosmetic on sale must be safety assessed	Leave it off the pack. Use it only to answer a buyer's compliance question

What to send when someone asks for a "CPSR certificate"

Retailers, distributors and marketplaces usually ask for a certificate because they want proof that the legal work has been done, not because they need a particular document. In practice the following answers almost every request, without handing over your full formula:

• A short letter or email from the Responsible Person confirming that a CPSR has been completed under Annex I of the relevant Regulation, naming the product, the date of the report and the safety assessor.
• The Part B conclusion page, if the buyer insists on seeing the assessor's signature. Keep Part A, which contains your full quantitative formula, confidential unless there is a good reason to share it.
• The notification reference from SCPN or the CPNP, and the Responsible Person's name and address as shown on the label.
• An SDS or transport document if the request is really about shipping or hazmat screening. Our guide to Amazon SDS requirements explains what Amazon looks for.

If the buyer comes back asking for an "approval number", explain politely that the UK and EU have no approval system for cosmetics and send the notification reference instead. Most compliance teams accept that straight away once it is put plainly.

Related reading

• What is a CPSR? The complete UK and EU guide
• Is a CPSR a test? The CPSR test myth explained
• CPNP registration: why notification is not approval
• PIF vs CPSR: what goes where
• Who can sign a CPSR?
• CPSR renewal and updates
• Cosmetic claims and the common criteria
• Who needs a CPSR, and when?
• All regulatory compliance articles

Myths we hear

• I need a CPSR certificate to sell. You need a CPSR. No certificate exists. A full Annex I report with a signed Part B is what an inspector will ask for.
• Once my product is notified, it is approved. Notification is a submission of product details. Nobody evaluates the product or the report, and you get a reference, not an approval.
• A ready made CPSR covers my version of the recipe. It covers the exact formula, suppliers, packaging and use it describes. Any change can take your product outside it.
• My assessor is responsible if something goes wrong. The Responsible Person keeps the legal duties under Article 5, including corrective action and recalls.
• Putting "safety assessed" on the label builds trust. Every cosmetic must be safety assessed, so presenting it as a benefit runs against the common criteria for claims.

What to do this week

1. Search your website, listings and packaging for "CPSR certified", "approved", "registered" and "safety tested", and rewrite them.
2. Open your CPSR and check Part B has the assessor's name, address, proof of qualification, date and signature.
3. Compare the formula, suppliers and packaging in Part A with what you actually make today.
4. Check that the rest of the PIF exists: product description, manufacturing method and GMP statement, claim evidence and animal testing data.
5. Prepare a one page Responsible Person confirmation and keep it ready for marketplace and retailer requests.

Frequently asked questions

Official sources and legislation

• Regulation (EC) No 1223/2009 on cosmetic products, EU text as adopted (legislation.gov.uk)
• GB Cosmetics Regulation, Annex I: cosmetic product safety report (legislation.gov.uk)
• GB Cosmetics Regulation, Article 11: product information file
• GB Cosmetics Regulation, Article 13: notification
• GB Cosmetics Regulation, Article 19: labelling
• Commission Implementing Decision 2013/674/EU: guidelines on Annex I (CPSR), text as adopted (legislation.gov.uk)
• Regulation (EU) No 655/2013: common criteria for cosmetic claims, text as adopted (legislation.gov.uk)
• Regulation 655/2013 common criteria as they apply in Great Britain (legislation.gov.uk)
• REACH Article 2(6)(b): finished cosmetics excluded from Title IV (SDS)
• Cosmetic Products Enforcement Regulations 2013 (SI 2013/1478)
• OPSS: making cosmetic products available to consumers in Great Britain
• GOV.UK: submit cosmetic product notifications (SCPN)