Cosmetics Regulation: US, EU, and UK Compared¶
Cosmetics regulation in the United States, the European Union, and the United Kingdom operates on three different legal frameworks — and a cosmetic product sold in all three markets needs three different safety assessments, three different product notifications, and potentially three different labels. The US system under MoCRA emphasizes manufacturer self-declaration of safety. The EU system requires a formal Cosmetic Product Safety Report by a qualified safety assessor. The UK system, post-Brexit, mirrors the EU structure but with separate notification, separate responsible person requirements, and the UK's own scientific advisory function.
This guide compares cosmetics compliance across all three markets and shows how to build multi-market compliance from the same toxicological data and the same product formulation.
Not sure which cosmetics regulations apply in which market? Use the Sustalium Global Compliance Map — select Cosmetics and switch between the US, EU, and UK to see MoCRA, CPSR, and UK notification requirements side by side.
The Three Cosmetic Regulatory Frameworks¶
| Requirement | United States | European Union | United Kingdom |
|---|---|---|---|
| Governing law | MoCRA (2022) + FFDCA | Regulation (EC) 1223/2009 | UK Cosmetics Regulation (retained EU 1223/2009) |
| Facility registration | FDA registration, renewed every 2 years | No facility registration; Responsible Person identified | No facility registration; UK Responsible Person identified |
| Product notification | FDA product listing (after market placement) | CPNP notification (before market placement) | UK SCPN notification (before market placement) |
| Safety assessment | Self-declared safety substantiation (no prescribed format) | CPSR by qualified safety assessor (Annex I format) | UK CPSR by qualified safety assessor |
| Responsible Person | Manufacturer, packer, or distributor on label | EU-based Responsible Person | UK-based Responsible Person |
| GMP | FDA GMP (proposed, not yet final) | ISO 22716 compliance required | ISO 22716 compliance required |
| Ingredient labeling | Common or usual name (INCI strongly encouraged) | INCI mandatory | INCI mandatory |
| Fragrance allergens | FDA proposed list (2024) | Annex III (26 allergens, expanding) | UK list (currently mirrors EU Annex III) |
| Animal testing | Not federally banned | Full marketing ban | Full marketing ban |
| Adverse event reporting | FDA within 15 business days (serious events) | Competent authority (serious undesirable effects) | UK competent authority |
| Recall authority | FDA mandatory recall (new under MoCRA) | Competent authority can order withdrawal | UK authority can order withdrawal |
Safety Assessment: The Biggest Operational Difference¶
The safety assessment is the compliance activity that differs most between the three markets — and where the cost multiplies if not managed efficiently:
- US MoCRA safety substantiation: No prescribed format. No specific qualifications required for the assessor. Must demonstrate that qualified experts evaluated the product and concluded it is safe under labeled conditions of use. The manufacturer maintains the records; the FDA does not pre-approve or receive the assessment.
- EU CPSR: A specific, structured document defined by Annex I of Regulation (EC) 1223/2009. Must be prepared by a qualified safety assessor with a diploma in pharmacy, toxicology, medicine, or equivalent. The CPSR is divided into Part A (cosmetic product safety information) and Part B (safety assessment — the assessor's conclusion). The CPSR is uploaded to the CPNP.
- UK CPSR: The UK retained the EU CPSR framework post-Brexit. The UK requires a safety assessor meeting the same qualification criteria, and the format mirrors the EU Annex I structure. However, the UK assessment is separate — it must be signed by a UK-recognized safety assessor, and it supports the UK SCPN notification, not the EU CPNP.
The toxicological data that underpins all three assessments — ingredient safety profiles, exposure calculations, concentration limits, margin of safety determinations — is the same. A single set of toxicological data can support the US MoCRA safety substantiation, the EU CPSR, and the UK CPSR. But the three documents must exist separately, in their respective regulatory formats, signed by the appropriate qualified persons.
Product Notification: CPNP vs. SCPN vs. FDA Listing¶
| Aspect | US FDA Listing | EU CPNP | UK SCPN |
|---|---|---|---|
| Timing | Within 120 days of first marketing | Before first market placement | Before first market placement |
| Data submitted | Ingredient list, category, label image | Full formulation (quantitative), CPSR, label, Responsible Person | Full formulation (quantitative), CPSR, label, Responsible Person |
| Toxicological data | Not submitted (maintained by Responsible Person) | Submitted with CPSR | Submitted with CPSR |
| Portal | FDA Cosmetics Direct | EU CPNP portal | UK SCPN portal |
| Update obligation | Annual (for any changes) | Immediate (for any changes) | Immediate (for any changes) |
The US system requires less data submission but more self-maintained documentation. The EU and UK systems require more data submission but centralize the documentation in the regulatory portals. A brand selling in all three markets files three separate notifications across three separate portals — using the same core formulation data.
The Multi-Market Cosmetics Strategy¶
-
Commission the EU CPSR first. The EU CPSR is the most structured and demanding safety assessment format. Commission it from a qualified EU safety assessor. The toxicological data in the EU CPSR becomes the foundation for both the US MoCRA safety substantiation and the UK CPSR — which can be adapted from the EU CPSR rather than built from scratch.
-
Notify the EU CPNP first. The CPNP notification is the most established regulatory portal. Once the EU notification is complete, the UK SCPN notification can be prepared using the same formulation data and safety assessment, with the UK Responsible Person and UK-specific identifiers.
-
Prepare the MoCRA safety substantiation last. The FDA product listing does not require uploading the safety substantiation — it is maintained by the Responsible Person. Using the toxicological data from the EU CPSR, prepare a US safety substantiation document that satisfies MoCRA's requirement without duplicating the work already done for the EU.
-
Use INCI across all markets. The EU and UK mandate INCI. The US strongly encourages it. Use INCI nomenclature on all labels and in all regulatory filings to maintain a single ingredient list across markets.
How Sustalium Simplifies Multi-Market Cosmetics Compliance¶
Running three regulatory programs — MoCRA for the US, CPSR and CPNP for the EU, CPSR and SCPN for the UK — for the same cosmetic product multiplies the compliance overhead without improving product safety.
Sustalium centralizes multi-market cosmetics compliance:
- Unified ingredient database — Maintain your formulation in INCI format once and map it to FDA product listing, CPNP notification, and SCPN notification data requirements
- Safety assessment integration — Link your EU CPSR toxicological data and use it to generate the US MoCRA safety substantiation and support the UK CPSR
- Triple notification support — Structured data export formatted for FDA listing, CPNP notification, and SCPN notification
- Responsible Person management — Link your US Responsible Person, EU Responsible Person, and UK Responsible Person to your product profiles
One Formulation, Three Markets, One Compliance Platform
Your lipstick does not change its formulation when it crosses a border. The safety data is the same. The regulatory paperwork should not triple your workload.
With Sustalium, build your multi-market cosmetics compliance for just €10 per document.
Frequently Asked Questions¶
Can one safety assessor sign both the EU CPSR and the UK CPSR?
A safety assessor qualified under EU standards may also meet UK qualification criteria, but the UK CPSR must be signed by a UK-recognized assessor. Whether the same individual can sign both depends on whether they hold the appropriate recognition in both jurisdictions. The assessments are separate documents.
Is the US MoCRA product listing the same as the EU CPNP notification?
No. The CPNP requires pre-market notification with the full quantitative formulation and the CPSR uploaded. The FDA product listing occurs after market placement, includes only the ingredient list and label image, and does not require uploading safety data. They serve similar purposes but are operationally different.
Do I need a separate label for each market?
Potentially. The US allows common names for ingredients; the EU and UK mandate INCI. The EU requires the Responsible Person's EU address; the US requires the manufacturer, packer, or distributor's address. The fragrance allergen requirements differ between markets. In practice, most multi-market brands design a single INCI-based label with a removable or variable section for the Responsible Person address and any market-specific warnings.
Last updated: July 27, 2026