Cosmetic compliance software, a buyer's guide for regulatory teams.

The regulatory surface a cosmetics brand has to manage in 2026 is wider than it was even three years ago. EU 1223/2009 with its evolving Annexes (Annex II prohibited substances, Annex III restrictions, the 80-plus fragrance allergens under the 2023 amendment), the UK Cosmetic Regulation post-Brexit divergence, MoCRA in the United States with its facility registration, product listing and adverse event reporting obligations, CMR and SVHC tracking under REACH, claims rules under EU 655/2013, China NMPA notifications, Japan's Standards for Cosmetics, ASEAN harmonisation. Each market has its own data, its own language, its own update cadence.

The teams running this in spreadsheets and email are not lazy. They are heroic. They are also losing. Every new ingredient triggers a manual hunt across files. Every Annex update sends someone re-reading old PIFs. Every audit becomes a fire drill. Launch dates slip because the regulatory assessment lives downstream of formulation, in a different system, owned by a different team, with no automation between them.

Cosmetic compliance software exists to close that gap. The good ones do it by treating the regulatory file as the source of truth, with formulation, operations and labelling reading from it, not bolting onto it.

Six jobs separate a real platform from a glorified document store. If a vendor cannot demonstrate each of these on screen with your data, keep looking.

1. CPSR and PIF assembly. Part A (the safety data) and Part B (the safety assessment) generated from structured formulation, stability, microbiology and toxicology data, with the safety assessor's sign-off captured and versioned. The PIF (the five mandatory parts under EU 1223/2009 Article 11) assembled on demand, kept current as the formula or supplier data changes, and ready for an inspector within minutes.

2. CPNP, SCPN and MoCRA notifications. The notification dossiers for the EU CPNP, the UK SCPN and the US MoCRA product listings generated from the same record, not re-typed into three portals. Updates triggered automatically when a formula change makes a previous notification stale.

3. Ingredient list checks. Every ingredient evaluated, in real time, against Annex II prohibitions, Annex III restrictions (with concentration limits per product category), Annex IV colorants, Annex V preservatives, Annex VI UV filters, and the equivalent lists in the UK, MoCRA, China, Japan and other markets. Restricted substances flagged before they reach the bench, not in the regulatory review the week before launch.

4. Claims compliance. Every on-pack and on-site claim mapped to the supporting evidence and to the rules of each market (EU 655/2013 common criteria, FTC guidance in the US, country-specific claim rules in China and Korea). "Clinically proven", "hypoallergenic", "natural", "fragrance-free" each have specific evidence requirements, and the platform should hold both the claim and the proof.

5. Documentation and audit trail. Every formula version, every CPSR sign-off, every notification, every label artwork, every supplier CoA and SDS linked back to the batch that uses it. When an auditor asks "show me everything you have on this batch", the answer is a query, not a week.

6. Regulatory horizon scanning. Feeds from ECHA, MHRA, FDA, NMPA, MHLW and the major standards bodies ingested into the substance master, so a new SVHC addition or a revised Annex III concentration limit flags every affected product, automatically.

The marketing pages all look the same. The differences show up in the demo, if you ask the right questions.

Content coverage. Ask for the complete list of regulations, Annexes and markets the platform covers, with the date of the last update for each. A platform that cannot tell you when it last refreshed Annex III is updating manually, on a cadence you do not control.

Up-to-date regulatory feeds. How does the platform learn about a new SVHC, a revised allergen list, an MoCRA guidance update? Is it automated ingestion from the regulator's source, or a human in the vendor's office reading PDFs? Ask to see the change log.

Workflows. The platform should model your real process, from chemist trial to safety assessment to notification to launch, with role-based sign-offs and an audit trail. A database with a dashboard is not a workflow.

Integrations. ERP for cost and procurement, MES or batch records for production, LIMS for stability and microbiology, artwork systems for labels, supplier portals for CoAs and SDSs. Open APIs, not "we can integrate, please contact services".

Scalability. Multiple brands, multiple markets, multiple languages, multiple contract manufacturers, thousands of SKUs. Ask the vendor for a customer reference in your size band and your market footprint, and speak to the regulatory lead unsupervised.

Over-reliance on generic PLM. Centric, PTC, Siemens and their peers were built for apparel and discrete manufacturing. The data model assumes BOMs of parts, not percentage compositions of substances with cumulative restrictions. Teams end up tracking restricted substances in a spreadsheet attached to the PLM record, which defeats the point.

Siloed regulatory tools. A standalone CPSR generator, a standalone notification tool and a standalone label artwork system each look fine in isolation. Together they recreate the spreadsheet problem at a higher price point, because nothing reads from a shared substance master. Every formula change becomes a manual sync.

Underestimating implementation. Software is the easy part. The data migration (legacy formulas, supplier specs, historic PIFs, claims evidence) is the hard part, and it is where teams underestimate by months. Pick a vendor that will own the migration with you, not hand you a template.

Buying for today's portfolio. A platform that fits your current SKUs and markets, with no headroom for the next market entry or the next brand acquisition, will be the bottleneck within eighteen months.

Worldover is a combined regulatory and operational platform built for cosmetics brands and manufacturers. Compliance is not a module that sits on the side. It is the core data model. Every formulation, every batch, every label and every notification reads from the same substance and product master, and that master is kept current by regulator feeds rather than by a quarterly content release.

In practice that means a regulatory lead can run multi-brand, multi-market portfolios from one workspace, with Willow, our AI co-worker, handling the repetitive drafting (CPSR Part A pulls, supplier SDS parsing, regulator feed triage) and humans handling the judgement.

See the related solution pages for cosmetic formulation software, cosmetic ERP and MoCRA compliance. The Iconic London case study is a worked example of a brand consolidating regulatory and operations on one platform.

Use this checklist when evaluating whether an ERP (not just a compliance point tool) can carry the regulatory load. If the answer to any item is "via a partner add-on" or "via integration", price that in.

• EU 1223/2009 Annexes II, III, IV, V, VI held as live data, updated automatically from ECHA/EU sources.
• UK Cosmetic Regulation tracked separately from EU post-Brexit divergence, with SCPN filing from the same record.
• MoCRA facility registration, product listing, safety substantiation and adverse event tracking native to the product record.
• REACH / UK REACH substance status, SVHC tracking and Article 33 workflows.
• CLP / GHS classification and SDS authoring, phrase library and multi-language output.
• PIF assembly from live formulas, versioned, printable for inspectors within minutes.
• CPSR Part A and Part B generated from structured data, safety assessor sign-off captured in system.
• CPNP / SCPN / poison centre notification dossiers generated once, filed to multiple markets, UFI code generated.
• Claims compliance mapped to EU 655/2013 common criteria, FTC guidance and market-specific rules.
• Fragrance allergen disclosure against the current EU allergen list (currently 80+ substances).
• Batch-level traceability from raw material lot to shipped pallet, one query, seconds.
• Recall management workflow with forward and backward genealogy, customer and lot impact query.
• Audit trail immutable, timestamped, attributable, exportable to inspectors on demand.
• Regulator feeds from ECHA, MHRA, FDA, NMPA, MHLW ingested into the substance master with change log.
• Multi-brand, multi-market, multi-language in one workspace with role-based access.

See also: electronic batch records and recall management and MoCRA compliance for cosmetics manufacturers.