The Cosmetic Product Safety Report is the heart of the UK Cosmetics Regulation (the assimilated EU 1223/2009, as amended for Great Britain). Every cosmetic product placed on the GB market must have one, before the first unit ships. It's not a certificate the government issues. It's a dossier you compile, that a qualified Safety Assessor signs, that the Responsible Person holds, and that the Office for Product Safety and Standards (OPSS) can demand to see at any point.

The structure is fixed by Annex I of the regulation. Part A is the data: who the product is, what is in it, how it has been tested, who is exposed and how, what has gone wrong in use elsewhere. Part B is the judgement: a named, qualified Assessor explaining, in their own reasoning, why the product is safe for human use under the conditions described in Part A.

Part A is a recipe of evidence. It includes the qualitative and quantitative formula, the physical and chemical characteristics and stability of the product, the microbiological quality (including the challenge test, where relevant), impurities, traces and information about the packaging material, the normal and reasonably foreseeable use, exposure to the cosmetic product and to its substances, the toxicological profile of each substance, undesirable and serious undesirable effects, and information on the cosmetic product including efficacy evidence behind any claim.

In practice, that means raw material specs and SDSs from every supplier, certificates of analysis on the finished product, the stability and PET reports from the lab, the artwork and substrate details from the packaging team, the claim substantiation files from marketing, and the cosmetovigilance log. If any one of those inputs lives only in someone's inbox, the CPSR can't be completed without chasing.

Part B is the Safety Assessor's reasoned conclusion. The Assessor must hold a diploma in pharmacy, toxicology, medicine or a similar discipline, recognised in the UK or an equivalent qualification. They review Part A, apply the relevant guidance (SCCS Notes of Guidance, the CTPA technical guidance, OPSS guidance), and produce a written assessment with a clear conclusion on whether the product is safe for human health when used under normal and reasonably foreseeable conditions of use.

The Assessor can be internal or external. Either is acceptable to the OPSS. What matters is qualification, independence of judgement, and a clear audit trail showing they had access to the full Part A before signing. The signed Part B carries a date and the Assessor's name and credentials.

Every product on the GB market has a single named Responsible Person established in the UK. The RP holds the Product Information File (PIF), which contains the CPSR, the product description, method of manufacture and GMP statement, proof of the claimed effect where the nature of the claim justifies it, and data on any animal testing. The PIF must be available, in English, at the RP's UK address, for ten years after the last batch is placed on the market.

Before the product is sold, the RP notifies it on the Submit Cosmetic Product Notification (SCPN) service. SCPN captures the product category, the frame formulation or full formula where required, the labelled use, photographs of packaging and the RP details. SCPN is the notification. The CPSR is the underlying safety case. They aren't the same thing, and SCPN doesn't replace the obligation to hold a CPSR.

The work in a CPSR isn't the writing. It's the data assembly. Most teams spend the bulk of every project chasing the raw material SDS from a supplier who has moved address, finding the stability report on a shared drive, getting the artwork team to confirm the final substrate, and matching INCI names across two formulation systems that disagree about whether a preservative is named one way or another.

The Assessor is then waiting for the dossier. The dossier is waiting for one missing supplier document. The launch is waiting for the Assessor. Multiply by a launch cadence of two a month and the regulatory team becomes the visible bottleneck on the company's growth plan, when the real bottleneck is the data hygiene one layer down.

At scale, the CPSR should be a one click output, not a project. That requires one substance master, one supplier portal, one PIF per product as the single source of truth, and a workflow that enforces completeness before the Assessor ever sees the dossier. Raw material SDSs are version controlled and pulled by CAS number, not by file name. Claim substantiation is filed against the claim, not the launch. Stability and PET results flow from the lab system into the PIF automatically.

When the OPSS calls, the answer is a query, not a panic. When a substance is restricted, the affected products surface in minutes. When the Assessor needs the latest tox profile on an ingredient used in forty SKUs, it's one record, not forty PDFs.

A well run CPSR process compiles Part A automatically from the PIF, routes it to the Safety Assessor with a complete pack, captures the signed Part B back into the PIF, triggers SCPN notification, files the notification reference against the product and opens the cosmetovigilance log. The Responsible Person sees, on one screen, every GB SKU, its CPSR status, its SCPN reference and its next regulatory event. That's the standard. Anything below it's a backlog waiting to happen.