The Product Information File is the legal dossier behind every cosmetic product on the EU or UK market. It's defined by Article 11 of Regulation (EC) No 1223/2009 and carried across, almost word for word, into the UK Cosmetic Regulation (the assimilated 1223/2009 as amended for Great Britain). The PIF isn't a single document. It's a structured collection of evidence that, taken together, allows a competent authority to verify that the product is safe, lawful and as labelled.

The Responsible Person holds the PIF. In the EU that's a legal or natural person established in the Union. In Great Britain it's a person established in the UK. The PIF must be kept at the address that appears on the product label and must be available, in an electronic or other format, for ten years after the date the last batch of the product was placed on the market.

Article 11(2) fixes the contents. The regulation doesn't say who inside your business produces each part, and that's where most incomplete files come from: every part has a different owner, and three of the five depend on someone outside the company.

Read the right-hand column as a list of what to check this quarter. Four of those five failure modes are silent: nothing breaks, no alert fires, and the gap is only discovered when an inspector asks.

The description is the identity of the product. It must allow the PIF to be clearly attributed to the cosmetic in question: trade name, internal reference, intended category (leave-on or rinse-off, area of application), the labelled use, the format, the pack sizes and the markets where it's sold. In practice this is the section that ties the rest of the file to a specific SKU, a specific artwork version and a specific Responsible Person declaration on the label.

The CPSR is the heart of the PIF. Annex I of the regulation fixes its structure: Part A gathers all of the safety relevant information about the product (qualitative and quantitative formula, physico-chemical and microbiological characteristics, stability, impurities and traces, packaging material, normal and reasonably foreseeable use, exposure to the product and its substances, toxicological profile of each substance, undesirable effects and supporting evidence for claims). Part B is the Safety Assessor's reasoned conclusion on whether the product is safe for human health when used under those conditions.

Part B must be signed and dated by a qualified Safety Assessor (diploma in pharmacy, toxicology, medicine or a similar discipline, recognised in the relevant jurisdiction). The CPSR is reviewed and updated whenever there's a material change to the formula, the packaging, the supplier of a substance, the toxicological profile of an ingredient or the claims being made.

The PIF must describe the method of manufacturing and include a statement that the product has been manufactured in compliance with Good Manufacturing Practice. ISO 22716 is the harmonised standard that's presumed to demonstrate GMP compliance. In practice this means a process description (mixing, filling, packing), the controls applied at each step and a clear link to the manufacturing site's GMP certification or internal audit evidence. For brands that contract out manufacturing, this section depends on the CMO providing current GMP evidence per site, per product.

Where the nature of the cosmetic claim justifies it, the PIF must contain proof of the effect. The applicable common criteria are set by Commission Regulation (EU) No 655/2013: legal compliance, truthfulness, evidential support, honesty, fairness and informed decision making. A claim of hydration must be supported. A claim of 24 hour wear, anti-ageing, dermatologically tested or hypoallergenic each carries its own evidence standard.

In practice the proof file is a structured set of clinical, instrumental or consumer studies, ingredient level evidence and references. Filing evidence against the claim, not against the launch, is what makes this section maintainable as the portfolio grows.

The PIF must contain data on any animal testing performed by the manufacturer, its agents or suppliers, relating to the development or safety assessment of the cosmetic product or its ingredients. In the EU and the UK, animal testing of finished cosmetics and of ingredients for cosmetic purposes is prohibited. This section therefore documents historical tests where they exist, alternative method use (in vitro, in silico, read-across) and, where ingredients have been tested for non cosmetic regulatory purposes (for example REACH), the basis on which that data has been relied upon.

The PIF is the underlying dossier. The Cosmetic Product Notification Portal (CPNP) is the EU level notification of the product before it's placed on the EU market. Submit Cosmetic Product Notification (SCPN) is the UK equivalent for Great Britain. Notification gives the authorities and poison centres the headline data. The PIF is what they ask for when they want to look behind the headline. A current CPNP or SCPN entry does not relieve the Responsible Person of the obligation to hold a complete, up to date PIF.

EU competent authorities and the UK Office for Product Safety and Standards (OPSS) inspect on a risk basis and on complaint. When they ask, the request is rarely for the entire file. They ask for the parts they need to test a specific concern: the signed Part B of the CPSR, the substantiation behind a specific claim, the supplier specification for a particular substance, the GMP evidence for the site of last manufacture, the cosmetovigilance log for serious undesirable effects.

The standard the regulation sets is availability without undue delay. In practice that means hours to days, not weeks. A file that requires someone to rebuild it from email threads, shared drives and a former colleague's laptop won't meet that standard.

Inspections follow a pattern. Work through this list for one product before an inspection is scheduled and you'll find the gaps that matter. If any item takes more than an hour to produce, that's the item to fix.

1. The Responsible Person address on the label matches the address where the PIF is actually held, and the person named still holds the role.
2. The PIF is in a language the competent authority can understand, English in the UK, and is accessible electronically from that address.
3. Part B of the CPSR is signed and dated, and the assessor's qualification evidence is on file and current.
4. The formula in Part A of the CPSR is identical to the formula currently in production, including the supplier and grade of each raw material.
5. Every raw material has a current specification, an SDS where applicable and a certificate of analysis for the batches used.
6. Ingredient restriction and prohibition checks against Annexes II to VI are evidenced, with the version of the Annex used and the date checked.
7. Every claim on the current artwork has substantiation filed against it that meets the Regulation 655/2013 common criteria.
8. The GMP evidence covers the site of last manufacture and is in date, including for each contract manufacturer used.
9. Stability and preservative efficacy (challenge test) reports exist, and the period after opening or durability date on pack is supported by them.
10. Packaging compatibility evidence exists for the pack actually in use, not the pack used at development.
11. The cosmetovigilance log is current, with serious undesirable effects reported to the competent authority as required.
12. The CPNP or SCPN notification exists, matches the current formula and frame formulation, and matches the current label.
13. Nanomaterials, if any, are notified separately and identified correctly in the ingredient list.
14. Animal testing declarations from every supplier are current, not collected once at onboarding.
15. Batch records for the batches in the market are retrievable and tie back to the approved formula version.

The retention period is ten years from the date the last batch of the product was placed on the market. That last batch is a moving target. A product reformulated, renamed or repackaged is a new product for PIF purposes; the previous PIF clock keeps running on the last batch of the old version, while a new PIF is opened for the new one. In a busy portfolio this quickly accumulates into hundreds of historical PIFs that still have to be retrievable on demand.

A brand launches a serum in 2019, reformulates the preservative system in 2022, repackages into a new bottle in 2023, and discontinues the line in 2025. That isn't one file with one deadline. It's three.

• PIF A, original 2019 formula. Last batch placed on the market in March 2022, when the reformulated version took over. Retention runs to March 2032.
• PIF B, 2022 reformulation. A material formula change means a new safety assessment and a revised CPSR. Last batch of that pack placed on the market in August 2023. Retention runs to August 2033.
• PIF C, 2023 repack. A packaging change requires compatibility and stability review and a CPSR update, but not necessarily a wholly new file if the formula is unchanged. Practice varies; treating it as a new version of the file with the packaging evidence updated is defensible, provided the version history is intact. Last batch placed on the market in November 2025. Retention runs to November 2035.

Three points fall out of this. First, "placed on the market" means the first making available in the EU or GB, not the date the last unit sold to a consumer, so the clock starts at your dispatch, not at retail sell-through. Second, the oldest file isn't the first to expire, because clocks run from the last batch of each version, not from launch. Third, over a decade a portfolio of 200 active SKUs generates several hundred retained files, all of which must stay retrievable at the address on the label. That's a records management problem, and it's the reason a folder structure eventually fails.

Most brands and contract manufacturers run the PIF as a folder. A folder is a snapshot. The moment a supplier changes specification, a substance is restricted, a piece of artwork is revised or a new market opens, the snapshot is out of date and nobody on the team has the time to chase every product it touches.

A unified data layer flips the model. Substances live in one master, versioned and CAS keyed. Suppliers push specifications and SDSs into a portal that updates every product they touch. Claim substantiation is filed against the claim, not the launch, so a single update flows through every SKU that uses it. The PIF is then a query against live data, generated on demand for any product in any market, with the version of every input pinned at the moment of generation. That's what audit-ready by default looks like.

Worldover is built around exactly this idea. The PIF, the CPSR pack, the CPNP and SCPN references and the cosmetovigilance log sit on one record, with one substance master underneath. When an inspector calls, the answer is a query.

Article 11(2) lists five parts. Inspectors don't grade prose; they check that each part is present, current and traceable to the product in front of them. This is the contents table to build the file against.

A sixth item isn't in Article 11 but is asked for at every inspection: the cosmetovigilance record for serious undesirable effects under Article 23. Keep it with the file.

OPSS in the UK and EU competent authorities work through a broadly consistent sequence. Rehearsing it is the cheapest preparation there is.

1. Who's the Responsible Person, and can you show the address on the label matches? Establishment address, named contact and the mandate if the RP isn't the manufacturer.
2. Show the PIF for this specific product, now. The file has to be accessible at the RP's address in an official language of the Member State, in readily accessible electronic or other format.
3. Does the formula in the PIF match the batch record? Quantitative formula against the last manufactured batch, including any in-process correction.
4. Show the CPSR, and the assessor's qualification. Diploma or equivalent in pharmacy, toxicology, medicine or a similar discipline, plus the signature date against the current formula version.
5. Annex restrictions. Every ingredient checked against Annexes II to VI at their current amendment, with the preservative and UV filter limits shown explicitly.
6. Labelling. Ingredient list in INCI descending order, nominal content, durability or PAO, batch code, function, warnings, and country of origin for imports.
7. Claims. Each on-pack and online claim mapped to its evidence, under the six common criteria.
8. Notification. CPNP reference for the EU or SCPN for GB, matching the formula frame and the pack presented.
9. GMP. Manufacturing site, ISO 22716 evidence, and the date of the last audit.
10. Cosmetovigilance. The serious undesirable effects log, and evidence that anything reportable was reported.

Two questions decide the tone of the rest of the visit: how fast the file appears, and whether the formula in it matches the batch record. Both are systems questions rather than diligence questions.

These four are used interchangeably in conversation and mean four different things. Getting them straight removes most of the confusion in this area.

In short: the PIF is the file, the CPSR is a chapter of it, and CPNP and SCPN are notifications that point at it. A CPNP reference is not evidence that a PIF exists, which is precisely why inspectors ask for the file rather than the reference.

Article 11(1) requires the PIF to be kept for ten years from the date the last batch was placed on the market. Not ten years from discontinuation of the product, and not ten years from the last manufacture.

A worked example. A moisturiser is discontinued in March 2024, but the final batch, manufactured in November 2023, is shipped to a distributor in July 2024 and sold through into 2025. The clock starts in July 2024, when that last batch was placed on the market, so the file must be retained until July 2034. If a later batch is found in stock and shipped in January 2025, the clock resets to January 2035.

Three practical consequences. The retention date is a property of the last shipment, so it can only be calculated from shipment data, not from a product status field. Discontinued products still need a maintained file, including the cosmetovigilance log. And the file has to remain readable and complete for the whole period, which is a real problem for teams whose PIFs are folders of documents on a shared drive with links to raw material specifications that have since been replaced.