Product Information File: the five mandatory parts, kept for ten years

The Product Information File is the legal dossier behind every cosmetic product on the EU or UK market. It is defined by Article 11 of Regulation (EC) No 1223/2009 and carried across, almost word for word, into the UK Cosmetic Regulation (the assimilated 1223/2009 as amended for Great Britain). The PIF is not a single document. It is a structured collection of evidence that, taken together, allows a competent authority to verify that the product is safe, lawful and as labelled.

The Responsible Person holds the PIF. In the EU that is a legal or natural person established in the Union. In Great Britain it is a person established in the UK. The PIF must be kept at the address that appears on the product label and must be available, in an electronic or other format, for ten years after the date the last batch of the product was placed on the market.

Article 11(2) fixes the contents. The regulation does not say who inside your business produces each part, and that is where most incomplete files come from: every part has a different owner, and three of the five depend on someone outside the company.

Read the right-hand column as a list of what to check this quarter. Four of those five failure modes are silent: nothing breaks, no alert fires, and the gap is only discovered when an inspector asks.

The description is the identity of the product. It must allow the PIF to be clearly attributed to the cosmetic in question: trade name, internal reference, intended category (leave-on or rinse-off, area of application), the labelled use, the format, the pack sizes and the markets where it is sold. In practice this is the section that ties the rest of the file to a specific SKU, a specific artwork version and a specific Responsible Person declaration on the label.

The CPSR is the heart of the PIF. Annex I of the regulation fixes its structure: Part A gathers all of the safety relevant information about the product (qualitative and quantitative formula, physico-chemical and microbiological characteristics, stability, impurities and traces, packaging material, normal and reasonably foreseeable use, exposure to the product and its substances, toxicological profile of each substance, undesirable effects and supporting evidence for claims). Part B is the Safety Assessor's reasoned conclusion on whether the product is safe for human health when used under those conditions.

Part B must be signed and dated by a qualified Safety Assessor (diploma in pharmacy, toxicology, medicine or a similar discipline, recognised in the relevant jurisdiction). The CPSR is reviewed and updated whenever there is a material change to the formula, the packaging, the supplier of a substance, the toxicological profile of an ingredient or the claims being made.

The PIF must describe the method of manufacturing and include a statement that the product has been manufactured in compliance with Good Manufacturing Practice. ISO 22716 is the harmonised standard that is presumed to demonstrate GMP compliance. In practice this means a process description (mixing, filling, packing), the controls applied at each step and a clear link to the manufacturing site's GMP certification or internal audit evidence. For brands that contract out manufacturing, this section depends on the CMO providing current GMP evidence per site, per product.

Where the nature of the cosmetic claim justifies it, the PIF must contain proof of the effect. The applicable common criteria are set by Commission Regulation (EU) No 655/2013: legal compliance, truthfulness, evidential support, honesty, fairness and informed decision making. A claim of hydration must be supported. A claim of 24 hour wear, anti-ageing, dermatologically tested or hypoallergenic each carries its own evidence standard.

In practice the proof file is a structured set of clinical, instrumental or consumer studies, ingredient level evidence and references. Filing evidence against the claim, not against the launch, is what makes this section maintainable as the portfolio grows.

The PIF must contain data on any animal testing performed by the manufacturer, its agents or suppliers, relating to the development or safety assessment of the cosmetic product or its ingredients. In the EU and the UK, animal testing of finished cosmetics and of ingredients for cosmetic purposes is prohibited. This section therefore documents historical tests where they exist, alternative method use (in vitro, in silico, read-across) and, where ingredients have been tested for non cosmetic regulatory purposes (for example REACH), the basis on which that data has been relied upon.

The PIF is the underlying dossier. The Cosmetic Product Notification Portal (CPNP) is the EU level notification of the product before it is placed on the EU market. Submit Cosmetic Product Notification (SCPN) is the UK equivalent for Great Britain. Notification gives the authorities and poison centres the headline data. The PIF is what they ask for when they want to look behind the headline. A current CPNP or SCPN entry does not relieve the Responsible Person of the obligation to hold a complete, up to date PIF.

EU competent authorities and the UK Office for Product Safety and Standards (OPSS) inspect on a risk basis and on complaint. When they ask, the request is rarely for the entire file. They ask for the parts they need to test a specific concern: the signed Part B of the CPSR, the substantiation behind a specific claim, the supplier specification for a particular substance, the GMP evidence for the site of last manufacture, the cosmetovigilance log for serious undesirable effects.

The standard the regulation sets is availability without undue delay. In practice that means hours to days, not weeks. A file that requires someone to rebuild it from email threads, shared drives and a former colleague's laptop will not meet that standard.

Inspections follow a pattern. Work through this list for one product before an inspection is scheduled and you will find the gaps that matter. If any item takes more than an hour to produce, that is the item to fix.

1. The Responsible Person address on the label matches the address where the PIF is actually held, and the person named still holds the role.
2. The PIF is in a language the competent authority can understand, English in the UK, and is accessible electronically from that address.
3. Part B of the CPSR is signed and dated, and the assessor's qualification evidence is on file and current.
4. The formula in Part A of the CPSR is identical to the formula currently in production, including the supplier and grade of each raw material.
5. Every raw material has a current specification, an SDS where applicable and a certificate of analysis for the batches used.
6. Ingredient restriction and prohibition checks against Annexes II to VI are evidenced, with the version of the Annex used and the date checked.
7. Every claim on the current artwork has substantiation filed against it that meets the Regulation 655/2013 common criteria.
8. The GMP evidence covers the site of last manufacture and is in date, including for each contract manufacturer used.
9. Stability and preservative efficacy (challenge test) reports exist, and the period after opening or durability date on pack is supported by them.
10. Packaging compatibility evidence exists for the pack actually in use, not the pack used at development.
11. The cosmetovigilance log is current, with serious undesirable effects reported to the competent authority as required.
12. The CPNP or SCPN notification exists, matches the current formula and frame formulation, and matches the current label.
13. Nanomaterials, if any, are notified separately and identified correctly in the ingredient list.
14. Animal testing declarations from every supplier are current, not collected once at onboarding.
15. Batch records for the batches in the market are retrievable and tie back to the approved formula version.

The retention period is ten years from the date the last batch of the product was placed on the market. That last batch is a moving target. A product reformulated, renamed or repackaged is a new product for PIF purposes; the previous PIF clock keeps running on the last batch of the old version, while a new PIF is opened for the new one. In a busy portfolio this quickly accumulates into hundreds of historical PIFs that still have to be retrievable on demand.

A brand launches a serum in 2019, reformulates the preservative system in 2022, repackages into a new bottle in 2023, and discontinues the line in 2025. That is not one file with one deadline. It is three.

• PIF A, original 2019 formula. Last batch placed on the market in March 2022, when the reformulated version took over. Retention runs to March 2032.
• PIF B, 2022 reformulation. A material formula change means a new safety assessment and a revised CPSR. Last batch of that pack placed on the market in August 2023. Retention runs to August 2033.
• PIF C, 2023 repack. A packaging change requires compatibility and stability review and a CPSR update, but not necessarily a wholly new file if the formula is unchanged. Practice varies; treating it as a new version of the file with the packaging evidence updated is defensible, provided the version history is intact. Last batch placed on the market in November 2025. Retention runs to November 2035.

Three points fall out of this. First, "placed on the market" means the first making available in the EU or GB, not the date the last unit sold to a consumer, so the clock starts at your dispatch, not at retail sell-through. Second, the oldest file is not the first to expire, because clocks run from the last batch of each version, not from launch. Third, over a decade a portfolio of 200 active SKUs generates several hundred retained files, all of which must stay retrievable at the address on the label. That is a records management problem, and it is the reason a folder structure eventually fails.

Most brands and contract manufacturers run the PIF as a folder. A folder is a snapshot. The moment a supplier changes specification, a substance is restricted, a piece of artwork is revised or a new market opens, the snapshot is out of date and nobody on the team has the time to chase every product it touches.

A unified data layer flips the model. Substances live in one master, versioned and CAS keyed. Suppliers push specifications and SDSs into a portal that updates every product they touch. Claim substantiation is filed against the claim, not the launch, so a single update flows through every SKU that uses it. The PIF is then a query against live data, generated on demand for any product in any market, with the version of every input pinned at the moment of generation. That is what audit-ready by default looks like.

Worldover is built around exactly this idea. The PIF, the CPSR pack, the CPNP and SCPN references and the cosmetovigilance log sit on one record, with one substance master underneath. When an inspector calls, the answer is a query.