Responsible Person Under EU Cosmetics Regulation — What to Look for and What to Avoid

One of the first questions a non-EU cosmetic brand asks when planning an EU launch is: who can be our Responsible Person? The question is reasonable. The answer, unfortunately, is often oversimplified. I have seen brands appoint an RP based on a low-cost online listing, only to discover months later that the RP had no capacity to maintain the Product Information File, had never reviewed the safety assessment, and could not respond coherently to a competent authority inquiry. That is not a hypothetical — it is a pattern that repeats itself across the industry.

This article is for brand owners, regulatory affairs managers, and executives at non-EU cosmetic companies who need to understand what the Responsible Person role actually requires, how to evaluate prospective RPs, and what warning signs to watch for.

What the Responsible Person Role Requires

Under Article 4 of Regulation (EC) No 1223/2009, only cosmetic products for which a legal or natural person established within the EU has been designated as the Responsible Person may be placed on the EU market. The RP’s name and address must appear on the product label.

The Responsible Person bears legal responsibility for a defined set of obligations under the Regulation:

Compliance assurance: The RP must ensure that the cosmetic product complies with the Regulation — including that the formulation does not contain prohibited substances, that restricted substances are used within permitted limits, and that the product has been manufactured in accordance with Good Manufacturing Practice (EN ISO 22716:2007).

Product Information File (PIF) maintenance: The RP must maintain the PIF at their address and make it available to competent authorities on request. The PIF must be kept for ten years after the last batch is placed on the market.

Safety assessment oversight: The RP must ensure that a Cosmetic Product Safety Report (CPSR) has been prepared by a qualified safety assessor before the product is placed on the market.

CPNP notification: The RP must submit the product notification through the Cosmetic Products Notification Portal before market placement.

Serious Undesirable Effects (SUE) reporting: The RP must notify the competent authority of the member state where the SUE occurred when they become aware of a serious undesirable effect. This is an active, ongoing obligation — not a one-time administrative task.

Market surveillance cooperation: The RP must cooperate with competent authorities and provide all information necessary to demonstrate product compliance. In practice, this means being reachable, responsive, and technically capable of answering substantive questions about the product.

What a Qualified RP Service Should Provide

A professional Responsible Person service should, at minimum, provide the following:

Documented acceptance of legal responsibility. There should be a written agreement between the brand and the RP that clearly sets out the scope of the RP’s responsibilities, the brand’s obligations to provide accurate information, and the conditions under which the RP relationship can be terminated.

PIF storage and management. The RP should have a documented system for receiving, storing, and maintaining PIFs. They should be able to confirm the location of each PIF and retrieve it promptly on request.

CPNP notification capability. The RP should have an active CPNP account and the technical capability to submit notifications on behalf of the brand. They should be able to explain the notification process and the information they will need from the brand.

SUE monitoring and reporting. The RP should have a process for receiving SUE reports from the brand and for notifying competent authorities within the required timeframes. This requires both a communication protocol and knowledge of the reporting obligations in each relevant member state.

Competent authority liaison. The RP should be capable of responding to inquiries from national competent authorities in the relevant EU languages. A UK-based entity acting as RP for EU market access post-Brexit is not a valid arrangement — the RP must be established within the EU.

Red Flags to Watch For

No written agreement defining responsibilities. If a prospective RP is unwilling to provide a written service agreement that clearly delineates responsibilities, that is a significant warning sign.

No documented PIF management system. An RP who cannot explain how they store and retrieve PIFs, or who proposes to store PIFs informally, is not providing a compliant service.

Inability to explain CPNP notification requirements. The CPNP notification process has specific technical requirements. An RP who cannot walk you through the process in detail is unlikely to execute it correctly.

No process for SUE reporting. Serious Undesirable Effect reporting is a legal obligation with defined timeframes. An RP who is unfamiliar with the SUE reporting requirements, or who treats this as a minor administrative matter, is not equipped for the role.

Established outside the EU. Post-Brexit, a UK-based entity cannot serve as Responsible Person for EU market access. The RP must be established within an EU member state. Verify the RP’s registered address and legal establishment.

Unusually low pricing with no explanation of service scope. Responsible Person services that are priced significantly below market rates often reflect a correspondingly limited scope of service. Ask specifically what is and is not included.

Practical Action Step

Use this checklist when evaluating a prospective Responsible Person:

Confirm the RP is a legal or natural person established within an EU member state
Request a draft service agreement and review the scope of responsibilities
Ask for a description of the RP’s PIF storage and management system
Confirm the RP has an active CPNP account and experience with CPNP notifications
Ask how the RP handles Serious Undesirable Effect reports and which competent authorities they have reported to
Ask for references from other brands for whom the RP currently acts
Confirm the RP’s capacity to respond to competent authority inquiries in relevant EU languages
Verify that the RP has professional indemnity insurance appropriate for the role

The Responsible Person role is a legal liability position, not an administrative checkbox. The quality of your RP service directly affects your exposure in the event of a product safety issue or a competent authority inquiry. Consult a qualified EU regulatory expert when evaluating your options.

Care Europe provides Responsible Person services for cosmetic brands entering the EU market, including PIF management, CPNP notification, and SUE reporting. Contact us to discuss your requirements.

Responsible Person Under EU Cosmetics Regulation — What to Look for and What to Avoid