How the EU Decides a Cosmetic Ingredient Is Safe

"Cosmetics aren't regulated" is a myth

A widespread belief says that cosmetics reach the shelf with no safety checks. In the EU that is wrong. Every cosmetic placed on the market must have a documented safety assessment signed by a qualified expert, a named company legally responsible for it, and a file kept ready for inspectors. Individual ingredients can be banned, capped or limited to certain uses by law, and those limits are based on the opinions of an independent scientific committee.

The system works differently from the one for medicines, though. Nobody approves a finished face cream before sale. Responsibility sits with the company, and the authorities check afterwards. This article explains how that works, where the strengths are, and where the gaps are.

The legal frame: one regulation, five annexes

Cosmetics in the EU fall under Regulation (EC) No 1223/2009. It names a Responsible Person, a company or person established in the EU, who answers for the product's compliance and for keeping its documentation. For a product made outside the EU this is usually the importer or a specialist service. The label must show their address.

The regulation controls ingredients through lists, called annexes:

Annexes IV, V and VI are positive lists: only the colourants, preservatives and UV filters named there may be used for those purposes. Every other ingredient is allowed unless Annex II bans it or Annex III restricts it. The lists change as the science develops. A single amending regulation can add, tighten or remove entries. Regulation (EU) 2024/996, for example, amended Annexes II, III, V and VI in one step, adding limits for vitamin A and arbutin.

The safety assessment: what the company must prove

Before a cosmetic is placed on the market, Article 10 requires the Responsible Person to make sure it has been through a safety assessment and that a Cosmetic Product Safety Report exists, in the form set out in Annex I. The assessment must take into account:

• how the product will be used and the expected systemic exposure to each ingredient in the final formula;
• a weight-of-evidence approach that reviews data from every available source, not a single study;
• new information that appears after launch, because the report has to be kept up to date.

The core of the report, the safety assessment itself, must be carried out by a person with a university qualification in pharmacy, toxicology, medicine or a similar discipline. This is a legal requirement, not a courtesy. The assessor works through each ingredient's toxicology and the exposure from the way the product is used. In scientific practice the question is whether the amount a person absorbs is far below the level at which effects are seen, with a built-in safety factor on top.

The assessor draws on guidance from the Scientific Committee on Consumer Safety, which publishes Notes of Guidance on testing and safety evaluation for authorities and industry. The same text records the EU's bans on animal testing for finished products and cosmetic ingredients, which is why the committee follows the development of alternative methods closely.

The report is one part of the Product Information File under Article 11. It also holds a product description, the manufacturing method with a statement of compliance with good manufacturing practice, proof of the claimed effect where the nature of the product requires it, and data on any animal testing. The company must keep it for ten years after the last batch goes on sale and make it available to inspectors at the address on the label.

Where the limits come from: the SCCS

The Scientific Committee on Consumer Safety (SCCS) is the independent expert body that advises the European Commission on the safety of consumer products, including cosmetic ingredients. It reviews the toxicology and exposure data on a substance and publishes an opinion. The Commission then decides whether to turn that opinion into law, and does so by amending the annexes.

Two examples show the process at work:

• Phenoxyethanol. The SCCS concluded that the preservative is safe at the current maximum of 1%, which is its limit in Annex V, for consumers of any age. Nothing changed in the law.
• Vitamin A (retinol). In October 2022 the SCCS adopted a revised opinion, SCCS/1639/21. It found vitamin A safe at 0.05% retinol equivalent in body lotion and 0.3% in other leave-on and rinse-off products. Those figures became the limits in Regulation (EU) 2024/996, adopted in April 2024.

The vitamin A opinion also shows where science stops and policy starts. The SCCS could not conclude on how much cosmetics add to total vitamin A intake, because the model calculations it received were inconsistent. It noted that food and supplements drive most of the exposure and that dividing the allowed intake between those sources is a risk-management decision for the Commission, not a scientific assessment. Understanding that distinction explains many headlines about "EU bans" and "EU limits": the scientists describe the risk, and the lawmakers choose how to manage it.

What the system does not do

The EU model is strong on documentation and weaker on prior verification. Four limits are worth knowing:

1. No approval before sale. A finished product is not licensed the way a medicine is. The company assesses and documents it, notifies it, and places it on the market. Authorities inspect afterwards.
2. Enforcement is national. Each Member State's authority checks products on its own market, so how often a product is examined depends on resources and priorities.
3. Claims are lightly tested. Proof of the claimed effect only has to be in the file where the nature of the product justifies it. A cream that promises to firm skin is not tested by the authorities before it is sold.
4. Combined exposure is hard to judge. The vitamin A opinion is the clearest case: the committee could not say how all sources add up, so the limits cover cosmetics alone.

None of this means products are unsafe. It means safety depends heavily on the company's own quality system, and on checks that happen after the product is already on sale.

What this means when you buy a product

You cannot see a safety report, but a few things on the pack and in the shop tell you whether the basics are in place:

• An EU address. The label should show the Responsible Person's address. The Product Information File must be available there on request from inspectors.
• A full ingredient list in INCI. If the list is missing or incomplete, treat the product with caution. Our guide to reading ingredient lists explains what to look for.
• A trustworthy seller. Products sold on marketplaces from outside the EU are the likeliest to lack a Responsible Person or a safety assessment.
• Proportion in claims. The system does not test claims before sale. Be as sceptical of "clinically proven" as you would be of any advertising, and look for studies on the product or its key ingredient.
• A reaction is worth reporting. If a product causes a serious reaction, stop using it, tell a doctor and report it to the company and your national authority.

The system is not perfect, but it is not a free-for-all. Ingredient limits rest on published scientific opinions, and every product on the EU market is meant to have a named company, a qualified assessor and a file behind it.

Sources

• Regulation (EC) No 1223/2009, Chapter III: Articles 10 and 11 on the safety assessment and the Product Information File. This is the original text as held on UK legislation.gov.uk. Check the current EU consolidated version on EUR-Lex.
• SCCS opinion on vitamin A (SCCS/1639/21): adoption date, the 0.05% and 0.3% retinol equivalent conclusions, and the statement on total exposure.
• Commission Regulation (EU) 2024/996: the amendment that turned the vitamin A opinion into law. The recital wording was read from a search excerpt, so check the full text.
• SCCS Notes of Guidance for the Testing of Cosmetic Ingredients and their Safety Evaluation, 10th revision: the guidance used by assessors, and the animal testing context. A newer revision may be in force.
• Phenoxyethanol is safe, says SCCS: the SCCS conclusion and the 1% limit in Annex V.