PIFProduct Information File

A Product Information File is the master dossier the Responsible Person for a cosmetic product placed on the EU market must hold, keep current, and produce on request to a national competent authority — the regulatory eyes-on-the-product. It is required by Article 11 of EU Cosmetics Regulation 1223/2009 and is the operational artefact that proves the product is safe, lawful and supported by evidence.

Four hard rules attach to every PIF:

1. One PIF per product. Same product sold in different markets with the same formulation can share one PIF; a variant with a material change (different preservative, different fragrance, different claims) needs its own.
2. Held at the RP's EU address in electronic or other accessible format. A PIF kept only at a US headquarters is non-compliant — the regulator must be able to obtain it from an EU-established RP without crossing the Atlantic.
3. In a language easily understood by the competent authorities of the member state where the RP is established. In practice English is widely accepted, but national authorities may require translation.
4. Retained for 10 years after the last batch of the product was placed on the market.

Article 11(2) of 1223/2009 names the five components every PIF must contain. National authorities open the PIF and check for these five by name; missing any one — even if the substance is held elsewhere — is a non-compliance.

1. Product description — the exact product identification (name, identifier, manufacturer / RP / importer details) sufficient that the PIF can be unambiguously linked to the marketed product.
2. Cosmetic Product Safety Report (CPSR) — the safety assessment, structured per Annex I to 1223/2009, in two parts: Part A (safety information) and Part B (safety assessment by a qualified safety assessor). See the next section.
3. Description of the manufacturing method, and a statement of compliance with Good Manufacturing Practice for cosmetics — ISO 22716 is the de facto standard and the statement typically cites it.
4. Proof of the effect claimed, where the nature or effect of the cosmetic justifies it. 'Anti-ageing', 'reduces wrinkles by X%', '24-hour hydration' all require substantiation — clinical, instrumental, consumer-perception or in vitro evidence depending on the claim. Basic functional claims ('cleansing', 'fragrancing') usually do not.
5. Data on any animal testing performed by the manufacturer, its agents or suppliers — relating to development or safety evaluation of the cosmetic product or its ingredients, including any animal tests performed to meet legislative or regulatory requirements of third countries. Required even where the result is 'none' (the statement that there was none is itself the data).

The Cosmetic Product Safety Report is the substantive document inside the PIF. Commission Implementing Decision 2013/674/EU defines its structure as Annex I to 1223/2009; the CPSR is in two parts.

Part A — Safety information. Contains the factual material the safety assessor relies on:

• Quantitative and qualitative composition of the cosmetic product (full formulation breakdown, INCI names, function, %w/w).
• Physical and chemical characteristics and stability — stability study results, packaging compatibility, real-time + accelerated data.
• Microbiological quality — preservative-efficacy testing (PET / challenge test per ISO 11930) and microbiological specifications.
• Impurities, traces, information about the packaging material.
• Normal and reasonably foreseeable use — instructions and warnings.
• Exposure to the cosmetic product — site, area, amount, duration, frequency, route, target population (adults, children, vulnerable groups).
• Exposure to the substances — calculated systemic exposure per ingredient.
• Toxicological profile of the substances — local and systemic toxicity, sensitisation, photo-induced toxicity, genotoxicity, carcinogenicity, reproductive toxicity, toxicokinetics. Built from the SCCS opinions, REACH dossiers, and supplier toxicology data.
• Undesirable effects and serious undesirable effects — adverse-event history.
• Information on the cosmetic product (e.g. previous formulations, market history).

Part B — Safety assessment. The qualified safety assessor's conclusion + reasoning + credentials + signature:

• Assessment conclusion — explicit statement that the product is compliant with Article 3 of 1223/2009 and safe for human health under normal and reasonably foreseeable conditions of use.
• Labelled warnings and instructions of use — the assessor confirms the labelling is appropriate to the risk profile.
• Reasoning — explicit reasoning that supports the conclusion, drawing on the Part A information.
• Assessor's credentials — proof of qualification (pharmacy, toxicology, medicine, or similar discipline per Article 10(2)), with evidence of EU recognition.
• Assessor's signature — name, address, signature, date.

Every cosmetic placed on the EU market must have a designated Responsible Person (Article 4) established in the EU. The RP is the legally-named entity that owns compliance:

• Holds the PIF and keeps it current.
• Files the pre-market notification on the Cosmetic Product Notification Portal (CPNP) per Article 13.
• Manages adverse-event reporting (serious undesirable effects per Article 23) to national authorities within 20 calendar days.
• Is the named contact point for national competent authorities and market-surveillance inspections.
• Bears responsibility for compliance with 1223/2009 — withdrawal, recall, corrective action all sit with the RP.

The brand owner, the EU-based manufacturer, the EU importer, or a third-party RP-service-provider can take the role; what matters is that the RP is EU-established and named in writing on the product packaging (Article 19(1)(a)).

Post-Brexit, UK-sold cosmetics need a UK-established UK Responsible Person under the UK Cosmetic Products Enforcement Regulations 2013 (which retains 1223/2009 as UK domestic law). A brand selling into both EU and UK markets typically holds the same PIF in two regulator-accessible locations under two RPs.

A brand selling in both markets typically maintains the full EU PIF as the master dossier and uses a subset of its data to populate the MoCRA product listing and facility registration. The CPSR feeds both — Part A's composition section is the same dataset; the safety-assessor conclusion in Part B is EU-specific.

1. PIF is a compound controlled document in V5 Document Control — the parent record carries the SKU link, RP details, marketed-since date, status, and the list of component documents.
2. Each of the five mandatory components is a separately versioned controlled document — product description, CPSR (with Part A + Part B as sub-documents), GMP statement, claims evidence, animal-test history. Independent versioning means a CPSR update (e.g. new toxicology dossier on a fragrance allergen) doesn't force a re-issue of every other component.
3. Two-person e-signature on every PIF revision — author + RP approver, per 211.186-style discipline applied to cosmetics. The RP signature is the legal anchor; V5 captures it with Part 11 §11.50/§11.70 metadata even though Part 11 is not binding on EU cosmetics — the audit trail is the same.
4. CPSR safety-assessor identity stored as a verified profile — qualification document attached, recognition jurisdiction recorded, signature ties to the verified profile, expiry-of-recognition tracked.
5. Auto-rebuild of the PIF cover dossier whenever any component changes — operators always download the current consolidated PIF (PDF assembled via @react-pdf/renderer, Worker-safe) plus each component as a separate attachment.
6. Currency monitoring — V5 tracks days-since-last-review per component, opens a review task at the configured cadence (typically 12 months CPSR, 24 months product description, 12 months GMP statement), and flags an overdue PIF on the SKU master.
7. Claims-evidence linkage — every claim listed on the product label is linked to its substantiation evidence inside V5 (clinical study, instrumental measurement, consumer-perception data, in vitro report); a label claim with no linked evidence opens a finding.
8. Authority-request export — one-click PDF assembly of the current PIF + all components for delivery to a national competent authority, with the assembly timestamp + V5 version + tenant ID stamped in the metadata for forensic traceability. Mobile-safe at ≤390px CSS width for RP-on-the-road delivery.

1. PIF held only at a non-EU address (typically the brand's US HQ) — operationally not accessible to EU authorities; treated as no PIF.
2. PIF assembled at launch, then never updated when formulation, supplier, claims, or packaging change — CPSR no longer matches the marketed product.
3. CPSR signed by an assessor without the Article 10(2) qualification — regulatory consultants without pharma / tox / medicine credentials; the CPSR is invalid.
4. Claims evidence missing for marketing claims printed on the label — '24-hour moisturisation' on the front of the bottle with no instrumental study in the PIF; Regulation 655/2013 finding.
5. GMP statement signed but ISO 22716 audit history unavailable — the statement asserts compliance but the audit reports that would prove it cannot be produced.
6. Animal-test data missing for ingredients sourced from suppliers without confirmation — the brand has not chased its suppliers; gap is inferred as non-compliance.
7. PIF kept only in physical form at a single location — not accessible to authorities in a member state outside the single physical address; particularly fragile when the named EU office is closed for holiday.