Cosmetic Safety Testing: What Brands Need Before Launch
Quick answer
Cosmetic safety testing is only one part of the safety evidence a product needs before launch. The EU requires a documented safety assessment and a cosmetic product safety report before the product is placed on the market. The US requires the responsible person to hold records supporting adequate safety substantiation. Neither market publishes a single list of tests that every cosmetic must pass.
- Usually needed: formula and market review, raw material and toxicology data, exposure, risk-matched microbiological evidence, stability in the final pack, packaging data, label warnings and adverse effect handling
- Who decides: in the EU, a qualified safety assessor signs the conclusion and the EU Responsible Person ensures it exists. In the US, the responsible person named on the label holds the substantiation
- What does not replace it: a batch COA, a factory GMP certificate, a single "pass" report, or a test on a sample that is not your final formula and pack
- Scope: what evidence a brand needs and who owns it. Not a laboratory selection guide, a test method guide or a regulatory overview
Brands preparing a launch often ask their manufacturer for "the safety test". That request hides several different jobs: legal duties of the responsible person, inputs a safety assessor needs, laboratory tests, batch checks, and claim support. When they are mixed up, a product can reach launch with a stack of reports and still no safety assessment, or with an assessment of a formula the brand no longer sells. This guide sorts out what safety testing cosmetics for launch actually involves and who owns each part.
Related topics are linked rather than repeated. Choosing a laboratory and reading reports: cosmetic product testing and laboratories. Stability reports: cosmetic stability testing. Pack testing: packaging compatibility testing. The wider EU and US routes: our EU private label guide and MoCRA compliance guide. Nothing here is legal advice.
What the Law Actually Asks For
Checked against official texts on 6 October 2026. EU references are to the current EUR-Lex consolidated text of Regulation (EC) No 1223/2009, dated 18 May 2026; confirm it is still current for your launch date.
- EU: safety is the requirement, the assessment is how you show it. Article 3 of Regulation (EC) No 1223/2009 requires a cosmetic product to be safe for human health under normal or reasonably foreseeable conditions of use. Article 10 says that, before placing the product on the market, the responsible person must ensure it has undergone a safety assessment and that a cosmetic product safety report (CPSR) is set up in line with Annex I. The assessment must consider intended use and systemic exposure, weigh data from all existing sources, and be kept up to date after launch.
- EU: the assessor must be qualified. Article 10(2) requires the safety assessment in Part B of Annex I to be carried out by a qualified safety assessor: a person holding a diploma or other formal qualification from a university course in pharmacy, toxicology, medicine or a similar discipline, or a course a Member State recognises as equivalent.
- EU: the report sits in a file the Responsible Person keeps. Article 11 requires a product information file containing the CPSR, a manufacturing description with a GMP statement, proof of claimed effects where the nature of the product justifies it, and data on animal testing. It is kept for ten years after the last batch is placed on the market. Under Article 4 the Responsible Person must be established in the EU. A manufacturer established outside the EU cannot take the role itself. For an imported product, the importer is the Responsible Person and may designate, by written mandate, another person established in the EU who accepts in writing.
- US: substantiation, not a test list. Section 608 of the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) requires the responsible person to ensure, and keep records showing, adequate substantiation of safety. That means evidence qualified experts would consider sufficient to support a reasonable certainty that the product is safe. FDA's MoCRA page states that neither the law nor FDA regulations require specific tests, and that existing data from scientifically robust methods can be used.
- US: no pre-market approval. FDA's Product Testing of Cosmetics page says FDA cannot approve cosmetic products or ingredients before marketing (color additives aside) and has no list of tests required for any particular cosmetic. Under the older rule in 21 CFR 740.10, a product whose safety is not adequately substantiated before marketing is misbranded unless it carries a "safety of this product has not been determined" warning.
Other markets set their own rules. We have not summarised the UK or ASEAN here; use each market's official sources, and our ASEAN guide as a starting point for that region.
Five Kinds of Evidence That Do Not Substitute for Each Other
Most launch problems start when one kind of evidence is treated as covering another.
| Layer | Question it answers | Who owns it | What it cannot do |
|---|---|---|---|
| Legal requirement | What must exist before this product goes on sale in this market? | EU Responsible Person or US responsible person | Supply the evidence itself |
| Safety assessment input | What does the assessor need to judge this formula at this exposure? | Responsible person, with manufacturer and suppliers | Replace the assessor's conclusion |
| Laboratory test | What did this sample show under this method? | Laboratory reports; brand commissions | Cover later batches or a changed formula |
| Batch release | Does this production run meet its approved specification? | The manufacturer's quality function | Show the formula is safe, stable or well preserved |
| Claim evidence | Does the product do what the label and advertising say? | The brand, with whoever runs the claim studies | Establish safety |
The batch release row causes the most confusion. A certificate of analysis records what one batch measured against an agreed specification, and you should get one for every batch. It cannot tell an assessor whether the preservative system holds up in use, whether the formula stays in specification over its shelf life, or whether an ingredient level is acceptable at your product's exposure. Our quality control process shows where batch release sits in production. Our resources page shows a redacted commissioned test report next to a redacted batch COA so you can see the difference on paper.
Claims also change the safety picture. "Suitable for sensitive skin" or "for use around the eyes" changes the users and exposure the assessor must consider, so fix the claims before the assessment is finalised. Wording is covered in our claims compliance guide.
Who Is Responsible for What
Contracts can assign tasks, such as who pays for a study or prepares a dossier section. They cannot move a legal duty to someone the law does not allow to hold it.
| Party | Typical role in pre-launch safety evidence | What it should not be assumed to do |
|---|---|---|
| Brand owner | Sets markets, claims, users and pack; funds evidence; often the US responsible person when named on the label | Assume the factory has covered it |
| EU Responsible Person | Established in the EU; ensures the assessment, CPSR and product information file exist and stay current; notifies serious undesirable effects | Be held by a manufacturer established outside the EU; for imports the role sits with the EU importer or a person it designates in writing |
| US responsible person | Manufacturer, packer or distributor named on the label; holds substantiation records; reports serious adverse events to FDA within 15 business days | Rely on a facility registration as proof the product is safe |
| Safety assessor (EU) | Writes and signs Part B: the conclusion, required warnings and the scientific reasoning | Conclude on data from a different formula, pack or use |
| Manufacturer | Supplies formula, specifications, raw material, stability and microbiological data within the agreed scope; manufactures under GMP and releases batches | Act as Responsible Person or safety assessor unless it actually holds that role |
| Testing laboratory | Runs specified methods on the samples received | Decide the product is safe or approved |
The Commission guidelines in Implementing Decision 2013/674/EU describe the CPSR as "an expert piece of work made up of different modules". Where the responsible person is not the manufacturer, they may need to involve the manufacturer, raw material suppliers and other experts. In practice the factory supplies much of the Part A data, and your assessor turns it into a conclusion.
The Evidence a Safety Assessment Usually Draws On
Annex I of the EU regulation lists what Part A of the CPSR must cover. It is a useful structure for any market because it is the most explicit public list of what a cosmetic safety assessment considers. It is not a list of tests: many sections are met with supplier data, literature or calculation.
1. Formula, market and use
Start with the exact formula version: every substance with its INCI name, function and concentration, plus fragrance details from the supplier. Then fix markets and use: leave-on or rinse-off, where, how much, how often, by whom. Annex I asks for particular attention to products used around the eyes, on mucous membranes, on damaged skin, on children under three, on elderly people and on people with compromised immune responses. Check banned and restricted ingredients now, not after the artwork is printed; our EU banned ingredients guide covers part of that check.
2. Raw material data, impurities and toxicology
For each raw material the assessor needs specifications, purity, relevant impurities and a toxicological profile. Annex I asks for particular focus on skin and eye irritation, skin sensitisation and, for UV-absorbing substances, photo-induced toxicity. Where relevant, it also asks for a margin of safety calculated from a no-observed-adverse-effect level. Most of this comes from suppliers, published data and expert reviews; FDA notes the same for the US. Additional testing fills gaps that existing data cannot.
3. Exposure
Exposure is calculated, not tested. It turns "is this ingredient hazardous?" into "is it safe at this level, on this site, for these users?" Annex I lists site and surface area, amount, duration and frequency, routes, the target population, and secondary routes such as inhaling a spray or swallowing lip product.
4. Microbiological quality and preservation
The EU guidelines sort finished products into three microbiological risk groups, which decide whether microbiological testing, a preservation challenge test, or both are needed. Any exemption needs a scientific justification. Our testing laboratory guide sets out the groups. For launch planning, two points matter: a clean result on one batch shows that batch's quality, not that the preservative works, and challenge results in the market file should relate to the formulation actually sold. In the US, FDA says cosmetics need not be sterile but must not contain harmful microorganisms.
5. Stability in the final pack
Annex I covers stability under reasonably foreseeable storage conditions. The guidelines ask for evidence that the composition tested matches the product placed on the market, and Part B must consider how stability affects safety. So stability is a safety input, not only a shelf-life question. Reading the report itself is covered in our stability testing guide.
6. Packaging
Annex I asks for the relevant characteristics of the packaging material, in particular purity and stability, and the guidelines note that substances may migrate from pack to product. The assessor needs the actual components touching the formula: bottle, liner, dropper teat, pump, airless parts. The final formula in the final pack is the input. Study design is in our packaging compatibility guide.
7. Human tolerance studies, where the assessor needs them
Human volunteer studies are not a default item. The EU guidelines list them among possible data sources but say they "should only be used to confirm safe levels of use for a relevant target population". Whether one is needed depends on the formula, the users and what the assessor still needs. Non-clinical safety studies used in an EU assessment must follow good laboratory practice under Article 10(3). FDA says animal testing is not a requirement for marketing a cosmetic in the US; the EU has its own animal testing rules. Confirm with your assessor before commissioning any study.
8. Warnings, instructions and undesirable effects
Part B of the CPSR states which warnings and instructions must appear on the label, so the assessment feeds the artwork. Our labelling requirements guide covers the rest of the label. After launch, the assessment depends on undesirable effects data. Article 23 requires serious undesirable effects to be notified to the competent authority without delay. MoCRA requires serious adverse events to be reported to FDA within 15 business days. Agree before launch who receives complaints, who judges seriousness, and how the manufacturer is told so the batch can be traced.
Planning safety evidence for a new product?
Send the product type, formula status, target markets, intended users, claims and pack. We will map which data our quality system can document, which tests would need an external laboratory, and which items sit with your Responsible Person or safety assessor. Scope and any external testing are confirmed per project in the quotation.
Request a Safety Testing Scope →What a "Pass" Does Not Mean
Four misreadings come up often in launch files:
- Passing a test is not market approval. FDA does not approve cosmetics before marketing. EU notification under Article 13 is a submission of product information by the Responsible Person, not an approval step. A report says what a sample showed against a method and a limit; whether the product may be sold depends on the full assessment and the other market obligations.
- A batch COA is not pre-launch safety evidence. It is part of release and shows production matches what was assessed. It does not replace the assessment.
- A factory certificate is not product evidence. ISO 22716 or GMPC shows a site's quality system was audited within a stated scope; neither completes a CPSR. Our certifications page explains what ours cover.
- A result on a different formula or pack does not transfer automatically. A study on a development sample, a glass jar or last year's formula describes that product, not the one you sell.
When the Evidence Has to Be Revisited
A safety assessment describes one product at one point in time. The EU guidelines say it should be reviewed, and updated if necessary, when any of these happen:
- new scientific findings or toxicological data on a substance that could change the result
- a change in the formulation or in raw material specifications
- a change in the conditions of use
- a rising trend in the nature, severity or frequency of undesirable effects
On an OEM order the usual triggers are a supplier substitution, a new fragrance, a jar-to-pump switch, a new market or a new claim. Agree in writing that the manufacturer tells you before any of these, not after. Our quality control process describes how component and formula changes are assessed on our side.
Launch Safety Evidence Checklist
A working list for your manufacturer, Responsible Person and assessor. Where a row does not apply, record why: a documented justification is itself evidence.
| Evidence item | Usually supplied by | Owner | Version / date | Status |
|---|---|---|---|---|
| Locked formula version with INCI, function and concentration | Manufacturer | |||
| Target markets, intended users, use instructions and final claims | Brand | |||
| Restricted and banned substance check per market | Manufacturer with Responsible Person | |||
| Raw material and fragrance specifications, safety data and impurity information | Raw material suppliers via manufacturer | |||
| Finished-product specification with limits and methods | Manufacturer | |||
| Microbiological quality results, or documented justification | Manufacturer or external laboratory | |||
| Preservation challenge test on the final formula, or documented justification | Laboratory confirmed per project | |||
| Stability data on the marketed composition in the intended pack | Manufacturer or external laboratory | |||
| Packaging component identification and compatibility evidence | Manufacturer with packaging suppliers | |||
| Exposure calculation and toxicological evaluation | Safety assessor | |||
| Human tolerance study, only if the assessor requires it | Study provider confirmed per project | |||
| Signed safety assessment (EU Part B) or US substantiation record | Safety assessor / qualified expert | |||
| Label warnings and instructions matching the assessment | Brand with Responsible Person | |||
| Manufacturing description and GMP statement | Manufacturer | |||
| Adverse effect and complaint handling route, including the manufacturer contact | Brand / responsible person | |||
| Change notification agreement for formula, supplier and pack changes | Brand and manufacturer |
Questions to Ask Your Manufacturer
Put these in writing before you approve the final sample, while changes are still cheap:
- Which Part A inputs can you document for this formula, and in what format will we receive them?
- Which tests sit within your own quality system, and which would go to an external laboratory? Who chooses that laboratory, and will we see the full report?
- Will challenge, stability and compatibility work be run on the final formula in the final pack? If not, what exactly will be tested?
- Who keeps the original reports, and can we obtain them later if we change manufacturer?
- What will you notify us about before production: supplier changes, raw material grade changes, process changes, component changes?
- What do you send with each batch, and how does that batch COA relate to the specification our assessor reviewed?
Warning signs: "has passed safety testing" with no report or specification behind it; a signed EU safety assessment offered without naming the assessor; a factory established outside the EU offering to act as your EU Responsible Person itself, rather than pointing you to the importer or a designated EU-established person; or a stability or challenge report on a different formula presented as yours.
How We Support the Evidence on Our Side
As a manufacturer, our part is the data and documentation an assessor and responsible person rely on, not the legal role or the signature. Our quality and testing page sets out what we document: physical and chemical checks, microbiological and preservation evidence, stability, packaging compatibility and claim-related work, scoped from the formula and market route. Where work from outside our quality system is required, the external laboratory, method, sample and report are agreed per project before quotation. We do not describe our internal laboratory as CMA- or CNAS-accredited. The EU Responsible Person, the safety assessor and the US responsible person stay on your side of the project.
Who holds the underlying data also depends on the model. On OEM projects your existing file is the starting point; on ODM projects the data package to be handed over is agreed at quotation. Our manufacturing process guide shows where each record is created during production.
Frequently Asked Questions
Is cosmetic safety testing legally required?
A documented safety basis is required; a fixed test list is not. The EU requires a safety assessment and CPSR before launch. The US requires records of adequate safety substantiation, and FDA says no specific tests are required. The tests you need are those that fill gaps in existing data. Checked 6 October 2026.
What is the difference between safety testing and a safety assessment?
Testing produces data on a sample. A safety assessment is the expert judgement that the product is safe for its intended use, drawing on tests, supplier data, literature and an exposure calculation. In the EU it is Part B of the CPSR, signed by a qualified safety assessor.
Can my manufacturer provide the CPSR?
A manufacturer can usually supply most Part A inputs. Part B must be written and signed by a qualified safety assessor, and the EU Responsible Person must ensure the report exists and stays current. Confirm in writing which parts are included.
Is a batch COA enough to prove my product is safe?
No. It shows one batch met its specification. It does not show the formula is safe at its exposure, stable over its shelf life or adequately preserved.
Do I need a challenge test for every product?
Not always. The EU guidelines set three microbiological risk groups. Products outside the two defined exception groups need both a challenge test and finished-product microbiological testing. Low microbiological risk products (for example above 20% alcohol, solvent-based, or high or low pH) may need neither, and single-use or non-openable packs may need only microbiological testing. Each exception needs a scientific justification. Your assessor decides which applies.
Does passing safety testing mean my product is approved for sale?
No. FDA does not approve cosmetics before marketing, and EU notification is a submission of product information, not an approval. A test result is one input to the safety assessment or substantiation.
Next Step
Plan safety evidence while the formula, pack and claims can still change. Our ODM service covers formulation from a brief; our OEM service covers production of a formula you own. Either way, request a quote with your markets, claims and pack, and we will confirm the evidence scope with it.
Ready to Start Your Project?
Tell us your product requirements. Within 24 hours, our technical team will reply with a quotation or the questions needed to prepare one.