Cosmetic Product Testing: How OEM Buyers Verify a Laboratory

Many buyers start looking for a cosmetic testing laboratory when a retailer, a regulator or a distributor asks for a report. By then the formula is fixed, the packaging is ordered and the launch date is set, and the question has quietly become "who can give us a result quickly" rather than "which results would support this product in this market".

This guide is for brand owners, sourcing teams and compliance leads who are working with an OEM or ODM manufacturer and need to decide what gets tested, by whom, and how to judge whether the result is usable. It does not rank laboratories. It sets out what to plan before you send a sample and what to check when the report comes back.

Start with the question, not the laboratory

Cosmetic product testing is not one service. It is a set of separate questions, and each belongs to a particular product, market and claim. A rinse-off cleanser sold in one country with no performance claims and a leave-on serum sold in three markets with a "clinically tested" claim do not need the same evidence, even if they come off the same filling line.

Before you contact cosmetic testing labs, write down three things:

• The product as it will be sold: the formula, the actual pack including the dispenser, the batch or batches to be tested, and the intended use and user group.
• The destination market or markets: the rules that apply, and who in that market is responsible for the product.
• The claims: list every explicit or implied claim on the pack, the listing and the advertising, then map each one to evidence that is adequate, verifiable and relevant to the product and the benefit. One body of evidence can support several related claims, and some claims need evidence that no routine test provides.

The regulatory starting point differs by market. In the United States, FDA states that it does not have a list of tests required for any particular cosmetic product or ingredient, and that the manufacturer or distributor is legally responsible for the product being safe when used as directed or in the customary way (FDA, Product Testing of Cosmetics). Under MoCRA, the responsible person must ensure and maintain records supporting adequate safety substantiation, while neither the law nor FDA regulations require specific tests (FDA, MoCRA).

In the EU, Regulation (EC) No 1223/2009 requires a cosmetic product safety report before a product is placed on the market (European Commission, Cosmetics legislation). There is no single test list for every cosmetic, but the Commission's guidelines on that report do set risk-based expectations for microbiology. Section 3.3.2 of Implementing Decision 2013/674/EU describes three groups:

• Low microbiological risk products, such as products with more than 20% alcohol, products based on organic solvents, or high- or low-pH products: neither a preservation challenge test nor microbiological quality testing of the finished product is necessary, but a scientific justification is required.
• Single-use products and products that cannot be opened: microbiological quality testing of the finished product is necessary, and a scientific justification is required for not doing a challenge test.
• All other products: both a preservation challenge test and microbiological quality testing of the finished product are necessary.

For claims, Regulation (EU) No 655/2013 requires explicit or implicit claims to be supported by adequate and verifiable evidence; statements of clear exaggeration or of an abstract nature are treated separately (Regulation (EU) No 655/2013). These positions were checked on 30 September 2026. Confirm them again for your launch date and for every other market you sell into.

The practical consequence is simple. A laboratory can only answer the question you give it. If the question is vague, the report will be precise about something that may not matter.

Accreditation: check the scope, not the logo

Where accredited testing is required, testing laboratories are generally assessed against ISO/IEC 17025 (ISO/IEC 17025:2017). According to ILAC, accreditation is the independent evaluation of conformity assessment bodies against recognised standards to carry out specific activities, so that their impartiality and competence can be relied on (ILAC, About ILAC). In practice, accreditation covers the defined activities within the laboratory's published scope, at the stated site or sites. It does not cover everything the laboratory offers.

An accreditation logo on a website or brochure is a claim. It does not show that the accreditation is current, or that the test you need is covered. To check:

1. Identify the accreditation body named on the certificate, then confirm through the ILAC MRA signatory search that the body is a signatory and that its recognised scope includes testing to ISO/IEC 17025.
2. Open the laboratory's entry in that body's own directory, not a PDF supplied by the laboratory. ILAC notes that many signatory entries link to such a directory (ILAC MRA and Signatories).
3. Match the details in the published scope: the legal entity, the site that will do the work, the activity or method, and the matrix or material.
4. Check that the status is current for the period in which your testing will be done.

The ILAC MRA helps accredited results travel across borders, but it does not guarantee that every regulator, customer or retailer will accept a specific report. If a buyer or authority has its own requirements, confirm them before you choose the laboratory.

A result that sits outside a laboratory's accredited scope can still have technical value, for example in development work. It simply carries no accreditation status. The report should say plainly which results are within scope and which are not, and you should decide in advance whether the party you are serving will accept the rest.

What each type of test is for

The work usually falls into five families. Each answers a different question, and one does not stand in for another.

• Microbiological quality. Asks whether a sample meets the agreed microbiological limits and is free from specified organisms. FDA notes that cosmetics do not have to be sterile but must not contain harmful microorganisms, and publishes its own methods in BAM Chapter 23: Methods for Cosmetics. A clean batch result does not demonstrate preservative efficacy.
• Preservative efficacy (challenge) testing. A standardised inoculation test that evaluates the antimicrobial protection of the formulation. It is a controlled challenge, not a reproduction of every way a product is contaminated in use. ISO 11930:2019 is the usual reference. Development-stage results can guide formulation; results that support placing the product on the market should correspond to the final formulation, and a significant change calls for re-evaluation.
• Stability. Asks whether the product holds its specification over time and under stress conditions. There is no single prescribed protocol, which is why the report needs careful reading. Our guide on how to read a cosmetic stability testing report covers the checks in detail.
• Packaging compatibility. Asks whether the formula and the complete pack, including pumps, droppers and airless mechanisms, change each other. See packaging compatibility testing for pumps, droppers and airless bottles.
• Safety, tolerance and claim support. The safety assessment is built up during development, completed before the product goes on the market and updated when new information appears. Where studies are used for substantiation, they must be relevant to the marketed product and the claimed benefit; formula or claim changes require a relevance review. Claim wording itself is covered in our guide to cosmetic claims compliance in the US, EU and China.

These studies depend on each other, so the order matters. Challenge results that support the market file should match the formulation you sell. Compatibility results belong to the exact pack. Studies used for claim substantiation must stay relevant to the marketed product and the claimed benefit, so a formula or claim change calls for a relevance review. Changing any of these later can leave an earlier report describing a product you no longer sell.

Samples: the result is only as good as the link to your product

A test report describes the sample the laboratory received. Whether it describes your product depends on how well that sample is identified and traced. Agree the following before anything is shipped:

• Sample identity. Product name, formula version, batch number, manufacturing date, pack type and fill. The same identifiers should appear on the sample label, the submission form and the batch record.
• Representativeness. Whether the sample comes from a laboratory batch, a pilot batch or a production batch, and whether it is in the final pack. Many studies are only relevant if run on product made by the intended process and filled into the intended component.
• Chain of custody. Who packed the sample, how it was sealed, how it travelled, what temperature it was kept at, and how the laboratory recorded its condition on receipt.
• Method suitability. Whether the method has been shown to work on this type of product. Oils, powders, strongly coloured products and products with high antimicrobial activity can interfere with a method unless it has been checked for that matrix.
• Report versions. How the laboratory issues an amended report, how it identifies which version replaces which, and how you will be told. You do not want two versions of the same report in circulation with different results.

What to check on the report itself

When the report arrives, read it against the brief before anyone files it or forwards it to a customer. The six checks below are a buyer-facing screen, at least. They are not the full list of report contents that ISO/IEC 17025 requires of the laboratory.

1. Laboratory and report identification. The legal name and site match the published scope you checked, and the report number and version are clear.
2. Sample identity. The sample description, batch number and receipt date match what you sent and what the manufacturer recorded.
3. Method. The method is named, and any deviation from it is stated and explained.
4. Results suited to the method. Quantitative results show values and units. Qualitative results give a clear outcome, such as detected or not detected, or present or absent.
5. Criteria and decision rule. Where the report states "pass" or "complies", it should name the specification or limit applied and, where relevant, the decision rule used to reach that statement. ILAC's guidance on decision rules and statements of conformity, G8, is published in the ILAC guidance series. Criteria you did not agree to may not be the ones your market uses.
6. Accreditation coverage. The report shows which results are within the laboratory's accredited scope, if an accreditation mark is used at all.

If any of these is unclear, ask before relying on the report. A report that cannot be traced to your product and your criteria is hard to use as evidence, however clean it looks.

Batch control and product evidence answer different questions

It is tempting to sort testing by where it happens: the factory for routine checks, an outside laboratory for "real" evidence. That is not a reliable guide. What matters is the question being asked and whether the laboratory doing the work is competent, and where required accredited, for that activity and method.

Batch control asks whether one production run meets its agreed specification. It covers incoming materials, in-process parameters and the finished product, and it decides whether a batch can be released. The quality control process page shows how that flow works at GZ Cosmetics Lab.

Product and market evidence asks whether the formula and pack will perform and whether the claims are supported: challenge testing, formal stability, compatibility and claim studies.

Either kind of work can be done by a manufacturer's own laboratory or by an external one. An in-house laboratory may hold accreditation for particular activities and may run development studies. An external laboratory may perform batch release testing. The choice depends on method suitability, the laboratory's competence and accredited scope, the independence the situation calls for, and what the buyer, retailer or authority has specified.

Two narrow conclusions hold either way. A batch certificate of analysis does not demonstrate that the preservative system works, that the product is stable or that a claim is supported. And a study on one sample does not show that later batches meet the specification. If a buyer, retailer or authority specifies where particular results must come from, follow that requirement; otherwise agree it in writing before testing starts. Our quality and testing page sets out which work sits within our own quality system and which is scoped separately, and the certifications page shows what each of our certificates does and does not cover.

Questions to ask before you commission testing

Whether you commission cosmetic testing services directly or through your manufacturer, put these questions in writing:

• Which of the tests we need are within your accredited scope, at which site, and under which accreditation body?
• Will any of the work be subcontracted? If so, to which legal entity and site, and are that site and the relevant activity or method within its accredited scope?
• Which method will you use for each test, and has it been checked on this type of product?
• What sample quantity, pack format and condition do you need, and how will you record receipt?
• Which acceptance criteria and decision rules will you report against, and can we specify our own?
• How will results be reported for each test: values and units, or a stated qualitative outcome?
• How do you issue and identify amended reports?
• Who can we share the report with: the manufacturer, the safety assessor, a retailer, a regulator?
• What happens if a result is out of specification: is there a retest policy, and how is it recorded?

Some answers should make you pause:

• An accreditation claim that cannot be found in the accreditation body's own directory, or that names a different site or legal entity.
• A "pass" or "complies" statement with no specification, limit or decision rule named.
• Acceptance criteria that are not stated or are described only as "standard".
• A promise of the outcome before the sample has been received.
• An offer to test a laboratory sample and report it as representing production.
• Reluctance to name the method, the site, any subcontractor or the signatory.

If you are also auditing the manufacturer, you can link the two. Our factory audit guide shows how to follow one batch through records, which is also a practical way to confirm that the sample you sent for testing came from that batch.

Frequently Asked Questions

What does a cosmetic testing laboratory do?

It runs specified tests on submitted samples and reports the results against stated methods and criteria. Typical work includes microbiological quality, preservative efficacy, stability, packaging compatibility, safety-related testing and claim support. The laboratory reports on the sample; deciding whether the results support the product in a given market remains the responsibility of the brand or its responsible person.

Is cosmetic product testing legally required?

It depends on the market. FDA states that it has no list of tests required for any particular cosmetic, while MoCRA requires the responsible person to maintain records supporting adequate safety substantiation. In the EU there is no single list for every product, but the guidelines in Implementing Decision 2013/674/EU set risk-based microbiological expectations: products outside the two defined exception categories need both a preservation challenge test and finished-product microbiological quality testing, and each exception requires a scientific justification. Positions checked on 30 September 2026; confirm them for your own market and date.

How do I check whether a laboratory is really accredited?

Identify the accreditation body, confirm through ILAC that it is an MRA signatory whose recognised scope includes ISO/IEC 17025 testing, then look the laboratory up in that body's own directory. Match the legal entity, site, activity or method and matrix to the work you need, and check the status is current. A logo on its own is a claim, not proof.

Can my manufacturer's in-house testing replace a third-party laboratory?

It depends on the question, not on the location. Batch release and product studies answer different questions, and either can be done in-house or externally. What decides it is method suitability, the laboratory's competence and accredited scope, the independence required and what your buyer, retailer or authority has specified. Agree in writing which results will come from which laboratory.

What should I check on a cosmetic test report?

As a buyer-facing screen, at least: laboratory and report identification with a version, the sample description and batch number, the method and any deviations, results suited to the method, the specification and any decision rule behind a pass statement, and which results fall within the accredited scope. This is not the full list of report requirements under ISO/IEC 17025.