Cosmetics PIF: The File Every Responsible Person Must Be Ready to Show
Anyone placing a cosmetic product on the EU market must hold a Product Information File at the address printed on the label, ready for authorities on request. Here is what goes inside it, what 'ready' actually means, and how to keep it audit-proof through reformulations.
What the PIF is and who has to hold it
Under Regulation (EC) No 1223/2009, every cosmetic product placed on the EU market must have a designated Responsible Person (RP) — either the EU manufacturer, the EU importer, an EU distributor that modifies a product, or an entity inside the EU appointed in writing by a non-EU manufacturer.
The Responsible Person must hold a Product Information File (PIF) for each product at the address printed on the cosmetic's label. The PIF is not submitted to an authority and is not kept on a public register. It sits with the Responsible Person and must be made available to the competent national authority on request within a reasonable time.
The PIF must be retained for ten years from the date the last batch of the cosmetic product was placed on the market. 'Last batch' is calculated per SKU, per formulation version — reformulating restarts the clock for the new version, and the previous version's PIF must still be retained for ten years from its own last batch.
What goes inside the PIF
A description of the cosmetic product so the PIF can be unambiguously linked to it: product name, format, INCI list, intended use, target population.
The Cosmetic Product Safety Report (CPSR) in two parts. Part A contains the safety information: quantitative and qualitative composition, physical/chemical characteristics and stability, microbiological quality, impurities, trace elements, packaging materials, normal and reasonably foreseeable use, exposure assessment, toxicological profile of substances, undesirable effects and serious undesirable effects. Part B contains the safety assessment conducted by a qualified safety assessor and their signed conclusion.
A description of the method of manufacturing and a statement of compliance with Good Manufacturing Practice (typically referencing ISO 22716).
Proof of the effect claimed for the cosmetic product, where justified by the nature or effect of the product.
Data on any animal testing performed by the manufacturer, its agents, or suppliers — kept on file even though animal testing for cosmetic purposes has been prohibited in the EU since 2013.
CPNP notification is a separate obligation
Before placing a cosmetic product on the EU market, the Responsible Person must also notify the product through the Cosmetic Products Notification Portal (CPNP) maintained by the European Commission. The CPNP notification covers basic identification, frame formulation, labelling information, and contact details for poison centres.
CPNP notification is mandatory but it does not replace the PIF. CPNP is the information channel for authorities and poison centres; the PIF is your evidence base for safety, manufacturing quality, and claim substantiation. Holding one without the other is non-compliant.
Keeping the PIF audit-ready
Store the PIF in a version-controlled folder structure: Part A, Part B, claims dossier, batch records, supplier specifications, certificates of analysis, and a change-control log. The change-control log is the single most useful artefact in an audit — it shows the authority that the PIF is a living document, not a snapshot.
Freeze a complete PIF snapshot every time the formula, packaging, or claim materially changes. Tag the snapshot with the date, the formula version, the CPNP notification reference, and the safety assessor's signature date.
Designate one person internally as the PIF custodian. PIFs that 'live in shared drives owned by nobody' are routinely incomplete when the inspector arrives.
Common gaps inspectors find
Safety assessor signature missing, expired, or signed before the final formula was locked.
Microbiological challenge test (e.g. ISO 11930) missing for water-containing or leave-on products.
Stability and packaging compatibility study missing or older than the current packaging supplier.
Claim substantiation absent for product-defining claims ('hypoallergenic', 'dermatologically tested', '24-hour hydration').
Supplier raw-material specifications not on file, or on file in a language nobody in the team can read.
Each of these is an avoidable gap. The cost of building the PIF correctly the first time is a small fraction of the cost of remediating it under inspection pressure.
