Kojic Acid on the Hotlist: Limit and Conditions

Kojic acid formulas cross my desk constantly because brightening is such a durable category, and kojic acid is one of those ingredients where "it's restricted" gets treated as a dead end when it is actually just a formulation constraint you can work within.

Restricted, not prohibited

Kojic acid sits on the Hotlist as a restricted substance rather than a prohibited one. That distinction matters because it means the ingredient is permitted in a Canadian cosmetic formula, provided you stay within the concentration limit set for it and meet whatever conditions of use come attached to that entry. It is not automatically off the table for a brightening serum or spot treatment the way a fully prohibited substance would be.

Kojic acid works by inhibiting tyrosinase, the enzyme involved in melanin production, which is exactly why it shows up so often in products targeting hyperpigmentation and uneven tone. That mechanism is also part of why it draws restriction in the first place. It is an ingredient with a real physiological effect on pigmentation, and restrictions on ingredients like this typically reflect established safety data around irritation potential and appropriate use levels, not an arbitrary cap.

Why the exact limit needs a current check

I am deliberately not printing a specific percentage here, and that is on purpose rather than an oversight. Hotlist entries get revised, and the specific maximum concentration attached to kojic acid is exactly the kind of detail that can shift between updates. Treat any number you see cited online, including in older blog posts or forum threads, as a starting point for your own verification rather than something to formulate against directly. Before you finalize a concentration, check the current Cosmetic Ingredient Hotlist entry for kojic acid directly, because that is the only source that reflects the current restriction rather than a snapshot from whenever an article was written.

Stability is the practical headache, not just the limit

Even once you know your allowed concentration, kojic acid brings its own formulation challenges that often matter more day to day than the regulatory ceiling. It is notoriously unstable in many formulation environments, prone to browning or discoloration over time, particularly when exposed to light, air, or certain pH ranges. A kojic acid serum that looked perfect at batch release can visibly change color on a shelf a few months later if the stability work was not done properly.

This is worth raising because a restricted concentration limit and a stable, functional formula are two separate problems that both need solving. Meeting the Hotlist limit does not guarantee your product will look the same in month six as it did on day one. Conversely, a beautifully stable formula that exceeds the allowed concentration is not something you can file regardless of how well it performs.

What a compliant approach looks like in practice

• Confirm the current maximum concentration directly from the Hotlist rather than a percentage you saw quoted somewhere, since these entries are revised over time.
• Build in a stability testing period before you commit to a final concentration and packaging combination, since light and air exposure affect kojic acid's discoloration risk.
• Consider packaging that limits light and air exposure, such as opaque, airless pump packaging, as part of your compliance and quality strategy together rather than treating them as separate concerns.
• Document your concentration and your sourcing clearly for the CNF, since kojic acid's INCI name and the actual delivered concentration in the finished product need to be accurate, particularly if you are using a derivative form like kojic dipalmitate rather than kojic acid itself, which is a distinct ingredient with its own identity.

A note on derivatives

Some brightening formulas use kojic dipalmitate or other kojic acid derivatives instead of kojic acid itself, specifically because the derivative can offer better stability. It is important not to conflate these on a filing. Kojic Dipalmitate is a different INCI entry from Kojic Acid, with its own CAS number and potentially its own Hotlist treatment, so check the specific ingredient you are actually using rather than assuming rules for one apply identically to the other.

Restricted ingredients like kojic acid are exactly where a careful ingredient-by-ingredient screen earns its keep, confirming the current limit, matching the correct INCI form, and flagging the concentration against the live Hotlist entry before the formula goes out the door. That kind of check is built into how Cosmetic Comply screens a formula ahead of filing.