Where Your Product Information File Has to Be Kept

Building a Product Information File is only half the job. The other half, the part people forget about because it is not a one-time task, is keeping it sitting somewhere specific, accessible, and intact for years after you have moved on to your next product line.

What has to be true about where the PIF lives

Under Regulation (EC) No 1223/2009, the PIF must be readily accessible at the address of the Responsible Person located within the EU. Not "available if we dig through an old hard drive," readily accessible, meaning a regulatory authority asking to see it should be able to get it without a multi-week scramble. And this obligation does not end when you stop selling the product. It runs for ten years after the last batch of that product was placed on the market.

Ten years is a long runway. Think about what your business might look like a decade from now: different software, possibly a different Responsible Person if you have switched providers, maybe a different email system entirely. The PIF needs to survive all of that continuity risk.

What actually lives inside the PIF

The Product Information File is not one document, it is a collection, and the centerpiece is the Cosmetic Product Safety Report, the CPSR, which has to be signed by a qualified safety assessor. Around that sits the rest of the safety and manufacturing picture for the product: a product description, the manufacturing method with a statement of compliance with good manufacturing practice (commonly referenced against ISO 22716), evidence of the effects claimed for the product where relevant, and data on any animal testing conducted or referenced.

The Responsible Person is the one legally accountable for making sure this file exists, is current, and is actually retrievable, not just theoretically assembled at launch and never touched again.

Why the ten-year window catches people off guard

Small brands sometimes discontinue a product, part ways with their original manufacturer or formulator, and treat the PIF as closed business along with the product itself. It is not closed. If your Responsible Person changes during those ten years, whether because you switched providers or restructured your business, the PIF needs to move with that responsibility, staying accessible at whatever EU address currently holds the Responsible Person role for that product.

This is also why choosing a Responsible Person is not just a box-ticking exercise at launch. You are entering a relationship that, in terms of document retention obligations, outlives the product's active life on shelves by a decade.

Practical steps that keep you covered

A few habits make the ten-year obligation much less stressful when a query eventually comes in:

• Keep a master index of every product's PIF location and current custodian, especially if you have discontinued products from years back
• When you change Responsible Person, get explicit written confirmation of PIF handover as part of that transition, do not assume it happens automatically
• Store the CPSR and supporting documents in a format that will still be openable in ten years, plain PDFs rather than proprietary formats tied to software that may not exist by then
• Revisit discontinued product files periodically rather than only when a request comes in, so you catch a missing or corrupted document while there is still time to reconstruct it

How this connects to your CPNP notification

Your Cosmetic Product Notification Portal filing is the visible, submitted part of your EU compliance. The PIF is the deeper, retained evidence sitting behind that notification, and regulators can ask to see it independent of whether anything about the notification itself is in question. Treat the CPNP filing as the tip of the iceberg and the PIF as the substance underneath it that has to keep existing long after the filing itself is old news.

Cosmetic Comply's Canadian notification work today is built around the same discipline this EU requirement demands, accurate ingredient data that stays retrievable and defensible, and as EU support rolls out, that same underlying ingredient and concentration data becomes the backbone your CPSR and PIF will need, not a separate exercise you start from scratch.