What to Check in an EU Responsible Person Mandate

Every brand selling cosmetics into the EU eventually has the same conversation: you need a Responsible Person established in the EU, and unless you have your own EU entity, that means signing a mandate agreement with a third party. The regulation, EC 1223/2009, tells you a Responsible Person is required and lists what that role must do. It says almost nothing about what your contract with them should look like. That gap is where brands get burned.

What the Responsible Person is actually agreeing to do

Before you get to contract terms, it helps to be clear on the job itself. The RP is legally accountable for confirming your Cosmetic Product Safety Report (CPSR) is in order, maintaining the Product Information File (PIF), handling notification through CPNP, cooperating with market surveillance authorities, and managing serious undesirable effect reporting. They are not your formulator and not your safety assessor, though some RP firms bundle those services in.

That distinction matters when you're reading a mandate agreement, because the document should be specific about which of those functions the RP is performing directly versus subcontracting or expecting you to source elsewhere.

Liability split: read this section twice

The single most consequential clause is who is liable if a regulator flags a problem. In principle, the RP carries specific legal obligations under the regulation regardless of what your contract says; you can't contract your way out of statutory responsibility. But contracts still allocate financial liability, indemnification, and cost of recall between you and the RP, and this is where wording varies enormously between providers.

Look for:

• Indemnification triggers: does the RP indemnify you for their own errors (say, a CPSR review they signed off on that had a gap), or is liability written so broadly that you're indemnifying them for almost everything?
• Caps on liability: many RP agreements cap the provider's liability at the annual fee paid, which can be a few hundred euros. If a recall costs tens of thousands, that cap tells you who actually absorbs the loss.
• Notification of non-compliance: the agreement should specify how fast the RP must tell you if they discover an issue with your PIF or your ingredient list, not just that they eventually will.

Data and file ownership

The PIF contains your formula, your CPSR, your safety assessor's report, sometimes manufacturing details. Ask directly: when the mandate ends, do you get the complete file back, in a usable format, without a separate fee? Some agreements are silent on this, which in practice means the RP holds the leverage if the relationship goes sour, since regulators expect the PIF to be available at the address on file.

A mandate agreement worth signing states plainly that:

1. The brand retains ownership of the formula, ingredient data, and safety documentation
2. The RP will transfer the complete, current PIF to a new RP or back to the brand within a defined number of business days of termination
3. There's no additional charge tied to that handover beyond what's already been paid

Termination and transition clauses

RP relationships end for ordinary reasons: you outgrow a smaller provider, you open your own EU entity, pricing changes, service quality drops. The agreement should specify a notice period (30 to 90 days is common) and, critically, what happens to your CPNP notifications during the transition. Products can't go unrepresented, so a clean mandate agreement addresses the handoff sequence rather than leaving a gap where your listings are technically orphaned.

Scope of coverage

Check whether the mandate covers every product you currently sell or only those explicitly listed, and how new products get added. Some agreements require a fresh addendum and fee per SKU; others cover a brand's full catalog under one fee structure. Neither approach is wrong, but you want to know which one you're in before you launch a fifth product and discover you owe another onboarding fee.

Practical questions before you sign

Question	Why it matters
Who signs the CPSR, your assessor or theirs?	Determines who is accountable for the safety science itself
What's the response time for a market surveillance inquiry?	Slow RP response can escalate a minor inquiry into a formal action
Is the fee per product, per year, or tiered by revenue?	Affects cost predictability as you scale
Can they terminate with less notice than you can?	An asymmetric notice period leaves you exposed
Is there a named individual contact, or a general inbox?	A named RP officer usually means faster turnaround

Where this fits into the bigger compliance picture

An RP mandate is a legal relationship, not a checkbox, and the contract terms shape how much friction you feel the first time something goes slightly wrong, which eventually happens to every brand. Cosmetic Comply's EU notification support is on the roadmap alongside the US and Australia, and when it lands the same principle applies there as it does with the Canadian CNF filings the platform already handles: a clean, well-mapped ingredient and concentration record makes every downstream conversation, including the one with your RP, faster and less contentious.