What Is the CPNP and Who Actually Has to Notify

CPNP gets tossed around in cosmetic forums like everyone already knows exactly what it is, and then someone asks "wait, do I file this or does my manufacturer?" and the thread goes sideways. Let's sort out both the what and the who.

What the CPNP actually is

CPNP stands for Cosmetic Products Notification Portal, the EU's centralized online system for notifying cosmetic products before they're placed on the market. It's the practical filing mechanism required under Regulation (EC) No 1223/2009, the regulation that governs cosmetics across the EU. Think of it as the EU's equivalent to Canada's Cosmetic Notification System, in the sense that it's the portal where the required information about a product gets submitted, though the underlying legal frameworks and what you need to submit differ quite a bit between the two.

Through CPNP you submit product category, presence of nanomaterials, packaging photo, formula information, and other details tied to the product. It's not a review-and-approval process where a regulator signs off before you can sell. Like Canada's system, it's front-loaded disclosure rather than pre-market approval, but the EU system has more supporting documentation requirements sitting behind it than a simple notification form.

The two documents that sit behind every CPNP filing

The notification itself is only the visible part. Underneath it, EU rules require two substantial pieces of documentation:

• Product Information File (PIF): a compiled record covering the product description, manufacturing method, safety assessment, and more, kept on file and available to authorities on request.
• Cosmetic Product Safety Report (CPSR): a safety assessment specifically, which has to be signed by a qualified safety assessor, not just compiled by the brand.

Neither of these gets uploaded wholesale to CPNP itself, but both have to exist and be maintained before the product goes to market, and both need to be produced quickly if a regulator asks.

Who actually has the legal duty to notify

This is where people get tripped up, because "notify" sounds like it should default to whoever's brand name is on the bottle, but the actual answer runs through a specific legal role.

Regulation 1223/2009 assigns the notification duty to the Responsible Person, a role that must be established within the EU. This isn't necessarily the brand owner and it isn't necessarily the manufacturer either. It's whichever party has been formally designated to hold that responsibility, and it has to be an entity with an actual EU presence, not an overseas brand acting alone.

In practice, the Responsible Person is usually one of:

1. The manufacturer, if they're established in the EU.
2. The importer, if the product is manufactured outside the EU and brought in.
3. A distributor, if they market the product under their own name or trademark, which shifts the duty onto them.
4. A third-party Responsible Person service, hired specifically to fill this role, common for non-EU brands entering the EU market without setting up their own entity there.

If you're a non-EU brand (say, based in Canada or the US) wanting to sell into the EU, you cannot notify yourself directly through CPNP as a foreign entity with no EU presence. You need one of these routes to have an actual Responsible Person on record, established in the EU, who takes on the notification duty along with maintaining the PIF and holding the signed CPSR.

Why this structure exists

The logic is the same reasoning behind Korea's requirement for a domestic importer or the UK's post-Brexit OPSS system: regulators want someone reachable, inside their jurisdiction, who can be held accountable if there's a safety issue, a recall, or an inspection. A brand sitting entirely overseas with no local presence is much harder to regulate effectively, so the rule pushes the duty onto whoever has feet on the ground.

What this means for a small brand eyeing the EU

If EU expansion is on your roadmap, budget time to either find a Responsible Person service or structure a distribution deal where your EU distributor explicitly takes on that role in writing. Don't assume a distributor is automatically willing to be your Responsible Person just because they're selling your product. It's a real legal obligation with real liability attached, and reputable distributors will want to discuss it directly rather than have it assumed.

Canada's model is simpler for a brand just starting to think about international filing, since the seller can file the Cosmetic Notification Form directly, no EU-style Responsible Person required, and gets a CN number as proof within the 10-day window after first sale. That's the market Cosmetic Comply currently supports end to end, mapping your ingredients to INCI and CAS, screening against the Hotlist, and filing once a reviewer checks the result. The EU, with its Responsible Person requirement, PIF, and CPSR, is a heavier lift and one worth planning for separately as that support comes online.