Selling balms in the UK and EU: safety reports, notification and what it really involves

The Responsible Person, the safety report, the product information file, CPNP and SCPN notification, labelling and the 2026 allergen change, for small makers.

The United States regulates cosmetics mostly after they are on sale. The United Kingdom and the European Union regulate them before. That is why a maker who can legally sell a balm at an American craft fair cannot do the same in Bristol or Bruges without a named Responsible Person, a written safety assessment and a notification filed in advance.

The framework, in one paragraph

The European Union operates Regulation (EC) No 1223/2009. Great Britain operates the same instrument as retained and amended law, the UK Cosmetics Regulation, enforced by the Office for Product Safety and Standards with local trading standards and the Cosmetic Products Enforcement Regulations 2013. Northern Ireland continues to follow the EU regulation. The substance is largely identical. What differs is who you notify, where your Responsible Person lives, and, increasingly, the annexes.

The Responsible Person

Article 4 is blunt: "Only cosmetic products for which a legal or natural person is designated within the Community as responsible person shall be placed on the market." That person carries the legal obligations, and it can be a sole trader. Manufacture in the territory and sell under your own name and you hold the role by default. Import, and the importer holds it unless it is passed on by written mandate. Rebrand somebody else's product and you become it.

The address must be a real establishment, not a mail forwarding service or a PO box, and it goes on the label. For Great Britain the UK Responsible Person has had to appear on packaging since 31 December 2022. A UK maker who wants EU customers needs a second Responsible Person established in the Union, normally bought as a service, and an EU maker selling into Great Britain needs the mirror arrangement. That is the most expensive consequence of Brexit for a small brand.

The cosmetic product safety report, and who can sign it

Article 10 requires a safety assessment before the product goes on the market, documented as the cosmetic product safety report in Annex I. It has two parts, and the split matters because you can do most of one yourself.

Two misreadings of Annex I are worth heading off. First, there is no anhydrous exemption in EU law. Microbiological quality must be characterised for every product, and a water activity argument offered in place of an ISO 11930 challenge test is the assessor's professional judgement, not a legal carve-out. Second, Annex I deals explicitly with non-intended ingestion of lip products and requires a special assessment for products intended for children under three, catching nappy balms and children's lip balms.

Part B must be carried out by a person holding "a diploma or other evidence of formal qualifications awarded on completion of a university course" in "pharmacy, toxicology, medicine or a similar discipline". You cannot write it yourself unless you hold that qualification, and experience does not substitute. What you can do is prepare Part A well, because a tidy submission is cheaper to assess than a shoebox. Bring the formula, supplier specifications, packaging details, label artwork and your stability and shelf life observations, and be ready to explain the microbiological reasoning set out under do balms need preservatives.

What the safety report actually costs, structurally

We do not publish prices: they vary by assessor and country and would date within a year. The structural points are stable, and they are what you plan around.

So a compliance budget is set by how many distinct recipes you sell, not how much you sell. One lip balm, one body balm and one salve is a different order of expense from fourteen scents on three bases. Consolidate: one well-built base carrying several fragrance or batch variations is the cheapest legal structure available.

The product information file

Article 11 requires the Responsible Person to keep a product information file, accessible at the address on the label, for ten years after the last batch was placed on the market. It holds the product description, the safety report, the manufacturing method with a statement of GMP compliance, proof of claimed effects where the claim justifies it, and animal testing data. In Great Britain it must be in English. It is not filed anywhere: you hold it and produce it on request.

The clause that catches people is "proof of the claimed effect". Say a balm lasts eight hours or suits sensitive skin and someone can ask what that rests on, since Regulation (EU) No 655/2013 requires claims to be "supported by adequate and verifiable evidence". What you may say is covered under cosmetic versus drug claims.

Notification: CPNP and SCPN

For the EU, the Responsible Person notifies each product through the Cosmetic Products Notification Portal before placing it on the market. Article 13 sets out the content: category and product name, the Responsible Person, country of origin for imports, the member state of availability, an emergency contact, nanomaterials, CMR substances and a frame formulation for poison centres.

For Great Britain the equivalent is the Submit Cosmetic Product Notifications service run by OPSS, with much the same content plus images of the label and packaging. Northern Ireland uses CPNP. Serious undesirable effects are reportable separately, to OPSS in Great Britain and to the competent authority in the EU.

Labelling under Article 19

The required elements are indelible, legible and visible: the Responsible Person's name and address; the nominal content; the date of minimum durability or, above 30 months, the period after opening as an open jar symbol; precautions for use; the batch number; the product function unless obvious; and the ingredients in INCI order under the heading "Ingredients". Imports give the country of origin, and nanomaterials are followed by "(nano)".

The 30 month rule is the one balm makers use most, because a well-made anhydrous product usually outlives that window. Above 30 months you print no date at all, only a period after opening, typically 12M or 24M for a balm, and you must be able to justify the number. Two elements the United States does not require are mandatory here: the batch number and the durability information. An American template will be wrong exactly there, and the differences are laid out under US cosmetic labelling. A consumer's-eye reading of the same panel is in reading a balm label.

The fragrance allergen change, and its dates

The framing that circulates, "26 becoming 81", is wrong at both ends. The baseline is 24 individually labelled allergens. Commission Regulation (EU) 2023/1545 of 26 July 2023 adds 45 new Annex III entries covering 56 new substances, replaces 17 existing entries and deletes 10, which leaves 80 substances across 81 entries. The thresholds are unchanged: declare individually above 0.001 percent in a leave-on product and above 0.01 percent in a rinse-off. New entries include camphor, menthol, terpineol, vanillin, lavender and peppermint, so the folk belief that true lavender never has to be declared is false.

One date has already gone. Non-compliant products could be placed on the Union market until 31 July 2026, now passed, and stock already on the market may be made available until 31 July 2028. Anything new for the EU must carry the expanded declarations today.

This matters to anyone using essential oils, because natural oils carry these allergens inherently: linalool, limonene, geraniol and citral are constituents, not additives. You need composition data from your supplier to declare them, another reason to buy from suppliers who publish full specifications, as argued under sourcing ingredients. Great Britain has not adopted 2023/1545 as at September 2026, and the proof is an absence: the GB Annex III stops at entry 325 and no amending instrument adds the rest. GB numbering already diverges from the EU list, so entry numbers are not interchangeable, and Northern Ireland stays under EU law. A shared UK and EU label is harder than it looks.

The Annex III limits that actually bite on balms

Most of Annex III is irrelevant to an anhydrous product. These entries are not. On names first: "Omnibus VII, VIII and IX" is not Commission nomenclature but trade shorthand that maps onto nothing official, so cite regulation numbers.

One prohibition is misquoted more than the rest. Annex II entry 904 does not ban petrolatum outright: it prohibits it except where the full refining history is known and the source can be shown not to be a carcinogen, so refined cosmetic grade is permitted. "Petrolatum is banned in the EU" is half true and misleading. In practice your supplier must document the refining history of the grade you buy, as discussed under petrolatum and mineral oil.

Good manufacturing practice

Article 8 requires manufacture in accordance with good manufacturing practice, and compliance is presumed where you follow the only harmonised standard, EN ISO 22716:2007. Certification against it is voluntary: nobody has to audit you, and no certificate is required to sell. The standard is about documented process rather than equipment: defined premises and cleaning, raw materials with acceptance criteria, batch records linking finished units to materials, trained personnel, returns and complaints, internal audit. A domestic workshop satisfies it if the paperwork exists, and fails if it does not. The starting points are under workshop hygiene and, for the material side, rancidity and oxidation.

From formula to first sale

An honest reading of the burden

The system is not designed to keep small makers out, but it does not accommodate them either: no threshold, no craft exemption, no simplified route. Against that, the recurring cost after launch is low, because the heavy items are once per formula or once per year rather than per unit.

So the decision that determines viability is made before any of it: how many recipes you sell. Cut the range, buy better documentation from fewer suppliers, and put the saving into a base good enough to carry variants. If you are tempted to add a sun protection claim, read SPF in lip balm first, because that one claim moves you into a testing regime that dwarfs everything on this page.

Reviewed and updated 6 September 2026. Spotted an error? Tell us and we will fix and log it.