Selling soap in the EU and UK: the safety assessment

In the EU and Great Britain every soap is a cosmetic, and a cosmetic may not be sold until three things exist: a person established there who is legally responsible for it, a safety report written with a qualified assessor, and a notification to the authorities. The rules come from one Regulation, 1223/2009, which Great Britain kept as its own copy when the UK left the EU. This guide follows a bar of soap through them, from the formula to the first sale and the ten years of paperwork after it.

Who does what

The responsible person. Only cosmetics “for which a legal or natural person is designated within the Community as ‘responsible person’” may be placed on the EU market (Article 4). For a soap made in the EU and sold there, the maker is the responsible person by default; the maker may hand the role to someone else in the EU by written mandate, which that person accepts in writing, and an importer is the responsible person for a product it imports. The responsible person answers for every obligation in the Regulation: the safety assessment, the product information file, the notification, the label, and reporting serious reactions. In Great Britain the responsible person must be established in the United Kingdom. It can be a business or an individual, sole traders included, at an address that is not a PO box or a mail-forwarding service.

The safety assessor. The assessment in Part B of the report must be done by someone holding “a diploma or other evidence of formal qualifications awarded on completion of a university course of theoretical and practical study in pharmacy, toxicology, medicine or a similar discipline, or a course recognised as equivalent by a Member State” (Article 10(2)). The assessor signs and dates Part B, with proof of that qualification.

The authorities. In the EU and Northern Ireland, notification goes through the Commission’s Cosmetic Products Notification Portal (CPNP). In Great Britain it goes to the Office for Product Safety and Standards through GOV.UK’s Submit cosmetic product notifications service, often called SCPN.

The order of things

1. Settle the formula. Every ingredient and its exact percentage, final. The report is for this formula and no other.
2. Gather the paperwork. Suppliers’ specifications and safety data sheets, the fragrance’s IFRA certificate and allergen declaration, details of the packaging. The list is below.
3. Start the evidence. Keep bars from your trial batches and note how they keep; test what the assessor asks you to test.
4. Commission the assessment. The assessor works from your Part A information and writes Part B: the conclusion, the warnings and instructions the label must carry, and the reasoning.
5. Finish the label to match Part B: its warnings, its durability, and the ingredient list the assessor accepts. The labelling guide covers the rest of it.
6. Assemble the product information file, which holds the report and more (see below).
7. Notify, through the CPNP or SCPN, before the product is placed on the market.
8. Sell, and keep the file alive: record reactions, report serious ones, update the file and the notification when anything changes, and keep the file for ten years after the last batch.

The cosmetic product safety report

Annex I of the Regulation sets out the report in two parts, under fixed headings. Part A is the information; Part B is what a qualified assessor concludes from it.

Part B has four headings: assessment conclusion; labelled warnings and instructions of use; reasoning; and the assessor’s credentials and approval of Part B, with name, address, proof of qualification, date and signature.

In its section on microbiological quality, Annex I asks for “particular attention” to cosmetics used “around the eyes, on mucous membranes in general, on damaged skin, on children under three years of age, on elderly people and persons showing compromised immune responses”. Market a bar as a baby soap and you have put it in that group, and the assessment has to answer for it.

Why a soap is simpler to assess than a lotion

Three features of soap shape the assessment, and each has a number behind it.

It is alkaline, and that matters for microbes. The Commission’s guidelines on the report sort products into three groups. Low microbiological risk products, “e.g. products with an alcohol content > 20 %, products based on organic solvents, high/low-pH products”, are those “for which neither a preservation challenge test nor microbiological quality tests on the finished product are necessary”, though “a scientific justification is to be provided”. Single-use products and packs that cannot be opened need the finished-product tests only; everything else needs both. A solution of properly made soap measures around pH 9 to 10 (the soap pH guide explains why), well on the high side. Whether that puts your soap in the low-risk group is for your assessor to judge, and to explain in the report’s reasoning. A product that needs a challenge test to ISO 11930 has its surviving microorganisms counted “at defined intervals during a period of 28 days”, which is time to allow for.

It is rinsed off. The Scientific Committee on Consumer Safety’s exposure figures apply a retention factor of 0.01 to rinse-off products: only a hundredth of what is used is taken to stay on the skin. A shower gel is counted as 18.67 g applied a day, and 0.19 g a day of exposure; hand washing with soap as 0.20 g a day. A body lotion, for comparison, is counted as 7.82 g a day, all of it staying on the skin.

Its safety is judged substance by substance. For each substance the assessor compares a dose that caused no adverse effect in studies with the dose the product delivers, the margin of safety. The SCCS’s default is that “a MoS of at least 100 therefore indicates that a cosmetic ingredient is considered safe for use”. Low exposure makes that margin easier to reach, which is why a soap’s questions tend to gather around the few ingredients with limits of their own: the fragrance, whose supplier certificate gives its maximum for IFRA category 9, the category for soap; any colourant, which must be on the Regulation’s list of permitted colourants; and any additive with a restriction.

What the assessor needs from you

The first line is the one the site’s engine can fill exactly. The rest is paperwork you collect once per supplier and keep up to date.

Notes on kept bars are simple and worth starting early: weight, smell, colour, and any orange spots of rancidity, at intervals, on bars stored as a customer would store them. The orange spots guide covers what those spots mean. The records behind the method of manufacture are covered in the batch records guide.

Costs and timing

Notification in the CPNP is free of charge; it asks for the product’s category and name, the responsible person and the address where its file is kept, the country of origin if imported, the country where it is first placed on the market, a contact person, any nanomaterials, any substance classified as carcinogenic, mutagenic or toxic for reproduction in category 1A or 1B, and a frame formulation for poison centres. SCPN asks for much the same in Great Britain.

The assessment is priced per formula, and prices vary between assessors. Two published price lists from UK assessors in 2026 give a sense of scale: one starts “from around £55 for a simple single product, such as a straightforward anhydrous balm, oil or soap”; another quotes £180, VAT included, for a base formula with one type of use and up to eight variants, with an admin fee of about £25 for each later submission of variants. Laboratory tests are extra.

Variants are where makers of scented ranges save or lose money. The Commission’s guidelines allow that for products “where the only difference among different products is the colouring agent, and that has no impact on safety”, a combined report “may be considered, but is to be justified”. A different fragrance is a different composition, with its own allergens and its own IFRA limit, so it needs assessing. The first of the assessors above says variants of one base are “almost always offered at a reduced rate per variant”; ask how yours works before you plan a range.

Timing runs in one direction: the assessment, the file and the notification all come before the first sale. A challenge test, where one is needed, adds its 28 days and the laboratory’s queue. Stability evidence takes as long as the bars take to show how they keep, which is the reason to start keeping trial bars on the day you settle a recipe.

Across the border. A maker in Great Britain selling into the EU needs a responsible person established in the EU, an EU notification, and a label for the country of sale; a maker in the EU selling into Great Britain needs a UK responsible person and an SCPN notification. Northern Ireland follows the EU rules.

The product information file, and after the first sale

The product information file holds five things (Article 11): a description that ties the file to the product, the safety report, “a description of the method of manufacturing and a statement on compliance with good manufacturing practice”, proof of any effect the product claims where the nature of the claim justifies it, and data on any animal testing. It is kept “for a period of ten years following the date on which the last batch of the cosmetic product was placed on the market”, readily accessible to the authorities, in electronic or other form, at the responsible person’s address. In Great Britain it must be in English.

Selling starts the second half of the job. Record every reaction a customer reports, with the batch code: it belongs in Part A 9, and the Regulation requires the safety report to be “kept up to date in view of additional relevant information generated subsequent to placing the product on the market” (Article 10(1)). A serious undesirable effect must be notified to the national authority “without delay” by the responsible person, and by distributors who learn of it (Article 23). When anything notified changes, the notification is updated without delay, and once the product is on the market the original label and a photograph of the packaging are added to it. A change of formula goes back to the assessor. And the label moves with the law: in the EU, a product first supplied from 1 August 2026 must name any of the 57 fragrance allergens added in 2023 that pass the threshold, as the labelling guide explains.

What the dossier does, and what it does not

The site’s safety dossier, on the Business plan, writes out Part A from a saved recipe, in Annex I’s order and under its headings:

• the composition, recomputed by the engine, with the INCI name and the CAS and EC numbers CosIng gives for each substance, and the ingredient list as saponified;
• a check of those ingredients against Annexes II to VI of the Regulation, as they stand in the EU and in Great Britain;
• the fragrance’s share of the product against its IFRA category 9 maximum, and the allergens its declaration puts on the label, from the supplier’s certificate and declaration in your fragrance library or saved with the recipe, worked the same way as the fragrance and allergen check;
• the suppliers and lots your batches drew from stock, the method of manufacture, and the batches made to the recipe.

What only you know, from the packaging and the pH to the reactions and the name of your assessor, you type in; anything left empty prints as a line to fill in. It never fills in a judgement. Every page says it is information for a safety assessor, not a safety report, and Part B is left for the assessor to complete and sign. The filing sheets page does the same for the questions the CPNP asks, and for Canada’s and the US’s filings, for you to copy into the regulator’s own forms; it files nothing. The pricing page lists what each plan includes.