There is a document behind every legally sold cosmetic in Britain that almost no consumer has heard of and that no brand advertises. It is not optional, it is not a formality, and a competent one runs to a considerable length. Understanding what it contains, and what it deliberately does not, is the fastest route to understanding what the word safe actually covers in this industry.
The requirement
Under the cosmetics regulation as retained in UK law, a cosmetic product may not be placed on the market unless a safety assessment has been carried out and a Cosmetic Product Safety Report drawn up. The report forms part of the product information file, which must be held by the responsible person and kept available to the market surveillance authority for a defined period after the last batch was placed on the market.
Enforcement sits with local authority Trading Standards services and with the Office for Product Safety and Standards, under the Cosmetic Products Enforcement Regulations 2013. Failing to hold a compliant safety report is an offence, not a paperwork lapse.
Part A: the safety information
Part A is a compilation. It is where all the evidence about the product is assembled so that somebody can reason over it. The regulation sets out what must be covered.
| Element | What it establishes |
|---|---|
| Quantitative and qualitative composition | Exactly what is in the product and at what level, including the function of each substance |
| Physical and chemical characteristics and stability | What the product is, and that it remains as specified under foreseeable storage conditions |
| Microbiological quality | That the product meets specification and that preservation is adequate for its use |
| Impurities, traces and packaging material information | What else may be present, including anything migrating from the container |
| Normal and reasonably foreseeable use | How people will actually use it, including uses that are predictable but not intended |
| Exposure to the product and to the substances | How much of each substance reaches the body, given the site, quantity and frequency of use |
| Toxicological profile of the substances | The hazard data for each ingredient, and the margin between exposure and levels of concern |
| Undesirable effects | Data on reactions reported for this product and for similar ones |
The exposure section is the one non specialists underestimate. The same substance at the same concentration presents a different question in a rinse off cleanser, a leave on face cream, a lip product that is ingested in small amounts, and a product used near the eyes. Safety in cosmetics is always safety in a specific use, never safety in the abstract.
Part B: the assessment itself
Part B is where a qualified person reasons over Part A and reaches a conclusion. It contains the assessment conclusion, any warnings and instructions for use that must appear on the label, the reasoning behind the conclusion, and the assessor's name, address, proof of qualification and signature.
The qualification requirement is specific. The assessor must hold a diploma or other evidence of formal qualification in pharmacy, medicine, toxicology or an analogous discipline. This is not a role a marketing team can fill, and it is one of the few places in cosmetic regulation where a named individual takes personal professional responsibility.
Where a pack tells you to avoid the eye area, to keep out of reach of children, not to use on broken skin, or to discontinue use if irritation occurs, that wording frequently comes from Part B. It is not legal boilerplate added by a lawyer. It is a condition attached by the person who assessed the product, and it is part of what made the product safe as assessed.
Which is a good reason to read it. A product used outside the conditions it was assessed under has not been assessed.
Safety tested
That some form of safety related testing was carried out. For a product legally on the UK market this is a description of compliance: a safety assessment is mandatory, and the underlying data has to exist.
It may also refer to specific additional work such as tolerance testing on a human panel.
It does not mean the product was tested on people, and it does not mean it was not. It does not mean the product is suitable for sensitive or reactive skin. It does not mean it will not irritate you, since individual sensitisation cannot be predicted by a panel. It does not mean anything at all about whether the product works, because safety assessment and efficacy are entirely separate exercises.
Most importantly it does not distinguish the product from any other legally sold cosmetic, all of which have been through the same requirement.
To be a distinction rather than a statement of compliance, a brand would have to describe the additional work: the type of study, the panel size, the duration and the outcome. Some do. Absent that, the phrase describes the floor of the market.
Where animal testing sits in this
This is the point at which most people's questions about cosmetic safety actually arrive, and it deserves a precise answer rather than a slogan. Testing finished cosmetic products on animals, and testing cosmetic ingredients on animals for cosmetic purposes, is prohibited in the UK, as is marketing products where such testing has been carried out for cosmetic purposes. The safety assessment therefore relies on existing toxicological data, on non animal methods, on read across from similar substances and on exposure modelling.
The area that remains genuinely complicated is chemicals legislation, where substances used in cosmetics may also be regulated for other purposes, including worker and environmental safety under UK REACH. That is a live and contested area, and anybody claiming it is simple in either direction is oversimplifying it.
Who the assessors are
Safety assessment is a specialist profession. Some large manufacturers employ assessors directly. Many brands use consultancies that provide assessment alongside regulatory services, and it is common for the same consultancy to act as responsible person, hold the product information file, prepare the notification and sign the assessment.
The assessor is paid by the person who needs the answer
A safety assessor is engaged and paid by the business that wants to sell the product. That is the same structure as auditing, building inspection and many other professional assurance roles, and it works because the professional carries personal liability and a reputation that is worth more than any single fee.
It is still worth naming, because the structure creates a pressure that has to be resisted rather than one that does not exist. An assessor who refuses too often loses clients. An assessor who never refuses is not doing the job.
- Regulatory consultancies. Sell a bundled service that a small brand cannot perform in house
- Brands. Get compliance handled by specialists, which is genuinely more reliable than doing it badly themselves
- The assessor. Carries personal professional responsibility for the conclusion they sign
- Consumers. Rely on a professional judgement they cannot see, made by someone the seller paid
A structural observation about assurance professions generally. It is not an allegation about any individual assessor or consultancy.
What the safety report does not cover
- Efficacy. Nothing in the report addresses whether the product works. That is a separate exercise, described in how a claim is substantiated before it is printed.
- Individual reactions. A product assessed as safe for general use can still cause a reaction in a specific person, particularly where there is an existing contact allergy.
- Misuse. The assessment covers normal and reasonably foreseeable use, which does not extend to every possible use.
- Claims. The report does not review the advertising, which is governed separately.
- Ongoing changes. A change to the formula, the pack or the manufacturing site requires the assessment to be revisited. The document is not a permanent certificate.
What a consumer can actually do with this
The report is not published, and there is no consumer right to obtain it. What you have instead is a chain: the pack names the responsible person, the responsible person must hold the file, and Trading Standards can require access to it. That chain works, and it is why the address on the pack matters more than it looks. See who the responsible person is and why it matters.
If a product causes you a reaction, report it to the responsible person with the batch code. Serious undesirable effects have to be notified to the authority, and a report from you is how they enter the system in the first place. If the response is inadequate, contact Trading Standards, whose powers under the enforcement regulations include requiring production of the product information file.