1What the safety report needs from the laboratory

In the EU, every cosmetic product needs a cosmetic product safety report before it is sold. The safety assessment is carried out by a safety assessor, who must hold a university qualification in pharmacy, toxicology, medicine or a similar discipline.

The report is part of the product information file. The responsible person, whose address is on the label, keeps this file for ten years after the last batch is placed on the market.

Annex I of the EU Cosmetics Regulation, (EC) No 1223/2009, lists what Part A of the report must contain. Three of its sections need laboratory results:

• Section 2, stability: the stability of the product under reasonably foreseeable storage conditions.
• Section 3, microbiological quality: the microbiological specifications of the product, and the results of the preservation challenge test.
• Section 4, packaging material: the relevant characteristics of the packaging material, in particular its purity and stability.

Great Britain applies Annex I with identical wording, and Northern Ireland follows the EU rules.

The European Commission has published guidelines that explain Annex I section by section (Implementing Decision 2013/674/EU). The Regulation requires such guidelines, in particular to help small and medium-sized businesses, and the UK government's guidance for Great Britain links to them.

Sources 1, 2, 4, 5.

The Regulation and the guidelines state which results the report needs, but neither names a test standard for them. The safety assessor decides which tests a product needs, and any test left out must be justified in the report.

2The four packages

Every package below is listed, with its price, on our cosmetics testing page. Each of the first three answers one question, and COS-04 combines them.

• COS-01 microbiological purity. It counts the total aerobic micro-organisms and the yeasts and moulds in the product, and tests for four specific organisms: Escherichia coli, Pseudomonas aeruginosa, Staphylococcus aureus and Candida albicans. The result is compared with the limits in section 3.
• COS-02 preservation (challenge) test. It includes COS-01, followed by the challenge test to ISO 11930. In the challenge test, the laboratory deliberately adds bacteria, a yeast and a mould to the product and counts them over several weeks. The result shows whether the preservative protects the product once it is opened and in use.
• COS-03 stability and packaging compatibility. The product is stored in its own pack at 45 °C for at least 4, 8 or 12 weeks and put through three temperature cycles; the pH is measured where relevant. The result shows whether the product and its pack remain stable in storage and transport, and supports the shelf life on the label.
• COS-04 safety report test set. COS-02 and COS-03 together: the three laboratory results the safety report requires, in one order.

A product that needs all three results needs COS-04. Section 4 explains which products need fewer.

3The microbiological limits

Neither the Regulation nor the Commission guidelines set numerical limits for micro-organisms. The guidelines refer to the Notes of Guidance of the European Commission's Scientific Committee on Consumer Safety (SCCS), which take the limits for finished products from ISO 17516.

Counts are given in colony-forming units (CFU) per gram or millilitre: each live micro-organism in the sample grows into one visible colony on the test plate.

Source 3, Appendix 9, Table A.9.

Plate counts vary from plate to plate, so the SCCS treats a result as over the limit only above 200 CFU for the first group, and above 2,000 CFU for all other products.

The Regulation and the guidelines require particular attention for a wider group: products used around the eyes, on mucous membranes or on damaged skin, and products for children under three, elderly people and people with weakened immune responses. The stricter row of the table covers only children under three, the eye area and the mucous membranes. For a product such as a cream for atopic or irritated skin, the safety assessor chooses the limit.

Our test: COS-01 microbiological purity, which measures every parameter in the table.

Sources 1–3.

One COS-01 result covers both rows of the table, and the quotation states which limit applies to your product.

4The challenge test

A product that is clean when filled can be contaminated each time it is opened and used. The preservative prevents micro-organisms from growing, and the challenge test shows whether it does so.

The SCCS Notes of Guidance state that the challenge test is mandatory for every cosmetic product that, under normal storage and use, may deteriorate or put the consumer at risk of infection. They also state that no legal or universal method exists, so the responsible person decides how the test is done. COS-02 follows ISO 11930, the ISO standard for evaluating the preservation of a cosmetic product.

Which products need it

Section 3.3.2 of the Commission guidelines divides products into three groups:

• Low microbiological risk, for example products with more than 20 % alcohol, products based on organic solvents, and products with a high or low pH. These need neither a challenge test nor a microbiological test of the finished product, but a scientific justification is required.
• Single-use products, and products in a pack that cannot be opened, such as a pack that doses the product without contact with the air. These need the microbiological test only, also with a scientific justification.
• All other products. These need both the challenge test and the microbiological test.

ISO 29621 gives guidance for identifying products of low microbiological risk, based on a risk assessment. The examples in the Commission guidelines do not include products such as a bar of soap or a balm made only of oils and waxes, so whether they belong to this group is for the safety assessor to decide.

The challenge test starts only after COS-01 has passed.

Our test: COS-02 preservation (challenge) test, which includes COS-01.

Sources 2, 3, 6.

Unless the safety report justifies a lower-risk group, a product needs COS-02, which includes COS-01.

5Stability and the pack

What the guidelines require

The Commission guidelines state the purpose of the stability section: to check whether the stability of the product affects its safety and quality, and to use the result to set the minimum durability and the period after opening.

They require three things in the safety report:

• a description of the method used to set the minimum durability, with all the supporting data;
• evidence that the product tested for stability has the same composition as the product placed on the market;
• stability tests in inert containers and in the containers in which the product will be sold, to show that the pack causes no stability problems.

Neither the Regulation nor the guidelines set the temperature or the length of a stability test. ISO/TR 18811 gives guidance on stability testing, but it does not specify the conditions, parameters or criteria: it leaves the manufacturer to specify and justify the stability protocol.

The pack

The guidelines list three points to consider for the packaging:

• interaction between the product and the packaging;
• the barrier properties of the packaging;
• migration of substances between the packaging and the product, in either direction.

The guidelines state that there are no standard procedures for testing a cosmetic with its pack, so the assessment can be based on knowledge of the formula and the pack, and on expert judgement.

Packaging developed for food has often been tested already, so stability and migration data may exist, and the guidelines state that supplier data should be preferred. Packaging of a new type may need more evaluation.

Ask your pack supplier for its stability and migration data before you order: the safety assessor can use it.

From the result to the label

Under Article 19 of the Regulation, a product with a minimum durability of 30 months or less must show the date until which it remains safe and fulfils its initial function, preceded by the words "best used before the end of" or the corresponding symbol.

A product with a minimum durability of more than 30 months needs no date. It must instead show the period after opening, as a symbol followed by the number of months, unless that period is not relevant to the product.

Our test: COS-03 stability and packaging compatibility.

Sources 1, 2, 6.

Decide the shelf life you will declare before you order COS-03: it determines both the storage time and what the label must show.

6Which package for whom

The table matches common situations with a package. The safety assessor makes the final decision: if your assessor has already sent you a list of tests, order what is on it.

7The sample

• COS-01: the quotation states how much product to send.
• COS-02: at least 150 g or ml of product, and the list of the preservatives used.
• COS-03: eight units in their original packs, and the ingredient list (INCI).
• COS-04: the samples for COS-02 and COS-03; the quotation states the total.

One handling and shipping fee covers each shipment, however many products it contains. The pro-forma invoice we send names the limit each result will be read against, the reporting limit and the measurement uncertainty of each method, how much to send and the expected turnaround. If your safety assessor needs the report in a particular format, tell us when you order.

Send the product in its final formula and in its final pack, as section 5 explains.

8One table to keep

How to read a test report explains the reporting limit and the measurement uncertainty shown on the report.