Can a cosmetics manufacturer write “CPNP approved” on its site?
A cosmetics manufacturer’s website does not say “CPNP approved”: the CPNP does not grant approval but receives notifications, and according to the Commission, a successful notification does not mean the product meets all requirements. For a product sold in the EU, the site states the responsible person in the EU, the fact that the product has been notified and, if there is one, the ISO 22716 good manufacturing practice certificate with its number and scope.
Cosmetics do not appear as a separate row in TİM’s sector table; they entered the cluster with their own guide because their regime is different. This guide is the detail of the cosmetics row of the certificate map by sector; the REACH obligations on the raw material side are in the chemical manufacturer website guide. The guide describes the EU rule; the Turkish market’s cosmetics rules are not in our list of facts and are not written here.
Which document does a cosmetics buyer ask for?
For a cosmetics manufacturer selling to the EU, the buyer’s first two questions come from this regulation: who is the product’s responsible person in the EU, and where is the product information file? The Cosmetics Regulation (1223/2009) requires a responsible person established in the EU for every product (Art. 4); the product information file is kept for 10 years (Art. 11), and the product is notified in the CPNP before it is placed on the market (Art. 13). On the production side, good manufacturing practice is asked about; ISO 22716:2007 is the harmonized standard under the regulation.
Because the responsible person must be established in the EU, for a product made by a manufacturer outside the EU, that person is a company in the EU. On a Turkish manufacturer’s site, who the responsible person is also says in whose name the product was notified in the EU and who holds the file. For a manufacturer selling the same product to several EU buyers, it is written clearly for which products the responsible person has been designated; a site where two buyers show different persons for the same product forces the buyer to ask.
How are the notification and the certificate shown on the website?
Each as what it is. A CPNP notification is not an approval but a notification: the site may say the product has been notified in the EU via the CPNP; it should not say “CPNP approved” or “CPNP certified”. The Commission’s CPNP user manual says so clearly: a successful notification does not mean the product meets all requirements. The ISO 22716 certificate appears on the certificate page with its number, scope, certification body and expiry date; the certificate belongs to a production system and is not an approval of the safety of individual products. In contract manufacturing, the responsible person who notifies the product may be on the brand’s side; the manufacturer’s certificate shows that production follows good manufacturing practice. In that case the certificate page states clearly which site and which product groups the certificate covers.
The CPNP is not public: competent authorities, poison centers, responsible persons and distributors have access to the portal. Because a buyer who is not a distributor cannot see the notification, the basis for the sentence on the site is the responsible person’s confirmation; this is why the responsible person’s name and contact details are useful on the site. The product information file is not a certificate either, but a file kept by the responsible person; it is not presented on the site as a “certificate”.
| Item | On the website | Basis |
|---|---|---|
| Responsible person in the EU | Yes; who it is, for products sold in the EU | 1223/2009 Art. 4 |
| CPNP notification | May be stated as notified; not as an approval | 1223/2009 Art. 13 · CPNP user manual |
| “CPNP approved” or “CPNP certified” | No | CPNP user manual |
| ISO 22716 certificate | Yes, with number, scope and expiry date | Harmonized standard |
| Manufacturer, product and warning information in distance sales | When selling to EU consumers | GPSR Art. 19 |
Where information belongs on a cosmetics website
- 01Responsible person in the EU
- 02CPNP notification, as a notification
- 03“CPNP approved” or “CPNP certified”
- 04ISO 22716 certificate
- 05GPSR information in distance sales
What should a cosmetics website not say?
- “CPNP approved”, “CPNP certified” or a similar approval statement: the CPNP does not grant approval.
- Presenting a product whose responsible person is not established as being on sale in the EU market.
- Presenting a product that has not been notified as ready for the EU market: notification takes place before the product is placed on the market.
- Describing the ISO 22716 certificate as a safety approval of the product.
- Presenting the product information file as a “certificate”.
What changed in cosmetics in 2026?
Our list of facts has no rule change dated 2026 for this sector. For sites selling directly to EU consumers, however, the General Product Safety Regulation (GPSR), which has applied since December 13, 2024, requires the distance sales offer to state the manufacturer’s name and postal and electronic address, the responsible person in the EU if the manufacturer is outside the EU, the product’s identification, and warnings (Art. 19). In our reading, this general rule applies where the cosmetics regulation does not cover the matter; confirm it for your product. The details are in the GPSR product page guide.
How does a buyer verify the notification and the certificate?
The notification through the responsible person, the certificate through its record. Because the CPNP is not public, a buyer who is not a distributor confirms the notification with the responsible person; the responsible person’s details on the site shorten the path to that confirmation. If the ISO 22716 certificate was obtained from an accredited body, it can be searched in CertSearch; the four-step path is in the is a company’s ISO certificate real guide. The product information file stays with the responsible person and is kept for 10 years; the buyer’s questions about the file also go to that person.
How are the product page and the machine layer built?
The product page says which market the product is ready for and who the responsible person is in the EU; the ingredient list is written the same as on the label. Writing a claim on the site that is not on the label means a sentence with no counterpart in the responsible person’s file. For a company doing contract manufacturing, the page states clearly whether the company is the manufacturer, the responsible person, or both.
In the machine layer, the certificate can be marked up as a Certification identical to the record visible on the page, knowing that Google does not use this markup for cosmetics: Google supports certification markup only in merchant listings, for the EU energy label and vehicle CO2 classes. Adding a certificate to the markup that the page does not state tells neither the buyer nor the machine anything true.
A short checklist for a cosmetics website
- Is a sentence with “CPNP approved” or “CPNP certified” left on the site?
- For every product sold in the EU, is the responsible person established and written on the site?
- Is it confirmed that notification took place before the product was placed on the market?
- Is the ISO 22716 certificate shown with number, scope and expiry date?
- Is the ingredient list the same as on the label?
- In distance sales to EU consumers, is the information the GPSR requires on the page?
- Is the product information file presented as a “certificate”?
The information here is not legal advice; confirm which rule applies to you from official sources and from your certification body’s current requirements.
Let’s read how your notification and certificate sentences appear on your site together: in a free preliminary review we send a written note on which statement promises an approval.
Request a free preliminary review
For a site that shows your certificates as a record buyers can verify, B2B website builds and measures the certificate page, the product scope and the path to a quote together.
FREQUENTLY ASKED QUESTIONS
Can I write “CPNP approved” on my website?
No. The CPNP is a notification portal; according to the Commission’s user manual, a successful notification does not mean the product meets all requirements. You can say the product has been notified.
Is a responsible person in the EU required for a cosmetic product?
Yes. The Cosmetics Regulation (1223/2009) requires a responsible person established in the EU for every product (Art. 4).
Can a buyer see the CPNP notification?
Not unless they are a distributor: competent authorities, poison centers, responsible persons and distributors have access to the portal.