A PIF — Product Information File — is the mandatory dossier that proves a cosmetic product is safe and compliant before it goes on sale. It bundles the formula, manufacturing information, test results, safety assessment, and claim evidence into one file that authorities can demand at any time. The concept comes from the EU’s Cosmetics Regulation 1223/2009, but it no longer belongs to Europe alone: the UK mirrors it, ASEAN runs a close cousin, and Taiwan completed its phase-in on July 1, 2026 — nearly every cosmetic sold there now needs one. If you build products through a contract manufacturer, most of what goes into your PIF originates at the factory, which makes PIF-readiness a supplier-selection criterion, not just a legal chore.
What Goes Inside a PIF?
Under the EU model — the template most other markets echo — the file has five core components:
1. Product description — identity, formula with exact concentrations, and specifications.
2. Cosmetic Product Safety Report (CPSR) — the heart of the file: a toxicological safety assessment signed by a qualified safety assessor.
3. Manufacturing description and GMP statement — how and where the product is made, with Good Manufacturing Practice conformity (ISO 22716 is the recognized standard).
4. Proof of claimed effects — test data or literature supporting what the label promises.
5. Animal-testing data — data on any animal testing of the product or its ingredients by the manufacturer, its agents, or suppliers.
Behind those headings sits the working evidence: stability testing, microbiological limits, preservative challenge testing, packaging-compatibility data, and ingredient documentation down to impurity profiles. Taiwan’s version organizes largely the same substance into a 16-item structure defined by the TFDA (Taiwan’s food and drug authority).
Which Markets Require a PIF?
| Market | Requirement | Key specifics |
|---|---|---|
| European Union | PIF mandatory for every cosmetic placed on the market | Kept by the Responsible Person (RP) at the EU address shown on the label; retained 10 years after the last batch; must be “readily accessible” to authorities |
| United Kingdom (Great Britain) | Mirrored PIF under the UK cosmetics regulation that applies in Great Britain post-Brexit | Same architecture; a UK-based Responsible Person holds the file. Northern Ireland follows the EU regulation, with an RP based in NI or the EU |
| Taiwan | Phased in 2024→2026, now near-universal | Sunscreens and other former specific-purpose products first (July 2024), baby/lip/eye products plus non-medicated toothpaste and mouthwash next (July 2025), all remaining cosmetics from July 1, 2026 (sole exemption: solid handmade soap from sites exempt from factory registration); file kept at the manufacturer’s or importer’s address shown on the label, for at least 5 years after the product was last on the market |
| ASEAN | Notification + PIF-style technical file under the ASEAN Cosmetic Directive | Member-state authorities audit the file post-market |
The United States is the notable exception — it has no PIF requirement, though FDA’s MoCRA rules now demand safety substantiation records that rhyme with PIF logic. For brands selling multi-market, the practical takeaway is the reverse of what most expect: you don’t write one PIF per regulation from scratch — you build one master technical file and adapt its packaging per market.
Who Prepares the PIF — Brand or Manufacturer?
Legally, the brand side owns the obligation: the EU Responsible Person, or in Taiwan the manufacturer or importer named on the label, keeps the file and answers to inspectors. Practically, most of the file’s raw material can only come from the manufacturer:
| Typically factory-sourced | Typically brand-sourced |
|---|---|
| Full formula with concentrations | Label artwork and final claims wording |
| Ingredient specs, INCI names, impurity data | Safety assessor engagement (often via a consultant) |
| Stability, microbiological & challenge test reports | Responsible Person appointment |
| Manufacturing method & GMP (ISO 22716) evidence | Market notifications (e.g., EU CPNP portal entry) |
| Batch records and specifications | Claim substantiation strategy |
This is why PIF-readiness belongs on your OEM shortlist criteria alongside pricing and MOQ — our guide on how to choose a skincare OEM partner covers the broader checklist. Without concentration-level formula documentation, test reports in audit-ready format, and GMP evidence from the factory, your file can be left incomplete — a gap you typically discover only when an inspector, distributor, or retailer asks for the file. Graminton’s cosmetics manufacturing is ISO 22716-certified, and formulation and testing run through its biotechnology development center — meaning the formula, stability, and manufacturing documentation your PIF needs is generated where the product is made. For formula ownership questions — who holds the recipe under OEM vs ODM — see the OEM vs ODM comparison.
What Happens Without One?
Enforcement is inspection-driven: authorities do not approve a PIF up front, they demand it after the product is already selling. A missing or incomplete file can mean forced withdrawal from sale, fines (Taiwan’s regime allows penalties up to NT$1,000,000), and — the cost brands underestimate — distributor and retailer fallout, since many European chains and importers now request PIF confirmation before listing. The economics are asymmetric: assembling the file during development costs little more than doing it late, but retrofitting one for a product already on shelves means re-running tests on a formula you may no longer be able to fully document.
For European and international brands sourcing from Asia, this is also a market-entry sequencing question — covered from the buyer’s side in our guide for international brands sourcing skincare OEM from Taiwan.
FAQ
What’s the difference between a PIF and a CPSR?
The CPSR (Cosmetic Product Safety Report) is one component inside the PIF — the signed safety assessment. The PIF is the full dossier: CPSR plus formula, manufacturing, GMP, claim evidence, and animal-testing data. Under the EU and UK rules you cannot have a valid PIF without a CPSR (Taiwan’s file requires an equivalent signed safety assessment), but a CPSR alone is not a PIF.
Is a PIF the same as product notification or registration?
No. Notification (like the EU’s CPNP entry or Taiwan’s product registration) tells the authority a product exists; the PIF is the evidence file that proves it is safe. Most PIF markets require both — notification before launch, file available on demand.
Do I need a separate PIF for each market?
Each regime wants its own file under its own rules, but the technical substance — formula, tests, manufacturing data — overlaps heavily. The efficient approach is one master dossier maintained with your manufacturer, adapted to each market’s format by your Responsible Person or local agent.
How long must a PIF be kept?
In the EU, 10 years after the last batch of the product was placed on the market; in Taiwan, at least 5 years from the day after the product was last placed on the market, kept at the manufacturer’s or importer’s address shown on the label. Either way, the obligation outlives the product — archive discipline matters.
Which PIF documents can Graminton provide?
The manufacturing-side documentation: full formula records, ingredient specifications, stability and challenge testing, microbiological data, and ISO 22716 GMP evidence, structured to feed your safety assessor’s work. Discuss your target markets during OEM project scoping so document preparation runs parallel to development instead of after it.
Building for the EU, UK, or Taiwan? Tell us your target markets and product types — we’ll map which documents your file needs and where they come from.