CPNP for Korean Cosmetics: What Changes When the Pack Is Already Korean-Labelled

A pharmacy in Linz orders 240 tubes of a Korean sunscreen from a trader in Seoul. The trader's answer to the compliance question was one line: the brand is CPNP registered, no problem. Every tube arrives with a Korean back panel, an English ingredient list, a Made in Korea line and no company address anywhere in the EU. The brand's European partner did file a notification years ago. It covers the units that partner imports and sells. It does not cover these 240 tubes, because the company that placed them on the EU market is the pharmacy.

The rule behind that outcome is short, and most Korean traders either do not know it or do not mention it: a notification belongs to the responsible person who filed it, for the units that person places on the market.

The short version

• Under Article 4(5) of Regulation (EC) No 1223/2009, each importer is the responsible person for the specific cosmetic product it places on the EU market, so a CPNP notification filed by the brand's European partner or by another importer does not cover units a retailer imports from Korea itself.
• The CPNP is a free notification system open only to competent authorities, poison centres, responsible persons and distributors (European Commission, 2026); it issues no certificate, so a PDF titled "CPNP certificate" was produced by the supplier, not by the Commission.
• A retailer buying stock an EU importer already placed on the market is a distributor: it notifies nothing and checks the pack under Article 6(2), but translating any label element on its own initiative for another Member State triggers its own notification under Article 13(3).

A notification belongs to whoever filed it

Article 13(1) of the cosmetics regulation puts the duty to notify on the responsible person, before the product is placed on the market, and the entry names that person's address where the product information file is kept and, for an import, the country of origin. Article 4(5) settles who that person is for an import: "each importer shall be the responsible person for the specific cosmetic product he places on the market." Placing on the market means the first supply in the EU (Article 2(1)(h)). If the goods came from Korea and you are the first EU company to supply them, that person is you.

So the same tube, same barcode, same formula can exist in the EU as two legally separate products: one placed by the brand's European partner, notified under its name, with its file at its office; and one placed by you, with no notification, no file and a Korean back panel. Market surveillance reads the pack, and the pack tells them which of the two it is.

Two more lines of Article 13 bite a Korean pack. Article 13(2) makes the responsible person notify the original labelling and a photograph of the packaging, so the Korean retail pack with its EU over-label is what gets filed, and Article 13(7) demands an update without delay when the name, the formula or the Member State changes, which for Korean brands is often.

What the pack tells you before any document does

Article 19(1)(a) makes the name and address of the responsible person mandatory on the container and packaging, and adds one sentence for imports: "The country of origin shall be specified for imported cosmetic products." Korean retail packs almost always carry the second half. They almost never carry the first, because the addressee printed in Korea is the Korean manufacturer or distributor, and a Seoul address is not an address within the Community.

That gives you a check that costs nothing and precedes every document. Turn the pack over. An EU company name and address means somebody has taken the responsible person role for that unit, and the notification, the file and the safety report should all sit at that address. No EU address means nobody has, whatever the supplier's email says.

Article 19(5) then hands the language of the content, durability, precautions and function to the law of the Member State where the end user buys. What has to be added, and who adds it, is in the labelling guide for Korean cosmetics. For CPNP the point is narrower: the over-label is where the responsible person's name goes, so the label and the notification have to say the same thing.

The file chain and the certificate that does not exist

Article 11 requires the responsible person to keep a product information file for ten years after the last batch was placed on the market, readily accessible at the address printed on the label, in a language the local authority can read. The file holds the safety report and the formulation data behind it. None of that comes with the cartons. It comes from the manufacturer, through whatever chain of contracts links the manufacturer to the EU company on the pack.

For Korean brands the chain usually looks like this. The manufacturer holds the formula. The brand's appointed European importer has, in a good case, received enough to commission a safety report and build a file. A Korean trader who bought retail stock and sells it on has nothing, and the trader's own FAQ page will usually say so. Import through that trader and you are the responsible person for a product whose file you cannot build, because the maker has no reason to give you the frame formulation. In our experience that, and not the customs bill, is where most self-import plans should stop.

Then the certificate. Regulation 1223/2009 provides for a submission of information, nothing more, and the Commission describes the portal as "a free of charge online notification system" open to competent authorities, European poison centres, responsible persons and distributors. Nobody outside those four groups can look anything up, and no document is issued to be waved at a buyer. What a responsible person can show you is the entry from its own account, carrying its own name and address. The test is whether that name matches the pack in front of you; the verification steps before you buy cover what a screenshot can and cannot prove.

Importer's list against distributor's list

Buy Korean products from an EU wholesaler that imported them and put its name on the pack, and you are a distributor under Article 2(1)(e). Your duties collapse to Article 6(2): verify that the responsible person's name and address, the batch number and the ingredient list are present, that the Article 19(5) language requirements are met, and that the minimum durability date has not passed. No CPNP account, no file, no safety assessor. The responsible person guide for EU retailers covers the mandate route if you do want to import and hand the role to a service company.

One move turns a distributor into a notifier without making it the responsible person. Article 4(6) says translating the information on a product already on the market does not count as a modification, so you stay a distributor. Article 13(3) says a distributor who translates "on his own initiative, any element of the labelling" to sell in another Member State has to submit its own entry naming both product names, the Member State and the responsible person. A Vienna shop that prints its own Czech sticker for a second store in Brno has crossed that line, and we see it crossed unknowingly more often than any other CPNP mistake among retailers.

The email to send before you pay

Copy it, fill the brackets, send it before the deposit, and keep the reply with the invoice.

Subject: Responsible person and CPNP notification for [product name, EAN]

Hello [name],

Before I pay for [quantity] units of [product], please confirm in writing:

1. 1. The name and EU address of the responsible person for these exact units. Is it your company, the brand's EU entity, or a third party under a written mandate?
2. 2. That the same name and address is printed on every unit, together with the country of origin.
3. 3. That this responsible person has notified the product in the CPNP under the name printed on the pack, for [Austria / Germany / your country], and can send me the entry from its own CPNP account.
4. 4. That the product information file, including the safety report, is held at that address.
5. 5. Whether the label text required in [German / your language] is on the units when they ship, and if not, a photo of the label you will apply.

If the responsible person is not a company established in the EU, please tell me now, so I can decide whether to import under my own name.

Thanks,
[Name, company, VAT number]

Decision rule: a Korean address in answer 1 means you are buying an import and become the responsible person when the goods clear. An EU address that matches the pack means you are a distributor, and your job on arrival is the Article 6(2) check. An EU address that does not match the pack is the worst of the three: somebody is claiming a role the label does not show, and you should not pay until it is resolved.

Questions buyers ask

If I buy from the brand's official European distributor, is the notification theirs or mine?

Theirs, provided they imported the units and their name and address is on the pack. You are a distributor and you notify nothing. That changes only if you translate the label yourself to sell in another Member State (Article 13(3)) or sell the product under your own brand, which makes you the responsible person under Article 4(6).

Do I have to notify every shipment or every batch?

No. The notification under Article 13(1) is per cosmetic product and per responsible person, filed before the first placing on the market. Later batches of the same product under the same responsible person need no new entry, but Article 13(7) obliges you to update the entry without delay if a name, a frame formulation or a Member State changes.

Can the Korean brand or the Korean trader act as my responsible person?

No. Article 4(5) lets the importer designate a responsible person by written mandate, but only a person established within the Community, who must accept in writing. A Korean company cannot hold the role. It can contract an EU service company to hold it, in which case that company's name goes on the pack and its address is where the file is kept.

Sources

• Regulation (EC) No 1223/2009 on cosmetic products, Articles 2, 4, 6, 11, 13 and 19 (EUR-Lex, European Parliament and Council, 2009)
• Cosmetic Product Notification Portal (European Commission, 2026)

Facts checked against the regulation text and the Commission's CPNP page on 2 September 2026.