How to Check a Product Is Already CPNP Notified Before You Buy

A supplier sends a screenshot: a browser window, a product name, a green tick, a date in the corner. You buy forty cartons on the strength of it. The units arrive with a Korean address on the back panel and no company inside the EU named anywhere on the pack. The screenshot was probably genuine. For your shipment it was worth nothing.

The short version

• The Cosmetic Product Notification Portal has no public search and no certificate a third party can validate; only competent authorities, poison centres, responsible persons and distributors hold accounts, and the Commission charges nothing for an entry.
• Under Article 4(5) of Regulation (EC) 1223/2009 the importer is the responsible person, so a carton shipped from Korea consigned to a European buyer needs that buyer's own notification, whatever the supplier has filed.
• Cosmetics were the most notified category on Safety Gate in 2024, at 36 percent of 4,137 alerts (European Commission, 16 April 2025), and the alert database is public and searchable by brand and responsible person name.

Nobody can look it up, including your supplier

The Cosmetic Product Notification Portal is an internal Commission database, not a public register. Four kinds of account exist on it: competent authorities, poison centres, responsible persons, and distributors of cosmetic products. There is no public search box, no lookup by barcode or EAN, and no certificate carrying a number an outside party can validate. Ask ten suppliers whether a product is notified and you get ten yes answers with no way to sort them.

One tell falls out of that. The Commission runs CPNP free of charge. A supplier quoting a per-SKU "CPNP registration fee" is charging for the safety assessment behind the submission, which is real work, but the portal entry costs nothing.

Because no public source will confirm a notification from outside, every check worth running moves the question onto something that is published.

The address on the pack outranks the screenshot

Article 19(1) of the cosmetics regulation puts the responsible person's name and address on the container and the packaging in indelible lettering, and adds the country of origin for imported products. Article 11(3) then says the responsible person "shall make the product information file readily accessible in electronic or other format at his address indicated on the label to the competent authority." That address is the operative fact in the whole system. It is where an inspector physically goes.

A screenshot proves a screen existed on the day someone photographed it. It does not prove the notification is current, that it stands in the name of the company that will place your units on the market, or that what is in your carton matches the frame formulation that was notified. A printed responsible person block commits a named company, permanently, on every unit, to a role it cannot later walk back. Weight the two accordingly: photographs of the front, the full back panel and the outer carton of one real unit from the batch on offer are worth more than any PDF in the email thread.

Article 6(2) backs this up from the other side. Your own legal duty as a distributor, before you make a product available, is to verify that the labelling required by Article 19(1)(a), (e) and (g) is present, that the language rules for the country of sale are met, and that the durability date has not passed. A pack inspection.

One fork underneath all of this decides whether the supplier's notification is relevant at all. Under Article 4(5) each importer is the responsible person for the product it places on the market. Goods shipped from Korea consigned to you make you the importer, and the supplier's notification, however real, covers their placings and not yours. Buy from a company that has already imported them and you are a distributor with a checklist instead. Everything about who carries the responsible person role follows from which of those two happened.

The decision rule is short. If the unit carries no EU name and address, the notification question is already answered: it is yours to solve, and the price you were quoted is missing a compliance line.

Three checks you can run without asking the supplier

The responsible person company. Take the name and address off the pack photo, look the entity up in its national business register through the EU's interconnected register search, and run the VAT number through VIES. Some member states return the trader's name and address on a VIES check and some do not, depending on national data protection rules, so a valid number with no name is not a red flag on its own. An address that resolves to a service mailbox in a country neither of you sells into is a different conversation.

Safety Gate. The EU rapid alert system for dangerous non-food products is fully public, with a weekly report every Friday. This is not a long shot for our category: cosmetics were the most frequently notified product category in 2024, at 36 percent of 4,137 alerts (European Commission, 16 April 2025). Search the brand and the responsible person name.

The CPNP existence check, if you hold a distributor account. Distributors get portal access because Article 13(3) obliges anyone who translates an element of a label to notify it themselves. That notification screen asks whether you know the product's CPNP reference. If you do, it matches what you type against references that actually exist. If you do not, you enter the responsible person's name, then at least five characters of the product name as sold in the member state of dispatch, and it lists the matching products. That confirms existence, in that responsible person's name, from inside. Only submit the notification itself if the translation trigger genuinely applies to you.

The evidence request, ready to send

Send this before the deposit, not after. It sits inside the wider document pack you should be collecting anyway.

Subject: Responsible person and notification evidence, order [ref]

Before we confirm this order, please send the following for every SKU on the attached list.

1. Photographs of one actual unit from the batch you would ship: front, full back panel, and the outer carton. Not renders and not brand press images. The back panel has to be legible.
2. The name and registered address of the EU responsible person for these units, exactly as printed on the pack, plus that company's VAT number.
3. Written confirmation of who is importer of record on this shipment, your company or ours.
4. If you are the importer: the CPNP product reference for each SKU, and confirmation that the notification stands in the name given at point 2.
5. If we are the importer: say so directly, and confirm you can supply the full INCI list, the manufacturer's identity and the frame formulation to the responsible person we appoint.
6. The batch number and the date of minimum durability, or the period after opening symbol, on the units you would actually ship.

We are not asking you to guarantee our compliance. We are asking who carries the responsible person role for these specific units, and for the pack evidence behind it.

An acceptable reply answers point 3 in one line without qualifiers, produces the photographs quickly because the stock is in the building, gives a responsible person name that matches the pack and resolves to a real company, and either offers a CPNP reference unprompted or says there is none because you are the importer. Both are good answers. Only fog is not.

The four replies that mean no

"All our products are CPNP registered." One EU wholesaler publishes exactly this sentence in its FAQ. Notified by whom, and for whose placings. It covers that company's own units and says nothing about a carton leaving Korea consigned to you.

A screenshot with the responsible person field cropped out. That field is the entire document. A crop is an answer.

"The brand handles CPNP." A Korean brand is not established in the Union and cannot be the responsible person. Only an entity inside the EU can be, and if the supplier cannot name it, nobody has been appointed.

"We can send you the product information file." Almost nobody can, and one large wholesaler says so in its own FAQ. The file belongs to the responsible person and is made accessible to the competent authority, not to trade customers. A supplier offering one freely is either the responsible person or is offering something that is not a PIF.

The pack tells you one more thing no document will. A back panel with a sticker over a sticker, or with the responsible person block scraped off, is describing its own route to your warehouse, and that is the grey-market pattern rather than a paperwork gap.

Questions buyers ask

How long does a CPNP notification take and what does it cost?

The portal entry is free and there is no approval step: Article 13(1) requires the notification before the product is placed on the market, and once submitted the product can go on sale. The cost sits behind the entry, in the safety assessment and the product information file, which a qualified assessor charges for per formulation. Nobody publishes a standard rate, so ask the responsible person for a written quote per SKU.

Can a retailer be the responsible person?

Yes, if the company is established in the EU. The role lands on you automatically when you import the goods under Article 4(5), or by written mandate from the importer that you accept in writing under Article 4(5). Holding it means filing the notification and keeping a product information file with a safety assessment at your address for ten years after the last batch under Article 11(1). Most small shops buy from an EU importer instead so the role sits with a company built to carry it.

Do I have to notify CPNP if I translate the label?

If you translate any element of the label on your own initiative to meet national law, Article 13(3) makes you file a distributor notification with the product category, its name in the country of dispatch and in yours, your own name and address, and the responsible person's name and address. A sticker your supplier applied before dispatch was the supplier's filing to make. Selling a pack in its existing language without changing anything needs nothing from you on the portal.

Sources

• EUR-Lex, Regulation (EC) No 1223/2009 on cosmetic products, 2009
• European Commission, Cosmetic Product Notification Portal, 2025
• European Commission, Safety Gate 2024 annual results press release, 2025
• European Commission, Safety Gate alerts database, 2026
• European Commission, VIES VAT number validation, 2026

Checked against EUR-Lex, the Commission's CPNP pages and the CPNP user manual on 1 September 2026.