Die Lieferantendokumentation, auf die eine Apotheke bestehen sollte

9 June 2026 · The Glow Trade

A customer is back at the counter three days after buying an eye cream from the Korean shelf, eyelid swollen, and she wants to know what is in it. Your pharmacist turns the tube over: a Korean date stamp, an ingredient list under a German sticker, and a delivery note in the back office that reads "K-beauty assortment, 48 units". Nobody can say which batch the tube came from, whether twelve more of that batch are on the shelf, or who in Europe holds the safety file.

A concept store rings the supplier, refunds the customer and moves on. A pharmacy cannot, because the customer came to a health professional and the incident goes into a system that expects an answer. Your supplier paperwork has to close that gap before the first carton arrives, on top of the six documents any retailer should ask for.

The short version

Article 7 of Regulation (EC) No 1223/2009 obliges a distributor to identify, on request, who supplied each batch and which distributors received it, for three years after the batch reached the distributor.
Article 6(3) of Regulation (EC) No 1223/2009 requires a distributor with reason to believe a cosmetic presents a risk to human health to inform the responsible person and the national authority immediately, and Article 23 puts serious undesirable effects on the distributor's notification duty as well.
Article 19(1)(e) of Regulation (EC) No 1223/2009 puts a batch number on every unit, and Article 11 keeps the product information file, with the full composition, for ten years after the last batch at the address printed on the pack.

Why the bar is higher behind a pharmacy counter

Cosmetics law does not know your channel. The same regulation binds a drugstore chain, a nail bar and a pharmacy, and whether a pharmacy may carry Korean skincare at all is decided by national pharmacy law. What changes is who asks, and what they expect back.

In a pharmacy the person reporting a reaction is talking to someone she treats as a clinician, the staff already run batch recalls for medicines, and in Germany § 2a of the Apothekenbetriebsordnung requires the pharmacy manager to operate a quality management system with documented self-inspections. That system covers pharmaceutical activities, so nobody audits a serum under it. A pharmacy that files its medicine batches and shrugs at its cosmetics still runs two standards in one building, and the lower one sits on the shelf customers ask most questions about. Our view: run the cosmetics shelf on the medicine rule. Batch in, batch out, name on file.

Batch traceability, per delivery line

Article 7 decides your goods-in process. At the request of a competent authority, a distributor must identify the distributor or responsible person a product came from, and any distributors it went to, for three years from the day the batch was made available to the distributor. The batch is the unit of that duty, so a supplier file organised by year and invoice total does not meet it.

Article 19(1)(e) requires a batch number or an identifying reference on the unit, and Korean manufacturers print one, usually as a manufacturing date in year, month, day order, so 26.03.05 is 5 March 2026. What the pack cannot tell you is which of those codes arrived in which delivery. The delivery note has to say it.

Ask two things before the first order. On every delivery note, per line: the batch or manufacturing-date code and the quantity. And once, in writing: confirmation that the supplier records which batch went to which customer. A supplier who ships mixed batches without recording them cannot answer an Article 7 request about you, so you cannot answer one either. If a delivery note arrives without codes, record them at goods-in before a unit goes on the shelf. Twenty minutes with a pen beats an afternoon opening cartons after a Safety Gate alert, and cosmetics were the most notified category on Safety Gate in 2024, at 36 percent of 4,137 alerts, per the Commission's figures of 16 April 2025.

INCI on file, in the counter's language, before listing

The legal ingredient list is the one on the pack, in the descending order Article 19(1)(g) sets, and on Korean stock it sits on the EU over-label. A pharmacist answering "is there a fragrance allergen in this" at nine on a Saturday needs it as a document, per SKU, in the language the counter speaks, before the product is listed. You build that file yourself, because the only party obliged to hold the composition is the responsible person, in the product information file at the address on the pack under Article 11, and distributors do not receive that file.

Ask the supplier for the INCI list per SKU as text, dated, matching a photograph of the pack, together with the responsible person's name and address as printed on the label. That name is as close as a buyer gets to checking the notification, and it is the address your incident reports will go to. Ask for the list again whenever the packaging changes. We see reformulations arrive under an unchanged product name and an unchanged supplier SKU, and only the pack reveals it, so a photo of the label from the first unit of each new batch is your version control.

Complaints and cosmetovigilance: build the route before the first customer needs it

The regulation splits reactions in two. An undesirable effect is an adverse reaction for human health attributable to normal or reasonably foreseeable use. A serious undesirable effect, under Article 2(1)(p), results in temporary or permanent functional incapacity, disability, hospitalisation, congenital anomalies, an immediate vital risk or death. Article 23 obliges the responsible person and distributors to notify a serious undesirable effect without delay to the competent authority of the member state where it occurred, with the product name and any corrective measures taken. The Commission publishes reporting guidelines that set a deadline in calendar days; no supplier will quote it to you, so read them before you need them and ask your national authority which form it wants.

Most counter complaints are not serious, and the regulation does not send those to an authority. They still go to the responsible person, because Annex I lists available data on undesirable effects among the contents of the safety report, and a reaction kept in a drawer never reaches the file that decides whether a formula changes.

So the supplier question is short. Who, by name and email, receives an incident report from you, and does the supplier forward it to the responsible person, or do you write to the address on the pack directly? A supplier who has handled one answers in one line.

The pharmacy supplier file, written out

Copy this into your quality folder: one file per supplier, one sheet per SKU, one line per delivery.

Per supplier, once, before the first order

Legal name, address, VAT number checked on VIES, and whether the supplier is the importer and responsible person or a distributor buying from one.

Name and address of the responsible person for each brand supplied, matching the pack.

Named incident contact: person, email, phone, and whether they forward to the responsible person or you report directly.

Written confirmation that batch or manufacturing-date codes appear per line on every delivery note, and that the supplier records which customer received which batch (Article 7).

Per SKU, before listing

Photograph of the back and base of one unit: responsible person's name and address, country of origin, batch position, EU-language ingredient list.

INCI list as text, dated, matching the photograph, filed in the language the counter speaks.

Durability: the expiry date, or the manufacturing date plus the period after opening where the pack carries the open-jar symbol instead, which Article 19(1)(c) allows above 30 months' shelf life.

The responsible person's name confirmed in writing, and the CPNP product reference if the supplier holds one.

Per delivery, at goods-in

Date received, supplier invoice number, and per line: SKU, batch code, quantity. Kept three years from receipt, or as long as tax law requires, whichever is longer.

Photo of the label of one unit per new batch.

Per incident, at the counter

Product, batch, purchase date, date of first use, date the reaction began, what was observed, any treatment, and the customer's consent to be contacted.

Serious under Article 2(1)(p)? Notify the competent authority without delay and the responsible person the same day. Not serious? Report to the responsible person via line 3 and log the date sent.

Check the shelf for the same batch and hold it until the responsible person answers.

Questions buyers ask

Can I get the product information file from my supplier?

No, and a supplier who says yes is probably thinking of a certificate pack. Article 11 of Regulation (EC) No 1223/2009 puts the product information file at the responsible person's address for the competent authority, and it holds the safety assessment and manufacturing method that a brand does not release to retailers. Written confirmation that the file exists at the address on the pack, plus the INCI list as text, is what you can get and enough to run a pharmacy shelf.

A customer had a mild rash from a Korean serum. Does anyone need to know?

Yes, the responsible person, in writing, with the batch number, even though nothing in the regulation obliges you to tell an authority about a reaction that is not serious. The responsible person's safety report is supposed to collect undesirable-effect data, and a pattern across batches only becomes visible if retailers send theirs in. Keep the customer's details and consent on your own record; the report to the responsible person can go without her name.

How long do I keep cosmetics delivery notes and batch records?

Article 7 of Regulation (EC) No 1223/2009 gives an authority three years from the date a batch was made available to you in which to ask who supplied it. Your national tax retention period for the invoice itself is longer and takes precedence. Keep the batch-level goods-in record together with the invoice so both survive for the longer period.