CPNP - F.A.Q.
Yes. Regulation (EC) N° 1223/2009 (Article 13) states that all cosmetic products that will be placed on the market in the European Union need to be registered into CPNP prior to being placed on this market.
You have an obligation to make this new product notification before placing it on the market. Regulation (EC) N° 1223/2009 does not specify a particular moment, just before putting it on the market.
However, for the notification of products containing nano-materials (Article 16), you must do it 6 months prior to placing them on the EU market.
No, no confirmation is sent.
Please note that the fact that a product has been successfully notified through the CPNP does not necessarily mean that the product in question fulfils all the requirements of the Regulation (EC) N° 1223/2009.
The CPNP is not open to the public. Its access is restricted to the Competent Authorities (for the purposes of market surveillance, market analysis, evaluation and consumer information) and to the Poison Centres or similar bodies established by Member States (for the purposes of medical treatment) and is not available for consultation by the public.
The obligation to register a cosmetic product in the CPNP falls on the Responsible Person that puts it in the market.
Each one of your customers selling cosmetic products under their own name or brand has the obligation to notify the products under its company name.
6. If someone else imports (from a non EU country) the same product from the same company as me, does he also has to notify it into CPNP?
Yes, Regulation (EC) N° 1223/2009 Article 4(5) establishes that for an imported cosmetic product, each importer shall be the responsible person for the specific cosmetic product he places on the market.
The CPNP is a free of charge online notification system created for the implementation of Regulation (EC) No 1223/2009 of the European Parliament and of the Council on cosmetic products.
When a product has been notified in the CPNP there is no need for any further notification at national level in the European Union.
Regulation 1223/2009 does not require the indication of all the countries where the product is on the market.
The Responsible Person has only the obligation to indicate the country where the product is first placed on the market.
However, when registering in the CPNP, you have to indicate the product name and when the product is made available in different countries with a name translated in different languages, each of these names has to be mentioned in the CPNP notification.
The country of origin is only necessary for imported products.
The field "Country of origin" is directly related to the previous question "Is this product imported in the Community?"
If the product is imported, the country of origin is a non EU country.
10. If a product is no longer marketed in a specific country, do I have to update the notification and remove this country?
The Responsible Person only needs to indicate in which EU Member State the product was first placed on the market. However, the Responsible Person may indicate when a product is no longer being manufactured.
There is therefore no list of all the countries in which the product is on the market and there is also no obligation (and no possibility) to indicate if a product is no longer on a certain market.
You can find them using the "Advanced search" as it allows you to search a product into the CPNP using cumulative search criteria such as Status: draft or notified
12. When I try to "Save as a Draft" the following message appears: "The submission contains untrusted data; the form will not be saved!" or "is not a valid string".
This message appears if one or more fields in the notification form contain characters that are not accepted by the system
The system indicates in red the fields that contain such characters. These characters need to be removed to be able to continue.
Please avoid doing a "copy/paste" from word because this action could introduce such characters. For example: characters like <,> are not accepted.
You can have the list of your notifications by performing a search.
The display results are limited to 100 records. However, if you export the search results you will obtain the list of all your notifications.
If your product notification is still on "draft" status you can delete it. You just need to find it via an advanced search and then click on the trash bin icon.
A product already notified cannot be deleted, it has to be corrected.
The CPNP notifications remain in the system, deleting is not possible.
In that case, you shall simply create an updated version and tick the field "product no longer manufactured".
The contact person field is mandatory. Instead of deleting, you must update the contact person field.
In order to edit a contact person in CPNP, click on the menu option "Contact persons" and select "Choose a contact person" if the contact person is new add it via the + button. Edit the data needed and when finished, click on "Save".
You can do only one notification for all different sizes of the same product.
We invite you to enter in the CPNP the most readable original labelling and original packaging (commonly the biggest size) and indicate the existence of different sizes in the field “Any other information of significance for poison centres (English only)”.
The type of tabs displayed is directly related to the user profile.
If you think that you have selected a wrong profile, please send us a request to change it via the form below on the bottom of the FAQ.
CPNP is a web-based tool compatible with most of the recent Internet browsers.
However, a full compatibility with all the browsers is technically impossible. If you currently use Internet Explorer we suggest you to try uploading documents with another browser like Mozilla Firefox or Google Chrome
20. Does the 2Mb limit for uploads relate only to the picture of labels, or does it cover all attachments and uploads for the whole notification?
The 2Mb limitation relates to the notification as a whole. This means that the size of all the attached documents together cannot be bigger than 2Mb.
No, Article 13 of Regulation (EC) N° 1223/2009 lists all the information to be notified to the Commission. The definition of the mandatory fields of the form is based on this list.
All the mandatory fields in the form need to be filled out. The CPNP indicates when it is possible to provide data via an attachment.
22. Is it possible to create a PDF summarizing all the information about each cosmetic product I notify?
Yes, for that you have to edit the notification, select view and then you will find the "PDF" button at the right bottom.
However, this can only be done once the product is notified and for each product individually, not in batch.
Only one of the two pieces of information is mandatory: image or text
The CPNP checks if at least one of this two fields has been provided.
Please note that the original labelling submitted via free text is intended for specific cases where the labelling is limited and exclusively composed of text.
25. Do we need to upload all the labels in all different languages for the countries where the product is on the market?
The Responsible Person only has the obligation to enter in the CPNP the original label of the product when the product was first placed on the market. However, if the Responsible Person on voluntary basis wishes to enter several labels, the CPNP allows it provided the 2Mb limit is respected.
The field "Industry Reference" is not mandatory. You can use it at your best convenience for example if you wish to enter your company reference number for the product that you are notifying.
It will make it possible to do a search for your notification based on this "Industry Reference" afterwards.
There is indeed a limited number of 2000 characters for visibility issues.
We therefore propose to use the function of "duplicate product".
This function allows the responsible person to duplicate an existing notification. You must first search for the product you want to duplicate and then click on the icon.
You cannot duplicate a notification that is in the status draft. Only a product that was already notified can be duplicated.
This is a useful function when very similar products have to be notified separately since it avoids retyping all identical information.
The system duplicates all data except the answers to questions relating to the ingredients of concern, the attached labelling (and packaging where appropriate) and the check box "product ready to go on the market or already in the market", so the responsible person needs to tick the checkbox "Product ready to go on the market or already on the market" in order to validate the duplication.
If you don't tick the check box "product ready to go on the market or already in the market", is as if you haven't entered the packaging and labelling.
29. The concentration ranges indicate "above" a specific percentage - does this mean "above" and not "equal to and above"?
The concentrations need to be provided if they are above the specific percentage.
The function "Product transfer" is intended for Local Administrators and allows transferring notifications from one sub-organisation (A) to another sub-organisation (B) when both belong to the same parent organisation.
You must first choose sub-organisation A and then select sub-organisation B.
The system will display the notifications submitted by sub-organisation A and you have the possibility to select individual notifications or to select them all.
Once the notifications are selected, click on the "GO" button and they will be transferred to sub-organisation B.
"When downloading the personal data of responsible persons, distributors or contact persons into national databases please be aware that the processing of these data is bound to the national legislations implementing Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and notably to the provisions on security. These personal data shall be processed for the limited purposes of article 13(5) and (6) of Regulation (EC) N° 1223/2009".
Responsible Person profile:
You must select a Responsible Person profile to notify cosmetic products into CPNP.
When creating an organisation with Responsible Person profile in SAAS, the name of the organisation must correspond to the Responsible Person details visible on the cosmetic products labelling.
Who is the Responsible Person?
- If a product is manufactured in the EU (and not subsequently exported and imported back into the EU) and marketed in the EU, the EU manufacturer is estimated being a Responsible Person (unless another person established in the EU has been mandated).
- If a product is manufactured in the EU (and not subsequently exported and imported back into the EU) and marketed in the EU, but the manufacturer is established outside the EU, then a Responsible Person established in the EU must be appointed.
- The distributor shall be the Responsible Person where he places a cosmetic product on the market under his name or trademark or modifies a product already placed on the market in such a way that compliance with the applicable requirements may be affected.
- For imported cosmetic products manufactured in a non EU country, each importer shall be the Responsible Person for the specific cosmetic products he places in the market and has to request a Responsible Person profile (unless another person established in the EU has been mandated).
You must select a distributor profile only if you want to distribute a product in a EU Member State and you translate, on your own initiative, any element of the labelling of that product in order to comply with national law. Then, you have to submit through CPNP some information related to the products you distribute. A distributor cannot notify products in CPNP, only link his/her notification to existing products; the products in question have to be registered in the CPNP by the Responsible Person beforehand.
Delegate for nanomaterials profile:
Delegate for nanomaterials is a specific profile referring exclusively to notifications under Article 16. The role of the Delegate for nanomaterials is to enter, on request of a Responsible Person, certain data for the notification of products containing non-regulated nanomaterials. They cannot notify cosmetic products.
First of all, please make sure that you have completed all the registration process steps as described on our tutorial (https://webgate.ec.europa.eu/cpnp/public/tutorial.cfm).
The Commission services only validate new organisations and the validation process generally takes 2 working days.
When someone creates a new organization and the access request is accepted, this person automatically becomes this organization "Local Administrator".
The Local Administrator is responsible for:
1) managing the accounts of his organisation.
2) managing the accounts of his organisation sub-organisations (if any). The Local Administrator of the parent organisation also validates sub-organisations access requests.
If you requested access to an already validated organisation you must contact your Local Administrator.
If your access request is accepted you will receive a confirmation, if it is rejected you will receive an e-mail explaining the reject reason.
This message appears when data about the Responsible Person (organisation details) is missing. Only the Local Administrators have the possibility to edit and complete the details of an organisation (Responsible Person) into SAAS.
Therefore, in order to complete your organization profile, connect to SAAS (https://webgate.ec.europa.eu/saas) and go to the administration interface clicking the "Manage" button just near your active access profile.
Then you will access the tab "Manage organisations" and you can search for your organisation.
Please make sure that you provide your company complete address. Select "Edit" to complete the missing data and then "Save" when completed.
You cannot edit the Responsible Person data in the notification of a cosmetic product in CPNP. The Responsible Person data is linked to the organisation details registered in SAAS.
Therefore, if the Responsible Person data needs to be updated or corrected, the organisation Local Administrator has to do it in SAAS.
Please note that, as a general rule, the name of the Responsible Person organisation can only be changed in two cases:
- 1. for corrections (e.g. spelling mistakes, typos)
- 2. when the Responsible Person has not yet notified products in CPNP
To update your organisation data, connect to SAAS https://webgate.ec.europa.eu/saas and go to the administration interface clicking the "Manage" button just near your active access profile.
Then, you will access the tab "Manage organisations" and you can search for your organisation. Select "Edit" to change the data you can change from above rules and then "Save" when done. Please allow the system 10 minutes for synchronisation between SAAS and CPNP.
Once a Responsible person has notified cosmetic products in CPNP, this Responsible Person should not update anymore the organisation name and/or country in SAAS (except for correction).
If a Responsible person having cosmetic products notified in CPNP wants to change (not to correct) the name and/or country, this Responsible Person has to create a new organisation in SAAS and, if applicable, copy its cosmetic products to the new Responsible person in CPNP.
Therefore, before doing any action in SAAS, if your organisation has changed name and/or country, please contact CPNP Application support (GROW-CPNP@ec.europa.eu) to know the correct steps to follow.
Please be aware that these rules apply to allow National Competent Authorities and Poison Centers to be able to find in CPNP all cosmetic products placed on the EU market including those marketed under the former Responsible Person name.
National Competent Authorities could consider that your products are not compliant with EU law if they cannot find the former data in CPNP.
The access requests submitted by your colleagues are in SAAS. However, only the organisation Local Administrators have the possibility to accept/reject the access requests.
Once connected to SAAS (https://webgate.ec.europa.eu/saas), you will see a table with all your current and active profiles on CPNP, one per organisation. If you are Local Administrator of one (or more) organisations, you will see in front of your profile a "Manage" button that redirects you to the administration interfaces.
In the administration interfaces, you will see the list of all pending access requests. It is up to you to validate or reject them. In this screen, you will also see all your organisation active profiles. As Local Administrator you have the responsibility of managing these accounts. If, for instance, one of your colleagues leaves the company, you can block/delete his account.
We warmly encourage all organisations to have at least two Local Administrators, so please make sure that you delegate your Administration rights to another person of your organisation.
The Local Administrator must:
1) connect to SAAS (https://webgate.ec.europa.eu/saas)
2) click on the "Manage" button (just near your active access profile) to go to the administration interfaces
3) Once in the administration interface, click on the edit icon in front of the person you wish to give Local Administrator rights name.
The User Profile details will be displayed and then you just need to tick "Local Administrator" and save.
7. My organisation has a Responsible Person. Why can't I accept my organisation distributors access requests?
All members of an organisation (and its sub-organisations) must have the same profile. Requests with different profiles will be rejected by the System Administrator.
A distributor must create his own organisation and request access to it instead of the one of the Responsible Person.
All members of an organisation (and its sub-organisations) must have the same profile. Nevertheless you don't need to create two organisations because when "Acting as Responsible Person profile" you can also notify as distributor. The menu option is under "Distribution".
Please note that a sub-organisation has nothing to do with a subsidiary, an affiliated company or an affiliated society.
The purpose of a sub-organisation is to allow an organisation to use a contractual company to notify on its behalf.
Therefore, an organisation can have one or several sub-organisations which are able to notify on behalf of the parent organisation.
On the CPNP Notification itself the Responsible Person/Distributor will always be the Parent organisation, no data of the sub-organisation will appear in the CPNP notification (they are not visible to Competent Authorities and Poison Centres).
For confidentiality reasons CPNP prevents a user of a sub-organisation to see notifications from the Parent organisation or other sub-organisations with the same Parent organisation.
First of all, please note that you can only create a sub organisation linked to a previously validated organisation.
1) connect to SAAS (https://webgate.ec.europa.eu/saas) and click on the "Request access" tab.
2) Click "2b Create organisation" tab and you will be prompted to Organisation details form
3) Fill up the form with the details of your sub organization. Please provide all the information concerning your sub organization.
4) Select the organisation you want to be linked with on the drop down menu from of the field "parent organisation".
5) Save the details of the sub organisation you must submit
6) Request access to the newly created sub-organisation selecting the same profile used by the parent organisation.
All sub organisations and their request access must be validated by the Local Administrator of the main organisation.
The CPNP application uses the ECAS account to authenticate.
If you need a password reset, go to the ECAS page: https://webgate.ec.europa.eu/cas and click on "Lost your password?"
If you need to change your personal data, once logged, click on "Account information" in the top right menu. The only thing you cannot change is the user name (login)