Korean ODM Compliance Documents for US, EU, and UK K-Beauty Launch: A 2026 Founder Reference

Ask any Korean ODM for a quote and you will get a formula spec sheet, a filler bill of materials, a lead time, and a per-unit cost. Ask that same ODM for the compliance package your product needs to actually cross the border into the United States, European Union, or United Kingdom, and the answer gets fuzzier fast. Founders who launch across all three markets discover that the regulatory doc pack is a separate deliverable, sometimes handled by a different team inside the factory, and sometimes not handled at all until the brand pushes for it in writing.

This piece is a founder-side reference on what to demand from a Korean ODM so that US MoCRA, EU CPNP, and UK SCPN launch is not a scramble in the final six weeks. The three markets share a common backbone, but each has a distinct submission portal, a distinct responsible-person concept, and a distinct set of documents that must live at that responsible person's address before your product is on shelf. Getting the doc package right at brief stage prevents the classic launch-blocker: formula ready, filling booked, and one missing safety assessment holding back the freight forwarder.

Why the doc package, not the registration, is the real bottleneck

Registration portals are visible. The FDA Cosmetics Direct portal, the EU CPNP portal, and the UK SCPN service are all fields on a screen. What is not visible from the portal is the paperwork that had to exist before those fields could be filled in truthfully. A CPNP notification takes minutes to submit once the Product Information File is complete, and the Product Information File takes weeks to compile if the Korean ODM has not been briefed to produce its inputs on time.

The gap founders keep missing is this: your Korean ODM is not the responsible person in any of these three markets, but the responsible person cannot notify without documents that only the ODM can produce. The safety assessor writing your Cosmetic Product Safety Report needs a stability report, a challenge test result, a heavy metals analysis, an ingredient dossier, and a batch manufacturing record. Every one of those documents originates on the ODM side, in Korean, and needs to arrive translated and in a version-controlled bundle. That handoff is the operational bottleneck, not the portal click.

A four-part framework for the ODM doc pack

Across all three markets, the compliance package Korean ODMs must supply falls into four categories. Naming them explicitly in your brief and your RFQ tells the factory that you know what you are asking for and lets their regulatory team scope the work.

The first category is identity and composition documents. This bundle proves what is in the bottle. It includes the full quantitative and qualitative formula with INCI naming, a specification sheet for each raw material, a Certificate of Analysis for the finished product, and allergen and impurity declarations at the level required by each market. Identity documents are the raw input to every downstream file.

The second category is safety and stability evidence. This includes the challenge test result under standards like ISO 11930 for preservative efficacy, stability under accelerated and ambient conditions per an ICH-adjacent protocol, compatibility with primary packaging, and toxicological assessment inputs. Safety evidence is what a qualified safety assessor uses to write the CPSR or the US safety substantiation dossier.

The third category is manufacturing quality evidence. This is where ISO 22716 becomes the anchor. A current ISO 22716 certificate for the manufacturing site, a batch manufacturing record for the launch lot, deviation logs, and quality system documentation demonstrate that the factory produces to Good Manufacturing Practice. All three markets accept ISO 22716 as the operative GMP standard for cosmetics.

The fourth category is market-specific submission artifacts. These are the documents each market requires in its own portal format: the US product listing entry in Cosmetics Direct, the EU CPNP notification, and the UK SCPN notification. Each of these submissions has adjacent artifacts the ODM must supply, and each is described in detail in the sections below.

US MoCRA: what your Korean ODM must supply

The Modernization of Cosmetics Regulation Act shifted US cosmetic oversight from a light-touch regime to something closer to a documented product-and-facility register. Under the FDA guidance summarized by Foley & Lardner and the FDA itself, two obligations sit next to each other: facility registration and product listing.

Facility registration is the ODM's responsibility as the manufacturer. Any cosmetic product manufacturer or processor whose products are distributed in the United States must register the facility with the FDA, and the FDA is requiring that facilities renew registration for the first time by July 1, 2026, and every two years after that per the FDA compliance policy. From your brief, you want to ask the ODM to confirm the FEI number of the Korean facility that will produce your product and to show evidence that facility registration is current and renewed on the FDA schedule. If the Korean ODM has multiple production sites, you want the FEI of the specific site your batch will run on, because the FDA registration attaches to the physical site.

Product listing is the brand's responsibility as the responsible person, because the responsible person under MoCRA is the manufacturer, packer, or distributor whose name appears on the product label. For indie K-beauty founders, that is your brand entity. You cannot delegate product listing back to the Korean ODM, but you can and should require the ODM to supply the inputs your listing depends on: the complete ingredient statement in INCI order, the cosmetic product category code that matches how the finished product will be described on Cosmetics Direct, and any active drug-versus-cosmetic classification calls where a formula sits near the sunscreen boundary.

The MoCRA safety substantiation obligation is the least visible piece and the most consequential. Responsible persons must maintain, per the statute and the FDA's implementing guidance, adequate substantiation of safety for every marketed product. That evidence has to live at the responsible person's address and be producible on request. Your Korean ODM is the source of the underlying data: challenge test results, heavy metal analyses, stability under conditions of use, and any tests that support marketing claims. Ask for the substantiation dossier as a discrete deliverable, not as a set of embedded references in an emailed spec sheet.

Serious adverse event reporting also sits with the responsible person. Founders should confirm the ODM has a documented procedure for tracing a specific complaint back to a specific batch, because the fifteen business day reporting window under MoCRA collapses fast if the brand cannot narrow which lot number is implicated. That procedure lives in the ODM's ISO 22716 quality system, not on a portal.

EU CPNP: the Product Information File is the deliverable

The EU cosmetics framework treats the notification portal, the CPNP, as a downstream artifact. What matters legally is the Product Information File that sits behind the notification. Per Article 11 of Regulation (EC) No. 1223/2009, the responsible person must maintain a PIF for each cosmetic product and keep it accessible to competent authorities at the responsible person's address for ten years after the last batch is placed on the market.

The PIF is a bundle, not a single document. Its core components include a description of the cosmetic product, the Cosmetic Product Safety Report as defined in Annex I, a description of the method of manufacturing and a statement of compliance with Good Manufacturing Practice, proof of effect where claimed, and data on animal testing where relevant. The CPSR itself has two parts: safety information (physical and chemical characteristics, microbiological quality, impurities, packaging interaction, normal and reasonably foreseeable use, exposure to the product, exposure to substances, toxicological profile, undesirable effects, information on the product) and safety assessment conclusion signed by a qualified safety assessor.

Every one of those data lines has an ODM-side input. Physical and chemical characteristics come from the finished product spec. Microbiological quality comes from the challenge test and finished-product micro. Impurities including heavy metals come from the analytical certificate on the raw materials and the finished bulk. Packaging interaction comes from the ODM's stability and compatibility studies with the specified primary packaging. Manufacturing method and GMP statement come from the ISO 22716 certificate and batch record.

The responsible person for EU CPNP notification must be a legal or natural person established within the European Union. A Korean ODM cannot be the EU responsible person for your brand. Founders launching into the EU appoint an EU-based responsible person, often a regulatory service provider, and that responsible person is the one who owns the CPNP submission and the PIF address of record. The ODM's job is to hand off a complete data package to that responsible person's safety assessor before the CPSR can be written.

UK SCPN: post-Brexit, the same package with a different portal

The UK post-Brexit regime kept the substantive requirements of the EU cosmetics framework almost intact and forked the notification portal. The Great Britain notification service, SCPN, is a separate submission from the EU CPNP, and it is legally required before any cosmetic product is placed on the Great Britain market. Per the UK Office for Product Safety and Standards, as of late May 2026 the SCPN system had received a cumulative 861,686 cosmetic product notifications from 24,112 registered responsible persons since its launch in December 2020.

The UK responsible person concept mirrors the EU concept structurally: any manufacturer based outside the UK must appoint a UK-established responsible person before placing a cosmetic on the Great Britain market, and that responsible person owns the SCPN submission. What founders should not assume is that an EU responsible person can double as a UK responsible person. Post-Brexit, they are legally distinct entities, and both must exist independently if you intend to sell in both blocs.

Northern Ireland sits on the EU CPNP under the Windsor Framework, and Great Britain sits on the UK SCPN. Your Korean ODM does not need to handle that distinction, but your brief should tell the regulatory service provider which UK market you intend to enter first so the provider knows which notification to file. The underlying PIF and CPSR the ODM supplies is largely reusable across EU CPNP and UK SCPN because the technical content overlaps, but the notification submissions themselves are separate and cannot be reused.

Non-compliance penalties on the UK side are enforceable. Founders who launch into Great Britain without an SCPN notification face fines and possible custodial penalties: per the UK Government cosmetics guidance, the maximum custodial sentence is three months, and Scotland and Northern Ireland cap fines at five thousand pounds while England and Wales have no upper limit. That risk is a paperwork risk, not a product risk. The formula being safe does not exempt the responsible person from making the notification.

I'm Liz, and I run ALTA MEET from Manhattan, NYC. The founders who get burned on multi-market launch are almost never the ones with weak formulas. They are the ones who assumed the Korean ODM would hand over the doc pack as part of the standard deliverable, and only discovered otherwise when the freight forwarder started asking for the CPSR reference number the week the container was booked. If you want a quick gut-check on whether your Korean ODM is set up to supply the US, EU, and UK doc package your responsible persons will need, I will spend fifteen minutes with you on it, free. Reach me at liz@altameet.com or book a slot.

Decision matrix: what is the same, what is different

A useful way to hold the three markets side by side is to look at each doc category and note where the requirements converge and where they fork. On identity and composition, all three markets converge on INCI naming, complete ingredient declaration, and an allergen list. The forking point is the fragrance allergen list threshold: the EU maintains an explicit list of fragrance allergens that must be declared above set concentrations, the UK carries the same list forward from retained EU law, and the US does not mandate an equivalent list in the same form.

On safety, the three markets converge on a documented safety evidence base but fork on the format of the deliverable. The EU and the UK require a formal Cosmetic Product Safety Report signed by a qualified safety assessor with defined credentials. The US requires adequate substantiation of safety maintained by the responsible person, without a mandated CPSR format, though most brands who serve all three markets simply use the CPSR as their US substantiation dossier because it satisfies all three regimes at once.

On manufacturing, all three markets accept ISO 22716 as the working GMP standard, and none of them presently mandate an ISO 22716 certificate as a submission artifact. What they do is treat the ISO 22716 evidence as proof of the GMP statement the responsible person must make. In practice, an ISO 22716 certificate that names your Korean ODM's specific production site is the fastest way to satisfy this requirement across all three markets, and asking for that certificate up front is standard.

On notification, the three markets fully fork. Cosmetics Direct requires product listing per finished product, per responsible person, with an annual update. CPNP requires notification per product formulation, submitted by the EU responsible person, held in a PIF for ten years after the last batch. SCPN requires notification per product formulation, submitted by the UK responsible person, held in a UK PIF for the same period. A single Korean ODM formulation produces three distinct notifications and requires three distinct responsible persons.

Cost and complexity signals in the doc pack

Founders often ask which parts of the doc pack drive complexity in a Korean ODM quote. The answer without inventing numbers: there are three structural drivers. The first is stability testing scope. A quote that covers three months at accelerated temperature is very different from a quote that covers twelve months at ambient plus accelerated plus freeze-thaw plus photostability, and the second bundle is what safety assessors typically want to see for a product that will sit on shelf across multiple markets. Ask the ODM which stability program they will run and whether the report will be issued in a format the CPSR author can consume directly.

The second driver is analytical scope. A Certificate of Analysis for the finished bulk that reports heavy metals, microbiological limits per ISO 17516, and residual solvent screens is more costly to produce than a basic assay COA. All three markets treat these tests as expected components of the safety evidence, and asking for the analytical scope in writing prevents a downstream request for extra testing that then delays notification.

The third driver is documentation localization. Korean ODMs generally produce their internal records in Korean. Your regulatory service provider on the EU or UK side will need those documents translated into English, and increasingly into the local language of the notifying member state where relevant. Some ODMs include translation in the quote; some price it separately; some do not translate at all and expect the brand to handle it. Getting a written answer on translation scope prevents a launch-week scramble.

Founder mistakes that push doc gaps to launch week

Three patterns show up in K-beauty launches that miss their planned ship date because of doc gaps rather than formula gaps. The first is treating the CoA and the safety substantiation as interchangeable. A CoA proves what is in the finished bulk; a safety substantiation proves the formula is safe under intended use. The CPSR author needs both, and asking only for the CoA leaves half the file empty.

The second is assuming the Korean ODM's stability report will satisfy the CPSR author without review. Safety assessors in the EU and the UK often have preferred stability report formats that itemize each condition, each timepoint, each parameter, and each acceptance criterion. If the ODM's report is a summary PDF without the underlying data table, the safety assessor may request the raw data anyway, and that request generates a second round of ODM communication that adds days at a time when days matter.

The third is confusing responsible person functions across markets. Founders sometimes appoint one EU responsible person and assume that entity will handle UK notifications, or they list the Korean ODM as the responsible person on the US product listing because that is who manufactures the product. Both mistakes are legally consequential. The US responsible person is the brand entity whose name is on the label, not the ODM. The EU and the UK responsible persons must be legal entities established in the EU and the UK respectively, and they cannot be the same entity.

Working with altameet on multi-market compliance

ALTA MEET's founder consulting is about narrowing the surface area brands negotiate with Korean ODMs. On regulatory doc packs specifically, the work is usually to help brands write briefs and RFQs that spell out the doc package expectation, to review draft compliance bundles from the ODM before they get sent to the safety assessor, and to coordinate the handoff between the Korean ODM and the EU or UK responsible person so that the CPSR author receives inputs in a form they can consume.

For founders already deep in supplier selection, a common first pass is a document-scope check on the ODM's quote. If the quote references "regulatory support" without itemizing which documents are included, that phrase is likely to cost time. Naming the four categories in this piece and asking for a line item on each is a fast way to convert vague language into a scoped deliverable.

Related reading on adjacent compliance topics: our earlier guides on EU CPNP step-by-step, UK SCPN filing, and US import compliance each cover one market in depth. This piece is intended as the cross-market reference that sits above those single-market pieces.

Key takeaways

The compliance doc package is a distinct deliverable from the formula quote, and Korean ODMs vary in how completely they scope it up front. Founders who name the four doc categories in the RFQ, which are identity and composition, safety and stability, manufacturing quality, and market-specific submission artifacts, get scoped quotes and fewer surprises. The US, EU, and UK converge on ingredient naming, GMP under ISO 22716, and the responsible-person concept, and they fork on the notification portal, the format of the safety deliverable, and the responsible-person legal entity requirements. A single Korean ODM formulation produces three distinct notifications across the three markets, and each notification requires its own responsible person and its own retained PIF or substantiation dossier.

FAQ

Can my Korean ODM be the responsible person for my US, EU, or UK cosmetic notifications?
No. The US MoCRA responsible person is the brand entity whose name appears on the product label, which for indie K-beauty founders is your brand, not the ODM. The EU responsible person must be a legal or natural person established in the European Union. The UK responsible person must be a legal or natural person established in the United Kingdom. Korean ODMs supply the underlying documentation but do not carry responsible-person duties in any of the three markets.

Is an ISO 22716 certificate legally required to sell cosmetics in the US, EU, or UK?
None of the three markets legally mandates the ISO 22716 certificate as a submission artifact. All three treat ISO 22716 as the operative Good Manufacturing Practice reference for cosmetics, and the EU cosmetics regulation and its UK-retained counterpart require a GMP statement in the PIF. In practice, a current ISO 22716 certificate for the specific Korean ODM production site is the shortest path to satisfying the GMP evidence requirement in all three notification workflows.

Do I need three separate Cosmetic Product Safety Reports for the US, EU, and UK?
Legally, only the EU and UK require a formal CPSR. The US requires adequate substantiation of safety maintained by the responsible person, without a mandated CPSR format. In operational practice, most brands launching across all three markets use one CPSR authored to the EU Annex I standard as their US safety substantiation dossier because it exceeds what MoCRA requires and satisfies all three regimes at once. The technical CPSR content is largely reusable; only the notification submissions are market-specific.

How long must the Product Information File be retained after launch?
Under the EU cosmetics regulation, the responsible person must keep the PIF accessible at the responsible person's address for ten years after the date on which the last batch of the cosmetic product was placed on the market. The UK-retained regulation carries the same ten-year requirement. The US does not have a mandated PIF retention period as such, but responsible persons must maintain safety substantiation records for as long as they are marketing the product, and the FDA has stated in guidance that records should be produced upon request.

What is the fastest way to check whether a Korean ODM is set up for multi-market launch?
Ask three questions in the initial technical call. First, is the specific production site ISO 22716 certified, and can they provide a copy of the certificate with the certification body and expiration date. Second, is the site's FDA facility registration current and can they provide the FEI number. Third, does their standard stability program report include the raw data table or only a summary, and is the report typically issued in English. Answers to these three questions predict whether the doc pack handoff will be smooth or noisy.

Do I need a UK responsible person if I already have an EU responsible person for CPNP notification?
Yes. Post-Brexit, the UK and EU responsible-person regimes are legally distinct. An EU responsible person can notify products only to CPNP for the EU market, and a UK responsible person, established in the United Kingdom, is required to submit SCPN notifications for the Great Britain market. Some regulatory service providers offer both functions through affiliated entities, and that is often a practical setup, but the two responsible-person appointments are separate legal roles.

What to do next

If you are early in Korean ODM selection, this piece is meant to sit next to your RFQ template. Copy the four doc categories into your brief so the ODM's regulatory team can scope their work at quote stage. If you are already in production and racing toward a US, EU, or UK launch, use the founder mistakes section as a checklist against your current doc pack. And if you want a second pair of eyes on a Korean ODM's compliance bundle before it goes to the safety assessor, that is the kind of narrow, targeted consulting we do at ALTA MEET.

Reach Liz directly at liz@altameet.com or book a slot for a fifteen-minute gut-check. Bring the ODM's quote and whatever doc list they have already committed to. Fifteen minutes usually surfaces the two or three items that would have slowed the launch by a full month if left unaddressed.

By the ALTA MEET editorial team. K-beauty ODM consulting from Manhattan, NYC. Reviewed for accuracy by ALTA MEET's formulation consulting team.