EU CPNP Product Information File for Korean ODM K-Beauty: What Your ODM Sends vs What You Must Prepare (2026)
Ask any Korean ODM for a quote and you will get a formula spec sheet, a filler bill of materials, a lead time, and a per-unit cost. Ask that same ODM for the compliance package your product needs to actually cross the border into the United States, European Union, or United Kingdom, and the answer gets fuzzier fast. Founders who launch across all three markets discover that the regulatory doc pack is a separate deliverable, sometimes handled by a different team inside the factory, and sometimes not handled at all until the brand pushes for it in writing.
By Liz Song, K-beauty sourcing consultant
This piece is a founder-side reference on what to demand from a Korean ODM so that US MoCRA, EU CPNP, and UK SCPN launch is not a scramble in the final six weeks. The three markets share a common backbone, but each has a distinct submission portal, a distinct responsible-person concept, and a distinct set of documents that must live at that responsible person's address before your product is on shelf. Getting the doc package right at brief stage prevents the classic launch-blocker: formula ready, filling booked, and one missing safety assessment holding back the freight forwarder.
Key takeaways
The compliance doc package is a distinct deliverable from the formula quote, and Korean ODMs vary in how completely they scope it up front. Founders who name the four doc categories in the RFQ, which are identity and composition, safety and stability, manufacturing quality, and market-specific submission artifacts, get scoped quotes and fewer surprises. The US, EU, and UK converge on ingredient naming, GMP under ISO 22716, and the responsible-person concept, and they fork on the notification portal, the format of the safety deliverable, and the responsible-person legal entity requirements. A single Korean ODM formulation produces three distinct notifications across the three markets, and each notification requires its own responsible person and its own retained PIF or substantiation dossier.
For a side-by-side comparison of EU CPNP with MoCRA, Health Canada CNF, and Korean MFDS, see our regulation hub for indie K-beauty founders.
Why the doc package, not the registration, is the real bottleneck
Registration portals are visible. The FDA Cosmetics Direct portal, the EU CPNP portal, and the UK SCPN service are all fields on a screen. What is not visible from the portal is the paperwork that had to exist before those fields could be filled in truthfully. A CPNP notification takes minutes to submit once the Product Information File is complete, and the Product Information File takes weeks to compile if the Korean ODM has not been briefed to produce its inputs on time.
The gap founders keep missing is this: your Korean ODM is not the responsible person in any of these three markets, but the responsible person cannot notify without documents that only the ODM can produce. The safety assessor writing your Cosmetic Product Safety Report needs a stability report, a challenge test result, a heavy metals analysis, an ingredient dossier, and a batch manufacturing record. Every one of those documents originates on the ODM side, in Korean, and needs to arrive translated and in a version-controlled bundle. That handoff is the operational bottleneck, not the portal click.
A four-part framework for the ODM doc pack
Across all three markets, the compliance package Korean ODMs must supply falls into four categories. Naming them explicitly in your brief and your RFQ tells the factory that you know what you are asking for and lets their regulatory team scope the work.
The first category is identity and composition documents. This bundle proves what is in the bottle. It includes the full quantitative and qualitative formula with INCI naming, a specification sheet for each raw material, a Certificate of Analysis for the finished product, and allergen and impurity declarations at the level required by each market. Identity documents are the raw input to every downstream file.
The second category is safety and stability evidence. This includes the challenge test result under standards like ISO 11930 for preservative efficacy, stability under accelerated and ambient conditions per an ICH-adjacent protocol, compatibility with primary packaging, and toxicological assessment inputs. Safety evidence is what a qualified safety assessor uses to write the CPSR or the US safety substantiation dossier.
The third category is manufacturing quality evidence. This is where ISO 22716 becomes the anchor. A current ISO 22716 certificate for the manufacturing site, a batch manufacturing record for the launch lot, deviation logs, and quality system documentation demonstrate that the factory produces to Good Manufacturing Practice. All three markets accept ISO 22716 as the operative GMP standard for cosmetics.
The fourth category is market-specific submission artifacts. These are the documents each market requires in its own portal format: the US product listing entry in Cosmetics Direct, the EU CPNP notification, and the UK SCPN notification. Each of these submissions has adjacent artifacts the ODM must supply, and each is described in detail in the sections below.
US MoCRA: what your Korean ODM must supply
If you are also launching in the US market, your Korean ODM will need to supply a separate set of documents to satisfy MoCRA facility registration, product listing, and safety substantiation requirements. The documentation overlap with CPNP is partial, COAs and stability data transfer, but the registration portal, responsible-person designation, and adverse-event reporting obligations are entirely different.
For the full MoCRA filing walkthrough, including registration steps, responsible-person obligations, and 2026 renewal procedures, see our MoCRA guide for indie K-beauty founders.
EU CPNP: the Product Information File is the deliverable
The EU cosmetics framework treats the notification portal, the CPNP, as a downstream artifact. What matters legally is the Product Information File that sits behind the notification. Per Article 11 of Regulation (EC) No. 1223/2009, the responsible person must maintain a PIF for each cosmetic product and keep it accessible to competent authorities at the responsible person's address for ten years after the last batch is placed on the market.
The PIF is a bundle, not a single document. Its core components include a description of the cosmetic product, the Cosmetic Product Safety Report as defined in Annex I, a description of the method of manufacturing and a statement of compliance with Good Manufacturing Practice, proof of effect where claimed, and data on animal testing where relevant. The CPSR itself has two parts: safety information (physical and chemical characteristics, microbiological quality, impurities, packaging interaction, normal and reasonably foreseeable use, exposure to the product, exposure to substances, toxicological profile, undesirable effects, information on the product) and safety assessment conclusion signed by a qualified safety assessor.
Every one of those data lines has an ODM-side input. Physical and chemical characteristics come from the finished product spec. Microbiological quality comes from the challenge test and finished-product micro. Impurities including heavy metals come from the analytical certificate on the raw materials and the finished bulk. Packaging interaction comes from the ODM's stability and compatibility studies with the specified primary packaging. Manufacturing method and GMP statement come from the ISO 22716 certificate and batch record.
The responsible person for EU CPNP notification must be a legal or natural person established within the European Union. A Korean ODM cannot be the EU responsible person for your brand. Founders launching into the EU appoint an EU-based responsible person, often a regulatory service provider, and that responsible person is the one who owns the CPNP submission and the PIF address of record. The ODM's job is to hand off a complete data package to that responsible person's safety assessor before the CPSR can be written.
UK SCPN: post-Brexit, the same package with a different portal
The UK's Submit Cosmetic Product Notification (SCPN) system mirrors the EU CPNP framework closely, the Product Information File structure, safety assessment requirements, and responsible-person obligations are nearly identical. The key differences are the portal itself (SCPN vs CPNP), the UK-based responsible person requirement, and separate nanomaterial notification timelines.
For UK market access, the SCPN (Submit Cosmetic Product Notification) portal mirrors the EU CPNP workflow closely, with a separate UK-based responsible person requirement and independent nanomaterial notification timelines.
Decision matrix: what is the same, what is different
A useful way to hold the three markets side by side is to look at each doc category and note where the requirements converge and where they fork. On identity and composition, all three markets converge on INCI naming, complete ingredient declaration, and an allergen list. The forking point is the fragrance allergen list threshold: the EU maintains an explicit list of fragrance allergens that must be declared above set concentrations, the UK carries the same list forward from retained EU law, and the US does not mandate an equivalent list in the same form.
On safety, the three markets converge on a documented safety evidence base but fork on the format of the deliverable. The EU and the UK require a formal Cosmetic Product Safety Report signed by a qualified safety assessor with defined credentials. The US requires adequate substantiation of safety maintained by the responsible person, without a mandated CPSR format, though most brands who serve all three markets simply use the CPSR as their US substantiation dossier because it satisfies all three regimes at once.
On manufacturing, all three markets accept ISO 22716 as the working GMP standard, and none of them presently mandate an ISO 22716 certificate as a submission artifact. What they do is treat the ISO 22716 evidence as proof of the GMP statement the responsible person must make. In practice, an ISO 22716 certificate that names your Korean ODM's specific production site is the fastest way to satisfy this requirement across all three markets, and asking for that certificate up front is standard.
On notification, the three markets fully fork. Cosmetics Direct requires product listing per finished product, per responsible person, with an annual update. CPNP requires notification per product formulation, submitted by the EU responsible person, held in a PIF for ten years after the last batch. SCPN requires notification per product formulation, submitted by the UK responsible person, held in a UK PIF for the same period. A single Korean ODM formulation produces three distinct notifications and requires three distinct responsible persons.
FAQ
Can my Korean ODM be the responsible person for my US, EU, or UK cosmetic notifications?
No. The US MoCRA responsible person is the brand entity whose name appears on the product label, which for indie K-beauty founders is your brand, not the ODM. The EU responsible person must be a legal or natural person established in the European Union. The UK responsible person must be a legal or natural person established in the United Kingdom. Korean ODMs supply the underlying documentation but do not carry responsible-person duties in any of the three markets.
Is an ISO 22716 certificate legally required to sell cosmetics in the US, EU, or UK?
None of the three markets legally mandates the ISO 22716 certificate as a submission artifact. All three treat ISO 22716 as the operative Good Manufacturing Practice reference for cosmetics, and the EU cosmetics regulation and its UK-retained counterpart require a GMP statement in the PIF. In practice, a current ISO 22716 certificate for the specific Korean ODM production site is the shortest path to satisfying the GMP evidence requirement in all three notification workflows.
Do I need three separate Cosmetic Product Safety Reports for the US, EU, and UK?
Legally, only the EU and UK require a formal CPSR. The US requires adequate substantiation of safety maintained by the responsible person, without a mandated CPSR format. In operational practice, most brands launching across all three markets use one CPSR authored to the EU Annex I standard as their US safety substantiation dossier because it exceeds what MoCRA requires and satisfies all three regimes at once. The technical CPSR content is largely reusable; only the notification submissions are market-specific.
