The responsible person and the product information file: the name on the pack that matters

The name you have never read

Somewhere on the back of every cosmetic product sold in Great Britain is a name and an address. Most people have never read it, and it is the most legally significant text on the pack.

It identifies the responsible person: the party carrying the obligations for that product. Not necessarily the manufacturer, not necessarily the brand as consumers understand it, and not necessarily the retailer. It is whoever has taken on the role for that product in that market.

Everything this publication describes about claims, evidence, safety assessment and labelling ultimately attaches to that name.

Who it can be

The role can be held by a manufacturer established in the relevant market, by an importer bringing the product in, or by another party appointed in writing who has accepted the role. For products placed on the Great Britain market, the responsible person must be established in Great Britain.

Two consequences follow that businesses regularly get wrong.

Importing makes you responsible. A business bringing a product into the market without an established responsible person already in place is likely taking the role on itself, with all the obligations attached.

Own labelling makes you responsible. A business that puts its own name on a product manufactured by somebody else, or that modifies a product in a way that affects compliance, is not simply reselling.

Neither is a technicality. Both determine who holds the file and who answers when an enforcement authority asks.

What the file contains

The product information file is a document set, held for a period specified by the regulation and kept readily accessible at the address on the pack.

It contains a description of the product allowing it to be identified with the file. It contains the cosmetic product safety report, comprising safety information about the product and its ingredients and a safety assessment by a person with the qualifications the regulation specifies. It contains a description of the method of manufacture and a statement on compliance with good manufacturing practice. It contains proof of effects claimed where the nature of the claim justifies it. And where relevant it contains data on animal testing.

For a sun protection product the claims evidence is substantial: the in vivo protection factor report, the in vitro ultraviolet A report, water resistance testing where claimed, tolerance assessments where claimed, and support for any additional wording.

The safety assessor

The safety assessment is not prepared by whoever is available. The regulation specifies the qualifications required, in pharmacy, medicine, toxicology or a similar discipline, and the assessment is a professional document rather than a form.

For sun protection products the assessment has to consider exposure realistically: these are products applied over large areas of body surface, repeatedly, often in warm conditions and often to children. Where a product is intended for children, and particularly for children under three years, that use must be taken into account specifically, which is the substance behind the wording examined in children's and sensitive sunscreen wording.

Notification

Products must be notified before being placed on the market, through the service the relevant authority operates, providing details of the product, its category, its formulation to the extent required and the responsible person.

Notification is not approval. Nobody assesses the product in response to it. Its purpose is to give authorities and poison centres the information they need, which is a public safety function rather than a gatekeeping one. The distinction is worth holding on to, because notified is sometimes presented as though it meant something it does not.

The file nobody sees

The whole structure has one feature that is unusual and that this publication keeps returning to: none of it is public.

The safety assessment is not published. The claims evidence is not published. The test reports are not published, the laboratories are not named, the panel sizes are not stated and the confidence intervals do not appear. The file is available to enforcement authorities on request and to nobody else.

There are reasonable arguments for that arrangement, including commercial confidentiality and the difficulty of interpreting technical documents out of context. There is also a straightforward consequence: a consumer cannot verify anything on the pack, and has to rely on the system rather than on the evidence.

That is the structural fact behind almost everything in the gap. The label is the entire interface between a body of evidence and the person relying on it.

Where it goes wrong

The recurring failures are organisational rather than scientific. A business assumes its supplier is the responsible person when nobody has been appointed in writing. A file exists but is held abroad and cannot be produced promptly. Claims are added to artwork after the file was assembled and nothing is added to support them. A formulation changes and the test reports refer to the previous version. A product is sold into a market where the responsible person is not established.

None of those is a formulation problem, and all of them are enforcement problems.

Where the obligations sit along a supply chain

A sun protection product typically passes through several hands before it reaches a shelf: a contract manufacturer, a brand owner, an importer, a distributor and a retailer, with a marketplace sometimes standing between the last two and the consumer.

The regime does not distribute obligations evenly along that chain. Most of them attach to the responsible person, which is one identified party. Distributors carry their own, lighter obligations, including checking that the required labelling particulars are present and that the date marking is respected, and acting where they have reason to believe a product is non-compliant.

The practical difficulty arises where the chain is longer or less formal than the parties assume. A brand owner who believes the manufacturer is the responsible person, a manufacturer who believes the brand owner is, and a written appointment that nobody made, together produce a product on sale with no identified responsible party. That is not an unusual failure and it tends to surface only when somebody asks for the file.

For businesses the corrective is documentary rather than technical: establish in writing who holds the role for each market, and confirm that the party named on the pack is the party that actually holds the file.

What a reader can do with this

Very little directly, and one thing indirectly. The name and address on the back of a pack tells you that somebody has taken legal responsibility for the product in this market. A pack without one is a pack that has not been placed on the market properly, and that is a meaningful signal, particularly for products bought through marketplaces from sellers outside the United Kingdom.

What happens when the file is asked for

The obligation is not to have a file somewhere. It is to keep it readily accessible at the address indicated on the pack, in a form an enforcement authority can use.

In practice that means it should be capable of being produced promptly, in English, organised so that a specific claim can be traced to the document supporting it. A file that exists as an unindexed archive across several systems and two countries technically exists and does not meet the practical requirement.

The situations in which the request arrives are predictable: a complaint from a consumer, a query from a competitor, a routine market surveillance exercise, a safety concern, or an advertising adjudication that prompts a parallel look at the product. None of them arrives with much notice.

The businesses that manage this well treat the file as a live document maintained alongside the artwork, so that a claim added to a pack triggers a corresponding addition to the file. The businesses that manage it badly assemble it in response to the request, which is the point at which gaps become visible to somebody other than themselves.

What to take from this

One named party carries the obligations, holds a file containing the safety assessment and the claims evidence, and makes it available to enforcement authorities. None of it is published, which is why the label carries the entire weight of communication.