For pharmacies

Skincare supplier documents: what a pharmacy should hold

Endless Pure Bio-Retinol Eye Elixir on a wooden table with small white blossoms

Short answer

A pharmacy's supplier file needs nine items per brand: Responsible Person, CPNP confirmation, safety assessment confirmation, GMP evidence, certificate, full INCI, a label photo, batch-level delivery records and a Regulation (EU) 2023/1545 allergen check. The PIF stays with the Responsible Person. For Endless Pure, product information is available to partners.

  • up to 50% Attractive margin
Partner accountCreate a trade account

Key facts

  • Only products with a Responsible Person established in the EU may be placed on the EU market (Regulation 1223/2009, Article 4).1
  • A distributor must be able to name who supplied a batch, and to whom it went, for three years after the batch was made available to it (Article 7).1
  • Regulation (EU) 2023/1545 adds 56 fragrance allergens to individual labelling above 0.001% in leave-on and 0.01% in rinse-off products.2
  • New products placed on the market after 31 July 2026 must carry the extended allergen labelling; older stock may stay on sale until 31 July 2028.3
  • REACH safety data sheet requirements exclude finished cosmetic products intended for the end user.4
  • Endless Pure produces every wholesale order as a fresh batch, with production time depending on the order volume, so the batch number on your delivery note is new each time.

Which documents should a pharmacy hold for each skincare brand?

Nine items, split into what the supplier gives you once and what you build yourself at every delivery. The legal duties for safety sit with the Responsible Person; your duties as a distributor are to check labels, store correctly and trace batches. The file proves you did both. The certifications guide explains which labels are legal and which are voluntary; this page is the working file.

#ItemLegal hookSourceWhat to check
1Responsible Person name and EU addressArt. 4Supplier, in writingMatches the address printed on the pack
2CPNP notification confirmationArt. 13SupplierOne confirmation per product you list
3Safety assessment and PIF confirmationArt. 10, 11SupplierWritten statement that both exist and are current
4GMP evidenceArt. 8SupplierISO 22716 certificate or audit report, in date
5Certification certificate (e.g. COSMOS)VoluntarySupplier + directoryProduct listed in the COSMOS directory
6Full INCI per SKUArt. 19SupplierIdentical to the pack
7Approved label photoArt. 6, 19YouTaken from the first delivery
8Delivery notes with batch numbersArt. 7YouKept three years1
9Allergen-labelling checkReg. 2023/1545YouPack lists the extended allergens if placed on market after 31 July 20263

Articles refer to Regulation (EC) No 1223/2009.1

What should the Responsible Person and safety documents look like?

Short written statements, not thick files. Ask for one letter or email per brand that names the Responsible Person and their EU address, confirms CPNP notification for each SKU on your order and confirms that a safety assessment and Product Information File exist for each.1 Then compare the address with a pack. A mismatch between paperwork and pack is the first gap to look for, and it is enough to hold the listing until it is explained.

You will not normally see the PIF. Article 11 requires it to be readily accessible to the authorities at the address given in the notification and kept for ten years after the last batch is placed on the market.1 Your proof is the confirmation, filed by date.

What counts as GMP and certification proof?

For GMP, an ISO 22716 certificate or a recent audit report covering skincare. Article 8 presumes good manufacturing practice when harmonised standards are followed, and ISO 22716 is that guideline for production, control, storage and shipment.15 Check the date: last year's certificate says nothing about this year's batches.

For certification, take the certificate and look the products up in the COSMOS directory.6 Check three things: the certifier's name, that each SKU you list is covered, and the validity date. If the brand uses the COSMOS Organic signature on one product and COSMOS Natural on another, your shelf cards must follow the product, not the brand. The COSMOS guide explains the difference.

What do you check when a delivery arrives?

The label, the batch and the dates, on one opened box per SKU. Article 6(2) makes these the distributor's checks before a product is made available.1 We suggest a short goods-in routine:

  1. Responsible Person name and address present and matching item 1.
  2. Batch number on the pack and on the delivery note.
  3. Date of minimum durability, or a period-after-opening symbol for products lasting more than 30 months.1
  4. Ingredient list headed "Ingredients", in the same order as the INCI you hold.
  5. Language suitable for your market.
  6. Precautions where the product needs them.

Photograph the first box of every SKU and file the photo as item 7. When a supplier changes a label, the next photo shows it at once.

How do the 2023/1545 allergen dates affect your stock?

They split your stock in two. Regulation (EU) 2023/1545 adds 56 fragrance allergens to the labelling list, declared individually above 0.001% in leave-on and 0.01% in rinse-off products.2 Products placed on the market after 31 July 2026 must carry the extended labelling; products placed on the market before that date may stay on sale until 31 July 2028.3

In practice:

  • Now: at goods-in, check that new deliveries show the extended allergen declarations where relevant.
  • Through 2027: sell older packs first. Mark the shelf position of any pre-August 2026 stock.
  • By July 2028: any pack without the extended labelling comes off the shelf.

The extended labelling matters at the counter too. A customer with a known allergy reads the INCI line for named allergens, so your team should know which products carry them. The sensitive-skin shelf guide has the counter scripts. For retinol products, a separate set of limits and dates applies under Regulation (EU) 2024/996; the retinol limits guide covers them.

Do you need safety data sheets or certificates of analysis?

No. REACH safety data sheet requirements exclude finished cosmetic products intended for the end user.4 Certificates of analysis are a manufacturer's internal batch-release document and are not part of the PIF contents listed in Article 11(2).1 If your own quality system asks for them, request them; otherwise the INCI, the safety assessment confirmation and the batch record are the documents that answer a customer or an inspector.

How does Endless Pure handle the supplier file?

Product information is available to partners; the buyer fact sheet sets out the brand facts and terms:

  • Product information: available to partners once the account is verified; partners get marketing materials and product information.
  • Certification: every formula except the Eye Renewal Patches is ECOCERT COSMOS certified (Natural or Organic).
  • Regulation: formulas comply with Regulation (EC) No 1223/2009.
  • GMP: made in ISO 22716 certified GMP facilities in Latvia, France and North America.
  • Batches: every wholesale order is a fresh batch, with production time depending on the order volume, shipped with tracking, so your delivery note and batch number arrive together.

The pharmacy hub shows the lines and trade terms.

Frequently asked questions

Can a pharmacy ask to see a cosmetic's Product Information File?

You can ask, but the PIF is kept for the authorities at the Responsible Person's address and is not normally released to retailers. Ask instead for written confirmation that the PIF and safety assessment exist for each product you list.

Do I need a safety data sheet for cosmetics I sell in my pharmacy?

No. REACH safety data sheet rules exclude finished cosmetic products intended for consumers. Keep full INCI and the safety assessment confirmation instead.

What changes for my stock on 31 July 2026 with the new allergen labelling?

Products placed on the market after that date must list the extended set of fragrance allergens. Stock placed on the market earlier can still be sold until 31 July 2028, so rotate older packs first.

How long must a pharmacy keep cosmetics delivery records?

Three years after a batch was made available to you, because Article 7 of Regulation 1223/2009 requires you to identify your supplier on request. Most pharmacies simply keep invoices and delivery notes with batch numbers for that period.

How do I check a COSMOS certificate is real?

Search the brand and product in the COSMOS certified products directory and check that the certificate is in date. A logo on the pack with no directory entry is a reason to pause the listing.

What product information does Endless Pure give pharmacies?

Product information is available to partners once the business is verified. Every formula except the Eye Renewal Patches is ECOCERT COSMOS certified (Natural or Organic).

Is an ISO 22716 certificate legally required?

No. The law requires good manufacturing practice and presumes compliance when harmonised standards such as ISO 22716 are followed, so a certificate or audit report is the practical proof to ask for.

Sources

  1. European Union, Regulation (EC) No 1223/2009 on cosmetic products (2009). eur-lex.europa.eu Checked 2026-10-22.
  2. Exponent, EU cosmetic regulation adds 56 new fragrance allergens (6 September 2023) (2023). www.exponent.com Checked 2026-10-22.
  3. Health Products Regulatory Authority (Ireland), Labelling of cosmetic fragrance allergens (2026). www.hpra.ie Checked 2026-10-22.
  4. Bens Consulting, When does a cosmetic product need a safety data sheet? (2024). bens-consulting.com Checked 2026-10-22.
  5. International Organization for Standardization, ISO 22716:2007 Cosmetics, Good Manufacturing Practices (GMP), Guidelines on Good Manufacturing Practices (2007). www.iso.org Checked 2026-10-22.
  6. COSMOS-standard AISBL, COSMOS-standard: certified products directory (2026). www.cosmos-standard.org Checked 2026-10-22.