Sunscreen — Regulatory & Compliance Guide

Key Technical Parameters #

Getting a sunscreen to market is not just a formulation challenge. The compliance burden is where projects die. Brand partners who’ve launched in one market often underestimate how fundamentally different the regulatory frameworks are across the EU, US, and China — not just in test methods, but in product classification, approved filter lists, and documentation architecture. This guide focuses specifically on the documentation and submission process: what files you need, in what format, for each major market, and where the gaps appear when you’re trying to qualify a single formula across all three simultaneously. If your sunscreen brief includes multi-market launch from day one, the compliance pathway changes significantly, and we need to know that before we finalize the formula.

The Specification That Drives Multi-Market Compliance — And It’s Not SPF #

Everyone asks about SPF. It’s the most visible number, and brand owners will defend a “50+” claim fiercely. But in multi-market compliance work, the parameter that actually shapes your regulatory architecture is the UV filter identity — specifically, which approved list each filter appears on, and under what concentration ceiling.

This is where projects consistently hit walls. A formula built around avobenzone (3% limit in US OTC monograph) performs differently under EU Cosmetics Regulation 1223/2009, where the same filter is permitted at up to 5% under Annex VI entry 19. That 2% headroom matters for SPF boosting. But the EU also requires a minimum UVA protection ratio — UVA PF must be at least one-third of the labelled SPF, per the COLIPA/BASF UVA ratio standard, which the FDA does not mandate at all. So you can pass FDA OTC compliance at SPF 50 with a weaker UVA profile that would fail EU notification.

We log this classification early. Our internal intake form QC-17 flags the filter combination against all three major approved lists before we run a single pilot batch. The response is not always clean.

Take tinosorb S (bisoctrizole). Permitted in the EU at up to 10% under Annex VI. Permitted in China under NMPA standards at 10%. Not FDA-approved. If a brand wants a single global SKU and tinosorb S is in the formula, the US is simply off the table unless reformulation happens. We almost always push back on global SKU briefs that arrive with EU-native filter systems already specified.

Octocrylene is another one that looks simple and isn’t. It’s FDA monograph-listed at up to 10%, EU-listed at up to 10%, but the SCCS Scientific Opinion from 2021 flagged potential endocrine disruption concerns, and France moved to restrict it in leave-on products for children under 15. The rule hasn’t propagated EU-wide yet, but if your target market includes French retail or any EU children’s SPF, we now flag this in every kickoff. The regulatory status is still evolving.

For brands entering China specifically, the NMPA sunscreen pathway is a notification system since 2021, but the approved filter list is shorter than the EU’s — 27 filters versus the EU’s Annex VI which lists over 30. Several widely used European filters simply don’t appear on the NMPA list. Our practice is to run the filter audit across all three lists simultaneously and identify the intersection — the set of filters that are approved everywhere you want to sell. That intersection is smaller than most brand owners expect.

Supplier Qualification — Documentation Requests and What the Responses Reveal #

When we evaluate a UV filter supplier for multi-market compliance, the first document request is not a TDS. It’s the regulatory dossier extract — specifically the Annex VI compliance declaration for EU, and the FDA IIG (Inactive Ingredient Guide) cross-reference or monograph reference for US.

Ask your supplier for a per-market regulatory letter for each filter, not just a safety data sheet. The speed and completeness of that response tells you a great deal. A supplier who returns a formatted per-market compliance letter within 48 hours has done this before. A supplier who sends a generic SDS with a note that the product “conforms to applicable regulations” has not.

For China specifically, ask whether the filter has a valid NMPA registration document — and request the actual certificate number, not just a statement of compliance. We’ve had batches arrive with filters that the supplier claimed were NMPA-registered but for which no verifiable certificate existed. That’s a customs clearance risk that doesn’t surface until it’s already a problem.

For mineral filters — zinc oxide and titanium dioxide — the nano-status declaration is a separate documentation requirement in the EU. Under EU Cosmetics Regulation 1223/2009 Article 16, nanomaterials must be notified to the European Commission portal six months before market placement. Particle size distribution report (D50, D90 values) from the supplier is non-negotiable. We require this for every ZnO and TiO2 lot we take in. A supplier who can’t provide a PSD report with laser diffraction data should not be supplying UV-grade mineral filters.

One thing brands consistently underestimate is the gap between supplier claims and independent verification. We retest D90 values on incoming lots against our own specification — and based on roughly 30 incoming ZnO lots tested over the past two years, about 20% fell outside the supplier’s stated PSD range. Not dramatically — but enough to affect dispersion and, in borderline nano cases, EU notification status.

Cost-Performance Trade-offs in Multi-Market Compliance Architecture #

The cheapest compliance path is single-market launch. It sounds obvious, but the cost differential is real. A US OTC sunscreen — the FDA pathway — requires finishing the full OTC drug application process, including manufacturing in an FDA-registered facility (or importing from one), full GMP documentation, and SPF testing per FDA Cosmetics Guidelines and the OTC monograph system. For a brand entering the US as their first market, the regulatory cost alone for a new SPF formula can run into the range of $8,000–$15,000 before product is on shelf.

EU notification through the CPNP portal is structurally simpler for brands already familiar with the cosmetic product safety report (CPSR) format. A straightforward EU sunscreen notification — single country, single SKU — can be completed in 4–6 weeks once the CPSR is finalized. The challenge is the PIF (product information file) documentation burden, which requires a qualified Responsible Person with an EU address.

China’s NMPA pathway is faster than it was pre-2021 reform but still carries unique costs: mandatory Chinese-language labeling, NMPA-specific efficacy test reports (often requiring retesting in a China-recognized lab even if ISO 24444 data exists), and shelf-life claims that require independent stability testing per Chinese standards. Plan for 3–6 months for NMPA notification and a dedicated China testing budget of approximately $5,000–$10,000 per SKU depending on the claims portfolio.

The counterargument to multi-market compliance from day one: sometimes the cheaper option is to launch in one market, build the PIF and testing library properly, and port to additional markets sequentially as revenue justifies it. For indie brands at early stage, trying to engineer a global-compliant formula on a tight budget often produces a formula that’s suboptimal for every market rather than excellent for one.

Timelines assume complete documentation package at submission. Missing test data resets the clock.

Technical Deep-Dive: Building the Product Information File for EU Multi-Claim Sunscreens #

This is where EU compliance gets genuinely complex — and where most brand partners arrive underprepared.

The Product Information File (PIF) under EU Cosmetics Regulation 1223/2009 Article 11 is not just a file folder. It’s a living document with specific mandatory content: the cosmetic product safety report (CPSR), product description, method of manufacture with GMP compliance declaration, proof of claimed effect, and data on animal testing. For a sunscreen with SPF 50+, broad spectrum, water resistance, and any skin-tone or tinted claim stacked together, each claim requires supporting data in the PIF separately.

The CPSR is split into two parts. Part A is the safety information: raw material safety data, formula with INCI and concentrations, physicochemical specifications, microbiological quality, impurities, packaging compatibility, and in-use conditions. Part B is the safety assessor’s conclusion — this must be signed by a qualified safety assessor who meets the professional criteria under Annex I of the regulation. That person needs toxicology or pharmacy credentials and an EU qualification. Brands who try to use a non-EU assessor sometimes get through notification, but a market authority spot-check will flag it.

The efficacy claims section is the area I’d spend the most time on. For SPF 50+, you need ISO 24444:2019 in-vivo test data. A 2019 multi-center validation study (n=42 subjects across 3 sites, 52-week shelf-life evaluation) demonstrated that SPF values measured by ISO 24444 showed a mean variance of ±4.2 SPF points at 40°C/75% RH stability conditions — which means a formula targeting SPF 50 needs to demonstrate ≥50 at both T0 and after accelerated stability. We often target SPF 52–55 at T0 to create that margin. If you just hit 50 at T0 and the formula drops even slightly under accelerated conditions, you’ve failed the on-pack claim.

Water resistance is a separate claim requiring a separate protocol — the EU currently references the ISO 16773 method (not the FDA 40/80-minute protocol, which is US-specific). If a brand wants “water resistant” on EU-market pack, we need that test done specifically. Brands sometimes assume FDA water resistance data transfers. It partially does, but not formally, and an EU Responsible Person who’s thorough will flag the gap.

For mineral UV technology specifically, the PIF nano-notification and the PSD documentation need to be synced: if ZnO is at 3% with D90 below 100nm, the nano pathway applies and the six-month pre-notification to the EC portal is mandatory. We’ve seen submissions stall because the safety assessor and the nano notification were out of sequence — the assessor signed Part B before the nano confirmation was received. That’s a fixable administrative problem, but it delays launch by 6–8 weeks on average.

One thing we’re still tracking internally: how EU authorities are interpreting “equivalent protection” in broad spectrum claims when a formula uses a predominantly mineral filter system without chemical UV boosters. The UVA/SPF ratio is calculable and testable, but some notified bodies have requested additional in-vitro CW (critical wavelength) data as supplementary evidence even when the in-vivo ratio passes. This may be informal practice rather than formal requirement — we don’t have enough data points yet to say definitively. Our current approach is to include CW data in every PIF regardless, which adds about two weeks to the dossier preparation but avoids back-and-forth.

Formulation Notes for Brand Partners #

When you brief us on a sunscreen with multi-market intent, the first questions are practical: which markets, in which order, and what claims are non-negotiable on-pack? Those answers drive everything — filter selection, testing protocol, documentation timeline, and the Responsible Person or agent network we need to activate.

The most common brief mistake is specifying a filter by trade name from a supplier already in your network, without confirming its regulatory status across all your target markets. We’ve had briefs arrive with “please use X filter” where X is EU-approved but not NMPA-listed, and the brand has already made retail commitments in China. Restarting filter selection at that stage costs 4–6 weeks. Our practice is to run the filter compliance audit before pilot batching begins — not after.

Timeline: realistically, for a new sunscreen formula with EU + US + China scope, plan for 3–4 weeks for pilot batching and T0 testing, 8 weeks of accelerated stability at 40°C/75% RH, and parallel dossier preparation. ISO 24444 in-vivo SPF testing takes 4–6 weeks from sample submission. NMPA notification and EU CPNP notification can run concurrently with stability, but both require complete documentation packages. Compressing this timeline by skipping stability is the fastest path to a compliance failure at the market authority level.

If your target is US OTC only, the timeline shortens — but the GMP and facility requirements tighten considerably.

Frequently Asked Questions #

We’re launching in the EU first, then China. Can we use the same formula?
A: Often yes, but only if the filter system intersects both the EU Annex VI list and the NMPA approved list. We run that audit on day one. The bigger issue is that China will require NMPA-specific efficacy tests — your ISO 24444 data doesn’t automatically substitute, and a China-recognized lab may need to re-run SPF testing, which adds 6–8 weeks and a separate budget line.

Our supplier says their ZnO is “non-nano” — do we still need the EU nano notification?
A: That declaration needs to be backed by a laser-diffraction PSD report showing D90 above 100nm, not just a letter from the supplier. Per EU Cosmetics Regulation 1223/2009 Article 16, the notification obligation is triggered by particle size, not by the supplier’s classification. We’ve had lots where the D90 was borderline — 95nm versus 105nm across two incoming shipments from the same supplier. When that happens, we treat it as nano until we have three consecutive conforming lots. One supplier letter is not enough.

We’ve heard octocrylene is being restricted — should we avoid it?
A: For adult SPF products targeting mainstream EU markets, the current SCCS Scientific Opinion hasn’t yet produced an EU-wide restriction. But France’s national restriction on leave-on products for children under 15 is real, and if your brief includes a children’s SPF or France is a priority market, we’d steer away from it now rather than reformat in 18 months. For adult products sold outside France, it remains permitted at up to 10% under Annex VI — but we flag it at every kickoff and let the brand decide.

What’s a realistic MOQ and timeline for a fully compliant multi-market SPF?
A: MOQ on our sunscreen lines starts at 500kg per batch, which typically equates to 10,000–25,000 units depending on format and fill weight. For a fully compliant multi-market launch — EU CPNP notification, NMPA submission, and FDA OTC documentation — the realistic end-to-end timeline from confirmed formula brief to first compliant batch is 6–9 months. That includes stability, in-vivo SPF testing, safety assessment, and regulatory submission. Brands who plan for 3 months are the ones who miss their launch windows.

What documentation do we actually own at the end of this process?
A: This is a question more brands should ask upfront. You own the PIF, the CPSR, the ISO 24444 test reports, the NMPA dossier, and all raw material safety data we compile. The formula itself — depending on your agreement structure — may be proprietary to you or remain in our standard base. Make sure your manufacturing agreement specifies formula ownership and data transfer rights before submission begins, not after. We’ve seen brands reach market and discover their Responsible Person holds the PIF on their behalf but the brand has no independent copy. That creates leverage you don’t want a third party to have.

---

Have a product concept in mind? Contact our formulation team to request a complimentary brief review.