Acid Exfoliation Technology — Regulatory & Compliance Guide

Key Technical Parameters #

Getting an acid exfoliant to market isn’t just a formulation problem — it’s a documentation problem. The pH is easy. The dossier is where projects stall. Brands building acid exfoliation technology SKUs across multiple geographies face a patchwork of concentration caps, pH floor requirements, mandatory safety assessments, and labeling obligations that don’t align neatly between the EU, US, and China. The technical insight that shapes how we approach every multi-market brief: the same glycolic acid serum at 8% can clear pre-market notification in China, sail through the US without any filing, and require a SCCS-aligned safety assessment in the EU — all three with different labeling text. Understanding the documentation burden by market, before formula lock, saves months.

Market Qualification Burden: What Filing Each Region Actually Requires #

The concentration limits for AHAs, BHAs, and azelaic acid across major markets are reasonably well-documented. What gets missed is the qualification burden attached to each — the safety testing stack, the labeling trigger points, and the documentation format regulators actually want to see.

Below is how we map this internally before a multi-region brief goes to formulation. We use a simplified version of this as part of our MF-REG-04 market readiness checklist, which runs in parallel with the stability protocol.

The China NMPA column is the one that surprises brands most. A 7% glycolic acid leave-on serum that positions itself around “exfoliation and renewal” will almost certainly be classified as a special cosmetic under NMPA Cosmetic Regulation, triggering the full registration pathway — translated dossier, human safety test conducted in a NMPA-recognized facility, and a registration timeline that can run six months on the optimistic end. We’ve had projects where the formulation was finalized at month two and the China registration didn’t close until month eleven.

The EU situation is more nuanced than brands expect. There is no pre-market approval, but the Responsible Person must hold a complete Product Information File before the product goes on sale, and the safety assessment must be conducted by a qualified assessor — often a toxicologist or pharmacist with appropriate credentials. The SCCS Scientific Opinion on AHAs from 2018 is the reference document assessors lean on. Below pH 3.5, you’re in a difficult position: most assessors will ask for additional substantiation, and some will decline to sign off without it. We’ve seen projects renegotiate their pH target from 3.2 to 3.5 at the safety assessment stage — after stability was complete. That’s a painful timeline reset.

Where Compliance Projects Actually Break Down #

This is the section nobody writes a checklist for, because the failures are situational. But across the briefs we’ve run, the breakpoints cluster in three areas.

The claims-concentration mismatch. A brand wants to call their salicylic acid product a “blemish treatment” or “acne control.” The moment that language appears on pack in the US, the product may fall under OTC drug monograph rules — specifically the acne monograph, which specifies 0.5–2% salicylic acid, pH 3.0–4.0, and a specific label format. The formulation may be identical to a cosmetic, but the claim triggers a completely different regulatory category. We flag this in every kickoff call when BHA is involved, because a lot of brand briefs arrive with both a 2% salicylic acid concentration and drug-adjacent copy written by a marketing team that hasn’t spoken to regulatory. The FDA Cosmetics Guidelines page lays out the boundary between cosmetics and OTC drugs — it’s worth reading before the brief is finalized.

Stability and the pH creep problem. We’ve observed, across multiple mandelic and lactic acid batches, that pH drift in HDPE packaging can push a formula from 3.8 at fill to below 3.5 by week 12 at 40°C. That’s a regulatory problem, not just a sensory one — because your safety assessment was conducted at the original pH. The qualified assessor’s sign-off is technically voided if the final product pH has shifted outside the assessed range. Brands rarely factor this into their documentation timeline. Our approach is to build a ±0.2 pH buffer into the target range and conduct a short packaging compatibility screen at T0, T4, and T8 weeks before the safety file is submitted. It adds two to three weeks, but it prevents re-submission.

The INCI declaration trap. Lactic acid and lactobionic acid are not the same INCI entry. Glycolic acid and ammonium glycolate are not the same entry, and in some regulatory contexts they carry different concentration accounting rules. We’ve corrected INCI declarations on incoming briefs in roughly a third of our acid projects — often because the brand’s marketing team sourced the ingredient name from the consumer-facing side of the supplier’s website rather than from the technical data sheet. This is logged under what we call a Category 2 brief error in our intake review process, and it’s fixable, but it adds a round of revision to the documentation.

One situation we’ve navigated carefully: a 2020 pilot batch of an AHA/PHA blend targeting both the EU and China markets. The formula sat at 5% glycolic acid plus 3% gluconolactone, pH 3.6. EU: manageable with a qualified assessor. China: the combined acid load placed it in special cosmetic territory even though neither individual concentration breached the general cosmetic limit. The NMPA reviewer’s position was that the total exfoliant burden was the relevant number. We don’t have a clean resolution here — the brand ultimately launched the EU SKU first and reformulated the China version to 4% glycolic, pH 3.8. Whether the NMPA’s combined-load interpretation is consistent or case-by-case, we’re honestly still not sure.

Does the Clinical Evidence Requirement Actually Apply to You? #

Short answer: not always, but closer to “yes” than most brands assume.

For EU, the safety assessment does not require a clinical study — but it does require adequate substantiation of safety for the intended use. If your AHA formula is at or near the concentration limits, a qualified assessor may ask for consumer use data or a well-controlled challenge test to support the assessment. A 2019 controlled usage study (n=60, 8 weeks, leave-on glycolic acid 8% at pH 3.5) demonstrated a mean erythema index reduction of 12% versus baseline, with no serious adverse events — the kind of data that meaningfully strengthens a safety file. Without something like that, assessors working near the upper concentration range tend to hedge their sign-off with caveats that some retailers won’t accept.

For China’s special cosmetic pathway, human safety testing is not optional — it’s a regulatory requirement, conducted at an NMPA-accredited testing facility. Patch testing, repeat insult patch testing (RIPT), and sometimes a safety use test with a fixed panel are all part of the standard package. The NMPA Cosmetic Regulation testing requirements are defined in the Cosmetic Safety Technical Standards. Planning for this testing adds roughly 8–12 weeks to the China timeline, on top of the dossier preparation and submission period.

For acid exfoliation technology products targeting sensitive-skin positioning, a dermatologist-tested or ophthalmologist-tested claim adds another layer of testing documentation. These claims aren’t regulated the same way in every market, but retailers — particularly EU pharmacy chains — often have their own substantiation requirements that go beyond what the regulations mandate. We’ve had projects where the regulatory file was complete but the retail account asked for additional dermatologist test data before listing.

Formulation Notes for Brand Partners #

When you brief us on an acid exfoliant, the first question is always: which markets, and what’s on the label? Those two things determine the entire documentation architecture before we finalize the formula.

If you’re targeting the EU plus China simultaneously, expect the China timeline to drive the overall launch schedule. There’s no shortcut to the special cosmetic registration pathway if your concentration and claims land you there. Brief us early on the regulatory intent — we can sometimes adjust the formulation to stay within general cosmetic thresholds without compromising the consumer experience, but only if we have that conversation before stability is locked.

The brief mistake we see most often: brands submit a target formula with marketing copy included, and the copy has already been approved internally. Then we have to tell them the claim triggers a different regulatory category. Decoupling the claims review from the formulation brief costs nothing and can save a full re-formulation cycle. We recommend running a claims screen in parallel with the initial formulation discussion.

Timeline: lab samples in 2–3 weeks, accelerated stability over 4–8 weeks, 24-month real-time stability initiated concurrently. For EU, factor 4–6 additional weeks for the safety assessment process. For China special cosmetic, budget 6–9 months for registration from dossier submission, and plan your human safety testing window accordingly.

Frequently Asked Questions #

We want to launch our AHA serum in both the EU and China — can we use the same formula?

A: Technically possible, but the documentation pathways are completely different. An 8% glycolic acid leave-on at pH 3.5 clears the EU concentration limit, but in China it triggers special cosmetic registration — which means NMPA-accredited human safety testing, a translated dossier, and a registration window of six to nine months. The formula may be identical; the filing burden is not. We’ve run dual-region projects where the EU SKU launched twelve months before China simply because of registration timing.

At what pH does an AHA formula create EU regulatory problems?

A: Drop below pH 3.5 and the qualified assessor responsible for the EU safety assessment will likely ask for additional substantiation, and some will ask you to reformulate before they sign off. Per EU Cosmetics Regulation 1223/2009 and the associated SCCS opinion, pH 3.5 is the accepted lower floor for consumer-use AHAs. Below that, you’re not automatically blocked — but you’re adding months and cost to the safety file.

Our salicylic acid is at 1.5% — do we need to worry about OTC drug rules in the US?

A: The concentration is fine for cosmetic use. The risk is in the claims. If your copy includes language like “fights acne,” “clears blemishes,” or anything that implies drug action, the product may fall under the OTC acne monograph regardless of the BHA percentage. We flag this in every acid project brief. Have someone review the FDA Cosmetics Guidelines boundary between cosmetics and OTC drugs before the label copy is finalized — not after.

What’s a realistic MOQ and timeline for a multi-market acid serum project?

A: MOQ starts at 1,000 units per SKU for most leave-on acid formats. If China registration is in scope, the product development timeline runs 10–14 months end-to-end for a first-to-market SKU. EU-only projects are shorter — typically 5–7 months including safety assessment. We initialize 24-month real-time stability at the same time as accelerated stability, so registration-supporting data is building in parallel with formulation refinement.

What documentation do most brands have wrong when they brief us?

A: The INCI declaration. Specifically, using the consumer-facing ingredient name from a supplier’s marketing sheet rather than the correct INCI entry from the technical data sheet. Ammonium glycolate and glycolic acid are not interchangeable in a regulatory dossier. We catch this in our intake review under what we call the Category 2 brief error screen, but if it gets further into the process it creates real re-work. Pull your INCI entries from the PCPC Guidelines ingredient database or the supplier’s certificate of analysis, not the product page.

---

Have a product concept in mind? Contact our formulation team to request a complimentary brief review.