Cosmetic Standards & Regulations Explained for Acid Exfoliation Technology

Key Technical Parameters #

Concentration limits get most of the attention when brands talk about acid exfoliation compliance. That’s understandable — but it’s also where projects stall, because the concentration question is only one layer of a much more complex qualification picture. The real friction we see in multi-market development isn’t “can we use 10% glycolic” — it’s what test methods you need to generate, which agency treats your product as a cosmetic versus a drug, and whether your INCI declaration will pass a Chinese customs review. This article addresses the compliance infrastructure around acid exfoliation: the frameworks, the test method standards, the naming rules, and the places where a product that sails through EU notification hits a wall at the FDA or NMPA. Product developers managing simultaneous market launches will find this the most useful. The one technical insight worth flagging upfront: mandatory versus voluntary isn’t a static distinction — it shifts by market, by product format, and sometimes by the specific claim on your pack.

When the Same Product Needs Three Different Compliance Strategies #

Glycolic acid at 8%, pH 3.8, in a leave-on serum. Straightforward, right? In the EU, that’s a cosmetic. In the US, depending on how you position it, you might be edging toward OTC drug territory. In China, a leave-on product at that pH targeting “exfoliation” can trigger a special cosmetics registration pathway rather than general filing — with a timeline that adds 12 to 18 months and a cost that surprises brands who’ve only ever filed in the EU.

We flag this in every multi-market kickoff. The product doesn’t change. The regulatory category does.

Under EU Cosmetics Regulation 1223/2009, AHAs are regulated primarily through concentration and pH thresholds codified in Annex III, with additional requirements for sun protection labeling when free acid concentration exceeds 10% or formulated pH falls below 3.5. The label must carry a specific advisory warning — “Contains AHA. May increase skin’s sensitivity to sun. Use sunscreen.” That’s mandatory. No exception for “gentle” formulations. Brands building EU-first SKUs often discover this at packaging sign-off, not at brief stage, which is a costly time to find out.

The US picture is different in structure. The FDA Cosmetics Guidelines don’t set an explicit AHA concentration cap for cosmetics the way the EU does. What the FDA cares about more — at least in enforcement practice — is the claim. Call it a “chemical peel” with before-and-after photos showing skin shedding, and you’re describing a drug effect. Call it “smoothing” or “resurfacing,” and you’re likely in cosmetic territory. This is a claims management problem, not a chemistry problem. We almost always push back on brief language when we see “removes dead skin layers” or “accelerates cell turnover” — both of those phrases have triggered FDA warning letters for brands that used them on cosmetic-registered products.

China’s framework under the NMPA Cosmetic Regulation operates on a two-tier system: general cosmetics and special-use cosmetics. Since the 2021 Cosmetic Supervision and Administration Regulation (CSAR) overhaul, the special-use category now includes products claiming “exfoliation” as a primary function, depending on acid type and concentration. Our internal intake form — we call it the M-REG-04 multi-market pre-check — specifically captures the intended on-pack claim before we finalize the concentration, because the claim can change the filing pathway more than the concentration itself.

The Test Method Layer — What’s Mandatory, What’s Market Expectation, and What’s Optional #

This is the section that product developers in multi-market roles find most useful and most confusing. Here’s how we break it down in practice.

Preservative Efficacy (ISO 11930)

ISO 11930 is the current standard for preservative efficacy testing in cosmetics — and it replaced the old PET (preservative efficacy test) as the European reference method. For acid exfoliation formulations specifically, pH is already doing some preservative work. We regularly see products at pH 3.2 to 3.8 pass ISO 11930 criteria A with minimal preservative loading. The complication is that the same test at pH 4.5 — where you might reformulate to reduce irritation or meet a “gentle” positioning — often drops to criteria B, which is acceptable under EU guidelines but may require additional narrative in your Product Information File (PIF).

What brands sometimes miss: ISO 11930 criteria B is not a failure. It’s acceptable for most cosmetic categories. But if you’re also targeting the US market and want to voluntarily follow PCPC Guidelines for preservative adequacy, you need to confirm which challenge organisms were tested and at what inoculum. We’ve had batches where the EU submission passed on criteria B, the PCPC review flagged a gap in the yeast/mold window, and the brand had to retest at additional cost before US retail launch.

SPF and UV Method Alignment

If you’re adding SPF to an acid formulation — which we see more often now, given the EU’s mandatory sun protection advisory for high-AHA products — ISO 24444 is the in vivo SPF testing standard referenced across most major markets. The EU recognizes it. Japan accepts it. For the US, SPF testing must follow the FDA OTC sunscreen monograph protocol, which is not ISO 24444. These are different test methods with different measurement endpoints. A product tested under ISO 24444 to SPF 15 cannot simply use that data for a US SPF label claim. You need a separate FDA-method test. We’ve seen brands budget for one SPF test and discover they need two. For multi-market SPF acid products, budget for both from the start.

Natural Index and ISO 16128

ISO 16128 — the natural and organic ingredient index — is voluntary almost everywhere. But it has become a market expectation in certain retail channels, particularly European clean beauty retail and some US specialty stores. For acid exfoliation, most AHAs score well on the natural index when sourced from fermentation or fruit extraction pathways. Synthetic glycolic acid (the most common manufacturing route) scores differently depending on the calculation methodology your certifying body uses. This matters when a brand wants to make “X% natural origin” claims. We don’t have a clean answer on this — calculation approaches vary between ISO 16128 interpreters, and we’ve seen the same ingredient get different index scores from different auditors.

The Comparison Matrix — Test Methods by Market

The China stability requirement is where we see the most project delays. Three months of accelerated stability at 40°C/75% RH is non-negotiable before NMPA general filing. We initiate that testing at pilot scale, concurrently with formula finalization, specifically to avoid a 12-week wait at the end of the project.

INCI Naming, Claims Translation, and the Compliance Gaps That Appear at Customs #

INCI nomenclature sounds administrative. It becomes a hard compliance issue fast when a product hits customs review in a new market.

Under EU Cosmetics Regulation 1223/2009, ingredient labeling must follow INCI names as defined in the current PCPC/CTFA dictionary. For acid exfoliation actives, this is generally unambiguous — glycolic acid is glycolic acid, lactic acid is lactic acid. The friction comes with newer acids, plant-derived complexes, and fermentation-derived materials where the INCI name isn’t universally established. Phytic acid, for instance, is listed under INCI as “Phytic Acid” — but some suppliers provide it under trade names or botanical descriptors, which cannot appear on the EU label in place of INCI.

China’s NMPA filing requires that every ingredient listed in the formulation must match the INCI name exactly as it appears in the Chinese INCI catalog (the CIRS-managed list). We log this under our internal M-ING-02 ingredient pre-screen before any formulation work begins for China-bound products. An ingredient that isn’t on the NMPA-recognized list requires a separate safety dossier. For acid exfoliation products, this most frequently affects novel PHA compounds and certain botanical acid sources. Mandelic acid, for example — a useful acid for sensitive skin and darker skin tones — has a specific entry, but the filing pathway for leave-on mandelic at concentrations above 3% has been inconsistently handled by different NMPA reviewers, and we’ve had two separate projects where the same concentration was approved and rejected in different filing cycles.

On claims: one area where we’ve seen the SCCS Scientific Opinion matter for acid exfoliation specifically is the SCCS opinion on glycolic acid safety (SCCS/1602/18), which supports leave-on use at up to 10% at pH ≥ 3.5 with the mandatory sun sensitivity warning. That opinion is what the EU Annex III entry is based on. What’s useful for product developers is that the SCCS opinion also includes data on systemic absorption and margin of safety calculations — which you can reference in your PIF safety assessment narrative. A 2019 open-label study (n=30, 8 weeks) using a 10% glycolic acid leave-on formulation at pH 3.5 demonstrated a 28% improvement in skin roughness scores (measured by profilometry) without significant erythema increase versus baseline — data consistent with the SCCS safety margins and useful as efficacy support in PIF documentation.

The area where opinions genuinely differ: what pH floor is “safe” for a leave-on product in markets without an explicit pH minimum. The EU sets 3.5 explicitly. The US doesn’t. Some brands target pH 3.0 to 3.2 for maximum free acid bioavailability, arguing the US doesn’t prohibit it. We’re cautious here. Our internal position is that pH below 3.5 in a leave-on triggers additional safety assessment work regardless of market — not because we’re required to, but because the irritation risk is real and a product causing consumer adverse events is a brand problem that no regulatory filing protects you from. That said, we’ve formulated at pH 3.2 when the brief required it. It’s a conversation, not a veto.

Formulation Notes for Brand Partners #

When you brief us on an acid exfoliation product for multi-market launch, the first questions we ask are: What markets are confirmed day-one versus planned for year two? What’s the on-pack efficacy claim — and has your marketing team approved the language? What format — leave-on or rinse-off?

The most common brief mistake we see is treating regulatory compliance as something to resolve after formulation is finalized. A brand will lock a 10% glycolic acid serum at pH 3.4 for the US market, then brief us six months later on adding the EU to the distribution plan. At that point, reformulating to pH 3.5 to meet EU Annex III — while maintaining the same consumer sensory profile — requires re-running stability and PET. That’s eight to twelve weeks of timeline you didn’t plan for.

The reformulation isn’t hard. The timeline surprise is the problem.

For a standard multi-market acid exfoliation product, our process runs as follows: lab samples in 2 to 3 weeks from brief confirmation, accelerated stability at 40°C/75% RH initiated at pilot stage (4 to 8 weeks for preliminary data), 24-month real-time stability initiated concurrently. For China NMPA general filing, factor 3 months of accelerated data as a hard gate. Tell us your target markets at brief stage, not post-formula lock.

Frequently Asked Questions #

Our EU formula is at pH 3.4 — does that mean we can’t sell it in Europe?

A: Not automatically, but you’re in a grey zone. The EU Annex III entry for AHAs requires pH ≥ 3.5 for leave-on products at concentrations above certain thresholds. At pH 3.4, you’d need a strong safety justification in your PIF, and most responsible persons will ask you to adjust. A 0.1 pH unit change sounds trivial — in practice it costs you a stability re-run, which adds 6 to 8 weeks.

The FDA doesn’t have an AHA concentration limit — so we can go as high as we want in the US, right?

A: The FDA doesn’t cap concentration, but it absolutely regulates the claim. At high concentrations — say above 20% in a leave-on — you’re in cosmetic-drug boundary territory if your claim describes skin restructuring or epidermal modification. The risk isn’t a concentration limit. It’s an enforcement action based on labeling language. We’d want to review your intended claims before signing off on any leave-on above 15%.

What happens if our glycolic acid serum fails preservative efficacy at the target pH?

A: We see this occasionally when brands push pH up toward 4.5 for gentleness positioning, which reduces the self-preserving effect of the acid. At that pH range, passing ISO 11930 criteria A becomes harder without adding a chelating agent or boosting preservative concentration. One project in our lab needed three rounds of reformulation before passing criteria A at pH 4.3 — we ultimately used a combination of ethylhexylglycerin at 0.5% plus disodium EDTA at 0.1% to close the gap. Criteria B is acceptable under current EU guidelines, but confirm this with your responsible person before filing.

How long does China NMPA general filing actually take for an acid serum?

A: For a general cosmetic filing (non-special-use), the technical review typically runs 3 to 6 months from submission, assuming no deficiency letters. Before you can submit, you need completed 3-month accelerated stability data and a compliant safety assessment. Realistically, from formula lock to filing-ready is 5 months minimum. Plan for 9 to 12 months total from brief to market for a China launch — and that’s when everything goes smoothly.

Should we list the free acid concentration or the total ingredient weight on the label?

A: This depends on market and it matters more than most product developers expect. In the EU, INCI labeling shows ingredient name with no percentage required (except fragrance allergens above 0.001%). In China, the NMPA filing requires exact concentrations in your technical dossier — but the consumer label shows INCI names in descending order, not percentages. For US labels, concentration isn’t required on the face of the label either. Where it gets complicated is when you make a “X% AHA” front-of-pack claim — that concentration must match the technical dossier, and your stability data must demonstrate it holds at that level through shelf life. We’ve seen products claim “5% glycolic” on pack that tested at 4.2% at the end of stability. That’s a labeling compliance issue in every market.

---

Have a product concept in mind? Contact our formulation team to request a complimentary brief review.