Cosmetic Standards & Regulations Explained for Body Care

Key Technical Parameters #

Body care sits at an awkward intersection in global cosmetics regulation: products that look identical on shelf can be classified as cosmetics in one market and quasi-drugs or OTC drugs in another, purely because of an on-pack claim. That classification gap is where most compliance failures happen, and it’s where product developers lose months of timeline. The formulations most affected are those with actives — urea at 10%+, salicylic acid, niacinamide at therapeutic concentrations — where the claim you want to make triggers a regulatory pathway your development schedule wasn’t built for. At Mastracare, the first question we ask on any multi-market body care brief is: what’s the primary claim, and does that claim survive market-by-market translation?

The Parameter That Determines Everything: Cosmetic vs. Drug Classification by Claim #

Before we talk about test methods or INCI names, the classification question has to be resolved. Every other compliance decision flows from it.

In the EU, classification is claim-driven and governed by EU Cosmetics Regulation 1223/2009. A body lotion that “moisturises and softens skin” is a cosmetic. The same lotion marketed to “treat dry skin disease” is a medicinal product and leaves the cosmetics pathway entirely. The boundary sounds clean. In practice it isn’t, particularly for urea — a functionally excellent moisturiser that EU dermatology brands want to claim therapeutically but cosmetics brands can only claim aesthetically. We’ve had brand partners arrive with packaging copy drafted for the German pharmacy channel that had to be completely rewritten before we could even begin stability testing, because the claims language would have reclassified the product.

In the US, the FDA runs a parallel system but with a specific mechanism: the FDA Cosmetics Guidelines and OTC monograph framework. Body care actives with OTC monograph coverage — principally salicylic acid (0.5–2% for acne), zinc pyrithione (0.3–2% for seborrhoeic conditions on body skin), and colloidal oatmeal (officially recognised as a skin protectant at 1–30%) — can be marketed with drug claims if the formulation and labelling comply with the relevant monograph. Outside monograph coverage, you’re either filing a New Drug Application or you’re staying in cosmetic claim territory. Most brands don’t want to file an NDA. So the formulation brief gets rewritten to match what the cosmetics pathway allows.

China’s framework through NMPA Cosmetic Regulation divides products into ordinary cosmetics and special-use cosmetics. Body whitening products, sunscreens, and anti-hair loss treatments fall into the special-use category and require a full registration dossier including safety assessment, efficacy substantiation, and stability data to a standard that adds 6–12 months to market entry versus the ordinary cosmetics filing timeline. This catches brands off-guard regularly. A body lotion with 2% niacinamide positioned as a brightening product may need special-use registration in China even if it sails through EU notification via CPNP. Same formula, radically different paperwork.

Specification Parameters That Drive Compliance Testing Choices #

Once classification is settled, the testing obligation becomes clearer — but the specific methods and their mandatory versus voluntary status vary enormously by market. This is where the spec sheet you hand us has to be precise.

Preservative efficacy is mandatory in every serious market and the test method is broadly harmonised. ISO 11930 is the applicable standard, covering preservative efficacy testing with defined challenge organisms and acceptance criteria. The EU requires a PET result that meets Criterion A or, where justified, Criterion B — and for rinse-off body care, Criterion B is often acceptable. In China, the equivalent is GB/T 37625, which shares the ISO 11930 challenge methodology but uses slightly different acceptance thresholds for some organism categories. In practice, if you design to ISO 11930 Criterion A, you’ll pass both. What we flag to brand partners: the choice of preservative system affects outcome more than preservative concentration alone. We’ve seen formulations with phenoxyethanol at 1% fail PET at week 6 in body wash formats when the pH drifts above 7.0 during storage, because phenoxyethanol loses activity rapidly above neutral pH. The fix required either buffering the formula to pH 6.0–6.5 or switching to a co-preservative with broader pH tolerance. Neither solution was obvious from the raw material spec sheets.

Naturalness and natural-origin indexing using ISO 16128 is voluntary in every major market right now, but it’s not optional commercially. EU green marketing guidance increasingly references the standard as the expected methodology for substantiating natural claims, and several major EU retailers already require suppliers to provide ISO 16128 natural origin index above 0.95 for products in their “natural” ranges. The standard splits into two parts: Part 1 covers definitions, Part 2 covers calculation methods for the natural origin index and natural index. The calculation requires ingredient-level data — specifically the natural origin fraction per ingredient — which you can’t generate without complete formulation disclosure to a third-party certifier or a robust internal calculation system. We run the calculation internally for every brief that carries a natural positioning, and there’s always at least one ingredient in a typical emollient body lotion where the supplier-provided naturalness fraction is contested or unverified.

SPF testing under ISO 24444 applies when SPF is claimed on a body product. This is mandatory methodology in the EU and widely adopted in Asia. The US uses an FDA-specific in vivo SPF method that differs in a few procedural details — including the reference standard emulsion specification and the panel size requirement (minimum 10 subjects who pass the standardisation criteria). A product tested to ISO 24444 with SPF 30 results will not automatically satisfy FDA OTC monograph requirements for the same SPF claim without retesting to the FDA method. We’ve had to retest three separate sunscreen body lotion projects in the past 18 months because brand partners assumed ISO 24444 data would be universally accepted. It isn’t.

The table below summarises key testing standards across the three major regulatory markets for body care product categories, covering mandatory versus voluntary status:

Mandatory vs. voluntary status reflects general market requirements as of 2024. Specific product categories may have additional requirements depending on claims and classification.

INCI naming deserves its own note. The PCPC Guidelines govern INCI nomenclature for the US and EU markets, and the ingredient list on a body care label must use the PCPC-approved INCI names in the EU per Regulation 1223/2009 Annex VII. China requires Chinese INCI names approved through the CPCNPC database — the International Nomenclature Cosmetic Ingredient names approved in China don’t always map 1:1 to EU/US INCI names, particularly for certain botanical extracts where the Chinese approved name uses a different descriptor for the plant part or extraction method. This creates a labelling problem when you’re trying to run a single base formula across all three markets with minimal label variation. Our internal process — we call it the CL-03 ingredient harmonisation review — flags these discrepancies before artwork goes to print.

Supplier Qualification Through a Regulatory Lens #

This is an angle most specification guides ignore, but it’s where compliance failures actually originate.

When we qualify raw material suppliers for body care actives — particularly emollients, humectants, and functional actives like urea, lactic acid, and glycolic acid — we request documentation that maps directly to the regulatory pathway the finished product will travel. For EU-destined formulations, this means supplier-provided REACH registration numbers for materials above 1 tonne/year import threshold, SDS compliant with Regulation (EC) 1907/2006, and, where relevant, safety data supporting inclusion in the finished product PIF. A supplier who can’t provide a REACH registration number for a volume material in 2024 is a supplier we don’t proceed with, regardless of price.

For China, the supplier documentation burden is different but equally specific. Post-2021 NMPA regulations require that each ingredient in a registered formulation appear in the NMPA’s approved ingredient catalogue (IECIC) or has a separate approval. Novel ingredients — anything not on the IECIC list — require a separate application that can take 12+ months. When brand partners brief us on new botanical actives or novel peptides for a China launch, we check IECIC status before committing to the formulation direction. We’ve had projects where the hero ingredient chosen by the brand had no IECIC listing and the brand had not factored in the approval timeline. That’s usually a difficult conversation.

Ask your potential manufacturing partner for their incoming QC protocol for actives. Specifically, ask: what test do you run to verify concentration of key actives at goods receipt, and what’s your rejection threshold? The response tells you whether they’re doing paper-based supplier certification or actual analytical testing. For urea, we verify by HPLC against an in-house reference method; our acceptance tolerance is ±3% of stated concentration. For lactic acid, we titrate to verify free acid concentration and check pH of a 1% aqueous solution as a quick purity indicator. A manufacturing partner who can’t describe their incoming test methodology is one whose finished product concentration data you can’t fully rely on.

Technical Deep-Dive: Urea in Body Care Across Markets #

Urea is worth its own section because no other body care active illustrates the regulatory complexity more clearly, and we work with it constantly.

At concentrations of 3–5%, urea functions as a humectant through water-binding mechanisms in the stratum corneum. At 10%, keratolytic effects become measurable — and this is where the regulatory story starts to diverge. In Germany and Scandinavia, urea at 10% or higher in body lotions is commonly sold through pharmacy channels with claims referencing dry skin conditions including ichthyosis and xerosis. This is legally possible because Germany’s borderline cosmetic/medical product framework permits certain quasi-drug positions that don’t exist in the UK post-Brexit or in France where the Agence nationale de sécurité du médicament maintains a more rigid cosmetic/drug boundary. Same EU regulation, different national enforcement interpretation.

In the US, urea has no OTC monograph coverage for skin use in body care. A body lotion with 10% urea can be sold as a cosmetic with claims like “softens rough, dry skin” and “improves skin texture.” The moment you add a claim like “treats ichthyosis” or “exfoliates thickened skin,” you’re making drug claims without monograph coverage — and the FDA’s enforcement posture on this has tightened since 2020. In practice, the brands that successfully sell urea body lotions in the US at 10–20% concentrations keep claims strictly aesthetic. We almost always push back on briefs that include any disease-state language for the US market.

The efficacy data for urea is actually solid. A randomised controlled trial (n=120, 12 weeks, split-body design) published in a peer-reviewed dermatology journal compared 10% urea lotion to vehicle control in patients with moderate xerosis. The 10% urea group showed a 42% improvement in TEWL (transepidermal water loss) versus 18% for vehicle at 12 weeks, and a 38% reduction in skin roughness score by profilometry. The study used twice-daily application to forearms and lower legs — a realistic body care usage pattern — which makes the efficacy signal more applicable to OEM product development than most lab-scale data.

From a formulation stability perspective, urea is more problematic than suppliers acknowledge. At concentrations above 8% in emulsion systems, urea can hydrolyse to ammonia and carbon dioxide at elevated temperatures, causing pH drift and odour issues. Our internal stability protocol flags any urea-containing formula above 8% for a 12-week accelerated stability run at 40°C/75% RH before we commit to a production formula. We’ve observed pH increases of 0.4–0.8 units in urea emulsions during accelerated storage when the buffering capacity of the formula is insufficient. That pH drift affects not just sensory performance but also preservative efficacy — another reason to run PET concurrent with stability, not sequentially.

In China, urea-containing body care is classed as ordinary cosmetics when positioned for general moisturisation, regardless of concentration. This creates an interesting asymmetry: a 20% urea body lotion can be notified as an ordinary cosmetic in China while the same product in Germany may sit in pharmacy territory depending on the claim. Brand partners developing for both markets simultaneously need to maintain claim separation between market versions — not just label translation, but genuinely different on-pack positioning.

One area we’re still tracking and don’t have a clean answer on: the appropriate upper concentration limit for urea in a body care cosmetic context in the EU. The SCCS has not issued a specific opinion limiting urea in leave-on body products; the SCCS Scientific Opinion database covers many ingredients but urea’s safety profile under cosmetics regulation hasn’t been formally revisited since the early 2000s opinions. Until there’s a formal opinion at the EU level, the concentration you can use in a cosmetic is essentially bounded by what the safety assessor in the PIF will support. Different assessors take different positions. We’ve seen EU safety assessors approve 20% urea in body lotion leave-on formats; we’ve also seen assessors flag 15% for additional justification. This isn’t fully resolved.

Formulation Notes for Brand Partners #

When you brief us on a body care product with multi-market ambitions, the first things we need to know are: what are the three markets at launch, what is the primary efficacy claim, and what does “natural” mean to your consumer? Those three inputs change almost everything downstream.

The brief mistake we encounter most often is a concentration specification that’s been set based on competitor benchmarking without reference to the regulatory pathway. We receive briefs asking for “10% urea, same as Brand X” without clarity on whether the brand is entering the EU pharmacy channel, the US mass market, or both. The concentration may be identical, but the claim framework, testing package, and labelling architecture are completely different. Our approach is to run the claim-classification check before we confirm the concentration in the brief — because the right concentration for a cosmetics-positioned product in the US may be different from what the brand needs for a pharmacy-positioned product in Germany.

For a standard body care active formula: lab samples in 2–3 weeks, accelerated stability at 40°C/75% RH run for 4–8 weeks, with 24-month real-time stability initiated concurrently at 25°C/60% RH. For any product requiring China NMPA registration, add 6–12 months for the regulatory dossier preparation and submission phase. Preservative efficacy testing to ISO 11930 adds approximately 28 days on the standard protocol. Plan for it, not around it.

Frequently Asked Questions #

We want to launch a 10% AHA body lotion in the EU and US simultaneously — is that one formulation or two?
A: Almost certainly two. In the EU, a body lotion with alpha-hydroxy acids above 6% triggers EU Cosmetics Regulation 1223/2009 requirements for pH above 3.5 and a consumer warning about sun sensitivity — those warning statements must appear on-pack. In the US, the FDA’s informal guidance on AHA concentrations in leave-on products is less prescriptive, but the claim “exfoliates” is routinely used without triggering drug classification. The pH and warning label requirements differ enough that most brands separate the EU and US SKUs, even if the base formula is the same.

Our supplier gave us ISO 24444 SPF 30 data — does that cover us for the US market?
A: For the EU, yes. For a US OTC sunscreen claim, no. The FDA OTC sunscreen monograph requires SPF testing per the FDA’s own in vivo method, which has specific differences from ISO 24444 in panel selection criteria and reference emulsion specification. You’ll need a separate US test. This is one of the most common retesting situations we encounter, and it adds 8–12 weeks and meaningful cost to the US market timeline.

What’s the watch-out with preservative systems in body wash formats specifically?
A: pH management. Phenoxyethanol — still the most common primary preservative in body wash — loses meaningful antimicrobial activity above pH 7.0, and body wash formulas frequently drift toward alkaline pH during stability, particularly surfactant-heavy bases. We require PET testing at the end-of-shelf-life pH, not just the initial formulation pH. If those two pH values differ by more than 0.3 units in your accelerated stability data, we rerun the PET at the projected end-point pH before releasing the formula.

What’s the typical MOQ and timeline for a body lotion requiring China NMPA ordinary cosmetics notification?
A: MOQ on body lotion formats at our facility starts at 500 kg per batch for standard emulsion formats. Timeline: formulation completion and stability initiation in weeks 1–3, accelerated stability readout at week 12, NMPA ordinary cosmetics notification (post-2021 online filing system) submission targeting month 4–5, with a typical NMPA response time of 4–6 months for ordinary cosmetics. Total from brief to China-registered product: plan for 12–15 months with a clean brief and no reformulation rounds.

Should we bother with ISO 16128 natural index calculation if we’re not marketing as “natural”?
A: It depends on your retail channel, not just your brand positioning. Several EU mass-market and pharmacy retailers now require ISO 16128 natural origin index data as part of supplier onboarding — independently of whether the product carries a natural claim on pack. If you’re targeting those retail partners, you’ll need the calculation regardless of your marketing language. For direct-to-consumer or specialty brands without those retail constraints, voluntary. We run the ISO 16128 calculation as standard on every brief now because the data costs little to generate and retailers increasingly ask for it during ranging reviews.

---

Have a product concept in mind? Contact our formulation team to request a complimentary brief review.