EU Annex V Preservatives: The 2026 Compliance Guide for Cosmetic Brands and Contract Manufacturers

A €18,000 Rotterdam seizure, one secondary preservative over limit

In Q2 2026 a mid-sized cosmetic brand placing an eau de parfum body lotion on the Dutch market received a Safety Gate notification 72 hours after a routine port inspection in Rotterdam. The notified cause was not the brand’s primary preservative. Phenoxyethanol was present at 0.85%, well under the Annex V entry 29 cap of 1.0%. The violation sat with a secondary acidic preservative: Sorbic Acid at 0.84%, calculated as free acid, versus the Annex V entry 4 cap of 0.6%.

The product was pulled from distribution across the EU within 48 hours. The brand’s compliance team reconstructed the error: the formulator had specified Potassium Sorbate at 1.0% to buffer the low-pH formula, confident that the salt form was outside Annex V scope. It is not. Annex V entry 4 covers "Sorbic Acid and its salts" and the cap is expressed as the free acid. The 1.0% potassium salt converts to approximately 0.84% free acid — above the 0.6% cap.

Direct costs: €18,000 in product recall logistics, retest costs, and relabelling. Indirect costs: four weeks of lost distribution, a Safety Gate record visible to every national competent authority in the EEA, and a demand from two retail partners for a signed compliance improvement plan. The reformulation itself took eleven working days.

This article is the compliance manager’s playbook that would have caught this at CPSR review — covering what Annex V actually governs, the five systematic traps, the non-Annex V multifunctional landscape, the CPSR evidence requirements, the supplier dossier audit, CPNP notification fields, Safety Gate enforcement patterns, and the change-management SOP that keeps subsequent batches defensible.

What Annex V actually governs (and what it does not)

Annex V of Regulation (EC) No 1223/2009 is a positive list of 59 entries covering substances that may be present in finished cosmetic products placed on the EU market when used for preservation. The qualifier matters. Annex V governs the primary function of preservation. Annex II (forbidden substances) and Annex III (restricted substances allowed only under conditions) interact with Annex V and must be read alongside.

Three practical consequences follow from the "when used for preservation" scope:

• A substance not on Annex V may still be used in a cosmetic product if its declared function is something other than preservation. The CPSR must substantiate the alternative function and no marketing claim may describe the substance as the product’s preservative.
• A substance on Annex V used at a concentration below its cap is legal if used as a preservative. Used above the cap, the product is non-compliant and triggers withdrawal regardless of marketing framing.
• "Self-preserving" or "preservative-free" claims attract scrutiny. The 2017 Commission Technical Document on cosmetic claims requires any such claim to be truthful, non-misleading, and substantiated — a formula containing an Annex V-listed substance cannot carry a "preservative-free" claim even if that substance is present for another declared purpose.

The regulatory philosophy differs meaningfully from the US MoCRA (which requires facility registration and adverse event reporting but imposes no preservative-specific positive list) and from China’s IECIC 2021 (which is a broader cosmetic ingredient inventory, not a function-specific positive list). An EU-compliant preservation system is not automatically compliant in those markets; a China-compliant system is not automatically compliant in the EU. Multi-market SKUs require a per-market Annex V analogue.

The full 59-entry Annex V decoder

Annex V entries do not read uniformly. Some caps are a single percentage; others split by rinse-off versus leave-on; others impose product-type exclusions (not under 3, not oral, not eye-area, not spray). The decoder below indexes the entries by function group, product-type restriction, and search string so a formulator or compliance reviewer can locate the exact cap and restriction without parsing the raw annex text.

Five traps when reading entry limits

Audits over the 2023-2026 period show the same five misreadings of Annex V entry limits recurring across unrelated brands. Each one is traceable to a specific wording in the annex that reads differently to a formulator than to a regulator.

Trap 1 — "Preservation function only" scope qualifier

Several Annex V entries are framed as applicable "when used as preservative." Reading this as a loophole — "we declare it as a conditioning agent, so Annex V does not apply" — is defensible only if the CPSR Part A substantiates the alternative function with analytical and formulation evidence. The default assumption of a competent authority is that an Annex V-listed substance in a cosmetic formula is there for preservation unless proven otherwise.

Trap 2 — Sum-of-parabens combined cap (entry 12)

Entry 12 caps a single paraben ester at 0.4% as acid, and mixtures of parabens at 0.8% as acid. The salt forms (sodium methylparaben, etc.) must be converted to the free acid equivalent before summing. A formula with 0.3% Methylparaben + 0.3% Ethylparaben + 0.2% Sodium Propylparaben looks like 0.8% but, after acid conversion of the sodium salt, is slightly over 0.8%. Reviewers routinely flag this.

Trap 3 — Rinse-off versus leave-on splits

Several entries cap leave-on more strictly than rinse-off. Sorbic Acid (entry 4) is a flat 0.6% irrespective of use type, but Salicylic Acid (entry 3) splits at 0.5% leave-on versus 3.0% rinse-off hair. IPBC (entry 46) has at least three distinct caps across leave-on, rinse-off, and leave-on deodorant/antiperspirant. Specifying the product category correctly in the PIF is a prerequisite to defending the preservative concentration.

Trap 4 — Child-product exclusions

Products for children under 3 carry additional Annex V restrictions beyond the general entries. Propylparaben and Butylparaben are banned in leave-on products intended for the nappy area of children under 3 (entry 12 specific restriction). Salicylic Acid is restricted for children under 3 except in shampoo. IPBC is excluded from most product types for children under 3. A compliance review that reads only the general entry cap will miss the age-specific overlay.

Trap 5 — Acid/salt interconversion math

The Rotterdam opener case belongs here. Entries 1 (Benzoic Acid), 4 (Sorbic Acid), and others cap the sum of the free acid plus salts expressed as free acid. The molecular-weight conversion between the sodium or potassium salt and the free acid typically shifts the calculated concentration by 10-20%. A formulator working from the salt-form concentration in the formula will miscalculate the compliance headroom.

Non-Annex V multifunctionals: legal grey zone or clear status?

The rise of "phenoxyethanol-free" and "paraben-free" clean-beauty positioning has driven adoption of a set of antimicrobial-active substances that are not on Annex V. The four most common in 2026 formulation are 1,2-Hexanediol, Ethylhexylglycerin, Caprylhydroxamic Acid (CHA), and Caprylyl Glycol. All four are legal in EU-sold cosmetics. Their regulatory treatment is distinct from Annex V-listed preservatives.

• 1,2-Hexanediol — INCI "Hexylene Glycol" is a different substance; do not substitute. 1,2-Hexanediol is used as skin-conditioning / humectant at 0.5-3%. Covered in detail in our 1,2-Hexanediol technical guide.
• Ethylhexylglycerin (EHG) — skin-conditioning agent with meaningful antimicrobial boost at 0.3-1%. Legal status detailed in our EHG technical guide.
• Caprylhydroxamic Acid (CHA) — chelator with antimicrobial contribution via iron sequestration. Used at 0.1-0.5%, almost always as part of a hurdle system. See our CHA technical guide.
• Caprylyl Glycol — skin-conditioning / emollient with antimicrobial activity, typically at 0.3-1%. Common partner for CHA and EHG in multifunctional systems.

The CPNP notification treatment of these substances is important. They are declared in the formula at their actual concentration under their standard INCI name, with the function stated as skin-conditioning (or chelating, for CHA). The CPSR Part A must substantiate the stated function and the CPSR Part B must demonstrate — through Challenge Test under ISO 11930 — that the overall product is adequately preserved despite the absence of an Annex V-listed primary preservative. See our walkthrough in the ISO 11930 protocol guide.

Marketing language carries legal weight. "Preserved with EHG" is a misleading claim because EHG is not on Annex V and cannot be legally positioned as the preservative; "formulated without Annex V preservatives" is defensible, factually true, and audit-safe.

CPSR Part A and B: where Annex V evidence must appear

The Cosmetic Product Safety Report (CPSR) is the central legal document under Article 10 and Annex I of 1223/2009. It is split into Part A (safety information) and Part B (safety assessment), signed off by a qualified Safety Assessor. Annex V evidence appears in both parts in specific locations — missing documentation here is the single most common audit finding.

Use the checklist below to generate the exact Annex V evidence set required for your product type and market scope. The checklist filters by product (leave-on face, rinse-off body, child, oral, eye-area, spray) and by market scope (EU only, EU + UK, EU + non-EU markets).

Supplier dossier audit: 7 CoA fields for Annex V defence

The compliance chain under Article 5 of 1223/2009 obliges the Responsible Person to maintain documentary evidence tracing finished-product compliance back to raw-material supply. Seven CoA fields are the minimum defence for an Annex V-listed preservative at import or audit.

1. Annex V entry number explicit on the CoA. Most supplier CoAs omit this. Add it to the RFQ as a mandatory CoA field. A supplier who cannot add the entry number has no internal process to track the regulatory tie-up.
2. INCI name matching Annex V text. The INCI must match the Annex V entry’s wording, including salt-form specification where relevant (e.g. "Potassium Sorbate" not "sorbate salt").
3. CAS number as a cross-reference. Multiple INCI names can map to the same CAS; multiple CAS numbers can share an INCI. Both are needed for an unambiguous match.
4. Assay by a method capable of quantifying the free acid or free base. For sorbic/benzoic acid, GC or HPLC with explicit free-acid quantitation. For paraben esters, HPLC with ester identification.
5. Residual process impurities panel. Phenoxyethanol with phenol residue above the standard CoA limit, parabens with p-hydroxybenzoic acid residue, formaldehyde-releasers with free formaldehyde — these are the fields a competent authority inspects first.
6. GMP ISO 22716 facility certificate with production address matching the CoA. The CoA’s production site must match the certified facility; mismatch suggests an unaudited repack layer.
7. Batch number, production date, and production site. All three present on the CoA, matching the commercial invoice. Missing any of these breaks traceability under Article 5.

Beyond the CoA itself, a signed 60-day change-notification clause in the supply contract is non-negotiable. Without it, you cannot discharge the Article 5 obligation to track upstream changes that affect product safety or compliance. The detailed audit framework for this sits in our Preservative CoA batch consistency playbook.

CPNP notification: four fields where Annex V compliance surfaces

CPNP (Cosmetic Products Notification Portal) is the EU-wide notification system for cosmetic products. Four CPNP fields carry Annex V compliance signal, and all four are the subject of competent authority spot-checks.

• Frame formulation declaration. The product’s frame formulation category — rinse-off hair care, leave-on skincare, child product, etc. — must match the Annex V entry’s product-type scope for each preservative. A product declared as rinse-off that uses an Annex V entry restricted to rinse-off (e.g. MIT at entry 39) carries no Annex V problem; the same product declared as leave-on is non-compliant on filing.
• Preservative concentration field. CPNP requires declaration of concentration ranges for substances of concern, including Annex V-listed preservatives above specific thresholds. Declared ranges that straddle the Annex V cap are automatically flagged for review.
• Nanomaterial check. Several Annex V entries (Silver Chloride on TiO2, entry 18) require a nanomaterial-form declaration if applicable. Omission is a flagged non-compliance.
• Child-product category tag. CPNP collects a child-product flag that triggers additional downstream checks for parabens (entry 12), Salicylic Acid (entry 3), IPBC (entry 46), and other child-sensitive entries. A mis-tagged child product is one of the most common early-stage filing errors.

Common 2024-2026 CPNP rejection patterns: concentration range above cap (34% of rejections per DG GROW statistics), formulation category mismatch (21%), missing child-product tag (18%), paraben sum calculation error (12%), nanomaterial omission (7%), other (8%).

Safety Gate 2024-2026 preservative enforcement patterns

The Safety Gate (formerly RAPEX) system aggregates national market surveillance notifications across the EEA. Cosmetic product notifications linked to preservative non-compliance over the 2024-2026 window cluster into four categories, each with a characteristic enforcement profile.

• Concentration overrun (approximately 38% of preservative-linked notifications 2024-2026) — an Annex V-listed substance present above its cap. Rotterdam-style cases. Typical trigger: port inspection, retail lab test, competitor complaint. Median withdrawal timeline: 7 days from notification.
• Forbidden substance (approximately 22%) — a substance in Annex II present in the product, often as an unintended impurity in a raw material (methylisothiazolinone contamination of a non-MIT preservative, trace formaldehyde above warning threshold). Trigger: targeted analytical sweep. Enforcement is strict; recall standard.
• Inadequate preservation (approximately 28%) — the product fails microbiological testing in the field. Pseudomonas aeruginosa, Burkholderia cepacia, mould regrowth. Trigger: consumer complaint, retail QC test, hospital-sourced infection trace. Response time: 48 hours typical to formal Safety Gate.
• Child-product violation (approximately 8%) — a Propyl/Butyl paraben in a leave-on nappy-area product, Salicylic Acid in a non-shampoo child product. Trigger: targeted inspection by national paediatric or consumer-safety body. High media visibility; near-automatic withdrawal.

Member-state enforcement intensity varies. Germany (BVL), the Netherlands (NVWA) and France (DGCCRF) are the most active enforcers, accounting for roughly 60% of all preservative-linked Safety Gate notifications in the 2024-2026 window. Brands with EU-wide distribution typically plan compliance around the most active member state’s practices, not the median.

Change-management SOP when your supplier changes source, process or grade

Article 5 of 1223/2009 obliges the Responsible Person to ensure that products placed on the market remain compliant. An upstream change at the preservative supplier’s plant — a new raw material source, a modified synthesis step, a change in purity grade — can shift the regulatory profile of the finished product even when the CoA number stays the same. The 60-day change-notification SOP is the discipline that keeps the PIF current.

Five supplier-side changes that trigger a re-run of ISO 11930 Challenge Test:

1. Change of production site, even within the same supplier organisation. Different plant equipment can yield different impurity profiles that affect microbiological performance.
2. Change of raw material feedstock (e.g. phenol source for Phenoxyethanol synthesis). Residual-impurity profile shift.
3. Change of synthesis route or purification method. Even isomer-ratio drift at the sub-percent level has been shown to shift Challenge Test outcomes for 1,2-Hexanediol-based systems.
4. Change in CoA method for a key field (e.g. HPLC vs GC for assay). Not a substance change, but a comparability concern that must be documented.
5. Change in purity grade (cosmetic-grade to pharma-grade or vice versa). Impurity caps differ; the product’s safety assessment may need re-reading.

Three supplier-side changes that trigger CPNP re-notification:

1. Substitution of the preservative itself (any Annex V entry number change).
2. Concentration change that moves the declared range above the Annex V cap or into a different CPNP reporting band.
3. Supplier-driven packaging change (e.g. a drum liner material change that affects stability) when the primary packaging material code is in the CPNP record.

The SOP itself: supplier notifies within 60 days of the change effective date, Responsible Person receives, logs in the PIF change register within 10 working days, decides within 20 working days whether re-test / re-notify is required, executes within the window before the first batch of changed material enters finished-product production.

UK post-Brexit divergence: where SCCS and OPSS rules now differ

The UK retained the full text of Annex V as of 1 January 2021 under the UK Cosmetics Regulation 2013 (as amended). Over the 2021-2026 window, approximately a dozen SCCS opinions have been adopted into EU Annex V but not into the UK equivalent, and the UK Office for Product Safety and Standards (OPSS) has independently updated several entries. The divergence is still small but non-zero, and brands distributing to both markets maintain a quarterly divergence register.

Notification is parallel: EU products go to CPNP, UK products go to the Submit Cosmetic Product Notifications (SCPN) portal on gov.uk. The UK Responsible Person must be UK-resident; the EU Responsible Person must be EU-resident. One Responsible Person entity cannot cover both markets without a UK establishment.

Testing and documentation generally transfer between the two systems. An ISO 11930 Challenge Test accepted under CPSR is accepted under the UK equivalent. CPNP and SCPN both accept the same underlying PIF content, with jurisdiction-specific annexes for the few diverged Annex V entries.

The practical rule: file against the stricter cap where the EU and UK differ, and maintain a divergence register that flags any entry where a UK-only or EU-only reformulation would be more cost-efficient.