PIF files were codified as a legal requirement in the cosmetic regulations that came into force in 2013. But the idea goes back some way before that. The 6th Amendment to the EU’s cosmetic regulations that came into force in 1993 had basically the same requirement. They were called product information packs, or PIPs at the time.
It is always the same with a change in regulations. Scary stories were circulated by the nervous, the talkative and regulatory consultants about how much work they were going to be. But as is often the case, the reality turned out to be much less troublesome. When you looked at the regulation itself it turned out that most companies had been keeping the information that was required to meet the rules for years. It was all the kind of stuff you needed yourself anyway.
There was a similar response when the 2013 EU regulation came in, which made the details of what data cosmetic companies need to keep on file and the name of these files was changed from PIP to PIF. This stands for Product Information File. But it wasn’t that big a change. And it still didn’t explicitly require any particular format, and certainly not that all the data on a formulation needed to be compiled into a single document. It is required that the information should be available from a legal entity in the EU, but that is the extent of the requirement.
The only specific information that needs to be on file is –
- Product description
- CPSR
- GMP manufacturing compliance statement
- Claim support evidence where applicable
- Animal testing data.
The CPSR will almost always include the product description, so that covers the first two for the price of one.
A statement of compliance to GMP (good manufacturing practice) is a bit superfluous given that it is a legal requirement to follow a good manufacturing practice. Companies do often get this compliance confirmed by a third party, and this usually involves a certificate being issued. But there isn’t any requirement to do so.
Claim support varies from almost nothing – you don’t need to prove that a bar of soap cleans your hand for example – through to extensive collection of clinical trial data. It depends on the claims you are making.
Given that testing on animals for cosmetic purposes is illegal, this should be a very short part of the PIF file.
For over a decade nobody not directly involved in the compilation of PIF files took much notice of them. The files definitely existed – they are full of the stuff any but the smallest of businesses would want to have on file anyway. Every company has its own particular way of doing so – they all after all have different ways of working. Some have everything on a hard drive. Some have elaborate structures into which they fit stuff. Others are a bit less organised. Some still rely on paper for at least some of their records. Cloud storage is quite popular. Some have one person who is responsible for the PIF files. Some, I’d say most, have the job shared between different people and even departments. The CPSR is a good example. This is usually something that is sorted out by the formulation team, but can be handled by a regulatory team. Others employ safety assessors to both compile and to look after the storage, update and retention of CPSRs. Simply subcontracting the whole process to a regulatory consulting firm is not unusual either.
But nobody was particularly asking to see them. Enforcement officials asked for specific bits of information to answer questions that they had. Distributors and retailers checked on the things that were important to them. But recently word seems to have got around that cosmetic companies are supposed to have PIF files, and have started asking to see them.
As I say, the problem isn’t that the data doesn’t exist. It would exist even if there were no regulations at all. But not many companies would choose to put all the required data in a single document. It’s quite simply not a sensible way of handling the information. Formulations are updated. Manufacturing partners change. New data is generated. So when you are asked for a document that doesn’t exist, you have a challenge.
The most honest answer to a request is to explain why you don’t have a thing called a PIF file, but you are happy to provide any information that is required. But this isn’t always easy. If your stock is held at a port running up a demurrage rather than making money, the easiest response is just to give them what they want. It is equally difficult to get into a conversation if a big order is hinged on giving the customer the report they are asking for.
It is good to push back if you can. But if you can’t my advice is to keep the PIF file format as short as possible. The golden rule of regulatory compliance is to only give over exactly what you are asked for, and make sure whatever you do hand over is correct. So my proposal is that the PIF file should be very thin. It should comprise the Safety Assessment, a statement that all goods are manufactured to a good manufacturing process, a statement that no animal testing has taken place and full details of how the claims you are making are justified. This might be very thin indeed in some cases. It would be a good idea not to have the PIF file compiled and ready to issue if it is requested. It is much better to issue it when it is needed, and check it is up to date the day you send it.
Do that, and you’ll make your life easier.
