Contract manufacturing: who holds the product file?
When a brand has its products made by a contract manufacturer, the Regulation looks at the name on the label. The brand that markets the product under its own name is the manufacturer in law and, unless it appoints someone else, the Responsible Person who keeps the CPSR and the PIF. This guide shows who holds what, what a manufacturing contract should say about the file, and how a contract manufacturer can follow many brands at once.
01/The manufacturer
Who is the manufacturer in law? The name on the label.
A contract manufacturer makes the product. In the Regulation, the manufacturer is whoever markets it under their own name or trademark. For a private label product, that is the brand.
Article 2(1)(d)
‘manufacturer’ means any natural or legal person who manufactures a cosmetic product or has such a product designed or manufactured, and markets that cosmetic product under his name or trademark
The same contract manufacturer is the manufacturer in law for the products it sells under its own brand. Türkiye’s Kozmetik Ürünler Yönetmeliği defines the manufacturer the same way, in its Article 4(1)(ı).
02/Roles
Who holds what? Role by role.
By default the brand is the Responsible Person: it has the safety assessment done, keeps the CPSR up to date and keeps the PIF. The contract manufacturer’s part of the file is how the product is made.
| Role | What the law gives them | Articles |
|---|---|---|
| Brand (manufacturer in law) | The Responsible Person by default when established in the EU (Article 4(3)); a brand outside the EU designates one by written mandate. Ensures the safety assessment and the CPSR before the product is placed on the market, and keeps the PIF. | EU 4, 10(1), 11 · TR 6, 13, 14 |
| Contract manufacturer | Manufactures under good manufacturing practice. Its description of the method of manufacture and its GMP statement go into the PIF. | EU 8, 11(2)(c) · TR 11, 14(2)(c) |
| Safety assessor | Carries out the safety assessment in Part B of the CPSR, with a university qualification in pharmacy, toxicology, medicine or a similar discipline. | EU 10(2) · TR 13(4) |
| Responsible Person | Ensures, for each product placed on the market, that the obligations of the Regulation are met. Established in the EU, or in Türkiye for the Turkish market. | EU 4 · TR 6 |
| Responsible technical officer (Türkiye) | Employed by the Responsible Person under Article 7; responsible for checking that a product to be placed on the market complies with cosmetics law and good manufacturing practice. There is no EU equivalent. | TR 7 |
One company can hold more than one role. A contract manufacturer that accepts a brand’s written mandate in writing becomes the Responsible Person for that product, with every duty in the first row.
03/The contract
What should the contract say? Seven lines about the file.
A manufacturing contract usually settles price, quantities and quality. The product file needs lines of its own. This is a checklist to take to your lawyer, not legal advice.
Who the Responsible Person is
Named for each product. If the manufacturer takes the role, the written mandate and its written acceptance are attached.
Who commissions the safety assessment
Which side appoints the safety assessor, pays for the CPSR and receives the signed report.
What the manufacturer delivers to the file
The description of the method of manufacture, the GMP statement, the formula as manufactured, and the supplier of each raw material with its documents.
Who owns the formula
Whether the brand receives the full formula or only its safety assessor sees it, and what happens to it if the brand moves production.
How changes are announced
A new raw material, supplier or process is reported before it reaches a batch, so the CPSR can be kept up to date under Article 10(1)(c).
Who records the last batch
Which side records the date the last batch was placed on the market; the ten years of Article 11(1) run from it.
What happens when the contract ends
What the manufacturer hands over, and how long it keeps its own records, since the Responsible Person keeps the PIF for ten years after the last batch.
Have the contract read by a lawyer who knows the market where the product will be sold.
04/Many brands
Making for many brands? Every file on one screen.
Every brand asks its contract manufacturer for the same things: the formula and the suppliers of its raw materials. Maker Portal puts every brand you make for on one screen, and each formula is sent once.
Every product file you are linked to, under its brand: its stage and what is needed from you. You see the stage, never the contents.
Each formula you send is kept in My formulas and suggested for the next request. A new version reaches the consultant as a suggestion and is written in only when they approve it.
Your formula goes only to the consultant who asked for it. My formulas is visible to you alone.
Maker Portal is free for contract manufacturers; the consultant or brand whose file it is pays through their plan. If you prepare your clients’ files yourself, one account can run several companies, give each client a read-only window with no account needed, and hand a company over when a brand takes the work in-house.
Questions about contract manufacturing.
Is the contract manufacturer the Responsible Person?
Not by default for products sold under another company’s brand. The brand that markets the product under its own name is the manufacturer in law and, unless it designates someone else by written mandate, the Responsible Person. The contract manufacturer becomes one when it accepts that mandate in writing, or for the products it sells under its own brand.
Who keeps the PIF?
The Responsible Person, at the address on the label, for ten years after the last batch was placed on the market. The contract manufacturer supplies part of it: the description of the method of manufacture and the GMP statement.
Does a private label product need its own CPSR?
Yes. The same formula sold under two brands is two products, each with its own Responsible Person, its own label and its own product information file.
What is a responsible technical officer?
A role that exists in Türkiye only. The Responsible Person employs a chemist, chemical engineer, pharmacist or a similar professional, who checks that a product to be placed on the market complies with cosmetics law and good manufacturing practice. A Responsible Person who meets the conditions can take the role itself.
Does Maker Portal cost the manufacturer anything?
No. It is free for contract manufacturers. The consultant or brand whose file it is pays, through their Unique Alphabet plan.
Settle who keeps the file before the first batch.
Free plan · no card