Cosmetic PIF (Product Information File) and Safety Assessment: Essential Before Notification

Cosmetics in Malaysia operate under a notification system (not batch-by-batch testing), but this does not mean there is no gatekeeping — the notification holder (CNH) must have a PIF (Product Information File) and a safety assessment ready for NPRA to inspect at any time. In other words, completing your notification on the QUEST system and obtaining a notification number only gives you "eligibility to go to market"; the real chain of evidence proving that the product is safe and lawful is this PIF, which is not uploaded routinely but must be producible on demand. This article sets out exactly what the PIF must contain, who performs the safety assessment, and where the common gaps are. (For the full overview, see the Malaysia Cosmetic Regulations and Labelling Guide.)

Why does a notification system make the PIF even more necessary?

Many brands mistakenly assume "notification = reviewed = all clear", which is the most dangerous misconception. The logic of a notification system is "go to market first, responsibility rests with the operator, the authority inspects afterwards", shifting the gatekeeping duty onto the CNH. That means when a product causes a problem, is spot-checked, or draws a market complaint, NPRA will require you to produce the PIF and safety assessment within a set period; if you cannot produce them, or the contents do not match the actual product, the notification can be cancelled, the product withdrawn, and in serious cases other products held under the same holder can be affected too. The PIF is not "a document made to show the authority" — it is the core evidence that you have discharged your duty of safety gatekeeping.

What does the PIF (Product Information File) contain?

The PIF is a file that integrates four dimensions of the product: identity, quality, safety and claims. Its core contents are as follows:

These parts must be consistent with one another: the concentrations in the ingredient list must match the concentrations evaluated in the safety assessment, the claims on the label must have corresponding substantiation, and the manufacturing source must match the GMP documentation. The PIF is not uploaded at the time of notification, but must be available for NPRA inspection at any time; incomplete or inaccurate data can lead to the notification being cancelled and the product withdrawn.

Safety assessment: the core of pre-market gatekeeping

The most technical — and most often skipped — part of the PIF is the safety assessment. It is performed by a qualified person (safety assessor) who makes an overall evaluation of the safety of each ingredient and of the finished product, covering:

• Whether any prohibited ingredient has been mistakenly used (see Cosmetic Prohibited Ingredients: ACD Annex II).
• Whether restricted ingredients stay within their concentration limits and conditions of use (see Cosmetic Restricted Ingredients and Concentration Limits).
• Whether impurities, heavy metals and microorganisms are within limits.
• Whether the exposure under consumers' actual conditions of use is safe.

This step combines the ingredient list, specifications and manner of use to judge that "this formula is safe for humans under normal and reasonably foreseeable use" — it is not a matter of printing out the SDSs and stapling them together. The safety assessment must consider real usage scenarios: whether the product is applied to the face or rinsed off, how many times a day it is used, whether it comes into contact with the eye area or mucous membranes, and whether users include sensitive groups such as young children. The same ingredient at the same concentration can give very different exposures in a rinse-off versus a leave-on product, and the conclusion may differ too — which is precisely why the safety assessment must be done product by product, and a single report cannot be applied across an entire range.

Common gaps

• Only completing the notification but not establishing a PIF / safety assessment, so nothing can be produced when spot-checked.
• Ingredient concentrations in the PIF not matching the actual formula (e.g. switching supplier or changing the formula without updating in step).
• The label carries efficacy claims with no substantiation, or an SPF value is stated with no test basis (see Sunscreen UV Filters and SPF Labelling).
• The PIF is built and then left untouched, not maintained after renewal or variation of the product (see Cosmetic Notification Renewal and Variation).

Pre-market self-check checklist

• [ ] Every SKU has its own complete, standalone PIF.
• [ ] The full ingredient list and quantitative data match the actual formula.
• [ ] The safety assessment is completed and signed by a qualified person.
• [ ] Every label claim has corresponding substantiation on file.
• [ ] Manufacturer GMP and specification data are complete and within validity.
• [ ] After renewal or variation, the PIF has been updated in step.

Frequently asked questions (FAQ)

Q: Must the PIF be submitted to NPRA? It does not need to be submitted proactively, but it must be kept ready for inspection; being unable to produce it during a spot check is equivalent to non-compliance.

Q: Who can perform the safety assessment? It must be completed by a person with the relevant qualifications and experience (a safety assessor) — not just anyone signing it off.

Q: Where should the PIF be kept, and who is responsible for it? It is generally kept and managed by the CNH (notification holder), who must be able to produce it within a reasonable period when the authority requests it.

Q: If the formula changes, does the PIF need to be redone? When there is a substantive change to ingredients or concentration, both the PIF and the safety assessment must be updated, and a variation notification handled as required.

Conclusion

The gatekeeping formula for cosmetics is: notification + PIF + safety assessment (kept for inspection). Notification is only the entry ticket; the PIF and safety assessment are the real evidence that your product is safe and lawful. Want to check first whether your data and label are complete? Run a free label check now — we can also help you get your PIF and notification in order.

This article is compiled from official NPRA guidelines and is for reference only; actual compliance is subject to the latest official text and review by the competent authority.