The Product Information File: What Cosmetic Brand Owners Must Keep

Cosmetic products sold across ASEAN must be backed by a Product Information File. This guide explains what the PIF contains, who is responsible for it, and why brand owners — not factories — carry the risk when it is missing.

What is a Product Information File?

Quick answer: A Product Information File (PIF) is the technical and safety dossier a company must hold for every cosmetic product it places on the market. Under the ASEAN Cosmetic Directive — the framework Malaysia applies through the National Pharmaceutical Regulatory Agency (NPRA) — notification is a simple online declaration, but the evidence behind that declaration must exist in a file the authority can ask to see at any time. The party named on the notification, not the manufacturer, is the one held responsible for producing it. Brand owners planning a first production run should agree in writing, before the purchase order, which side supplies each part of the file.

Key takeaways

• Cosmetic notification in Malaysia is a declaration, not an approval. The supporting evidence lives in the PIF, which is never submitted at notification and is requested later, usually during post-market surveillance.
• The ASEAN recommended format has four parts: administrative documents, raw material quality data, finished product quality data, and safety and efficacy data.
• The Cosmetic Notification Holder (CNH) — typically the brand owner or importer — is the custodian. Outsourcing manufacture does not outsource this obligation.
• Much of the file's content sits inside the manufacturer's systems. If contract terms do not require the factory to release it, the brand owner may be legally responsible for documents it cannot obtain.
• The file must be kept current. New ingredients, a new raw material supplier, or a changed production process all require the PIF to be updated.
• Health supplements follow a different route entirely — full product registration under the Drug Registration Guidance Document, not notification — so the cosmetic PIF model does not transfer.

Who this guide is for

This guide is written for founders and brand managers launching cosmetic, skincare or personal care products through an OEM (Original Equipment Manufacturer) or ODM (Original Design Manufacturer) partner in Malaysia or the wider ASEAN region. It is most useful at the point where a formula has been approved and a first purchase order is being negotiated — the moment when documentation terms are still open. It is a practical explainer, not legal advice; the applicable requirements should be confirmed against the current NPRA guidelines and, where a product is exported, against the destination market's own rules.

Why does a cosmetic product need a PIF at all?

The PIF exists because cosmetic regulation in ASEAN moved away from pre-market approval. Before harmonisation, several member states reviewed cosmetic dossiers before granting a licence. The ASEAN Cosmetic Directive replaced that with a notification system: a company declares a product, pays a fee, and may place it on the market without a technical review. The regulator's control shifts to after the product is on shelf.

That shift only works if the evidence still exists somewhere. The PIF is that somewhere. It is the mechanism that allows an authority to reconstruct, months or years later, what was in a product, how it was made, who supplied the ingredients, and on what basis it was judged safe. In practice this means the burden of proof has not been reduced — it has been moved from before launch to after it, and from the regulator's desk to the company's own filing system.

This is where the analysis matters for new brands. A notification number arrives quickly and reads like a clearance. It is not one. It is a record that a declaration was made. If the file behind it is incomplete when the NPRA asks, the product's regulatory position becomes difficult to defend, regardless of how carefully the product was formulated.

What goes into each of the four parts of a PIF?

The ASEAN guidelines set out a recommended four-part structure, with a table of contents for each part. The table below summarises what each part is intended to hold and, importantly, who usually generates it in an outsourced manufacturing arrangement.

Part	Typical contents	Usually generated by
Part I Administrative documents and product summary	Copy of the notification form bearing the authority's acknowledgement; identity and address of the manufacturer, assembler, importer and the company placing the product on the market; qualitative and quantitative formula; product presentation, outer and inner labels, leaflets and instructions for use.	Brand owner, using formula data from the manufacturer
Part II Quality data of raw materials	Specifications and test methods for each ingredient, including water where relevant; safety data for the raw materials drawn from supplier documentation, published literature, or scientific committee opinions such as the ASEAN Cosmetic Scientific Body, the EU scientific committees, or the US Cosmetic Ingredient Review.	Manufacturer and raw material suppliers
Part III Quality data of the finished product	The qualitative and quantitative formula using INCI or other ACD-approved reference names, with the function of each ingredient stated; the manufacturing method and confirmation that production complies with Good Manufacturing Practice; finished product specifications and stability data.	Manufacturer
Part IV Safety and efficacy data	A safety assessment summary prepared in line with the ASEAN safety assessment guidelines; any confirmed undesirable effects on human health; and support for the claims that appear on the pack, including a summary of efficacy assessment where such claims are made.	Safety assessor, using test data from the manufacturer or a third-party laboratory

Two observations follow from that table. First, only Part I is naturally in a brand owner's possession. Second, Part IV is the part most often missing, because a safety assessment is a commissioned professional output rather than a by-product of manufacturing. Claim support belongs in Part IV as well, which is why the wording on a pack and the contents of the file are directly linked — a subject covered separately in what brands can legally say about health and beauty products.

Who is responsible for the PIF — the brand or the factory?

In Malaysia the responsibility sits with the Cosmetic Notification Holder. The CNH is the party that notifies the Director of Pharmaceutical Services before a cosmetic product is manufactured, sold, supplied, imported or possessed, and it is the party the NPRA approaches when it wants the file. For a brand that outsources production, the CNH is normally the brand owner or its appointed importer — not the contract manufacturer.

This creates a structural gap worth naming plainly. Legal responsibility sits with the brand owner. Physical possession of most of Parts II and III sits with the factory. Nothing in the regulation resolves that gap; only the commercial contract does. A brand owner who has not secured documentation rights in the manufacturing agreement is relying on goodwill to discharge a legal obligation.

The practical response is to treat PIF content as a contractual deliverable rather than a favour. That means listing, in the supply agreement, the specific documents the manufacturer will provide and keep updated: raw material specifications and safety data, finished product specifications, stability results, the GMP position, and the batch documentation supporting each shipment. It also means agreeing what happens on exit — whether that content remains available if the relationship ends. These terms sit naturally alongside the intellectual property clauses discussed in who owns your formula, and they are best raised during a factory visit, when documentation systems can actually be inspected rather than described.

How long must a PIF be kept, and where?

Under the ASEAN framework, the file must be readily available and accessible to the authority at the address given for the responsible company. It may be a physical dossier or a set of electronic records, and in Malaysia it must be in Bahasa Malaysia or English. Documents should carry revision dates so that version history can be verified. The file must be kept updated for changes to the notified product — new ingredients, a new manufacturer, a different raw material supplier, or a changed production process.

Retention practice differs between markets, and brands that export should not assume one rule covers all. The European Union's Cosmetics Regulation (EC) No 1223/2009 requires the responsible person to keep the PIF for ten years from the date on which the last batch was placed on the market, at a single address, accessible to the competent authority. A brand selling into both ASEAN and the EU is therefore managing two overlapping obligations with different retention clocks and different definitions of who the responsible party is. Export sequencing is covered more fully in the guide to exporting health and beauty products from Malaysia.

Does the same file apply to supplements?

No — and assuming it does is a common and costly error. In Malaysia, health supplements are not notified; they are registered products, assessed by the NPRA under the Drug Registration Guidance Document. The applicant submits a technical dossier for evaluation before approval, including the batch manufacturing master formula and substance-level detail on actives and excipients with quantity per unit dose, verified by authorised personnel. The product registration holder is then responsible for maintaining the safety, quality and efficacy of the product throughout the validity period of the registration, with batch, packaging and inventory records maintained accordingly.

The practical difference is timing. A cosmetic brand can be on the market before its evidence file is complete — which is precisely the risk this article addresses. A supplement brand cannot, because the evidence is assessed first. Founders moving between the two categories should expect different timelines, different costs, and a different order of work.

Where do Product Information Files usually fall apart?

Looking at how brands assemble these files, a small number of failure patterns repeat. They are rarely dramatic; they are administrative gaps that only surface under request.

• No safety assessment was ever commissioned. The formula was approved, the product was notified, and Part IV was left empty because nobody was assigned to produce it.
• The file was assembled once and never updated. A raw material supplier changed, or the fragrance was reformulated, and the documentation still describes the original version.
• Claim support does not exist. Marketing language was finalised after the file was compiled, so the pack promises more than the evidence covers. See how brands prove a product works.
• Ingredient safety data is a supplier brochure. A marketing datasheet is not a specification and not a safety dossier. Documentation standards for inputs are covered in raw material sourcing.
• Batch records are held only by the factory. The brand owner has certificates of analysis for some batches and nothing for others — a gap explained in certificates of analysis explained.
• The label artwork in the file is not the label on shelf. A late artwork revision was never filed back. Label content requirements are set out in product labelling for health and beauty brands.
• Preservative efficacy data is missing for a water-based product. Challenge testing is discussed in preservatives and challenge testing.

A practical checklist before the first production run

1. Confirm which party will be named Cosmetic Notification Holder, and confirm that party accepts custody of the PIF.
2. List the Part II and Part III documents the manufacturer will supply, and write them into the supply agreement as deliverables with a delivery point.
3. Appoint a safety assessor early and confirm what data they will need, so testing is scheduled rather than retrofitted.
4. Freeze the on-pack claims before the safety and efficacy work is scoped, so Part IV covers what the pack actually says.
5. Confirm the manufacturer's GMP position and how it will be evidenced — see GMP explained.
6. Decide the file's storage format and single point of custody, in Bahasa Malaysia or English, with dated revisions.
7. Set a review trigger: any change of ingredient, supplier, manufacturer, process or artwork prompts a PIF update, not a note to do it later.

Frequently asked questions

Do I have to submit the PIF when I notify a cosmetic product?

No. Cosmetic notification in Malaysia is an online declaration submitted through the NPRA's system, and the PIF is not uploaded as part of it. The file must exist and be available if requested, typically during post-market surveillance or in response to a complaint or adverse event. The absence of a submission step at notification is exactly what leads some brands to treat the file as optional.

Can my OEM manufacturer keep the PIF for me?

A manufacturer can hold and maintain much of the content, and many do so as a service. What cannot be transferred is the notification holder's responsibility to make the file available to the authority. If a manufacturer maintains the file, the arrangement should be documented, and the brand owner should confirm it can obtain the file directly and promptly — including if the commercial relationship ends.

How much does it cost to put a Product Information File together?

There is no single figure. The main variable costs are the safety assessment, any physical testing needed to support it, and claim substantiation, all of which depend on the formula, the product category and the number of claims made. Documentation the manufacturer already holds, such as raw material specifications and GMP records, usually carries no incremental cost if it was requested in the contract. Brands should obtain a scoped quotation from a safety assessor rather than budgeting from a general benchmark.

What happens if the NPRA asks for the file and it is incomplete?

Failure to maintain or produce the PIF is a compliance failure against the conditions attached to notification, and it places the product's regulatory position at risk. Because outcomes depend on the specific circumstances and on the authority's assessment, a brand owner facing a request it cannot fully meet should seek qualified regulatory advice rather than submitting a partial file and waiting.

Does an imported finished product still need a PIF?

Yes. The obligation attaches to placing the product on the market, not to where it was made. An importer notifying a foreign-made cosmetic is the notification holder and needs the same four parts, sourced from the overseas manufacturer. This is often harder than domestic sourcing, because the documentation must cross a company boundary and sometimes a language boundary, and it should be settled before the first shipment is ordered.

How often should the file be reviewed if nothing has changed?

The requirement ties updates to changes rather than to a calendar. In practice, a periodic review — annually is a reasonable working rhythm — catches changes that were made operationally but never recorded, such as a substituted raw material grade or a revised artwork file. The review should compare the file against the product currently being produced and sold, not against the file's own last version.

Sources

• National Pharmaceutical Regulatory Agency (NPRA), Regulatory Requirements for Cosmetics and Cosmetic Notification.
• NPRA, Guidelines for Control of Cosmetic Products in Malaysia.
• ASEAN Cosmetic Directive, Guidelines for Product Information File (PIF).
• Health Sciences Authority, Singapore, ASEAN Cosmetic Directive.
• European Commission, Regulation (EC) No 1223/2009 on cosmetic products.
• NPRA, Drug Registration Guidance Document (DRGD) and Guideline on Registration of Health Supplements.

Scope and limitations

This article explains a documentation framework; it is not legal or regulatory advice and does not substitute for a qualified safety assessor or regulatory consultant. Requirements change: the ASEAN guidelines are revised periodically, NPRA guidance is updated, and destination markets outside ASEAN apply their own rules. The descriptions above reflect published guidance as at August 2026 and should be checked against the current version before being relied on for a specific product. No factory audit, laboratory testing or file review was conducted for this article; the analysis draws on published regulatory guidance and on patterns commonly observed in outsourced manufacturing practice.

---

Disclosure: Creaton Poh is the pen name of Poh Tze Kheng, founder of the ORIZI Group, a Malaysian OEM/ODM manufacturer. This article is educational and independent, and is not promotional.

Written by Creaton Poh
Industry Researcher • Author • Vlogger • Manufacturing Strategist
Turning ideas into products. Turning experience into knowledge.

Connect with Poh Tze Kheng on LinkedIn.