Get in touch with NEXO Beauty Labs Company
MSDS vs COA in Cosmetics: Two Documents, Two Different Promises

MSDS vs COA cosmetics is a document-sorting problem dressed up as a comparison. The questions usually start the same way. A supplier sends one document, a customer demands the other, and nobody involved says out loud which question each piece of paper actually answers. One reports hazard. One reports a batch. COA and MSDS arrive in the same inbox and get filed in the same folder, which is exactly why they’re swapped more often than any other pair of documents in the cosmetics industry. Confusing them costs money at the worst possible moment.
A certificate of analysis reports measured test results for one specific batch against an agreed specification. A safety data sheet reports the hazard profile of a substance or mixture in the 16-section format set by the Globally Harmonized System. One is negotiated in a contract; the other is written by law, and for many finished cosmetics, no law asks for it at all.
COA vs MSDS vs SDS in Cosmetics: The Difference at a Glance

A certificate of analysis is a batch record and a safety data sheet is a hazard record. One says this drum, tested on this date, met these numbers. The other says this material, in any drum, can hurt someone in these ways. Neither substitutes for the other, and neither proves a product is legal to sell.
Everything below turns on the level the evidence attaches to. Substance-level evidence follows the chemistry and never changes between deliveries. Batch-level evidence follows the container and changes with every delivery. Once a buyer sorts chemical documentation onto those two shelves, most of the confusion in the COA vs MSDS debate disappears. Quality and safety questions arrive on one email thread and get answered by two entirely different pieces of paper.
| Dimension | Certificate of analysis (COA) | Safety data sheet (SDS, formerly MSDS) |
|---|---|---|
| Question answered | Did this batch meet specification? | How can this material harm a person? |
| Evidence level | Batch-level; a new batch number means a new document | Substance-level; unchanged until the hazard data changes |
| Structure | No mandated field list anywhere in cosmetic law | 16-section format, fixed heading order |
| Legal driver | Purchase contract and internal quality control | Hazard classification under OSHA or REACH |
| Who owes it | Whoever agreed to supply it in the contract | Chemical manufacturers and importers of the hazardous material |
| Intended reader | Incoming inspection, quality assurance, release decision | Worker, safety manager, emergency response team |
| Update rule | None; the next batch simply gets its own | Without delay on new hazard information, re-issued to 12 months of recipients |
| Machine-readable | No; formats vary by supplier | Yes; standardised headings drive automated safety management |
| Cannot prove | Safety, legality, or that any other batch matches | Quality, potency, purity, or that your batch is in specification |
MSDS is the retired name for the second column. MSDS survives in supplier templates and search habits, but the current instrument in the United States is the safety data sheet, and the change wasn’t cosmetic. Chemical safety and batch quality are two separate shelves, and a supplier printing safety and quality across the top of one document doesn’t make it serve both.
Why MSDS Is a Retired Label, and What Twelve Months of Search Data Show

Search demand for the term msds in the United States fell from 33,100 monthly searches in August 2025 to 14,800 in July 2026, a drop of 55.3 percent. Over the same 12 months the live term sds moved from 49,500 to 40,500, down 18.2 percent, while certificate of analysis began and ended the year at 1,900, inside a 1,600 to 1,900 band. Three curves, three different stories.
| Term | Aug 2025 | Jul 2026 | Movement |
|---|---|---|---|
| msds | 33,100 | 14,800 | −55.3 % |
| material safety data sheet | 33,100 | 14,800 | −55.3 % |
| sds | 49,500 | 40,500 | −18.2 % |
| safety data sheet | 14,800 | 9,900 | −33.1 % |
| certificate of analysis | 1,900 | 1,900 | 0.0 % — flat |
The MSDS Retirement Curve. Source: Google Ads monthly search volumes for the United States, retrieved through DataForSEO on 4 September 2026 for the 12 months August 2025 to July 2026. These are keyword-planner estimates rounded by Google into fixed bands, not a count of individual queries. Search volume is draining from the retired label three times faster than from the live one, while the certificate term ends the year exactly where it started. That asymmetry is the point. MSDS isn’t an older spelling of SDS that happens to persist; it’s a decaying vocabulary attached to a superseded standard. Certificate of analysis is flat because it was never a statutory term in the first place — no standard revises it, so no revision cycle disturbs the people searching for it. One document is legislated and dated. Its counterpart is negotiated and undated.
Dating is checkable. United States hazard communication law was established in 1983; the 2012 alignment with the Globally Harmonized System of Classification and Labelling of Chemicals (77 FR 17574) is the amendment that replaced material safety data sheet with safety data sheet, and a further final rule aligning to GHS Revision 7 was published on 20 May 2024 and took effect 19 July 2024. Meanwhile the United Nations published Revision 11 of the Purple Book on 12 September 2025. United States rules sit four revisions behind the international standard text, and that gap is checkable rather than rhetorical. For a buyer it means international standards and the national rule can disagree about a hazard class for months at a time.
Boundary condition. These figures measure United States Google search behaviour, not a census of cosmetics buyers. Google groups msds with material safety data sheet, and the bare acronym SDS also absorbs unrelated chemistry lookups. Read the direction, not the absolute population. One practical inference is narrow and safe: a supplier still writing MSDS on a 2026 document is working from a template that predates the 2012 alignment, which is worth one extra question about how recently their hazard data was reviewed.
What a Certificate of Analysis Actually Proves

A certificate of analysis beats every other supplier document at one narrow job: proving that one identified batch was tested and met agreed limits on the day it left the factory. Outside that job it proves very little. No binding instrument in United States or European Union cosmetic law fixes the fields of a commercial COA, so what arrives is whatever the contract earned. Buyers arriving from medication manufacturing expect a mandated field set and don’t find one here.
Two documents share the name and aren’t this thing. In one narrow case, the United States Food and Drug Administration issues a genuine batch certificate for certifiable colour additives, described later in this article. The SCCS Notes of Guidance, 12th revision (SCCS/1647/22), issued by the European Union’s independent Scientific Committee on Consumer Safety, carries an Appendix 6 listed in reproduced contents pages as “Requirements for the Certificate of Analysis for a Cosmetic Ingredient”; the appendix text itself was not retrieved here, because the source document runs past this review’s page ceiling. Recommended in non-binding scientific guidance addressed to a safety assessor isn’t the same as required by law in a purchase order.
The COA Commitment-and-Silence Teardown. Read the certificate field by field and name what each field commits the supplier to, and, more usefully, what it doesn’t.
| Field | What it commits the supplier to | What it does not prove |
|---|---|---|
| Supplier name and site | Which legal entity and which plant stands behind the result | That the plant made it; a broker can reissue another site’s data |
| Batch number | Traceability to one manufactured lot | That the lot in your warehouse is the lot on the page |
| Manufacture and issue dates | When the material was made and when it was tested | Remaining shelf life after transit and storage |
| Attribute list | Which physical and chemical properties were examined | That unexamined attributes are acceptable |
| Specification limits | The agreed pass band, with units | That the band matches your specification rather than the supplier’s |
| Actual results | Measured values for this specific batch | Batch homogeneity, or the result of any retest |
| Test method reference | How each number was obtained | Comparability with a different method giving a different number |
| Laboratory identity and accreditation | Who ran the analysis and under whose scope | That accreditation covers the specific test cited |
| Signatory and storage conditions | A named person accepting the document, plus transport and storage terms | That those conditions were held; missing temperature data makes the certificate unreliable |
Process limits on a certificate are defined and justified by the manufacturer, not drawn from one universal regulatory table. Health Canada’s good manufacturing practice guidance puts specification setting on the manufacturer, and the United States Food and Drug Administration states it has no required test list for every cosmetic product or ingredient. Both point the same way: COA content is contract-defined, which is why a strong quality management system and a written specification matter more than the document template. Chemical data on a certificate is only as useful as the specification it’s measured against, which is why research and development (R&D), quality and compliance teams should agree the attribute list before the first order rather than after the first rejection.
Certificates are also not the only batch evidence a brand holds. Cosmetic stability testing generates its own report against its own protocol, and a COA on a raw material says nothing about how the finished formulation behaves at month nine, or about packaging compatibility once the physical properties of the container come into play.
What an SDS Actually Proves, and Who It Is Written For

For a worker opening a drum, the safety data sheet is the document written with them in mind. OSHA’s hazard communication standard names employers and employees, including employers further down the supply chain, as its audience, and the sheet organises everything by hazard rather than by quality, because it assumes a reader who is handling the material, not releasing it to stock.
In the rule text, the Occupational Safety and Health Administration sets that audience: 29 CFR 1910.1200(b)(1) requires chemical manufacturers and importers to evaluate the hazards of the chemicals they produce or import, and requires all employers to provide safety information to their employees about the hazardous chemicals to which they’re exposed. Paragraph (b)(2) extends the section to any chemical known to be present in the workplace such that employees may be exposed under normal conditions of use or in a foreseeable emergency. Worker exposure is the trigger, and it’s the whole of the trigger. Chemical hazard drives the content, safety standards fix the format, and neither depends on which industry the buyer happens to work in.
Europe’s counterpart, REACH Article 31(6), fixes the format of 16-section safety data sheets in heading order, the GHS 16-section format that appears on every European raw-material document: identification; hazards identification; composition and information on ingredients; first-aid; fire-fighting; accidental release; handling and storage; exposure controls and personal protection; physical and chemical properties; stability and reactivity; toxicological information; ecological information; disposal; transport; regulatory information; other information. Article 31(9) adds the update rule: revised without delay on new hazard information, marked with a revision date, and pushed free of charge to every recipient of the preceding 12 months.
Disclosure thresholds are where the sheet becomes a working tool for a formulator. Under Article 31(3) an unclassified mixture still owes a sheet on request once a health- or environment-hazardous substance reaches 1 percent by weight, or 0.1 percent for a carcinogen category 2, reproductive toxicant 1A/1B/2, skin or respiratory sensitiser category 1, or a candidate-list substance. Worked case: a surfactant blend containing 0.4 percent of a category 1 skin sensitiser sits above the 0.1 percent sensitiser trigger and below the 1 percent general trigger, so the sensitiser alone pulls the mixture into the disclosure duty.
That threshold logic explains a question buyers raise constantly. Section 3 of a raw-material sheet often sums to well under 100 percent, because only hazardous constituents carry a disclosure trigger at all. Geraldine Garrs CChem, an independent cosmetic safety assessor, states it plainly:
“If the raw material is a mixture, you will see in Section 3 that the mixture rarely adds up to 100% – this is because the SDS only has to list Hazardous materials.”
One downstream use case sits beside the workplace one, and it’s frequently mistaken for the primary purpose. In transport, the United States Pipeline and Hazardous Materials Safety Administration stated in a 2015 rulemaking notice that a current safety data sheet, “although not required, is one form of information that may be used to satisfy the emergency response information requirements”. That sheet is one permitted vehicle for emergency response information, not the duty itself. In practice, a workplace safety document isn’t a shipping document, and treating it as one leads buyers to request the wrong paperwork from the wrong party.
Does a Finished Cosmetic Even Need a Safety Data Sheet?

A finished cosmetic packaged for retail sale to a consumer generally falls outside the United States hazard communication section entirely. Drums of the same formulation moving between two businesses don’t. Carve-out logic tracks the container and the handler, never the word cosmetic, and reading it any other way is the single most expensive mistake in this subject.
Two paragraphs do the work, and they’re different animals. Paragraph (b)(5) is introduced “This section does not require labeling of the following chemicals:” — a labelling carve-out only. Paragraph (b)(6) is introduced “This section does not apply to:” and (b)(6)(viii) covers “Cosmetics which are packaged for sale to consumers in a retail establishment, and cosmetics intended for personal consumption by employees while in the workplace”. Several widely-read pages cite the first as though it were the second. OSHA’s own 1994 rulemaking preamble settles it: “OSHA did not exempt consumer products from any provisions of the original final rule other than labeling.”
Question 1, What’s in the container? A retail-packaged finished cosmetic, or bulk material, raw material, work-in-process, or product being repackaged?
Question 2, Who opens it? A consumer, or a worker whose duration and frequency of exposure exceeds normal consumer use?
Two consumer answers land on no SDS owed. Any other combination lands on SDS owed by the upstream supplier of the hazardous material.
Retail-packaged finished cosmetic going to a consumer. Worked case: a 50 ml retail moisturiser jar sold through a beauty counter. Paragraph (b)(6)(viii) removes it from the section, and (b)(6)(ix) independently exempts workplace use where the duration and frequency of exposure is “not greater than the range of exposures that could reasonably be experienced by consumers when used for the purpose intended”.
Bulk, raw material, work-in-process, or repackaged product moving business to business. Worked case: a 200 kg drum of surfactant delivered to a filling line, or hotel amenity bottles filled from bulk toiletries. Neither is packaged for sale to consumers in a retail establishment, and the handler’s exposure is nothing like a consumer’s.
Column 2 is where an ODM procurement reader actually lives, and there’s a 1995 OSHA letter of interpretation directly on the point. Replying to a firm that bought bulk toiletries and repackaged them into hotel amenity sizes, OSHA held that the definition of produce includes repackage, that “Manufacturers who provide bulk supplies for repackaging are clearly covered by the HCS and would be required to meet the MSDS requirements for hazardous chemicals”, and that “Repackaging of hazardous bulk materials would not qualify for the consumer product exemption”. That letter predates the 2012 alignment, which is why it says MSDS, a useful dating artefact in its own right.
Europe reaches the same boundary by different machinery. REACH Article 2(6)(b) provides that Title IV “shall not apply to the following mixtures in the finished state, intended for the final user”, listing cosmetic products as defined in Regulation (EC) No 1223/2009. Article 31 sits inside Title IV. So the finished retail cosmetic is lifted out of the sheet duty in both regimes, and in both regimes the upstream duty survives untouched, at 1910.1200(g)(1) in the United States and Article 31(1) in Europe.
Where the carve-out stops. A finished cosmetic that itself meets hazard classification criteria — certain hair dyes, nail products, alcohol-based sprays and flammable aerosols, where combustibility and flammability decide the class — is still a classified mixture, and the exemption for finished cosmetics doesn’t convert a flammable aerosol into a non-hazardous one. Check the classification before relying on the category. Treating the exemption as a blanket safety compliance answer hides real safety risks for the people filling, decanting and cleaning down.
Worked example, carried through the rest of this article. Lumen Botanica is a hypothetical skincare brand placing its first contract order: 200 kg of a phenoxyethanol-based preservative blend, drummed in 8 units of 25 kg, alongside a finished night serum filled and labelled for retail. Numbers in this example are illustrative. The blend is a classified mixture, so a safety data sheet is owed on the drums outright. Which components drive the content of that sheet is a cut-off question, and cut-offs sit per hazard class rather than in one table; the figures this article can quote with an article number behind them are the European ones at Article 31(3), 1 % by weight and 0.1 % for category 2 carcinogens, reproductive toxicants and category 1 sensitisers, which govern a different case, the unclassified mixture supplied on request. The serum leaves the plant labelled for a consumer, so the same supplier owes no sheet on it. One order, two answers, and the split lands exactly where the container and the recipient change.
Who Owes Which Document: Four Parties, Four Different Duties

Four parties sit in a typical cosmetic supply chain and each owes something different. Sending every request to the brand owner, or to the contract manufacturer, wastes weeks. For a bulk buyer, the duty that matters most sits furthest upstream, at the party that made or imported the hazardous raw material in the first place.
29 CFR 1910.1200(g)(1) states that chemical manufacturers and importers shall obtain or develop a safety data sheet for each hazardous chemical they produce or import, and paragraph (g)(6) requires them to pass it downstream with the first shipment. That duty is untouched by the retail exemption, because the drum was never packaged for sale to consumers in a retail establishment. REACH Article 31(1) puts the identical obligation on the supplier of a substance or mixture meeting classification criteria under Regulation 1272/2008, or listed as persistent, bioaccumulative and toxic, or on the candidate list. That duty was written for chemical manufacturing, and it does not soften because the chemical ends up in a face cream.
| Party | Owes the SDS? | Owes the COA? | Cannot answer for |
|---|---|---|---|
| Raw material supplier | Yes, under 1910.1200(g)(1) and REACH Art 31(1) for hazardous material | Per contract, per delivered lot | Finished-product performance |
| Contract manufacturer | For the bulk it supplies onward, yes; for retail-packed goods, generally no | Yes, for each finished batch it releases | Hazard data for a raw material it only buys |
| Brand owner / responsible person | No, as such; holds the safety file | Collects and retains, does not issue | Test results it never generated |
| Distributor / importer | Yes to commercial customers; a retail distributor that sells only to consumers is relieved on notice | Passes through what it receives | Anything about the original producer’s process |
Outsourcing a task never transfers the statutory duty. Whoever a regulation names as responsible stays responsible, which is why document ownership belongs in the contract manufacturing agreement rather than in an email thread six months later. Settle who issues, who retains and who reissues before the first purchase order, because document ownership in an ODM programme is a clause worth drafting rather than inheriting. Anyone starting a cosmetic line should treat it as a commercial term, not boilerplate.
Often true, and lawful. OSHA’s preamble records that manufacturers and importers “need not provide material safety data sheets to retail distributors which have informed them that the retail distributor does not sell the product to commercial customers or open the sealed container to use it in their own workplaces” — while a retail distributor that does sell to commercial customers “shall provide a material safety data sheet upon request”. Tell your distributor, in writing, that you’re a commercial customer. That single sentence switches the duty back on upstream.
Applied to the hypothetical order, the four duties stop overlapping. Lumen Botanica owes nothing upstream; the blend manufacturer owes the sheet on the 200 kg it shipped and, under REACH Article 31(9), owes a revision without delay once new hazard information appears; the contract manufacturer owes its own workers access to that sheet for as long as the drums sit in its store; and the brand owes a safety file that cites the data, not the sheet. Writing those four lines into the manufacturing agreement takes an afternoon. Reconstructing them after a complaint takes weeks.
When to Ask for Which Document: The 11-Scenario Ask-or-Skip Roster

For a specific purchase, the request list changes with what’s in the container and who receives it. Below, the 11-Scenario Ask-or-Skip Roster answers 11 situations a cosmetics buyer meets in practice, each sorted onto the bulk branch or the retail branch of the fork above rather than by product category.
| # | Scenario | Ask for | Can skip | Limitation / not suitable for |
|---|---|---|---|---|
| 1 | Buying a 200 kg drum of surfactant | SDS plus COA plus specification | Nothing | A COA alone cannot be read without the specification |
| 2 | Repackaging bulk into hotel amenity sizes | SDS from the bulk supplier; you become a producer | Nothing | Retail exemption does not reach repackaging |
| 3 | Private-label finished units, retail-packed | COA per batch; safety file evidence | SDS, unless the product is itself classified | Fails for aerosols, nail products, alcohol sprays |
| 4 | Salon or spa professional-size packs | SDS where staff exposure exceeds consumer use | Batch COA if not doing incoming testing | Judgement call on duration and frequency of exposure |
| 5 | Air shipment of a finished cosmetic | Classification decision; carrier’s stated requirement | SDS as a legal transport document | Operator variations override; check the carrier, not the rule |
| 6 | Customs entry into the United States | Manufacturer and importer declarations, product description | SDS as entry data | Colour-additive status is checked separately |
| 7 | Warehouse or marketplace onboarding | Whatever the counterparty demands, in writing | Arguing that no law requires it | A commercial requirement, not a compliance one |
| 8 | Safety assessor building an EU dossier | Specification and COA per ingredient; SDS where one exists | Nothing | Unclassified ingredients may have no sheet at all |
| 9 | Buying through a broker or reseller | Original producer identity; producer’s COA | Nothing | Qualifying the broker is not qualifying the producer |
| 10 | Colour additive purchase | FDA certification lot number on the label | Supplier’s own certificate as sole proof | Exempt colours under Part 73 carry no lot number |
| 11 | Recall or complaint investigation | Retained COAs for every implicated lot | Nothing | Missing lot records force a wider recall than the facts require |
Read against the hypothetical order, only three rows fire for Lumen Botanica: row 1 for the 200 kg of blend, row 2 for the 25 kg drums moving between two sites, and row 3 for the retail-labelled serum, where the retail exemption in paragraph (b)(6)(viii) means the honest answer is that no sheet is owed. The other 8 rows are noise for this buyer, which is the point of sorting by container rather than by product category.
Row 5 deserves its own sentence because the answer is genuinely two-sided. 49 CFR 172.200(a) attaches the shipping paper duty to a hazardous material, not to a cosmetic as such, and 172.602(b)(3) permits a shipping paper, another document carrying the basic description and technical name, or a cross-reference to the Emergency Response Guidebook. So no transport rule requires a safety data sheet for a correctly classified non-dangerous cosmetic. Individual carriers, though, impose their own terms: the IATA Dangerous Goods Regulations record at least one operator variation under which an airline requires an English sheet for most dangerous goods consignments. Check the operator variation rather than assuming either answer. Transporters asking for a sheet are asking commercially; safety and regulatory standards for the consignment are settled by the classification.
Where the Technical Data Sheet Fits: One Artefact, Three Trade Names

The technical data sheet outperforms the certificate at exactly one thing, telling you what the material is supposed to be, and it isn’t a third peer document at all. TDS, Product Specification and Sales Specification are three trade names for the same artefact, and some suppliers compress the first into a single word, datasheet, without changing anything behind it.
A certificate is defined by reference to it, which means a COA arriving without a specification can’t be read; the ISO 22716 clause set, as rendered by Taiwan’s Food and Drug Administration, makes acceptance of a supplier’s certificate conditional on established supplier competence, agreed test methods and audit.
Both a government export-development agency’s guidance and practising safety assessors describe the same relationship: a specification is built on the actual analysis of at least three batches and lists each test with an acceptable range, and the certificate then carries the same list of tests with the actual results obtained for one batch. Water content specified at 1–2 percent; this batch measured 1.4 percent. Think of it this way: the specification is the yardstick, and the certificate is the reading.
| Document | Question it answers | Batch-specific? | Example field |
|---|---|---|---|
| TDS / specification | What should this material be? | No; product-generic | Water content 1–2 %; viscosity band; chemical composition |
| COA | What was this batch? | Yes | Water content 1.4 %, batch number, test method |
| SDS | How can this material hurt someone? | No; substance-level | Potential health hazards, first-aid, safe handling |
Technical performance data and product performance claims live on the TDS, not on the certificate. That’s why accepting a technical data sheet in place of a COA quietly removes the only batch evidence in the transaction, and why suppliers who send one document and not the other aren’t necessarily being obstructive; many simply have one of the two prepared. TDS and COA are read together or not at all.
Boundary condition. Differently-named sheets can sometimes serve the same regulatory purpose; United Kingdom guidance on detergents, for example, allows required ingredient information to be supplied through a technical data sheet, a safety data sheet or a similar method. Only the narrow claim is defensible: a product-generic specification doesn’t substitute for a batch-specific certificate.
Where These Documents Land: The EU Product Information File and United States MoCRA Filings

Neither document is filed with a regulator in either jurisdiction, which is the single most useful thing to know about regulatory compliance in this area. Europe requires a product information file to be kept available; the United States requires facility registration and product listing submissions. Filing and retention are different duties, and mixing them is the most common safety and compliance error in a first submission.
Reading the operative provisions side by side shows something the competitor set never states: both instruments mandate data and name no artefact.
Regulation (EC) No 1223/2009 Article 11(2) lists five items for the product information file: a description of the product; the cosmetic product safety report; a description of the method of manufacturing with a statement on good manufacturing practice compliance; proof of claimed effect where justified; and data on animal testing. Article 11(1) sets the retention clock at 10 years following the date the last batch was placed on the market. Annex I, the safety report structure, runs to 14 headings covering quantitative and qualitative composition, physical and chemical characteristics and stability, microbiological specifications, impurities and packaging material purity, exposure, toxicological profile with a margin of safety, and the assessor’s credentials. Toxicity data is demanded in detail; a certificate of analysis appears in neither list.
On the United States side, 21 U.S.C. § 364c governs what’s submitted. Registration contents at § 364c(b)(2) are facility name and address, email and phone, a United States agent for a foreign facility, the facility registration number, all brand names used at the facility, and product category with responsible person. Listing contents at § 364c(c)(4)(A) are the facility registration number, responsible person name and contact, product name as it appears on the label, cosmetic category, the ingredient list per 21 CFR 701.3, and the product listing number. Section 364d is separate and governs safety substantiation records that must be maintained rather than filed. Neither enumeration contains a certificate of analysis or a safety data sheet.
Two details in § 364c save contract-manufacturing brands real work. Under § 364c(a)(3) a facility that manufactures or processes cosmetic product for multiple responsible persons registers once, not once per brand. Under § 364c(e) brand names submitted under (b)(2)(D) and facility registration numbers appearing in listings are withheld from public disclosure.
The Food and Drug Administration states directly that cosmetic product facility registration and product listing “is neither a cosmetic approval program nor a promotional tool” and that it “does not issue ‘certificates’ for cosmetic product facility registrations or product listings”. Buyers ask for that certificate constantly. Describe the obligation by statute instead, and keep the scope words attached every time: the position is specific to facility registration and product listing.
The only place in either regime where anyone has published a heading of that name is Appendix 6 of the SCCS Notes of Guidance, 12th revision (SCCS/1647/22, adopted 15 May 2023, with corrigenda dated 26 October and 21 December 2023). Its heading carries that wording in every contents listing that reproduces it, and it’s non-binding scientific guidance addressed to safety assessors rather than to supply contracts. Recommended in guidance and required by law are different legal facts, and conflating them is how the claim that “EU law requires a COA for every ingredient” entered the search results in the first place. What the regulation requires is the data: composition with chemical identity, physicochemical characteristics, microbiological specification, purity. Certificates are one common vehicle for some of it.
One parallel duty on pack is worth keeping separate in your head: cosmetic labeling requirements govern what a consumer reads, while these filings govern what an authority can ask to see. Documents disclosed on request aren’t documents printed on a carton.
How to Verify a COA You Have Been Sent

Certificate verification failures cluster around two failure modes, and neither is a chemistry problem. Since neither document is filed with a regulator, the check falls to whoever receives the drum. Most common is a lot-number mismatch: the certificate on file describes a different batch from the one in the warehouse. Next comes accepting results at face value without comparing them against your own specification. Both are invisible to anyone who only checks that a document exists.
Verification and validation of a supplier follow a settled pattern, and verify-then-rely is its short name. Approve the supplier, validate the first 3 consecutive lots against every attribute within a documented tolerance, 5 lots for higher-risk material, then monitor by spot testing 1 lot in 5 to 1 in 10. Taiwan’s Food and Drug Administration, rendering the ISO 22716 clause set, permits acceptance of a supplier’s analysis certificate only where supplier competence, agreed test methods and appropriate inspection and audit have been established. An approved development sample never substitutes for per-batch release, which is a distinction that belongs in the same conversation as manufacturing quality control.
Colour additives are the one real exception. For any product containing a certifiable colour additive there is a free, public, government-hosted verification path that does not depend on the supplier at all. In FDA’s own words: “If we find that the sample meets these requirements, FDA issues a certificate for the batch. The certificate identifies the color additive, the batch weight, the uses for which the color additive is certified, the name and address of the owner, and other information as required.” A unique lot number is assigned to the batch under 21 CFR 80.31. Certifiable colours sit in 21 CFR Parts 74 and 82, exempt colours in Part 73, certification procedures in Part 80.
Three steps follow from that. First, check the label: a certified colour additive must be labelled with the colour additive name as it appears in the CFR, general limitations for use, any other limitations or tolerances, and the FDA certification lot number, under 21 CFR 70.25. Second, cross-check the supplier against FDA’s published list of companies requesting colour certification within the last two years. Third, know the stakes: using an uncertified form of a colour additive that requires certification renders an FDA-regulated product adulterated, and colour-additive violations are a common cause of import refusal.
For Lumen Botanica the verification plan is three lines long. Check every attribute on the first 3 lots against the agreed specification; hold any accelerated stability result, 3 months at 40 °C, for example, as specification evidence rather than batch evidence; then spot-check 1 lot in 5 for the following 12 months. Illustrative figures, but the shape of the plan is what transfers.
RFQ checklist — copy these into your quote request:
| Parameter | Recommended range | Why it matters | How to verify |
|---|---|---|---|
| COA issue window | Within 30 days of dispatch | A stale certificate may predate a reblend or retest | Compare issue date to bill of lading date |
| Lot identity match | 100 % of delivered containers | Lot mismatch is the most common audit finding | Read the drum label against the certificate, per container |
| Specification attached | Every attribute, with units and limits | Results without limits cannot be judged | Require the TDS or specification as a contract annex |
| Test method cited | Named method per attribute | Two methods can give two legitimate numbers | Check the method reference sits beside each result |
| Skip-lot testing plan | First 3–5 lots full, then 1 in 5 to 1 in 10 | Sets when you may rely on the supplier’s numbers | Written incoming inspection procedure |
| Storage and transport terms | Stated on the certificate | Missing temperature data voids reliance | Data logger or carrier record on arrival |
| Original producer named | Always, for brokered goods | A broker’s approval is not a producer’s approval | Ask for the producing site name and address |
Four Dated Movements Reshaping Cosmetic Documentation in 2026

For anyone building a document policy this year, four dated movements matter more than any market forecast. The verification steps above are the part of a document policy these movements touch first. Each has already happened or has a fixed date attached, and each changes what a buyer should accept from a manufacturer or supplier over the next few quarters.
15 January 2026, OSHA extended the hazard communication compliance dates. Substance evaluation for chemical manufacturers and importers moved from 19 January 2026 to 19 May 2026, OSHA pushed all other dates back by four months, and in the interim parties may comply with the previous standard, the updated standard, or both. Original training deadlines of 20 July 2026 therefore move to 20 November 2026 on OSHA’s four-month shift. Procurement consequences are immediate and counterintuitive: a sheet received before 19 May 2026 may lawfully be in either format, so a format change between two batches from the same supplier isn’t by itself evidence of a supplier-quality problem. Advice telling buyers to treat inconsistent formatting as a red flag is wrong for the current window.
31 July 2026, the EU fragrance-allergen placing window has closed. Regulation (EU) 2023/1545 requires individual labelling of additional fragrance allergens above 0,001 % in leave-on and 0,01 % in rinse-off products, treating prehaptens and prohaptens as equivalent. Non-compliant product could be placed on the Union market until 31 July 2026 and made available until 31 July 2028. As of today only sell-through of existing stock remains, so incoming raw-material documentation needs to carry allergen content at those thresholds, not merely a general statement.
11 February 2026, FDA added registration status and renewal date fields to the Cosmetics Direct portal, with automated email reminders to the facility contact, United States agent and additional contacts. Renewal is biennial, with an abbreviated renewal path where nothing has changed, and the clock runs from your initial registration date rather than a common calendar date. FDA’s own worked example: a registration received on 20 February 2024 renews by 20 February 2026. Any article printing a single industry-wide renewal date is wrong for most facilities.
Recall arithmetic, and why all of this is commercial. The EU Safety Gate 2025 report records 4,671 alerts, roughly 100 per week, with cosmetics the most-notified category for a third consecutive year at 36 percent. Chemical risk drove 53 percent of all alerts, and 77 percent of chemical-risk cosmetic alerts trace to a single banned substance, BMHCA, which produced 1,278 alerts in one year under a ban applying retroactively. Retroactivity is the detail that decides a brand’s exposure: stock that was lawful at purchase became notifiable later, and batch-level certificates tied to lots are what let a brand scope a recall to the affected lots instead of pulling everything.
Several compliance-software vendors say on their own published roadmaps that they are automating the collection, validation, classification and updating of safety data sheets, because the SDS is structurally regular; 16 numbered sections in a fixed order. COAs have no mandated structure at all, which is exactly why they can’t be automated the same way. Ironically, the document that looks more technical is the one leaving the buyer’s desk; the one that looks like routine paperwork is the one that stays. Staff the certificate review, not the sheet filing.
Common Failure Modes: When a Document Request Goes Wrong

Four requests fail predictably, and each has a specific correction rather than a general warning. None of the four dated movements above prevents them, because these are request-writing errors rather than regulatory ones.
- Demanding an SDS from a brand owner. Brand owners hold a safety file and never generated hazard data for a raw material they only buy. Ask the party that produced or imported the hazardous material.
- Reading a supplier refusal as evasion. A retail distributor that has told its upstream it doesn’t sell to commercial customers is lawfully relieved of the duty. State in writing that you’re a commercial customer and the obligation reactivates.
- Treating a COA as evidence of legal compliance. Certificates report measured results against agreed limits. They say nothing about product safety substantiation, classification, or whether the product may be sold in your market.
- Accepting a certificate with no specification behind it. Numbers without limits can’t be judged, and a supplier’s internal limits may be wider than yours.
Asking for a document nobody owes you is not itself an error. OSHA’s own 1994 rulemaking preamble records that the agency “certainly cannot prevent anyone from providing MSDSs for products that are not covered by the rule. In fact, it is often useful to know that there is no hazard associated with the product.” A voluntary sheet is a legitimate category, and requesting one is reasonable practice, provided you know you’re making a commercial request rather than citing a legal duty.
Frequently Asked Questions
Are MSDS and COA the same?
No. A material safety data sheet, now called a safety data sheet, reports the hazard profile of a substance or mixture in a 16-section format. A certificate of analysis reports measured test results for one specific batch against an agreed specification. One is substance-level and hazard-focused; the other is batch-level and quality-focused.
Is COA the same as SDS?
No. An SDS is the current name for the MSDS and covers hazard classification, safe handling, first-aid and emergency response for a material in any drum. A COA covers batch number, test methods, specification limits and the actual results for one drum.
Asking an SDS whether your batch passed is asking the wrong document, and asking a COA whether the material is flammable is the same mistake in reverse. Suppliers send both because they answer different questions, not because one duplicates the other.
What does MSDS mean in cosmetology?
MSDS means material safety data sheet, the retired name for the hazard document that accompanies chemical products used in salons and studios. Since the 2012 alignment with the Globally Harmonized System, the correct term in the United States is safety data sheet, and the content changed with the name: a fixed 16-section order replaced the free-form layouts that came before it.
Salon and studio operators still meet the older word on supplier templates, so treat MSDS on a current document as a dating clue rather than a different obligation.
What products do not require MSDS?
Cosmetics packaged for sale to consumers in a retail establishment fall outside 29 CFR 1910.1200 under paragraph (b)(6)(viii), and cosmetics intended for personal consumption by employees at work are treated the same way. A separate consumer product exemption at (b)(6)(ix) applies where workplace exposure is no greater in duration and frequency than ordinary consumer use.
In the European Union, REACH Article 2(6)(b) lifts cosmetic products in the finished state, intended for the final user, out of Title IV, which is where the Article 31 sheet duty sits. None of this reaches bulk material, raw materials, work-in-process or repackaged product moving between businesses, and none of it converts a classified mixture such as a flammable aerosol into an exempt one.
Is a COA required for every batch of production?
No statute in United States or European Union cosmetic law requires a certificate of analysis per batch. Any requirement, where it exists, comes from your purchase contract and your own incoming inspection procedure, which is why it varies so widely between suppliers. Quality practice still points strongly toward per-batch certificates: they’re what allow a recall to be scoped to affected lots rather than to all stock, and an approved development sample doesn’t substitute for batch release.
Set the expectation in the supply agreement, name the attributes and methods, and state what happens when a certificate is missing or late.
Who issues COAs?
Whoever manufactured and tested the batch issues it, usually the raw material supplier or the contract manufacturer. Brand owners collect and retain certificates; they don’t issue them. In practice a third-party laboratory may run the tests behind a certificate, but the document that travels with the lot is still issued by whoever manufactured and released it.
How often should COAs and SDSs be updated?
Update logic runs in opposite directions, and the asymmetry is written into law on one side only. REACH Article 31(9) requires a safety data sheet to be revised without delay when new hazard or risk-management information appears, when an authorisation is granted or refused, or when a restriction is imposed. Nothing sets a re-issue rule for a certificate of analysis, because a certificate documents one batch: the next batch simply receives its own.
The revised sheet carries the mark “Revision: (date)” and goes free of charge to every recipient of the preceding 12 months. Keep the current sheet on file per material, and one certificate per delivered lot.
Use the Two-Question Document Fork to decide what your transactions actually trigger, then write the answer into the supply agreement rather than discovering it during an audit. To work through the documentation package for a specific formulation and market, contact NEXO Beauty Labs.
What this article does not cover. Nothing here is legal advice, and no section addresses drug-cosmetic combination products, sunscreens regulated as drugs in the United States, national language requirements for sheets supplied inside the European Union, United Kingdom REACH and GB CLP divergence after Brexit, or IFRA certification for fragrance materials. Jurisdiction-specific questions belong with a qualified regulatory adviser or safety assessor.
References and Sources
- 29 CFR § 1910.1200, Hazard Communication (Cornell Legal Information Institute)
- 29 CFR § 1910.1200, current text (eCFR)
- OSHA Letter of Interpretation, 27 November 1995, repackaging of bulk toiletries
- OSHA, Hazard Communication Final Rule preamble, 9 February 1994, 59 FR 6126
- OSHA, Hazard Communication rulemaking, compliance date extension
- OSHA, Hazard Communication rulemaking history
- Regulation (EC) No 1907/2006 (REACH), Article 31, requirements for safety data sheets
- Regulation (EC) No 1907/2006 (REACH), Article 2, application
- Regulation (EC) No 1223/2009 on cosmetic products
- Regulation (EC) No 1223/2009, Annex I, Cosmetic Product Safety Report
- Regulation (EU) 2023/1545, fragrance allergen labelling
- 21 U.S.C. § 364c, registration and product listing
- 21 U.S.C. § 364d, safety substantiation
- FDA, Registration and Listing of Cosmetic Product Facilities and Products
- FDA, Color Certification, frequently asked questions
- FDA, Color Additives in Foods, batch certification
- FDA, Product Testing of Cosmetics
- 49 CFR § 172.200, Applicability of shipping paper requirements
- SCCS Notes of Guidance, 12th revision (SCCS/1647/22)
- Safety Gate 2025 report, EU Publications Office
- Health Canada, Good manufacturing practices for cosmetics
- Taiwan FDA, ISO 22716 cosmetic good manufacturing practice clauses
- Supplier verification of certificates of analysis, quality management reference
- Geraldine Garrs CChem, Suppliers’ documents for cosmetic safety assessment
- Cosmetics Business, When SDS and IFRA documentation are required (authored by a consultancy that sells safety data sheet authoring services)
Why beauty brands work with NEXO
NEXO Beauty Labs supports skincare, body care, sun care, hair care, and private label brands with formulation, sampling, filling, quality control, and export-ready launch support.
Before quotation, we help clarify product category, active direction, formula stage, package choice, compliance market, MOQ, sampling schedule, and required documents.
Request a Cosmetic Quote








