Quality Standards: FDA, CE, EU TST Explained for Lash Brands.

Your lash brand is gaining traction. Orders are growing. Then a retailer sends an email: "Do you have FDA registration? We need it for shelf placement." A distributor in Germany asks: "Where is your CPNP notification number?" Your freight forwarder warns: "Customs is holding the shipment — they want the CE declaration of conformity."

Suddenly, certifications aren't optional paperwork — they're the gatekeeper between your product and revenue. But the landscape is confusing: FDA, CE, EU TST, ISO 22716, CPNP, MoCRA — a wall of acronyms with different meanings, requirements, and costs depending on your target market. This guide breaks down every standard, what it covers, who needs it, and how to get it — without wasting money on certifications you don't need.

Why Certifications Matter for Your Lash Brand

Three forces are making compliance non-negotiable for lash brands in 2026:

1. Customers Are Asking

Beauty consumers are increasingly ingredient-conscious and safety-aware — especially for products applied near the eyes. Social media reviews now routinely ask: "Are these FDA approved?" "Do they have safety testing?" A brand that can answer "yes, here's our certification" converts. A brand that can't answer loses the sale to one that can.

2. Retailers and Distributors Require It

Major beauty retailers — Sephora, Ulta, Boots, Douglas, and even mid-tier chains — now require documented compliance before they'll stock a new brand. Amazon's beauty category has tightened its documentation requirements significantly. If you want shelf placement beyond your own Shopify store, certifications are table stakes.

3. Customs Authorities Are Demanding It

US Customs and Border Protection (CBP) and EU customs authorities have increased scrutiny on imported cosmetics. Shipments without proper documentation face delays, storage fees, and in some cases destruction. A missing FDA registration or CE declaration can turn a profitable shipment into a loss — not because your product is unsafe, but because your paperwork is incomplete.

Certification Comparison: FDA vs CE vs EU TST vs ISO 22716

Before diving into each standard individually, here is the landscape at a glance. Use this table to understand which certifications apply to your specific situation:

Standard	What It Covers	Who Needs It	Cost Range (USD)	Timeline
FDA Registration	US market entry — facility registration + product listing via VCRP. Confirms your products are manufactured in a registered facility, not FDA "approval."	All lash brands selling in the US, including online sales to US customers	$0 (self-registration) to $500-1,500 (consultant-assisted)	1-4 weeks
CE Marking (EU)	EU/EEA market entry — declaration that product meets EU Cosmetics Regulation 1223/2009 safety requirements	All lash brands selling in the EU, UK (UKCA post-Brexit with overlap), and EEA countries	$1,500-5,000 (testing + documentation + Responsible Person)	4-12 weeks
EU TST (Toxicological Safety Testing)	Safety substantiation — microbial, heavy metals, formaldehyde, irritation, preservative efficacy testing	Required as part of CE compliance; strongly recommended for any brand selling near-eye products regardless of market	$800-3,000 per product formulation	3-6 weeks
ISO 22716 (GMP)	Good Manufacturing Practices for cosmetics — facility processes, documentation, hygiene, traceability, and quality management	Recommended for all lash manufacturers; increasingly required by major retailers and distributors globally	$3,000-8,000 (audit + certification, recurring)	3-6 months

FDA Requirements for Lashes Sold in the United States

The FDA does not "approve" cosmetics (including false eyelashes) before they go to market. What the FDA requires is registration and compliance — your facility and products must be registered, and your labeling and safety practices must meet federal standards.

Cosmetic vs Medical Device — The Critical Distinction

Under FDA classification, standard false eyelashes are cosmetics, not medical devices. They fall under the Federal Food, Drug, and Cosmetic Act (FD&C Act) as products "intended to be applied to the human body for cleansing, beautifying, promoting attractiveness, or altering the appearance." This means they follow cosmetic regulations — not the more stringent medical device pathway (510(k) premarket notification).

Important exception: If your lashes make therapeutic claims (e.g., "promotes lash growth," "prevents lash loss," "medicated lash band"), the FDA may classify them as a drug or medical device, triggering a completely different and far more expensive regulatory pathway. Stick to beauty claims and you stay in the cosmetic lane.

VCRP Registration (Voluntary Cosmetic Registration Program)

The VCRP is a voluntary program — but in practice, it is expected by retailers and provides a public record of your compliance. Registration has two parts:

• Facility registration: Where the lashes are manufactured. The factory (not the brand owner) typically registers their manufacturing facility. This is why working with an FDA-registered factory matters — your manufacturer should already have this in place.
• Product formulation statement: What is in the product. For false eyelashes, this covers the fiber material (PBT, faux mink, silk), band material, and any adhesive if included.

Registration is free through the FDA's online portal, but the paperwork requires precision. Many brands use a regulatory consultant ($500-1,500) to ensure correct filing. If your manufacturer is already FDA-registered, your path is significantly shorter.

MoCRA 2023 — What Changed

The Modernization of Cosmetics Regulation Act (MoCRA), signed into law in December 2022 and fully effective by 2024, represents the biggest update to US cosmetics regulation since 1938. Key changes affecting lash brands:

• Mandatory facility registration: Previously voluntary under VCRP, now mandatory. All facilities manufacturing cosmetics for the US market must register with the FDA and renew every two years.
• Product listing requirement: Each cosmetic product must be listed with the FDA, including ingredients and the responsible person's contact information.
• Adverse event reporting: Brands must maintain records of any adverse events (customer reactions, injuries) and report serious events to the FDA within 15 days.
• Safety substantiation: Brands must maintain records demonstrating that their products are safe under labeled conditions of use. For lashes, this means having safety data on materials, adhesives, and the finished product.
• Labeling updates: Labels must now include US contact information for the "responsible person" and identify fragrance allergens (relevant if your lash packaging includes scented components).

CE Marking for EU Market Entry

CE marking is not a certification you earn — it is a declaration you make. By affixing the CE mark, you (or your EU Responsible Person) declare that your product complies with all applicable EU regulations. For eyelashes, the governing regulation is EU Cosmetics Regulation (EC) No. 1223/2009.

The Responsible Person (RP)

Every cosmetic product sold in the EU must have a designated Responsible Person — a legal entity established within the EU who is accountable for regulatory compliance. This can be:

• The manufacturer (if they have an EU legal entity)
• The importer (your EU-based distributor)
• A third-party RP service provider (cost: approximately $500-2,000 per year, depending on product count)

The RP's name and address must appear on your product label. They hold the Product Information File (PIF) and are the point of contact for EU authorities. If something goes wrong, the RP is legally liable — choose carefully.

Product Information File (PIF)

The PIF is the central compliance document for any cosmetic product in the EU. It must contain:

• Product description: What the product is, how it is used, and for whom
• Cosmetic Product Safety Report (CPSR): Prepared by a qualified safety assessor, this is the scientific substantiation that the product is safe. It includes the safety assessment (Part A) and the safety information (Part B — toxicological profile, exposure data, undesirable effects data)
• Manufacturing method description: GMP compliance statement per ISO 22716
• Proof of effect claimed: If you claim "24-hour curl retention," you need data backing that
• Animal testing data: Statement that no animal testing was conducted (mandatory under EU ban)

The PIF must be kept for 10 years after the last batch of the product is placed on the market, and it must be immediately accessible to the RP at their EU address.

CPNP Notification

Before placing a cosmetic product on the EU market, the Responsible Person must notify the European Commission via the Cosmetic Products Notification Portal (CPNP). This is an electronic submission that includes product category, formulation, and label artwork. The CPNP makes your product information available to EU poison control centers and competent authorities. Notification is mandatory and must be completed before the first sale.

EU TST and Safety Testing Requirements

EU Toxicological Safety Testing (TST) is the scientific backbone of CE compliance. It is not a standalone certification — it is the testing that supports your Cosmetic Product Safety Report (CPSR). Without passing these tests, your safety assessor cannot sign off on your product, and you cannot legally affix the CE mark.

Core Safety Tests for Eyelash Products

• Microbial testing (ISO 17516): Total aerobic mesophilic bacteria, yeast, and mold counts must be below specified limits. Pathogens (Pseudomonas aeruginosa, Staphylococcus aureus, E. coli) must be absent. This applies primarily to lash adhesives and any liquid/gel components — dry lash fibers have lower microbial risk but should still be tested.
• Heavy metals analysis: Lead, mercury, arsenic, cadmium, antimony, and nickel levels must be below EU limits. Nickel is particularly relevant for lash bands that may contain metal traces from tooling. Even trace nickel above the limit can trigger allergic reactions in sensitized users.
• Formaldehyde and formaldehyde releasers: Some adhesives and preservative systems release formaldehyde over time. EU limits are strict: 0.05% for oral products, 0.1% for leave-on cosmetics. Lash adhesives used near the eye should be well below these thresholds.
• Skin irritation test (patch test / HRIPT): Human Repeat Insult Patch Test (HRIPT) on 50 human volunteers to confirm the product does not cause skin irritation or sensitization under normal use conditions. This is the gold-standard test for products applied near the eye.
• Preservative efficacy (challenge test): For products containing water (some lash adhesives), a preservative efficacy test (ISO 11930) demonstrates that the preservative system prevents microbial growth throughout the product's shelf life.

How Much Testing Do You Actually Need?

If your lashes are dry fiber products (no adhesive included in the tray), your testing burden is relatively light: heavy metals + microbial on the fiber material, plus a declaration that no CMR substances (carcinogenic, mutagenic, reprotoxic) are present. If your product includes lash adhesive, you need the full panel: microbial, heavy metals, formaldehyde, irritation, and preservative efficacy. The adhesive, not the lashes themselves, drives the majority of testing cost and complexity.

ISO 22716: Good Manufacturing Practices for Cosmetics

ISO 22716 is the international standard for Good Manufacturing Practices (GMP) in the cosmetics industry. Unlike FDA registration (which is about the product) or CE marking (which is about market access), ISO 22716 is about the manufacturing process itself — the facility, the people, the documentation, and the quality systems.

What Auditors Look For

An ISO 22716 audit covers every aspect of the production environment:

• Personnel hygiene and training: Workers must follow documented hygiene protocols. Training records must be current. The factory floor must show evidence that hygiene is practiced, not just written in a manual.
• Premises and equipment: Facility layout must prevent cross-contamination. Production areas must have adequate lighting, ventilation, and cleaning schedules. Equipment must be calibrated and maintained with records.
• Raw material management: Incoming materials must be inspected, tested, and traceable to supplier. Each raw material batch must have a Certificate of Analysis (CoA). Storage conditions (temperature, humidity) must be monitored.
• Production and batch records: Every production batch must have complete documentation: what was made, when, by whom, from which material lots, under what conditions. If a quality issue arises, batch traceability must pinpoint the affected products within hours, not days.
• Quality control laboratory: In-house testing capability or documented relationship with an external lab. QC test results must be retained and reviewed before product release.
• Deviations and complaints handling: A documented procedure for handling out-of-spec results, customer complaints, and recalls. The system must demonstrate continuous improvement — recurring issues must trigger corrective actions.

Why ISO 22716 Certification Matters Even If "Not Required"

ISO 22716 is technically voluntary. But in practice, it functions as a shorthand trust signal for the entire supply chain. A factory with ISO 22716 certification has been audited by an independent third party against a rigorous international standard. Retailers, distributors, and customs authorities recognize it instantly. It also streamlines other certifications — an ISO 22716-certified facility has most of the documentation already in place for FDA registration, CE marking, and safety testing.

Which Certifications Do You Actually Need? A Decision Framework

Not every brand needs every certification. The answer depends entirely on where you sell. Use this decision logic:

Selling in the US Only

You need: FDA facility registration + product listing under MoCRA. If your manufacturer is already FDA-registered (which saves you the facility step), your primary responsibility is ensuring your products are listed and your labels are MoCRA-compliant. CE marking and CPNP are not required for US-only sales. ISO 22716 is recommended but not mandatory — though major US retailers increasingly expect it.

Estimated budget: $0-1,500 (registration assistance) + labeling updates + ongoing adverse event tracking system.

Selling in the EU Only

You need: CE marking (via EU Cosmetics Regulation compliance) + CPNP notification + a designated Responsible Person in the EU. The full package includes safety testing (TST), a Cosmetic Product Safety Report signed by a qualified assessor, and a Product Information File maintained at the RP's address. FDA registration is not required for EU-only sales. ISO 22716 is strongly recommended as it forms part of your PIF's manufacturing method documentation.

Estimated budget: $3,000-8,000 (testing + safety assessor + RP first year + CPNP notification) + annual RP renewal ($500-2,000/year).

Selling in Both US + EU (and Most Other Markets)

Get ISO 22716 certification for your manufacturing facility first — it is the foundation that supports both FDA and CE compliance. Once your GMP system is certified, FDA registration and CE marking become substantially easier because the underlying documentation (batch records, QC data, material traceability) already exists. Countries like Canada (Health Canada), Australia (NICNAS), and GCC states (GSO cosmetics standard) also recognize ISO 22716 as evidence of manufacturing quality, making it the most efficient single investment if you plan to enter multiple markets.

Estimated budget: $5,000-11,000 (ISO 22716 certification + FDA registration + CE compliance package) + annual maintenance costs.

How Aurevia Lashes Handles Compliance

Compliance is not an add-on service at Aurevia — it is built into our manufacturing infrastructure. Here is what that means for your brand:

• FDA-registered manufacturing facility: Our factory is registered with the US FDA, and we maintain current facility registration with biennial renewal. Your products are manufactured in a registered facility from day one — no waiting, no retroactive filing.
• CE-ready documentation: We maintain safety data sheets (SDS) for all raw materials, third-party test reports for heavy metals, microbial contamination, and formaldehyde, and ISO 22716-compliant batch records. This documentation package dramatically reduces the time and cost of your EU market entry.
• GMP-certified production environment: Our facility operates under ISO 22716 GMP standards with documented hygiene protocols, material traceability systems, and a 4-stage quality control process. We can provide the manufacturing documentation your safety assessor needs for your CPSR.
• Third-party tested materials: All lash fibers, bands, adhesives, and packaging materials come with Certificates of Analysis. We do not use materials that cannot be fully documented — no exceptions, no shortcuts.
• MoCRA-ready labeling support: We ensure your product labels include the required elements for US market compliance under MoCRA, including ingredient disclosure, responsible person contact information, and net quantity statements.
• Export documentation expertise: Our in-house export documentation team prepares certificates of origin, FDA prior notice filings, and commercial invoice documentation that clears customs without delays. We handle the paperwork so you can focus on your brand.

Want to verify our certifications? Tour our facility → or request a sample with compliance documentation →

The Bottom Line

Quality and compliance certifications are not bureaucratic obstacles — they are competitive advantages. In a market where most new lash brands fail within two years, documented compliance separates professional operations from hobby projects. It signals to retailers, distributors, and customers that your brand takes safety seriously and has invested in doing things properly.

The most efficient path for most lash brands: work with an ISO 22716-certified, FDA-registered manufacturer that can provide the documentation backbone. Build your compliance stack around that foundation — FDA for the US, CE plus CPNP for the EU, and ISO 22716 as the universal quality signal. Get it right before your first shipment, and you will never know the pain of a customs hold, a retailer rejection, or a customer questioning your safety — problems that cost far more than compliance ever will.

Need certified, compliant lashes for your market?
Work with an FDA-registered, ISO 22716 GMP manufacturer. Get a quote with full compliance documentation.
Get a Compliance-Ready Quote →