How to read the EU Cosmetics Regulation annexes: a column-by-column guide with a real example

• Knowing that Annex III is "the restricted list" gets you nowhere if you cannot read a row: which column carries the limit, which one carries the mandatory warning, and which one tells you that you are looking at the wrong annex entirely.
• The annex tables have nine columns (a–i) with precise meanings — and the most common compliance mistakes are born from misreading just one of them.
• In this guide we read a real entry (salicylic acid, III/98) cell by cell, and finish with an end-to-end workflow for checking any ingredient.

1. Why reading a row matters more than knowing the list

If you work in regulatory or formulation, you already know what each annex of Regulation (EC) No 1223/2009 does: Annex II prohibits, Annex III restricts, Annexes IV/V/VI are the positive lists for colorants, preservatives and UV filters. If you need that map, it is in our guide to what each annex bans, restricts and allows.

This guide starts where that one ends. If you still need context on what CosIng is and how the database works, that guide is the first stop. Here we assume you know what CosIng is and go straight to the job: having an Annex III row in front of you and extracting an operational verdict from it: can I use this ingredient, in this product, at this concentration, with which mandatory phrase on the label?

That is column reading. Let's get to it.

2. The anatomy of an Annex III entry: the nine columns

Every Annex III entry (restricted substances) has nine columns, labelled (a) through (i). Sounds like a lot — but they really only answer four questions:

That is the entire mental map you need: what the substance is (blue), where it is allowed (green), how much (gold) and under what conditions (red). With that map in mind, here is each column in detail:

Two clarifications that prevent confusion:

• Old header vs. new header. The original 2009 text grouped the columns differently (substance identification sat in a single block). Entries amended since ~2019 and the current CosIng view use this nine-column breakdown. The content is equivalent; the presentation depends on how old the PDF in front of you is.
• The internal letters. When an entry distinguishes several product types, columns f, g, h and i subdivide with letters — and those letters are read in parallel: limit a) in column g applies to product type a) in column f. Reading them crossed is the single most common interpretation error there is.

3. A real example: salicylic acid (III/98), cell by cell

Theory done. Now a real entry, read the way a professional reads it. Salicylic acid — the active behind half the anti-acne and exfoliating products on the market — sits in Annex III, entry 98. Here is what that row looks like with the real data:

What this single row teaches you:

1. "Allowed" means nothing without column f. Salicylic acid at 3% is legal in a shampoo and illegal in a face cream. Concentration is not a property of the ingredient: it is a property of the ingredient + product type pair.
2. The warnings in column i are not advice. They are labelling obligations. If your product omits them, the product is non-compliant even if the concentration is right.
3. Column h changes the entire game. "For purposes other than inhibiting micro-organisms" means this entry regulates salicylic acid as an exfoliant/anti-dandruff/keratolytic agent. If you use it as a preservative, this is NOT your entry — which takes us to section 5.

One more thing: salicylic acid also carries a CMR category 2 classification under the CLP Regulation, and remains usable because it went through the Article 15 derogation with a favourable SCCS opinion. If you want to understand that mechanism (how a chemicals classification can ban a cosmetic ingredient), we explain it in our ECHA guide for cosmetics.

4. "Maximum concentration in ready for use preparation": what it really means

Column g does not say "maximum concentration" and stop there. It says "in ready for use preparation", and that nuance matters:

• The limit is measured on the final product, as it reaches the consumer — not on the raw material, not on a premix, not at a manufacturing stage.
• If you sell a concentrate meant to be diluted before use, the limit is assessed on the diluted, ready-to-use form.
• And the other way around: if you buy a raw material that already comes diluted at 10%, what counts is how much active salicylic acid ends up in your final formula, not the percentage of raw material you added.

It is a thirty-second cross-multiplication — and done wrong, it turns a compliant product into a recallable one.

5. The same ingredient in two annexes: III/98 and V/3

Here is the lesson almost nobody teaches, and the one column h already hinted at. Salicylic acid appears twice in the annexes:

Which entry applies to your formula? It depends on what you use it for — and the proof is not what you claim, but what the "presentation of the product" makes apparent (that is what column h says). If your label promises "BHA exfoliation", you are in III/98. If the salicylic acid is only there to preserve the formula, you are in V/3 with a limit four times stricter.

And it is not an isolated case. Multi-function colorants are the other classic example: titanium dioxide lives in Annex IV as a colorant — declared as CI 77891 — and at the same time in Annex VI as a UV filter (entries 27 and 27a, the latter being the nano form), with a 25% maximum and specific conditions for powder forms and spray applications. Same ingredient, two annexes, two regimes: if you use it for colour, Annex IV governs; if you use it for sun protection, Annex VI governs — and if it does both jobs in your formula, you comply with both.

Reading only one of an ingredient's entries and stopping is the classic non-compliance mistake. So when you check an ingredient, the question is never "which annex is it in?" but "how many annexes is it in, and which one applies to my case?". You can browse both entries and the rest of the live data in our CosIng database.

6. How to read the other annexes

The good news: if you can read Annex III, you can read all of them. The differences:

• Annex II (prohibited) — the easiest table to read, because it only has four columns: reference number, chemical name/INN, CAS and EC. There is no concentration column and no conditions column. Why? Because the answer is always the same: zero. If it is here, it is not used, full stop.
• Annex IV (colorants) — adds a column of its own: the Colour Index (CI), the nomenclature colorants are declared with on the label (CI 77891 instead of "Titanium Dioxide", for instance). And a nuance that trips many people up: colorants intended to colour hair are excluded from Annex IV — hair dyes are regulated as restricted substances under Annex III.
• Annex V (preservatives) and Annex VI (UV filters) — same column structure as Annex III, but with one conceptual difference: they are positive lists. In Annex III you read "it is restricted — may I?"; in V and VI you read "is it on the list? If it is not, you cannot use it as a preservative / UV filter at all", even if the ingredient is not banned for other functions.

7. CosIng vs. the legal text: what the database tells you (and what it does not)

CosIng is the European Commission's public database where all of this gets looked up. Four things you need to know to read it well:

• CosIng has no legal value. The Commission says it itself: the database serves "informative purposes", and only the Regulation and its amendments published in the Official Journal carry legal value. CosIng is the convenient index; the consolidated text on EUR-Lex is the law. For decisions that put a batch on the line, verify against the legal text.
• Ingredient vs. substance (the I/S convention). CosIng distinguishes ingredients (nomenclature inventory entries, in CAPITALS, symbol "I") from substances (the regulated annex entries, in lower case, symbol "S"). An ingredient existing in the inventory does not mean it is authorised: the inventory is not a positive list.
• Active vs. not active. Entries have historical versions. "Not active" means you are looking at a superseded version. Always check that the entry you are reading is active — working from a stale version is one of the most expensive mistakes there is.
• The common glossary gets updated. The names in column c come from the common ingredients glossary (Article 33), whose current version is Commission Implementing Decision (EU) 2025/1175 (repealing Decision 2022/677): over 30,000 names, with a transition period running to July 2026. If your label uses a name from the old glossary, you have until 30 July 2026 to adapt it.

8. How to check an ingredient end to end

The full workflow, against a CosIng base that is kept up to date:

1. Identify unambiguously. Get the INCI name and, above all, the CAS number of the ingredient. Searching by trade name or synonyms is the number-one source of errors.
2. Search by CAS in our CosIng database. It returns every entry where the substance appears, with its annex and maximum concentration.
3. Is it in Annex II? End of conversation: it is not used. (If you are curious how it got there, it is usually a CMR classification.)
4. Is it in Annex III? Read the full entry: columns f and g in parallel (product type ↔ limit), column h (does it regulate your use or a different one?), column i (warnings that go on your label).
5. Are you using it as a preservative, colorant or UV filter? Then also check Annexes V, IV or VI: for those functions the positive list rules, not the absence of a ban.
6. Is it a declarable fragrance allergen? If it exceeds the thresholds (0.001% leave-on / 0.01% rinse-off), it must be individually declared on the label.
7. Document the reference. In your PIF, cite the entry by its reference number ("III/98"), not just by name — it is the only unambiguous, stable citation.

The mistakes we see most: reading the letters of columns f and g crossed (assigning the 3% to the face cream), checking only one annex when the ingredient lives in two, calculating the limit on the raw material instead of the final product, and copying the column i warning "summarised" instead of literal.

9. Frequently asked questions

What does each column of Annex III mean? Nine columns (a–i): reference number, chemical name/INN, glossary name (INCI), CAS, EC, product type, maximum concentration in ready for use preparation, other restrictions, and conditions of use and warnings.

What does "maximum concentration in ready for use preparation" mean? That the limit is measured on the final product as the consumer uses it — not on the raw material or on intermediate concentrates.

What is the difference between the CAS number, the EC number and the INCI name? CAS is the universal chemical identifier; EC is the European inventory number (EINECS/ELINCS); INCI is the labelling name that comes from the common ingredients glossary.

What is an annex reference number? The stable ID of each entry within its annex (e.g. III/98). It is the correct way to cite a restriction in a dossier — it is not the CAS number.

Can the same ingredient appear in more than one annex? Yes, depending on its function. Salicylic acid is in Annex III (entry 98, non-preservative use: 3%/2%) and in Annex V (entry 3, as a preservative: 0.5%). Titanium dioxide is in Annex IV (colorant, CI 77891) and in Annex VI (UV filter, entries 27/27a).

Are the warnings in the last column mandatory? Yes. Column i is legal labelling text, not a recommendation. Omitting it makes the product non-compliant.

Is CosIng legally binding? No. CosIng serves informative purposes; legal value sits in Regulation 1223/2009 and its amendments published in the Official Journal (consolidated text on EUR-Lex).

Where does the official INCI name of an ingredient come from? From the common ingredients glossary (Article 33), whose current version is Decision (EU) 2025/1175 — mandatory from 30 July 2026.

How do I check if an ingredient is allowed in EU cosmetics? Search it by CAS → if it is in Annex II, it is not used → if it is in Annex III, read its conditions → if you use it as a preservative/colorant/UV filter, check the positive lists (V/IV/VI) → check whether it is a declarable allergen.

How often do the annexes change? There is no fixed calendar: they change whenever an amending Commission Regulation is published. That is why we monitor the upstream sources instead of re-reading the annexes by hand.

10. Bottom line

The annexes of Regulation 1223/2009 are not "looked up" — they are read. And reading them well is a concrete skill: knowing which column carries the limit, which one carries the condition that decides which entry applies to you, and which one carries the phrase that must appear, literally, on your label. The difference between a compliant product and a market withdrawal often fits inside a single misread cell.

The mechanical part — finding every entry for a substance, across every annex, always in its current version — is exactly what we automate: our CosIng database is updated with every amendment to the Regulation and gives you all of an ingredient's entries at once. The judgement part — deciding which entry applies to YOUR product — stays yours. As it should.