CPNP done, goods stuck at the Spanish border? The AEMPS importer declaration (COSMET2_DR) explained

2026-11-06 · IberTrust Global

From our files · enquiries from non-EU cosmetics brands shipping to Spain, October–November 2026, anonymised

“Our products are notified in CPNP and we have an EU Responsible Person. The goods are at the Spanish border and the broker is asking for the importer’s AEMPS declaration. What is that, and why is it not the same thing?”

The brand did the product-level work. What is missing is a company-level step that Spain added on top of the EU Cosmetics Regulation: the responsible declaration of import activity, filed with the Spanish Agency of Medicines and Medical Devices (AEMPS) in its COSMET2_DR application. Without it, the business importing the goods is not entitled to start that activity.

Four different things that sellers often mix up

Item	Legal basis	Who	Level
CPNP notification	Regulation (EC) 1223/2009, Article 13	The Responsible Person (RP)	Each product, before it is placed on the EU market
EU Responsible Person	Regulation (EC) 1223/2009, Articles 4 and 5	For imported products, the importer — unless it designates another EU person in writing, who accepts in writing	Product: safety report, product information file, labelling
Import activity declaration (COSMET2_DR)	Royal Decree 85/2018, Articles 17–21 and Annex B	The company that imports cosmetics into Spain from outside the EU	Company and its facilities, before the activity starts
EORI number	EU customs law (AEAT guidance)	Whoever lodges customs declarations	Customs identity, valid across the EU

None of these replaces another. A CPNP notification does not make anyone an importer. An importer declaration does not notify a single product. An EORI number does not prove either.

Who must file the declaration — and who does not

Under Royal Decree 85/2018, anyone who imports cosmetic products from countries outside the EU into Spain must submit the declaration to AEMPS before starting the activity (Article 18). AEMPS’s border guidance confirms that cosmetics from third countries are subject to health control and that the importer must have filed this declaration beforehand.

According to the AEMPS FAQ (updated 23 September 2026), the following do not file it:

Distributors of cosmetics already placed on the EU market that translate the label or relabel it to appear as Responsible Person.
Companies hired only to provide storage or control for a manufacturer or importer.
Goods moving between EU Member States: that is not a third-country import.

Being the brand owner or the RP does not, on its own, trigger or remove the duty. The question is who actually carries out the import.

What the importer must really have (Annex B)

The declaration is a statement that you already meet the requirements and hold proof. AEMPS can ask for that proof at any time after filing. Annex B of the Royal Decree lists:

Organisation with defined responsibilities, suited to the company size and the products imported.
Qualified staff for import, labelling where relevant, storage and control — one of them named as the qualified contact person. AEMPS accepts cosmetics-specific training (GMP, quality control, legislation) or experience in a cosmetics manufacturer or importer.
Facilities and equipment for storage and control that preserve quality and hygiene, and for relabelling or label translation if you do it.
Written procedures: purchase, receipt, release and storage; filing the certificate of analysis of each imported product; storage, dispatch and returns; rejected products; complaints and the batches affected; recalls; document archiving. If the importer is also the RP, it must also assess manufacturers and keep proof of GMP compliance.
Records that show the procedures were followed and give batch traceability for imports and distribution.
For anything subcontracted: a written, signed contract covering duties, audits and checks, complaints and documents, plus an assessment of the subcontractor.

Two points sellers find reassuring: AEMPS states that no GMP certificate is required (meeting the Annex is enough), and storage and control may be subcontracted. But the AEMPS filing instructions are clear that the import activity itself must be declared as your own — it cannot be ticked as subcontracted.

How filing works, step by step

Decide which legal entity is the importer, and make the invoice, transport documents, customs declaration and AEMPS declaration all name that same entity.
Put the Annex B system in place (people, procedures, records, contracts) before filing — not after.
The activity holder or its legal representative logs in to COSMET2_DR with Cl@ve or a digital certificate. A legal representative must upload proof of representation.
Enter company data, notification addresses, the qualified contact person, own and subcontracted activities, the facilities and the expected start date. Importers do not list product categories.
Preview the declaration, sign it and pay the official fee using the code the application generates. Per the AEMPS manual, an unpaid declaration is not considered submitted.
Keep the declaration document. Since 28 June 2023 it carries a verification code (CSV) that anyone can check on the AEMPS locator.
Activity may start from the date of submission. If data is missing, AEMPS gives 10 working days to correct it; if it requests documents, you have 15 working days. It may then order an inspection.

Any change — new premises, a new qualified contact, adding or removing a subcontracted activity — requires an updated declaration.

Common mistakes we see

“We have CPNP, so we are covered.” CPNP is product-level. The import declaration is a separate company-level step.
Naming an importer that never filed. AEMPS publishes a register of manufacturers and importers; buyers and brokers can search it in seconds.
Using a marketplace warehouse as “the importer”. Amazon’s EU Business Solutions Agreement (FBA terms, F.3.3) requires the seller to list itself as importer/consignee and appoint a customs broker; Amazon does not become the importer. Its terms also allow commingled storage and movement between sites (F.4), so batch traceability and release must be organised by the importer, not assumed.
Treating “received” as “released”. A stock status of “available” is not the documented quality release Annex B expects.
A qualified contact on paper only, with no training or experience records to show if AEMPS asks.
Different entities on the invoice, the customs entry and the declaration.

Who this does not apply to

Brands selling only products that are already in free circulation in the EU, bought from an EU importer or distributor.
Importers into other EU countries that never import into Spain — their own national rules apply.
Companies that only store or control goods for a declared importer.
Non-cosmetic products: medical devices, biocides and food supplements follow different regimes.

FAQ

Is the AEMPS declaration an authorisation I must wait for?

No. It is a responsible declaration: you may start from the day it is submitted, but AEMPS can check it later and can stop the activity if the requirements are not met.

Can a non-EU company file it?

The declaration asks for a Spanish tax number (NIF) and facilities; in practice the importer is a company established in the EU that carries out the import in Spain.

Do I need ISO 22716 certification?

AEMPS says a certificate is not required; meeting the requirements of the Royal Decree is enough.

Does the importer have to be the Responsible Person?

By default yes, under Article 4 of Regulation (EC) 1223/2009, but it can designate another EU person in writing, who must accept in writing.

Can storage be outsourced?

Yes, storage and control can be subcontracted under a written, signed contract. The import activity itself cannot.

Shipping cosmetics into Spain?

IberTrust Global S.L. helps non-EU cosmetics brands sort out the EU Responsible Person, CPNP notifications, labels and product files, and map who must hold the Spanish import declaration in each sales flow. Send us your product list, current RP and CPNP status, and how the goods travel — we will tell you what is missing.

Request a cosmetics compliance review →
Or email contact@ibertrust.info.

Sources: Royal Decree 85/2018, Articles 17–21 and Annex (BOE-A-2018-2693); AEMPS, FAQ on the responsible declaration of manufacturing and/or import of cosmetics (updated 23 September 2026); AEMPS, instructions for importers’ responsible declaration and COSMET2_DR manual; AEMPS FAQ on importing cosmetics, personal care products and biocides; Regulation (EC) 1223/2009, Articles 4, 5, 13 (EUR-Lex consolidated 18 May 2026); AEAT guidance on the EORI number; Amazon Services Europe Business Solutions Agreement, FBA terms F.3 and F.4. General information, not legal advice.