Testing is usually where a brand and a manufacturer misunderstand each other the most. Which tests are legally required, which are market convention, and which are optional extras — these three get blended together in conversation, and the result is either a brand that under-tests and carries compliance risk, or one that over-tests and burns budget and timeline it didn't need to. This article walks through the testing categories a new product typically faces between finalized formula and production, including rough cost and turnaround ranges, so brands can budget for it up front.
1. Safety Testing: What a Factory Lab Can Run, and What Has to Go Out
Microbiology testing sits on current standards: aerobic mesophilic count follows ISO 21149, yeast and mould count follows ISO 16212, and detection of four specified pathogens (S. aureus, E. coli, P. aeruginosa, C. albicans) follows ISO 18415 — all three were amended in 2022 and remain the current editions.
Here's the detail that catches a lot of first-time clients off guard: an in-house factory lab can typically run two of these — aerobic count and yeast/mould count — because that's what standard lab equipment covers. Specified pathogen detection has to go to a third-party lab, since it needs dedicated identification equipment and lab accreditation that most factories don't carry in-house. If a manufacturer tells you "we tested everything internally," it's worth asking exactly which panel and which method. Basic colony counts usually take about a week, or roughly three days on a rush basis. Pathogen detection, because it's outsourced, runs longer and costs more — we'll give you a project-specific estimate once we know the formula and target market.
Whether a preservative challenge test (PET) is required depends on the formula. For water-based products, especially anything relying on a natural preservative system, we typically recommend running a full challenge test before production. The standard protocol is a 28-day cycle, and most factories don't have the facilities for it in-house — it goes to a third-party lab. Anhydrous formulas or products at an extreme pH (above 9, for example) can usually skip it, but the exemption needs to be documented in the technical file, not just assumed.
2. Toxicological Risk Assessment (TRA): The Common Thread Between the EU and North America
Whether a product is headed to the EU or North America, the document that actually determines market readiness is the same at its core — a Toxicological Risk Assessment (TRA): a qualified assessor reviews each ingredient's toxicological profile against realistic exposure under actual use, and calculates a Margin of Safety to reach a documented conclusion.
In the EU, the TRA is embedded inside the CPSR (Part A and B), a mandatory requirement under Article 10 of Regulation (EC) No 1223/2009 — we've covered that structure in more detail in our earlier piece on CPNP, PIF, and CPSR.
North America works a little differently. The TRA isn't tied to one fixed regulatory format, but it's become the de facto core of compliance anyway. The US MoCRA hasn't finalized its GMP rule yet, but the industry has already settled on the TRA — typically built to the CTFA (now PCPC) Safety Evaluation Guidelines — as the standard way to demonstrate a substantiated safety basis. Health Canada similarly requires that a company be able to demonstrate product safety, and a TRA is the commonly accepted form that evidence takes. This is why North American clients frequently come to us asking for a TRA directly — it's not a byproduct of the EU process, it's their own requirement, often driven by what a retailer or their own compliance review expects to see.
One clarification worth making explicit: the TRA itself has to be issued by a qualified third-party toxicologist — we don't do this, and shouldn't. What we provide is the technical groundwork an assessor needs to complete it — ingredient SDS sheets, finished-product CoAs — organized into a format the assessor can use directly. For North American clients, our standard advice is to engage a qualified lab or assessor for the TRA itself; our role is making sure the underlying documentation is complete and accurate before it gets there.
Separately, California carries its own layer on top of the federal picture — Proposition 65 warning labeling — which runs on a different mechanism than MoCRA/TRA and isn't interchangeable with it. That's a big enough topic on its own that we'll cover it in a dedicated article.
3. Where US Federal Regulation Actually Stands
MoCRA originally required the FDA to issue mandatory cosmetic GMP regulations. As of this writing, the FDA still hasn't published a final rule — it's been moved to the agency's "long-term actions" list, so nothing binding is expected in the near term. That doesn't mean the standard has relaxed: the FDA has been clear that, pending a final rule, the industry is expected to follow ISO 22716 as the de facto operating standard. We align quality systems to ISO 22716 when scheduling production for US-bound clients, for exactly that reason.
4. The EU Side Keeps Moving
Regulation (EC) No 1223/2009 itself is stable, but its annexes aren't static — the EU is currently working through another round of ingredient restrictions (the latest CMR-related omnibus update), which means the substance lists get revised on an ongoing basis. Formula compliance isn't a one-time check; it needs to be re-verified against the current annex version before every notification, not just at initial formulation.
5. Stability Testing: The Evidence Behind "Shelf Life," and Where Experience Actually Matters
There's no single mandatory standard for stability testing, but ISO/TR 18811 and the COLIPA guidelines are the industry's common reference points: accelerated testing typically runs at 40°C / 75% RH for three months to approximate roughly two years of ambient shelf life, while thermal cycling alternates low and high temperatures to simulate transport and storage conditions. Turnaround runs anywhere from a few weeks to three months depending on the panel, with cost varying accordingly by product type and scope.
The formal protocol runs the full three months before drawing a conclusion. But in practice, if a product shows no separation, discoloration, off-odor, or significant viscosity shift within the first two weeks, the odds of a problem showing up later drop sharply. That's a pattern we've built up from tracking stability data across projects over time — it's not a substitute for the full protocol, but it's useful for pacing a project: if a client needs an early read on packaging compatibility, or wants to greenlight a small pilot run before the full report is in, the two-week data point is usually a reasonably reliable directional signal, even though the final stability report still runs the complete cycle as the record of reference. We generally recommend starting stability testing as soon as the formula is finalized, not right before production — that way, if something needs adjusting, there's still a window to do it instead of being forced to choose between shipping on time and having complete data.
6. What's Optional, and When It's Worth Doing
Patch testing (skin irritation assessment) isn't mandatory, but for anything positioned for sensitive skin or infant/child use, it's typically the kind of evidence buyers and end retailers ask for on their own. Third-party skin tolerance certifications follow the same logic — not every product needs one, but whether it's worth the budget depends on the target customer and how much a given channel expects in the way of proof. Patch testing typically takes about a week, though lab scheduling usually adds a wait, with cost depending on panel size and lab. Early in a project, we help clients weigh whether this kind of testing is worth the budget and timeline for their specific product, rather than defaulting to "more testing is always safer."
Typical Cost & Turnaround Reference
To give a rough sense of scale, the list below summarizes representative third-party lab quotes for the regulatory reviews and lab tests referenced throughout this article. Most labs will quote a lower rate for larger batches or ongoing partnerships, so treat these as a starting point for budgeting rather than a fixed price.
Disclaimer: The figures above are indicative third-party lab quotes gathered at a point in time and are provided for general budgeting reference only. Actual pricing and turnaround vary by lab, product complexity, packaging material count, and order volume, and should always be confirmed directly with the testing provider before finalizing a project budget.
Where This Leaves Testing Planning
Testing planning is really an extension of formulation judgment, not a separate step bolted onto the end of production. We prefer to build testing checkpoints into the project timeline as soon as the formula is finalized, so a brand knows — at the same moment they get their final formula — what's coming next, roughly how long it takes, and roughly what it costs. That's part of what we mean by being a development partner rather than a factory.
Disclaimer: Testing requirements, timelines, and costs vary by product type, target market, and testing provider. This overview is for general reference only and does not replace project-specific guidance or a quote from a qualified testing lab.
