Artificial intelligence and cosmetics in Europe: toward a proliferation of regulatory frameworks

The integration of artificial intelligence into the European cosmetics industry is changing product development, evaluation, and consumer experience. These transformations are taking place within a regulatory framework already established by Regulation 1223/2009, which is now being overlaid with requirements from the digital world, notably the GDPR and the AI Act. Cosmed takes an overview of rising practises in the cosmetic industry and of the developing regulation in the EU.

At the early stages

The use of AI for product formulation or the prediction of toxicity, tolerance, or efficacy is on the rise. These approaches rely on a large volume of complex data, the accuracy of which must be verified.

Indeed, the elements of the Product Information File (PIF) must remain verifiable, traceable, and scientifically valid.

It will therefore become necessary to scrutinize and document data used to train the AI, their validation and performance, and the supporting evidence in the event of an audit by the competent authorities.

Finished products and claims

Common criteria regarding cosmetic claims require a strict alignment between the claim and the evidence. The use of AI to generate or analyze this evidence, for example through automated analysis of clinical images or algorithmic scoring, also raises methodological questions.

Authorities could classify AI tools as “instrumental methods,” requiring therefore qualification, calibration, independent data validation, and documented management of model drift.

Consumer interfaces

Skin diagnostic or personalized recommendation applications, increasingly based on AI, introduce a risk of being reclassified as medical devices depending on their intended use (diagnosis, prevention, monitoring).

It is therefore imperative to be careful in the design of these tools, limiting them to cosmetic and non-medical purposes, and to conduct a regulatory analysis as early as the design phase.

Regulation and the AI Act

Whether AI is used for claims or for personalization solutions, all of this relies heavily on biometric data or, at the very least, personal and sensitive data, which is already regulated by the European General Data Protection Regulation (GDPR).

Furthermore, to regulate the use of artificial intelligence, the cross-sectoral AI Act introduces requirements for data quality and bias management (technical documentation, data governance, human oversight) that will have a direct impact on companies.

The AI Act classifies AI-based technologies into four risk levels: unacceptable, high, limited, or minimal.

Although only to a limited extent, certain uses of AI in the cosmetics sector could indirectly fall within the “high-risk” category if the technology is not properly managed.

For instance, AI systems that assess skin conditions or recommend treatments may pose risks to consumer health if their outputs are inaccurate or lead to harmful effects. In such cases, these applications could be classified as “high-risk.”

Similarly, if a cosmetic product recommendation algorithm is biased on the basis of ethnicity, gender, or other sensitive characteristics, this may raise concerns regarding compliance with non-discrimination requirements and the protection of fundamental rights.

Another example is the use of AI by cosmetics companies to evaluate the performance of salespeople or aestheticians based on video analysis, behavioural data, or customer interactions. Such uses may also fall within the “high-risk” category.

However, in most cases, the AI systems used in the cosmetics industry will fall into the two categories of limited and minimal risk, which are subject to more flexible regulations.

Future Challenges

In conclusion, in the cosmetics industry as in many other sectors, the use of AI is becoming unavoidable but will require the implementation of a framework for evaluating AI-driven projects. This leads to the need to anticipate the classification of AI systems used, assess the risks associated with their use, and address transparency and technical documentation requirements, as well as requirements for bias management and performance.