UK law does not name one mandatory SPF test, but a sunscreen must carry evidence for every claim. In practice that means in vivo SPF testing to ISO 24444 on 10–20 volunteers at 2 mg/cm², UVA testing to ISO 24443 (UVA protection at least one third of the labelled SPF), plus a safety report and Product Information File.
- ISO 24444 in vivo SPF: 10–20 valid volunteers, product applied at 2 mg/cm² of skin.
- UVA protection target: UVA-PF of at least 1/3 of the labelled SPF, with a critical wavelength of 370 nm or above.
- Evidence must be held in the Product Information File for 10 years after the last batch is placed on the market.
- Sun protection claims fall under the "higher level of evidence" principle of Article 20 of the UK Cosmetics Regulation.
Here is the uncomfortable part: a sunscreen that was never properly tested looks identical to one that was. Same white cream, same confident number on the front. The only difference is a file in a cabinet, and that file decides whether a brand is legal, honest and safe. Let's open the cabinet.
How UK law treats a sunscreen
In Great Britain, sunscreens are cosmetic products. They sit under the UK Cosmetics Regulation, which is retained Regulation (EC) 1223/2009, and are enforced through the Cosmetic Products Enforcement Regulations 2013. There is no separate "sunscreen licence" and no government laboratory that approves SPF numbers. The system works on the principle of the Responsible Person: a named UK company or person who guarantees that the product complies and that the evidence exists.
That is why SPF testing requirements in the UK are often misunderstood. People look for a sentence saying "you must use method X" and don't find it. What the law actually demands is substantiation, and the accepted way to substantiate is through recognised standard methods.
Article 20: why SPF is a safety issue, not a marketing one
Article 20 of the regulation says that claims must not mislead and must be supported by adequate evidence. Importantly, the principle is that a higher level of evidence is expected where a lack of efficacy could create a safety problem, and sunscreens are the textbook example (UK Cosmetics Regulation, Article 20). If a moisturiser claims to "plump" and doesn't, the customer is disappointed. If an SPF 50 is really SPF 15, the customer gets burned, and over years the damage accumulates.
CPSR and PIF: the paperwork behind the bottle
Before a sunscreen is placed on the market, a qualified safety assessor must complete a Cosmetic Product Safety Report (Article 10). The Responsible Person must keep a Product Information File containing the product description, the safety report, manufacturing information and proof of effects claimed, available for 10 years after the last batch is placed on the market (Article 11). For a sunscreen, the SPF and UVA reports live in that file.
The tests that actually get done
Think of the testing landscape as three layers: the SPF number, the UVA balance, and the real-world robustness (water resistance, photostability). Each has an accepted method, even if the regulation itself does not name it.
SPF: ISO 24444 in vivo
The standard approach is the in vivo method ISO 24444, usually adopted in Britain as BS EN ISO 24444. Volunteers with suitable skin phototypes have a defined area of the back treated with the product at 2 mg/cm², then exposed to a series of UV doses from a solar simulator. The lab compares the minimal erythema dose (the smallest dose causing visible redness) on protected and unprotected skin. The ratio is the SPF for that person, and the product's final SPF is derived from the panel mean, with a valid panel of 10 to 20 subjects.
Two things to notice. First, the 2 mg/cm² dose is far higher than most people apply in life, which is why real-world protection is typically lower than the label suggests. Second, this is a biological endpoint, so inter-laboratory variation of a few SPF units is normal. A well-run lab will have its own quality system, ethics approval and dermatological supervision.
UVA: ISO 24443 and the one-third rule
SPF measures mostly UVB (burning). UVA drives photoageing and contributes to skin cancer risk, and it is measured separately. The in vitro method ISO 24443 spreads the product on a roughened plate, measures UV transmission, adjusts the curve to match an in vivo SPF and calculates the UVA protection factor (UVA-PF). The long-standing European benchmark, which UK practice continues to follow, is a UVA-PF of at least one third of the labelled SPF and a critical wavelength of 370 nm or higher. That is what sits behind the circled "UVA" logo on bottles. Because this is guidance-based rather than spelled out in the main text of the regulation, always check the current UK position with your safety assessor before you print the logo.
Water resistance and photostability
If a pack says "water resistant", the claim needs its own test: SPF is measured after a defined water immersion routine, and the product must retain a defined proportion of its protection. Photostability matters too. Some filters, such as butyl methoxydibenzoylmethane (avobenzone), degrade under light unless stabilised, so the formula must keep its UVA performance after irradiation. This is a formulation question, not a lab trick.
Comparing the main approaches
| Question | Method | Type | What it tells you |
|---|---|---|---|
| How much UVB protection? | ISO 24444 | In vivo (human volunteers) | SPF value from erythema response |
| How much UVA protection? | ISO 24443 | In vitro (plate, spectrophotometer) | UVA-PF and critical wavelength |
| Does it survive water? | Water immersion protocol with SPF re-test | In vivo | Retained SPF after immersion |
| Is it stable in the pack? | Stability and challenge testing | In vitro/lab | Shelf life, microbiology, filter integrity |
Note the gap: nothing in this table says "approved by a regulator". The evidence is generated by the brand, assessed by the safety assessor and inspected later if Trading Standards ever asks.
The filters themselves: the list decides, not the label
Every UV filter in a UK sunscreen must appear in Annex VI of the regulation, the list of permitted UV filters, with its stated conditions and maximum concentrations (Annex VI). Whether a given filter, a nanoform, or a natural-sounding ingredient is allowed is therefore settled by checking the list as it currently applies in Great Britain, not by how "natural" or food-grade it sounds. Because amendments happen, verify the live list and any recent UK changes before you finalise a formula; I won't quote percentages from memory here.
Why a formulator cannot "reverse engineer" SPF
Filter percentages do not add up linearly to an SPF. Film formation, emulsifier system, emollients, solvent polarity and even how evenly the film dries all change the result. Two creams with identical filter loads can test several SPF points apart. That is the core reason DIY and kitchen sunscreens fail: the maths cannot be done on paper. We cover this in depth in our complete sunscreen formulation guide, including why DIY SPF doesn't work. The emulsion's structure matters just as much, as explained in emulsifiers and cream texture: what is actually happening inside your moisturizer.
What testing costs and how long it takes
Budget is where small brands panic. As a rough order of magnitude, a single in vivo SPF test at an accredited lab commonly lands in the low thousands of pounds, often somewhere around £1,500–£3,000 per formula, and UVA plus water resistance add to the bill. Timelines usually run several weeks from sample submission to report, longer if the formula needs adjusting and re-testing. Treat these figures as planning estimates and request quotes, since lab pricing varies.
This is why smart brands test late in development, not early. First stabilise the base, finish the preservation work and check sensory feel; then pay for the human panel. A common sequence:
- Choose filters from Annex VI and set target SPF/UVA with a safety assessor.
- Develop and stability-test a prototype, including microbiological challenge.
- Run in vitro screening (UVA-PF, critical wavelength) to eliminate weak candidates cheaply.
- Commission in vivo ISO 24444 testing on the final formula.
- Complete the CPSR and compile the PIF, then notify the product through the UK portal.
Claims you can and cannot make
Testing defines what you may say. A few practical rules from the way the claims principles are applied:
- Don't promise "total" or "100%" protection. Sunscreens reduce, never eliminate, UV exposure.
- Don't print an SPF higher than the tested and substantiated value.
- Don't use the UVA logo unless the UVA criteria are met.
- Don't imply a regulator has "approved" or "certified" the SPF.
- Do include use instructions, such as reapplication and avoiding peak sun; these support safe use.
The same discipline applies to other claims. If you've ever wondered how far you can push wording on a label, see can you call your oil non-comedogenic on a UK label? for a parallel case.
Red flags on a shelf
A sunscreen from a brand that can't tell you which method produced its SPF, or which lab did it, deserves scepticism. Ask for the test method (ISO 24444 or equivalent), the lab and the date. A serious Responsible Person will answer quickly.
Where formulation meets the test
Chemists learn quickly that the SPF test is the final exam, not the study session. Filter solubility, crystallisation of solid filters in the oil phase, emulsifier compatibility and film uniformity all show up as variability in the result. Skills like these are what separate a cream that passes first time from one that costs three rounds of panels. If that process fascinates you, read how to become a cosmetic chemist: the journey from curiosity to professional formulation, and if you want hands-on training, we run a formulation course where this logic is taught step by step.
FAQ-style recap for busy brand owners
If you take one thing away: the requirement is evidence, the accepted evidence is standardised testing, and the person legally on the hook is the Responsible Person. Everything else is detail.
