Correction

Hazard Is Not Risk: How to Read Any Ingredient Score

The claim

“A high score in an ingredient checker means the product is dangerous.”

The short answer

No. It measures hazard — whether a substance could cause harm under any conditions. Risk depends on dose, formulation, rinse-off versus leave-on, exposure site and frequency. A score that ignores all five is an index into the literature, not a verdict.

Evidence status

Settled — the distinction is written into the European safety-evaluation procedure, and EWG's Skin Deep states on its own methodology page that its rating does not account for exposure.

The Cosmetic Record · Published 2026-08-06 · Last checked 2026-08-06 · 14 sources · Corrections: none

1. Two words that are not synonyms

Hazard is a property of a substance. Risk is a property of a situation. The European Commission's Scientific Committee on Consumer Safety builds its procedure on that gap: a safety evaluation comprises four elements, the first being hazard identification, “carried out to identify the intrinsic toxicological properties of the substance, i.e. whether it has the potential to damage human health”. The other three are exposure assessment, dose–response assessment, and risk characterisation, in which a Margin of Safety is a point of departure divided by the Systemic Exposure Dose.¹ Exposure sits in the denominator; identity is not in the equation at all.

The Committee's own worked example: “A cosmetic substance that has the intrinsic property to be corrosive is not necessarily excluded for use in cosmetics. An example is potassium hydroxide KOH, the corrosivity of which depends on the final concentration, the pH, the presence of ‘neutralising’ substances, the excipient used, the exposure route, etc.”¹ KOH is a hazard in every jar it has ever been in. Whether it is a risk is settled by the five variables that sentence names, plus an “etc.”, and no ingredient name carries any of them. A number from step one alone has done a quarter of the work.

2. Dose makes the poison — and what that does and does not excuse

The maxim is load-bearing, and it is the thing toxicologists say the press handles worst: in a 2009 survey of Society of Toxicology members, 96% rated media performance as poor at explaining that “the dose makes the poison”, against 3% rating it well.¹⁰

What it does not excuse is treating a limit, once set, as a permanent verdict. Until 11 February 2017, Annex V entry 57 allowed methylisothiazolinone at 0.01% in any cosmetic product, leave-on included. A regulation of 22 July 2016 cut leave-on out and kept 0.01% for rinse-off, applying from 12 February 2017.⁴ Less than twelve months after that regulation, on 6 July 2017, the Commission cut the rinse-off figure again by nearly seven-fold, on an SCCS opinion of 15 December 2015 concluding “that for rinse-off cosmetic products, a concentration up to 0,0015 % (15 ppm) Methylisothiazolinone is considered safe for the consumer from the point of view of induction of contact allergy”:³

In Annex V to Regulation (EC) No 1223/2009, entry 57 is replaced by the following:

Reference number — 57
Chemical name/INN — 2-Methyl-2H-isothiazol-3-one
Name of Common Ingredients Glossary — Methylisothiazolinone
CAS number — 2682-20-4
EC number — 220-239-6
Product type, Body parts — Rinse-off products
Maximum concentration in ready for use preparation — 0,0015 %

Three positions in under three years — 0.01% anywhere, 0.01% rinse-off only, 0.0015% rinse-off — on chemistry that never changed. What changed was the estimated dose at which induction of allergy occurs. (Entry 39 carries the same 0,0015 % figure for a 3:1 mixture with methylchloroisothiazolinone, and the footnote to entry 57 makes the two entries mutually exclusive: a product may use one or the other, never both.¹²) Nor is “more is always worse” universal: the SCCS records non-monotonic dose–response curves — meaning the effect does not rise steadily with the dose but can peak and fall away again, tracing a U or an inverted U — as an observed phenomenon.¹ The maxim licenses attention to the dose, not the conclusion that a permitted ingredient is settled for good.

Which raises the obvious question, since dose is what decides this: can you read the dose off the pack? Almost never. The order rule on an ingredient list tells you less than it appears to, and what it can and cannot tell you is worth knowing before you try to score anything from a label.

3. The variables a score throws away

Two rows of the SCCS exposure table. Shampoo: 10.46 g applied per day, retention factor 0.01, calculated daily exposure 0.11 g. Body lotion: 7.82 g per day, retention factor 1.00, calculated daily exposure 7.82 g.² The retention factor exists “to take into account rinsing off and dilution of finished products by application on wet skin or hair”. The same ingredient at the same percentage therefore differs about seventy-fold between those two products in the amount left on skin per day — and a score attached to a name cannot move between them, because the name has not moved.

EWG's Skin Deep — a database of ingredients in over 100,000 products, built by comparing labels against “nearly 60 toxicity and regulatory databases” — says so in its own methodology: the hazard rating “considers potential health hazards but does not account for exposure or individual susceptibility, factors which will drive health risks, if any, but which are generally not available for assessment”.⁸ The disclosure is on the page. The failure is in the reading.

There is an inversion worth naming too. In that methodology the hazard category “use restrictions” — “prohibited for use in cosmetics, or subject to concentration, use, or manufacturing method restrictions, according to industry safety guidelines and government requirements and guidance from the U.S., E.U., Japan, and Canada” — carries a weighting factor of 0.9, behind only the six categories weighted 1.0.⁸ Writing an exposure limit is risk management, and the act reduces risk. Fed into a hazard score it raises the number. Entry 57 above is exactly such a restriction.

4. What a data-gap penalty does to a new, well-characterised molecule

“Every product and ingredient in Skin Deep® gets a two-part score – one for hazard and one for data availability.”⁹ The second is reported as none, limited, fair, good or robust, and half of it is arithmetic on a literature search: “The remaining 50 percent reflects the number of studies listed for that ingredient in the government's PubMed scientific research index.” The band table runs 0 or 1 study → 0; 2–100 → 1; over 100 → 2; over 1,000 → 3; over 10,000 → 4, and the ceiling is anchored by example — “well-studied ingredients are set at 4 (formaldehyde, benzene and other ingredients with higher ratings than these two)”.⁸ A molecule introduced in the last decade with a complete modern dossier — read-across, in silico prediction (computer modelling from structure), an OECD-guideline test battery, an SCCS opinion — can return a hundred indexed papers or fewer under its INCI name and score 1, “limited”, on that half of the rating. Not because less is known, but because less has been printed under that name.

The Cosmetic Ingredient Review refuses to compress the same problem. Its procedures define safety such that “a lack of information about an ingredient shall not be sufficient to justify a determination of safety”, and one of the Panel's four conclusions is insufficient data, on which it “does not state whether the ingredient is safe or unsafe”; the other three are safe as used, safe with qualifications and unsafe.⁵⁶ Where use is reported and the data never arrive, the classification becomes after two years “Use Not Supported by the Data and Information Submitted to the Expert Panel”.⁵ That is a statement about a file rather than about a molecule, and a 1–10 axis cannot make it. On who pays, CIR's about page reads: “Although funded by the Council, CIR, the Expert Panel for Cosmetic Ingredient Safety, and the review process are independent from the Council and the cosmetics industry.”⁷

5. The survey everyone cites, and nobody reads properly

“79% of toxicologists say the Environmental Working Group overstates the risks of chemicals” is an accurate sentence and the least interesting line in its table. Here is the whole column, in the order printed: Greenpeace 96%, Environmental Defense Fund 85%, PETA 80%, Environmental Working Group 79%, Natural Resources Defense Council 79%, Center for Science in the Public Interest 79%, EPA 41%, CPSC 36%, WHO 31%, NIEHS 29%, NIOSH 29%, OSHA 28%, the International Agency for Research on Cancer 28%, AMA 28%, FDA 22%, National Cancer Institute 21%, CDC 17%, USDA 12%, National Science Foundation 11%, FASEB 10%, the Society of Toxicology itself 8%, ASPET 7%, PhRMA 2% and the American Chemistry Council 2%.¹⁰ A quotation that keeps the 79% and drops the 17% has converted a spread into a verdict.

The denominator matters more than the spread. Those percentages exclude respondents who answered “not sure”, because familiarity with the organisations varied so widely that leaving them in would, the authors wrote, stop the comparisons being “commensurable”; the newsletter reprints that caveat in a footnote and records that the full report gives the calculation both ways.¹⁰ It does, in a second chart, and the second chart reorders the list: with “not sure” counted in the denominator, Greenpeace falls to 83%, the Environmental Defense Fund to 61%, and the Environmental Working Group to 40% — one point above the EPA's 39%.¹⁴ The 79% that gets quoted is the figure among the minority of toxicologists who had an opinion about the group at all.

The rest of the methodology deserves the same treatment. Between 27 January and 2 March 2009 the Center for Media and Public Affairs, STATS and the Center for Health and Risk Communication at George Mason University contacted 3,562 full members of the Society of Toxicology, using an online instrument administered by Harris Interactive; 1,136 responded, a 32% return rate, and the published percentages rest on the 937 who answered every question.¹¹ It is a survey of professional opinion about organisations, not a measurement of any ingredient, and it was fielded seventeen years ago.

6. How to use a score properly

Treat it as an index. A high number means something has been written about the molecule in one of the nearly sixty databases behind the score; follow it to the finding and read four things — the endpoint, the species, the dose, the route. Then ask what the score cannot: does this product hold the ingredient against skin for sixteen hours, or send it down a drain in ninety seconds? EWG's own advice is to read both axes at once, buying “products with lower hazard ratings AND at least ‘fair’ data availability”.⁸ Used as a verdict, a score is step one of four wearing a number.

7. Why this site publishes no score of its own

Any single digit does one of two things. It encodes exposure assumptions — how much, how often, on which body site, rinsed or left on — which for products we have not opened we would have to invent; or it drops them, at which point it is a hazard score again. A rating also implies a comparison across products, and this site does not test products. And numbers outlive their reasoning: entry 57 read 0,01 % and then 0,0015 %, and only the citation makes the change visible. What we publish instead is the limit, the conclusion and the study, with the document attached — the method is at How we source.

8. Four questions to ask of any score, including ours

What is measured — a property of the molecule, or of the exposure? If the method never mentions concentration, product type or frequency, it is hazard.

Can you reach the underlying finding in one click, with dose, species and route? A source named but not linked cannot be checked, and that failure is as available to this site as to any other.

What does the system do when data are missing? It can emit a low number and warn separately, decline to conclude, or say the file is incomplete. Watch which.

When was the source data last refreshed, and is that date printed? Ours is at the top of this page as “Last checked”. Where a source carries no such date, it is recorded immediately below.