What it does
The EU's CosIng database lists three functions for citric acid: buffering, chelating and fragrance.1 CosIng defines buffering as altering or keeping a product's pH at the desired level, and chelating as forming complexes with metal ions that could affect a product's stability or appearance.2 The US Cosmetic Ingredient Review (CIR) describes the same three roles: pH adjuster, chelating agent or fragrance ingredient.3
In shampoo the pH job is the main one. Most detergents are alkaline, which makes the hair shaft swell, and a shampoo can be "pH balanced" by adding an acidic substance.4 A dermatology review names citric acid as one, used to bring the pH down to about 5.5.5
As a chelating agent it also helps preservation indirectly. A review of cosmetic preservation counts citric acid among the chelating agents that make microbial cell membranes more permeable, and so more sensitive to preservatives, and that withhold the iron microbes need to grow.6
Why its position on the list varies
EU ingredient lists run in descending order of weight at the time each ingredient is added, but ingredients below 1% may follow in any order after the rest (Article 19(1)(g)).7 A pH adjuster is added in whatever amount it takes to reach the target pH, so the same name can sit higher in one product than in another, and below 1% its place says little about how much is there. Ingredient list order explains the rule in full.
It can also share a list with its own salt. Sodium Citrate carries the same three CosIng functions, buffering, chelating and fragrance8, and a list may also include a base such as Sodium Hydroxide, which raises pH where citric acid lowers it.9
What official sources say
Citric acid has no entry of its own in any annex of the EU cosmetics regulation, so the regulation sets no maximum or condition for it.7 It is not one of the listed preservatives either. Annex V, the list of permitted preservatives, does have an entry that names it, entry 59, but that entry covers a different ingredient: a combination of citric acid and silver citrate, glossary name Citric Acid (and) Silver Citrate, with conditions of its own. Plain citric acid is not covered by it.7
In 2014 the CIR expert panel assessed citric acid together with 12 inorganic citrate salts and 20 alkyl citrate esters, and concluded that they are safe in the present practices of use and concentration. Because citric acid is generally recognised as safe as a direct food additive in the US, the panel focused on exposure through the skin.3 In the EU it is also the food additive E 330.10
How it appears on a label
As Citric Acid, its INCI name.1 The list does not state the product's pH, so the name shows that citric acid is in the formula, not how acidic the result is or which of its jobs it is doing. The guide to reading a shampoo ingredient list shows where pH adjusters sit among the other ingredients, and the shampoo ingredient checker sorts the names on your own list by job.