Cosmetic Adverse Event Reporting: U.S. vs EU Guide

A customer complaint becomes a regulatory problem when a brand treats it as an isolated service ticket. A report may first reach a marketplace, retailer, distributor, salon, social-media team, overseas office, or contract manufacturer. If that channel does not recognize and forward health-related information, the legal operator may learn about a serious case after the reporting clock has started.

U.S. and EU systems use different roles, seriousness criteria, destinations, and clocks. Both require exact product identification, preserved source information, follow-up, trend review, and links to batch and distribution records. This guide covers ordinary cosmetics; drugs and devices can follow different systems.

What Counts as a Reportable Serious Cosmetic Event?

An adverse event is not the same as a product defect, and a serious event is not merely one that sounds alarming. Separate a quality complaint without a health effect, a non-serious health event, and an event that meets the applicable legal seriousness outcome.

The U.S. definition expressly includes infection and significant disfigurement, as well as intervention needed to prevent a serious outcome.^[1] The EU definition includes temporary functional incapacity and uses “immediate vital risk” language.^[3] A short-lived mild rash may be a recordable health complaint without meeting the serious threshold, while a burn requiring hospitalization or a reaction creating persistent incapacity may be reportable.

Do not let customer-service labels decide regulatory status. “Allergy,” “burn,” “hair loss,” or “infection” should trigger clinical and regulatory follow-up questions, but the actual outcome determines seriousness. Conversely, a complaint written in calm language can still be serious if it describes hospitalization, disability, or another qualifying outcome.

Who Is Responsible for Adverse Event Reporting?

The legal reporting owner is market-specific. Identify that operator before launch, then require every customer-facing partner to forward possible adverse events quickly enough for the operator to assess them within the applicable clock.

In the United States, the Responsible Person is determined by the name on the label, not simply by who made the bulk formula.^[1] In the EU, the Responsible Person ensures compliance with Article 23, but distributors are also named reporting actors.^[3] A service agreement can allocate operational tasks, but it should not obscure the statutory role.

Private-label contracts should name the safety contacts, forwarding deadline, required data fields, translation and privacy controls, record owner, investigation owner, and submission owner. The path must cover retailers, marketplaces, customer support, sales teams, distributors, and the manufacturer.

U.S. Cosmetic Adverse Event Reporting Under MoCRA

The U.S. Responsible Person must submit any received report of a serious adverse event associated with use in the United States of a cosmetic it manufactured, packed, or distributed. The report is due no later than 15 business days after receipt, and a copy of the label on or within the retail packaging must accompany it.^[2]

If the Responsible Person receives new and material medical information within one year of the initial FDA report, that information must be submitted within 15 business days after receipt.^[2] The case should therefore remain open for follow-up even after the first submission.

What must be submitted to FDA?

FDA currently allows electronic submissions through database-to-database transmission or the Safety Reporting Portal. A paper-route submission uses Form FDA 3500A with supporting information, including relevant label scans, sent by the stated email or mail route. The agency encourages electronic submission.^[1]

Capture the event narrative, dates, product identity, use, outcome, reporter details, available medical information, label copy, and supporting documents without changing the reporter’s account. Separate reported facts from the company’s assessment.

Filing is not an admission that the cosmetic caused or contributed to the event. The law requires reports associated with use and expressly states that submission is not to be construed as an admission of causation.^[2] This prevents a brand from using an unfinished causality investigation as a reason to miss the reporting clock.

What records must the U.S. Responsible Person keep?

The Responsible Person must retain records related to each adverse event report—not only serious reports—for six years. A qualifying small business that does not manufacture or process the specified higher-risk product categories uses a three-year period. FDA can access required adverse-event records during an inspection.^[2]

Preserve original communications, assessments, FDA submissions, follow-up information, duplicate-case decisions, product and batch identification, investigation results, and corrective actions. U.S. labels must also provide a domestic address, domestic telephone number, or electronic contact through which the Responsible Person receives adverse-event reports.^[2]

For broader U.S. role assignment, facility registration, product listing, safety substantiation, and label controls, use ZICAIL’s MoCRA compliance checklist.

EU Serious Undesirable Effect Reporting Under Article 23

Article 23 requires the EU Responsible Person and distributors to notify all serious undesirable effects known to them or reasonably expected to be known to them. The notification goes to the competent authority of the Member State where the SUE occurred and must identify the product and any corrective measures taken.^[3]

This is not a CPNP submission. SUE reports follow the national competent-authority route, so brands selling across Member States need a current authority and form map. ZICAIL’s EU cosmetics compliance guide explains the separate roles of the Responsible Person, CPSR, PIF, and CPNP.

Where and when must an EU SUE be reported?

The Regulation says “without delay.” European Commission guidance interprets that period as within 20 calendar days from the date any employee of the company, regardless of role or function, becomes aware of the SUE.^[4] A retailer email received by a sales employee can therefore matter even if the regulatory team sees it later.

SUE Form A is strongly encouraged for initial, follow-up, and final notifications by a Responsible Person or distributor.^[4] After receiving a report, the competent authority transmits the information to other Member States and, when the initial notifier is a distributor, to the Responsible Person.^[3]

What information is needed for the initial EU notification?

The initial notification should proceed when three minimum elements are available: an identifiable reporter; the nature of the alleged SUE and its onset date; and the cosmetic product name enabling specific identification. If those elements are not yet available, the notifier should continue reasonable efforts to obtain them and notify without delay once they are available.^[4]

The initial file can be incomplete. Follow-up can add medical information, product and batch details, use conditions, causality assessment, investigation findings, outcome, and corrective measures. EU guidance states that all SUEs should be notified except cases classified as excluded in the causality assessment within the reporting timeframe; notification is not an admission of liability.^[4]

Post-market information also feeds the product safety system. The CPSR must be kept current when relevant information becomes available, so serious and recurring undesirable effects may require safety-assessor review, PIF updates, new warnings, or other action rather than remaining only in a complaint database.^[3]

A Cross-Market Cosmetic Adverse Event Response Workflow

One global procedure can control intake, evidence, and investigation, but the market-specific legal operator must control the reportability decision, filing route, and deadline.

1. Protect the user and preserve the report. Tell the reporter to seek appropriate medical help for urgent symptoms without attempting to diagnose the case. Save the original message, attachments, contact details, date, time, channel, and exact wording.
2. Open one case record. Assign a unique case number and check for duplicates. Record the product name, SKU, size, country, purchase source, lot or batch code, use dates, application area, amount and frequency, other products used, event onset, outcome, and current status.
3. Escalate potential seriousness immediately. Route death, hospitalization, life-threatening experience or vital risk, incapacity, disability, congenital outcome, infection, significant disfigurement, serious persistent rash, major burn, significant hair loss, or preventive medical intervention to the regulatory owner the same day.
4. Map the legal route. Confirm where the event occurred, the product’s regulatory category, the U.S. labeled Responsible Person, the EU Responsible Person, involved distributors, and any other applicable jurisdiction. Do not assume one filing covers every market.
5. Assess seriousness and reportability separately from causality. Apply the destination market’s legal criteria. Record the reasoning, reviewer, date, information gaps, and reporting-clock start. Do not postpone a required initial report while waiting for batch testing or a final medical opinion.
6. Submit the initial report on time. Use the current FDA route for a U.S. serious adverse event or the competent authority and applicable form for an EU SUE. Preserve the exact submission, attachments, confirmation, authority case number, and company case number.
7. Investigate and follow up. Request relevant medical and use information without pressuring the reporter, identify the lot, review retained samples and batch records, check formula and raw-material changes, assess microbiology and packaging where relevant, and search for related complaints.
8. Decide and document action. Update the authority when required, revise the CPSR or other safety file where applicable, correct labels or instructions, hold affected inventory, notify partners, withdraw or recall product when justified, and trend the event across products and markets.

Predefine substitutes for weekends, leave, and time-zone gaps. A deadline should never depend on one employee opening a shared mailbox. Test the process with a mock complaint and verify that every channel can reach the regulatory owner.

What Should a Cosmetic Complaint File Contain?

A defensible file preserves what was reported, learned, decided, and done. Control these record groups:

• Source and chronology: original complaint, reporter identity and contact route, received date, awareness date, internal forwarding history, follow-up attempts, and event onset.
• Product identification: exact product name, SKU, size, label version, purchase channel and country, lot or batch code, manufacturing and expiry information where applicable, and product photographs.
• Use and event information: intended and actual use, application site, amount and frequency, co-used products, prior exposure, symptoms, seriousness outcomes, medical attention, treatment, status, and available records.
• Regulatory assessment: market, legal operator, seriousness determination, causality status where used, clock start, reviewer, decision rationale, authority route, submission number, and follow-up obligations.
• Quality investigation: batch record, finished-product specification and release data, retained-sample review, deviations, complaints from the same lot or formula, raw-material changes, microbiological evidence, packaging observations, and distribution scope.
• Actions and closure: customer communication, authority correspondence, distributor or manufacturer notices, inventory hold, correction, withdrawal or recall decision, CPSR or safety-file update, CAPA, trend code, approvals, and closure date.

Batch identity connects a health report to production and distribution evidence. ZICAIL’s cosmetic batch codes and traceability guide explains that connection, while the manufacturer document guide helps brands define which records must remain obtainable after launch.

When Should Reporting Trigger Corrective Action?

A regulatory report and a recall decision answer different questions. Reporting asks whether the event meets a legal notification threshold. Corrective action asks what the available evidence says about ongoing product risk, nonconformity, distribution scope, and the controls needed to protect users.

Escalate beyond individual case handling for a serious event, cluster or rising trend, repeat use pattern, infection concern, burn, unexpected hair loss, package contamination or dosing failure, lot or supplier link, misleading direction, undeclared ingredient, or evidence that the released product no longer matches its safety basis. Do not continue distribution solely because causality is unfinished when credible evidence indicates material risk.

The review can lead to no product action, enhanced monitoring, consumer follow-up, batch hold, expanded testing, label or instruction changes, distributor communication, market withdrawal, or recall. Under EU rules, a Responsible Person that believes a product is noncompliant must take corrective measures, withdrawal, or recall as appropriate and immediately inform authorities when the product presents a human-health risk.^[3] In the United States, FDA has mandatory recall authority in defined serious-risk circumstances if the Responsible Person does not voluntarily act.^[5]

Investigation testing should answer a defined case question. Review ZICAIL’s skincare product testing guide when planning stability, microbiological, compatibility, safety, or claim-related evidence, while qualified regulatory and technical reviewers set the case-specific protocol.

Build Post-Market Responsibilities Into Your ZICAIL Project

ZICAIL can discuss formula identification, manufacturing and batch records, finished-product specifications, quality-control data, testing coordination, packaging information, and document handover for a private-label or custom skincare project. The brand must appoint the applicable legal operators and obtain market-specific regulatory review for its complaint, reporting, safety, and corrective-action procedures.

Before production, define the U.S. or EU Responsible Person, distributor network, complaint contacts, forwarding timeline, lot-coding format, required manufacturer records, retained-sample plan, investigation support, change-notification rules, and authority-response ownership.