Cosmetovigilance Basics: What Brands Must Report and to Whom

Cosmetovigilance is the duty nobody budgets for & everybody inherits. A brand launches, the first complaint arrives, & someone in customer service has to decide whether the message is a refund request or a legal notification with a deadline. In most markets the answer is defined by law, the deadline is short, & the party who must act is the brand rather than the factory that made the product.

The buyer's problem is that the duty sits at the end of the project & is invisible at the start. Nobody specifies a complaint route, a triage rule or a response time when the brief is written, so when the first report arrives there is no procedure to follow & the clock is already running. This article covers what counts as an undesirable effect, what makes one serious, the reporting routes in the European Union, Great Britain, the United States & China, the fields a complaint form must capture, triage & causality, signal detection, & what a contract manufacturer can & cannot supply. Batch traceability is set out in our batch record guide, & the stability evidence a report often depends on is described in our stability testing guide.

Why the brand is usually the responsible person

In the European framework the duty falls on the responsible person, which is the legal or natural person designated within the European Union who takes responsibility for a placed product. In practice that is the brand owner, or an appointed representative, or an importer that accepted the role. It is rarely the factory, because the factory is upstream of the placing on the market & outside the territory.

The role carries a file rather than a task. The responsible person must hold the product information file, which includes the product description, the safety assessment, the manufacturing method, the proof of effect where a claim is made, & the data on undesirable effects. That file is retained for a fixed period after the last batch is placed on the market, commonly set at ten years, & it is the file an authority asks to see when a report arrives.

The consequence for a brand working with a contract manufacturer is that the factory holds the evidence & the brand holds the duty. The brand needs a contractual right to the data on a timescale that fits the reporting deadline, & the factory needs to know which documents the brand will ask for. Neither is automatic, & both belong in the supply agreement rather than in an email exchange after the first complaint.

What counts as an undesirable effect

An undesirable effect is an adverse reaction in a person that is attributable to the normal or reasonably foreseeable use of the product. The phrase carries two tests. The reaction must be adverse, so an outcome the product was sold to produce is not one; & it must be attributable to a normal or reasonably foreseeable use, so a reaction to a use the label warns against sits outside the definition.

The second test is where judgement is needed. Overuse is arguably foreseeable, misuse is less so, & an accident such as a jar slipping from wet hands is a product safety matter rather than a cosmetovigilance matter. A brand should write the boundary into its procedure, because the decision determines what enters the file & what the authority later sees.

The file itself is broader than the reports. Non-serious effects are recorded rather than notified, & those records are what let a brand see a pattern. A complaint database that only holds the serious reports is a database that cannot detect a signal, which is the one thing it is for.

What makes an effect serious

Seriousness is not severity in the colloquial sense; it is a fixed list of outcomes. An effect is serious where it results in death, where it is life-threatening, where it requires in-patient hospitalisation or prolongs an existing hospitalisation, where it results in persistent or significant disability or incapacity, or where it results in a congenital anomaly or birth defect. One outcome from that list is enough.

The practical consequence is that a report from a clinician is usually the one that triggers the duty, because only a clinician can confirm hospitalisation or a persistent disability. A consumer email describing a rash is rarely classifiable at first read, which is why the intake form has to ask whether medical attention was sought & what the outcome was.

Brands get this wrong in both directions. Some classify every complaint as serious & flood the authority with notifications that do not meet the test, which damages credibility & wastes the reporting channel. Others wait for certainty before reporting & miss the deadline, which is the worse of the two errors, because the duty attaches to the receipt of information rather than to the completion of an assessment.

The European route: who reports, to whom, how fast

The European duty is to notify serious undesirable effects to the competent authority of the Member State in which the effect occurred. The location rule matters for a brand selling across the Union: the report goes to the authority where the person is, not to the authority where the brand is established, so a complaint in one country is a report in that country & a complaint in another is a second report.

The timing is measured from receipt of the information, not from the incident, & not from the completion of an investigation. The period is short & is commonly set at twenty calendar days. That is the number a complaint procedure has to be built around, because twenty calendar days from a consumer email includes the time to identify the product, find the batch record, assess seriousness & draft the notification.

The notification itself is a structured report rather than a letter. It identifies the product, including the notification reference from the European portal, the category, the description of the effect, the outcome & the seriousness criteria met. Authorities exchange information between themselves, so a cluster in one Member State becomes visible across the Union, & a brand with an unresolved pattern in one market will eventually be asked about it in another.

Great Britain, Northern Ireland: the split

Leaving the European Union created two regimes where there used to be one. Great Britain operates its own cosmetics regime with its own responsible person, its own notification route & its own duty to report serious undesirable effects to the designated national authority. The substance is close to the European duty, but the destination is different & the forms are different.

Northern Ireland continues to follow the European framework for goods placed on the market there, which means a single brand can carry two reporting routes for what is geographically one island. The practical answer is a procedure that asks where the affected person was when the effect occurred, before deciding which authority receives the report.

The lesson for a brand is to write the market into the intake form. A complaint form that captures only the product & the symptom leaves the reporting route undecided at exactly the point the clock starts, & the correction costs days that the deadline does not have.

The United States under MoCRA

Recent federal cosmetics legislation introduced a serious adverse event reporting duty for the first time at federal level. The responsible person is the manufacturer, packer or distributor whose name appears on the label, & the duty is to report serious adverse events to the agency within a short business-day period of receiving the report. The period is measured in business days rather than calendar days, & it starts on receipt.

The definition of a serious adverse event mirrors the European seriousness list & adds a preventive criterion: an outcome that requires medical or surgical intervention to prevent one of the listed outcomes from occurring. That addition captures cases a European assessment might classify differently, so a brand operating in both should triage against the broader definition rather than maintain two thresholds.

Two further duties follow from the same legislation. Records relating to adverse events must be retained for a multi-year period, shorter for smaller businesses, & the label must carry a contact route for reporting adverse events. The second is an artwork requirement: a pack designed before the rule & reprinted after it is the pack that fails. A brand should check the label carries the contact route before the next print run rather than at the next reformulation.

China, other markets with monitoring systems

China operates a national cosmetic adverse reaction monitoring system layered onto its registration & notification regime. The duty runs through the local registrant or notifier rather than through an overseas brand directly, which means a brand selling into China needs its local partner named in the procedure, with an agreed route & an agreed response time. The categories reported & the timelines apply as set out in the current measures, & they should be confirmed locally rather than assumed from another market.

Several other markets run systems of their own, some mandatory & some not. In a few, reporting by industry is encouraged or voluntary rather than required, & the authority's expectation is that a serious event is still brought to its attention. A brand should hold a per-market entry stating whether the duty is mandatory, who the responsible party is, & where the report goes.

The common thread is that every system is built on the same three questions: what happened, to whom, & with which product. A brand that can answer those three questions quickly can operate in any of them. A brand that cannot will struggle in all of them, & the missing piece is almost always the batch code.

Intake, triage, causality: report or record

The intake form is the control point. It should capture the reporter's contact details, the product name & the batch code, where & when it was bought, the date of onset, the duration, a description of the effect in the reporter's own words, the body area, how often & how long the product had been used, any other products in use at the same time, any relevant history such as known sensitivities, whether medical attention was sought & the outcome, & whether the reporter consents to follow-up.

The batch code is the field that decides everything downstream. Without it the report cannot be tied to a production run, a raw material lot or a retained sample, & the investigation has nothing to compare against. A brand should ask consumers for the code on the first contact & should make sure the code is legible on the pack, because a code printed too small to read is a code that will never be reported.

Triage applies the seriousness list first, & then assesses plausibility. The assessment is not a proof of causation; a report is not held back because the brand believes the effect had another cause. The factors considered are the timing of onset relative to use, whether the distribution matches where the product was applied, whether the effect settled on stopping use & returned on resuming it, whether another explanation is more likely, whether other reports exist for the same code, & what is known about the ingredient class involved.

Signal detection: when one complaint becomes a batch problem

A single report is a data point. A signal is a pattern, & the pattern is found by grouping rather than by reading. The useful groupings are by batch code, by formula version, by ingredient, by market & by time, & the comparison that matters is rate against units sold rather than absolute count, because a popular product generates more complaints without being less safe.

The groupings answer different questions. A cluster on one batch points at a production or raw material event & is investigated through the batch record & the retained sample. A cluster across batches of one formula points at the formulation & is investigated through stability, preservation & the safety assessment. A cluster in one market points at distribution, storage or a local misuse pattern rather than at the product.

The outcome of a confirmed signal is a decision, & the options are a corrective action, a formulation or specification change, a packaging change, a label change, an update to the product information file & safety assessment, or a withdrawal. Where a product presents a serious risk, a separate product safety duty to notify & to act applies alongside cosmetovigilance, & that route is faster than the reporting deadline. Preservative-related failures are one common origin of such a cluster, & the checks are set out in our preservative systems guide.

What the factory supplies, what it cannot

A contract manufacturer holds most of the evidence. It should be able to supply the batch record, the raw material lots & their certificates, the retained sample from the run, the stability data for the formula, the preservative efficacy data, the fragrance composition at the level required for allergen assessment, & a statement of the manufacturing standard applied. It should also be able to say whether the same formula produced the same complaint before.

The timescale is the part that needs agreeing in advance. A twenty-day reporting window does not leave room for a factory to locate a batch record at leisure, so the supply agreement should set a response time for technical enquiries, name a technical contact, & state who pays for any retesting. Three working days is a workable target; a month is not.

The limits are as important. A factory is not normally the responsible person, & it cannot notify on the brand's behalf without instruction. It cannot establish what happened to an individual, because it does not see the person, the medical history or the product after opening. It cannot make a medical judgement about a reporter, & it should not be asked to. What it can do is give the brand the technical facts fast enough for the brand to meet its own duty.

Reporting duties at a glance

The table below sets the main markets against what must be reported, where it goes & how fast. The entries are a planning aid drawn from the frameworks described above, not a legal summary, & the current position for any specific product should be confirmed with the competent authority & with local counsel.

These are planning directions, not determinations. The duty in each market attaches to a defined party, on a defined trigger, with a defined destination, & all three differ. The common element a brand can control today is the intake: a procedure that captures the batch code, the market & the seriousness criteria on first contact will satisfy every route faster than one that has to reconstruct them later.

What to put in the brief

State the markets you will sell into & who the responsible person is, because those two decide the whole procedure. Ask the factory for the documents you will need in a report, & agree a response time before you need it. Then write the intake form, the triage rule & the escalation path, & keep them with the product information file rather than with the customer service team.

• The markets you will ship to, & the named responsible person for each.
• The reporting route per market, with the authority & the deadline.
• The intake fields you will capture, including batch code & location of the person.
• The triage rule that decides serious from non-serious, written not implied.
• The documents you expect the factory to supply, listed by name.
• The response time you require for technical enquiries, in working days.
• The retention period for complaint records & who holds the retention sample.
• The signal review cadence, & the threshold that triggers an investigation.

Then confirm the batch code is legible on the pack & that the label carries the contact route where a market requires one. Both are artwork decisions made months before the first complaint, & both are the difference between a report that can be investigated & one that cannot.

Where our capability fits

We support a reporting procedure rather than run one. We keep the batch record & the raw material lots traceable to the unit shipped, hold a retention sample from each run in the primary pack, & respond to technical enquiries on an agreed working-day basis so a brand can meet its own deadline. Where a cluster points at a production event, we can pull the batch record, compare the retained sample against the approved golden sample & state what changed, which is the question a brand is actually asked.

We work with brands on private label (your brand on a proven base), OEM/ODM contract manufacturing & full custom formula development, & the documentation set is agreed at the start of a project so it exists before it is needed rather than after. Our own lines include an astaxanthin renewal capsule & a green tea antioxidant serum, produced with the same batch record & retention discipline.

Tell us the markets you sell into & the response time you need, & we will come back with the document set & the traceability route. Start at our inquiry page, email capsulebiotech@163.com, or message the right team on WhatsApp: Capsule Series (capsules only) +86 158-7655-5319, Cosmetics Series (serum, hair care, body care, fragrance) +86 158-7655-5319.

General manufacturing information, not regulatory or legal advice. Reporting duties for undesirable effects differ by market, depend on the role the brand holds in that market & change over time; the applicable trigger, destination & deadline for any specific product should be confirmed with the competent authority & with local counsel before it is placed on sale.