Cosmetic Product Recall UK and Withdrawal: What to Do When a Product Is Unsafe or Non Compliant, Step by Step

The email from the new fragrance supplier was routine, a reorder confirmation with the allergen statement attached. Reading it, the maker noticed a name she had never seen on the old supplier's paperwork: geraniol, at a level that meant it should have been on her rose body oil's label for the last four batches. Nobody had been hurt. Nothing was on fire. And yet in that moment she had, in the words of the regulation, reason to believe that a product she had placed on the market did not conform, and the law told her what to do next. Articles 5 and 6 of Regulation (EC) No 1223/2009 set out the duties of the Responsible Person and of distributors, the UK regulation enforced through the Cosmetic Products Enforcement Regulations 2013 mirrors them, and the Office for Product Safety and Standards and its EU counterparts have powers to require and publicise action.

This guide is the calm version of that moment. It explains the legal duties and when they bite, the difference between corrective action, withdrawal and recall and how to choose, how the authorities and the public alert systems work, a step by step procedure from stop to closure, the traceability you need to have in place before anything goes wrong, how to write a recall plan in an afternoon, how insurance treats recalls, and, most usefully, how the CPSR, the label review and the complaints log prevent most recalls from ever starting. Read it before you need it.

The legal duties, and when they start

The Responsible Person who considers or has reason to believe that a cosmetic they have placed on the market is not in conformity with the regulation must immediately take the corrective measures necessary to bring it into conformity, withdraw it or recall it, as appropriate. Where the product presents a risk to human health, they must immediately inform the competent national authorities of the member states in which the product was made available, and in Great Britain the enforcement authority, giving details of the non compliance and the corrective measures taken. Distributors have a parallel duty: if they have reason to believe a product they have made available is non compliant, they must ensure corrective measures are taken and inform the Responsible Person and, for risks to health, the authorities. Both must cooperate with authorities on request.

The phrase to underline is reason to believe. The duty does not wait for a regulator's letter, a laboratory result or a customer complaint. A supplier's corrected allergen statement, a failed release check, a pattern in the reactions log, an annex amendment you missed, a wrong label spotted on the shelf: each is enough to start the obligation, and the record of what you did next, and how quickly, is what an authority will judge.

Corrective action, withdrawal and recall

The choice is proportionate to the risk, and the safety assessor's view of the risk is the basis for it. A missing period after opening symbol on a batch is corrected on the next print and the notification updated. A batch found to contain a preservative at double the assessed level is withdrawn from the supply chain and, if the excess could cause harm, recalled from consumers. A batch with confirmed microbial contamination in a leave on product is recalled. Record the decision and its reasoning; if an authority later disagrees, a documented, proportionate judgement made with expert input is a defence, and an undocumented guess is not.

How authorities and alert systems work

In the EU, competent authorities notify serious risks through Safety Gate, the rapid alert system for dangerous non food products formerly known as RAPEX, which publishes weekly alerts including cosmetics, and businesses can submit their own notifications through its Business Gateway. In Great Britain, OPSS and Trading Standards use the Product Safety Database, which publishes recalls and corrective actions. The duty to inform is yours; publication is the authority's decision, but a product presenting a risk to health will usually be published, and the notice will carry the product name, batch codes, the risk and the action. Cooperation is required: authorities can demand documents, order measures and, where the Responsible Person does not act, act themselves and recover the cost. Our guide to cosmetovigilance covers the separate duty to report serious undesirable effects, which often precedes a recall decision.

A recall, step by step

• 1. Stop. Halt sales of the affected product immediately across every channel, including marketplaces, and hold stock.
• 2. Assess. With the safety assessor, establish the nature of the problem and the risk: what, how serious, to whom.
• 3. Identify. From batch records, determine exactly which batches and units are affected and rule out those that are not.
• 4. Trace. From distribution and sales records, establish where affected units went: distributors, retailers, marketplaces, direct customers.
• 5. Decide. Corrective action, withdrawal or recall, proportionate to the risk, and record the decision and its basis.
• 6. Inform authorities. OPSS or Trading Standards for Great Britain; the competent authority in each EU market; immediately for health risks.
• 7. Communicate. Notify distributors and retailers with instructions; for a recall, contact direct customers and publish a recall notice with product name, batch codes, the risk, what to do and how to obtain a refund or replacement.
• 8. Retrieve. Recover stock, log returns by batch, quarantine and dispose of or rework as appropriate, with records.
• 9. Investigate. Find the root cause: supplier, process, formula, packaging, labelling.
• 10. Fix. Corrective and preventive action; update the CPSR, PIF, label and notification as needed; document everything.
• 11. Report back. Close the loop with the authorities on the outcome.

The rose body oil: a worked example

Return to the maker and her geraniol. She stops sales the same afternoon, on her website and on Etsy. She rings her assessor, who confirms the undeclared allergen is a non compliance with a real but limited risk: a sensitised consumer could react, but the level is not one that would harm most people. From her batch records she identifies the four batches made with the old oil; from her distribution records she finds two went to a retailer and two were sold direct, and her dispatch system captured the batch code on each order. The assessor advises that withdrawal from the supply chain plus direct notification to the customers who bought the affected batches, with an offer of refund, is proportionate; a public recall is not required. This is a useful reminder that product recalls sit at the far end of a spectrum of corrective actions, and that proportionality is what separates a manageable withdrawal from a full public notice. She informs Trading Standards that day, which is the local enforcement route, with the Office for Product Safety and Standards (OPSS) as the national body that oversees these matters, withdraws the retailer stock, emails the affected customers, relabels the remaining stock with the corrected allergen list, has the CPSR updated by addendum, updates the PIF and the notification label image, and records the root cause as an incomplete allergen statement from the original supplier. Nine days from email to closure. Without batch codes on her dispatch records the customer notification would have gone to everyone who had ever bought the oil, and without batch records at all she could not have said which units were affected.

What makes a recall possible: traceability

Every step above depends on records that exist before the problem does. Batch records identify which raw material lots went into which batch and which units carry which batch code. Distribution records identify where each batch went. Marketplace and website orders identify direct customers by batch where the batch is captured at dispatch. A brand with these can recall a single batch of two hundred units; a brand without them must recall every unit ever sold. Handling product recalls and safety issues this way is what regulators mean when they talk about proportionate, evidence-based action under the wider framework of product safety and standards. Our guide to GMP for small makers explains the batch record, and it is worth capturing the batch code on every dispatch even for a very small brand; it takes seconds and it is the difference between a targeted recall and a total one.

Recalls that reach the alert systems: what they teach

Read a month of cosmetic entries on Safety Gate or the Product Safety Database and a pattern appears. The most common reasons are not exotic contaminants but undeclared fragrance allergens, missing warnings, prohibited or restricted ingredients that a screen would have caught, and microbial contamination in water based products. Many are small brands, and many are labelling failures on products whose formulas were fine. The lesson is that the prevention list at the end of this guide is not generic advice; it is a direct response to what actually goes wrong. A label review and a supplier document check prevent more recalls than any amount of laboratory testing.

Communicating a recall

• Be clear and specific. Product name, sizes, batch codes, where and when sold, the risk in plain language, what to do.
• Make it easy. Stop using the product; contact us for a refund; no need to return it if disposal is safe.
• Use every channel the product used. Website banner, email, social media, marketplace messaging, retailer point of sale.
• Do not minimise or over apologise. State the facts and the action.
• Keep records. Of every notice, every contact and every return.

Customers forgive a brand that tells them clearly and acts quickly. They do not forgive a brand they discover was quietly deleting listings. A well handled withdrawal, honestly explained, has been known to strengthen customer loyalty rather than damage it.

Writing a recall plan before you need it

A recall plan for a small brand is one or two pages: who decides and who does what, the contact details for the assessor, the authorities, the insurer and every distribution channel, where batch and distribution records are kept, a template recall notice, a template customer message, a template distributor instruction, and the disposal and rework procedure. Walk through it once on paper with a hypothetical problem. The plan lives in the PIF's manufacturing section as part of GMP, and insurers offering recall cover will ask to see it.

Costs and insurance

Standard product liability insurance covers injury and damage claims, not the cost of a recall itself: notices, retrieval, refunds, destruction and lost stock. Recall cover is an extension worth considering for brands with retail distribution, and insurers price it on the quality of traceability and the existence of a plan. Our article on the CPSR and product liability insurance covers what insurers look for.

Preventing the recall

• A thorough CPSR. Catches the ingredient, level or allergen that would otherwise become the reason.
• Supplier control. Documents on receipt, change notification, no silent substitutions.
• Release checks. pH, appearance, odour and, for water based products, periodic microbial testing.
• Label review before print. Most cosmetic recalls in the alert systems are for undeclared allergens or missing warnings, which a review catches.
• Regulatory watch. An annex amendment caught early is a reformulation, not a withdrawal.
• Cosmetovigilance. A pattern seen in the log at two reports is contained; at twenty it is a recall.

Myths we hear

• I only have to act if a regulator tells me to. The duty starts when you have reason to believe.
• A recall means a public notice and my brand is finished. Most problems are handled by corrective action or withdrawal, and honest handling protects a brand.
• My insurance covers the cost. Not without recall cover.
• Small brands do not get recalled. Small brands appear in the alert systems every week, usually for labels.
• I can just remove the listing. Quietly delisting without informing authorities or affected customers is itself a breach.

What to do this week

• Check that every dispatch captures the batch code.
• Write the one page recall plan with the template messages.
• Put the assessor, authority and insurer contacts in the PIF.
• Walk through one hypothetical problem with whoever helps you.
• Ask your insurer whether recall cover is available and what it costs.

If you believe a product may need to be withdrawn or recalled, a same day consultation will help you assess the risk, decide the measure and meet the duty to inform. The maker with the geraniol email was back to normal trading in nine days because she had records and a plan. That is the whole point of both.

Official sources and legislation

• Regulation (EC) No 1223/2009 on cosmetic products, Articles 5 and 6
• Cosmetic Products Enforcement Regulations 2013
• Safety Gate, the EU rapid alert system
• UK Product Safety Database
• Office for Product Safety and Standards
• OPSS guidance on cosmetic products regulations

Disclaimer: This article is general information, not legal advice. Regulations change and product decisions depend on your exact formulation, claims and market. Have your product assessed by a qualified professional before sale.