Cosmetovigilance: Undesirable Effects, Serious Undesirable Effect Reporting and the Complaints Log That Protects Your Brand

The message usually arrives on an ordinary afternoon. A customer says your facial oil gave her a rash across both cheeks. It took a week to settle and her GP prescribed a cream. She isn't angry. She just thought you should know.

What you do in the next hour, and what you set up before she ever bought the jar, is cosmetovigilance. Most small brands have never read the rules behind it, and most find out about them exactly like this. This guide covers the two definitions that decide everything, who has to do what, the reporting deadlines in Great Britain, the EU and the US, how to judge causality without guessing, and how to keep a reactions log that will hold up when an inspector asks for it.

Where the duties come from

In the EU, the rules sit in Regulation (EC) No 1223/2009. Article 23 covers notification of serious undesirable effects, Article 21 public access to information, and Article 10 with Annex I the safety report that has to absorb what you learn after launch. Great Britain kept the same Regulation after Brexit, amended for GB by SI 2019/696 (Schedule 34), so Article 23 now tells the Responsible Person and distributors to notify the Secretary of State, which in practice means the Office for Product Safety and Standards (OPSS). The Cosmetic Products Enforcement Regulations 2013 do not create these duties. They supply the enforcement powers, offences and penalties. Northern Ireland still applies the EU Regulation.

If you also sell in the US, the Modernization of Cosmetics Regulation Act 2022 (MoCRA) added adverse event duties to the Federal Food, Drug, and Cosmetic Act in section 605. They run alongside the UK and EU rules and use different definitions, so we cover them separately below.

The two definitions that decide everything

An undesirable effect is an adverse reaction for human health attributable to the normal or reasonably foreseeable use of a cosmetic product. The net is wide on purpose. Redness, itching, stinging, a rash, swelling, watery eyes, a headache from a strong fragrance, a breakout after a new moisturiser: if a customer reports it after using the product the way it was meant to be used, or the way anyone might foreseeably use it, it counts. Whether you believe the product caused it doesn't matter at this stage. You record it, then you assess it.

A serious undesirable effect (SUE) is an undesirable effect that results in temporary or permanent functional incapacity, disability, hospitalisation, congenital anomalies, an immediate vital risk or death. Contact dermatitis that keeps someone off work for a week, a chemical burn treated in A&E, an eye injury that affects vision, an anaphylactic reaction: those are serious. OPSS also spells out the other side. Reactions that don't stop someone carrying out their usual day-to-day tasks, such as ordinary allergic reactions, irritation and cosmetic acne, are not reportable SUEs. They still go in your log.

Who must do what

Two points catch brands out. First, distributors carry their own duty. A stockist who hears about a hospitalisation and says nothing is in breach, so brief every stockist in writing. Second, consumers and doctors can go straight to the authority, which means the first you hear of an SUE could be OPSS asking for your PIF. A brand with a log and a written procedure can answer that call within the hour.

The reporting clock in GB, the EU and the US

Article 23 says "without delay". It doesn't give a number, and the authorities read it differently.

Every clock starts at awareness, and awareness by anyone in the business counts. The EU guidelines say it plainly: the 20 days run from the date on which any employee, whatever their role, becomes aware. The OPSS wording is "anyone in the company". So the freelancer answering your Instagram DMs, the friend helping on your market stall and the customer service inbox all start the clock for you.

You don't need a full picture to report. Under the EU guidelines an initial notification can go in once you have three things: an identifiable reporter, the nature of the alleged effect and the date it started, and the product name in enough detail to identify it. Medical records, a confirmed diagnosis and a finished causality assessment can follow as updates. If you sell in GB and the EU, work to the shorter 20-day target for everything. That gives you one internal rule instead of two.

What goes into an SUE notification

Article 23 sets the legal minimum: the serious undesirable effects known to you or that you could reasonably be expected to know about, the name of the product so it can be specifically identified, and any corrective measures you have taken. The OPSS and EU forms ask for more, and it helps to have it ready:

• You and the product. Responsible Person details, product name, category, batch code and notification reference (SCPN or CPNP).
• The person affected. Age, sex and relevant history where known, with no names.
• The reaction. What happened, when it started, how long it lasted, how severe it was, the outcome, and which seriousness criterion it meets.
• How the product was used. Amount, frequency, how long for, and any other products used at the same time.
• Medical involvement. Treatment, diagnosis, any patch test results, hospital details.
• Causality. Your assessment using the Commission method, or "pending" if you are still gathering information.
• Actions. What you have done or plan to do: batch check, CPSR review, label change, withdrawal.

MoCRA: serious adverse events for US sales

Under section 605 of the FD&C Act, the responsible person (the manufacturer, packer or distributor named on the label) must send FDA any report it receives of a serious adverse event linked to use of the product in the United States. The deadline is 15 business days from receiving the report, and the submission has to include a copy of the label. If new and material medical information arrives within a year of the first report, that goes to FDA within 15 business days too. FDA recommends MedWatch Form 3500A and lists the email and postal routes on its reporting page.

The US definition is not the same as the EU one. Besides death, a life-threatening experience, inpatient hospitalisation, persistent or significant disability, and congenital anomaly, it also covers an infection, significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or a persistent or significant change in appearance that was not intended), and any case needing medical or surgical intervention to prevent one of those outcomes. A persistent rash that would not be an SUE for OPSS can be a serious adverse event for FDA. Records of every adverse event report, serious or not, must be kept for six years, or three years for a qualifying small business. The label must also carry a domestic address, domestic phone number or electronic contact through which the responsible person receives adverse event reports. Our guide to MoCRA product listing and facility registration covers the rest of the US set-up.

Assessing causality without guessing

Not every reaction reported after using a product was caused by it, and nobody expects you to assume it was. The European Commission's causality method gives you a structured way to decide. It looks at six criteria in two groups. The chronological group covers timing of onset, what happened when the product was stopped, and what happened on re-exposure. The semiological group covers whether the symptoms fit the product and its ingredients, any test results such as patch tests, and whether something else explains it, like a new medicine, another product or an illness. The scores combine in a decision table to give one of five levels: very likely, likely, not clearly attributable, unlikely or excluded.

The Responsible Person makes the assessment, and the guidelines say it should be done by someone experienced in complaint handling, with healthcare input where needed. Your safety assessor is the obvious person to ask. Two rules follow from the method. A case scored unlikely stays in the log. A case you can't score yet still gets reported on time, marked pending. The Commission's CPSR guidelines (Decision 2013/674/EU) expect effects judged very likely, likely, not clearly attributable or unlikely to appear in the safety report, and copies of SUE notifications to be attached to it.

A worked example: from a customer message to a closed case

Back to the facial oil. Customer service logs the message the same day and asks for the batch code, which the customer reads off the base of the bottle. It is an undesirable effect. Is it serious? A rash treated by her GP, with no time off work, no hospital visit and no lasting mark, doesn't meet the UK or EU definition, so nothing goes to OPSS. If the bottle had been sold in the US and the rash had become persistent, the FDA definition would need a second look.

Causality next. Onset two days after first use, clearing once she stopped, symptoms consistent with sensitisation to a fragrance allergen declared on the label, no other new products. The case is scored likely. The batch record matches the assessed formula and approved suppliers. The assessor is told at the next quarterly review. One case involving a declared allergen doesn't justify a change to Part B, but it is recorded in Part A section 9. The customer gets a refund, a proper reply and a suggestion to check the ingredient list against any allergies she knows about. Closed in three days.

Now change one fact. She was admitted to hospital overnight. The same message starts the clock that afternoon, and the OPSS form goes off that week with what you know, followed by an update when the discharge letter arrives.

Running a reactions and complaints log

Annex I Part A section 9 requires the CPSR to contain all available data on undesirable and serious undesirable effects for the product, including statistics. The log is where that data comes from. For a small brand, one spreadsheet with a row per report is enough. The columns we use:

• date received, channel (email, DM, review, stall, stockist, authority) and who received it
• product, shade or scent, and batch code
• reporter type (consumer, health professional, distributor, authority)
• description of the reaction, onset, duration and outcome
• how the product was used
• serious or not, with the criterion if serious
• causality level and who assessed it
• date notified to OPSS, the EU authority or FDA, with reference number
• actions taken and date closed

Keep the original correspondence with each entry. Then read the log at least once a quarter. Three mild reactions to the same batch mean a batch investigation. Three to the same scent across different batches mean a fragrance review with your assessor, often around one of the labelled fragrance allergens.

Making the information available

Article 21 requires the Responsible Person to make certain information easily accessible to the public by any appropriate means: the qualitative and quantitative composition (quantitative only for dangerous substances), the name and code of the fragrance, the identity of the supplier, and existing data on undesirable and serious undesirable effects. In practice that means being able to give a consumer an honest summary when they ask, with no personal data, and producing the full log for an inspector on request. You are not expected to publish every complaint on your website. A brand with a few assessed reactions in its log has nothing to hide. The one that invites questions is the brand selling thousands of units with nothing recorded at all.

How cosmetovigilance feeds your CPSR

Article 10 requires the safety report to be kept up to date in view of relevant information generated after the product is placed on the market. Reaction data is the clearest example of that information. A pattern can expose a sensitiser at a level the assessment accepted, a batch or supplier problem, a foreseeable use nobody planned for, or a group of people the product shouldn't be marketed to. Send the log to your assessor before every scheduled review and straight away after any SUE. The assessor then decides whether Part B needs a new warning, a restriction or a reformulation. Our guide on when to update your CPSR covers the review cycle, and the log itself belongs in the Product Information File.

When a pattern emerges

1. Check the batch. Batch records, raw material lot numbers, and any deviation from the assessed formula or approved suppliers.
2. Bring in the assessor. Send the log, the batch record and the current label.
3. Decide on corrective action. A clearer warning, a reformulation, a batch withdrawal or, where there is a serious risk, a recall.
4. Report what has to be reported. SUEs inside the deadline, and corrective measures with them, because Article 23 asks for them.
5. Record it. In the log and in the PIF change history.

If it comes to taking product off the market, our guide to cosmetic recall and withdrawal picks up where the log leaves off.

Setting it all up before launch

None of this needs software. Before your first sale, take an afternoon and do six things:

• Create the log so section 9 of your CPSR has something to describe.
• Train anyone who talks to customers. A reaction mentioned in a review, a DM or at a stall is a report.
• Check the label contact. The Responsible Person's name and address are mandatory in the UK and EU. For US sales, add a domestic phone number, address or electronic contact for adverse event reports, and use a monitored inbox.
• Agree the escalation. Who decides seriousness, who files the report, who calls the assessor, and who covers when that person is on holiday.
• Brief distributors in writing on their duty and on telling you.
• Book the quarterly review. Patterns only appear if somebody looks.

Related reading

• When should you update your CPSR?
• Cosmetic product recall and withdrawal: what to do
• What is a CPSR? UK and EU guide
• The Product Information File (PIF) explained
• UK vs EU Responsible Person: the key differences
• MoCRA product listing and facility registration
• How to label fragrance allergens
• All regulatory compliance articles

Myths we hear

• If my product didn't cause it, I don't have to record it. You record it first and assess cause second. A case judged unlikely is logged as unlikely, not deleted.
• I'll report once the doctor confirms it. The clock starts when anyone in the business hears about it. Send the initial report with what you know and add the medical detail as a follow-up.
• A rash always has to go to OPSS. Only if it meets the serious definition. OPSS is clear that ordinary allergic reactions, irritation and cosmetic acne that don't stop someone doing day-to-day tasks are not SUEs. They still go in your log.
• My stockists deal with their own complaints. Distributors have their own Article 23 duty to notify SUEs, and they are your best early warning. Put a reporting clause in every stockist agreement.
• A long reactions log makes the brand look bad. An empty log on a product that has sold thousands of units is what makes an inspector suspicious. A tidy log with assessed cases shows you are paying attention.

What to do this week

1. Open a reactions log today, even if it has no entries yet, and file it with the PIF.
2. Write a one-page procedure: who logs, who decides seriousness, who reports, and by which deadline in each market.
3. Save the OPSS SUE form, the EU authority contacts for the countries you sell in and, for US sales, MedWatch Form 3500A in the same folder.
4. Send every stockist and marketplace partner a short written note on their duty to report and to tell you.
5. Search your inbox, DMs and product reviews from the last 12 months for reactions nobody logged, and log them now.
6. Put a quarterly log review in the diary and send the log to your safety assessor before each CPSR review.

Frequently asked questions

Official sources and legislation

• Regulation (EC) No 1223/2009, Article 23 as it applies in Great Britain
• Regulation (EC) No 1223/2009, Article 21 (public access to information), GB
• SI 2019/696, Schedule 34: EU Exit amendments to the Cosmetics Regulation
• Cosmetic Products Enforcement Regulations 2013
• OPSS statutory guidance: Regulation 1223/2009 and the Cosmetic Products Enforcement Regulations 2013 (GB)
• GOV.UK: Cosmetic products, reporting SUEs (forms)
• GOV.UK: SUE and safeguarding notifications for cosmetics
• GOV.UK: Making cosmetic products available to consumers in Great Britain
• Regulation (EC) No 1223/2009 on cosmetic products (EU)
• Commission Implementing Decision 2013/674/EU: guidelines on Annex I (CPSR)
• European Commission: Cosmetics market surveillance and SUE reporting
• European Commission: Causality assessment of undesirable effects caused by cosmetic products
• FDA: How to report a cosmetic product related complaint (industry SAE reporting)
• FDA: Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
• 21 U.S.C. 364a: Adverse events (FD&C Act section 605)