In the US the brand named on the label (the MoCRA "responsible person") must send FDA every serious adverse event report it receives for a cosmetic within 15 business days, on MedWatch Form FDA 3500A with a copy of the label, and keep records of all adverse event reports for 6 years (3 years for qualifying small businesses). In the EU and the UK the Responsible Person must report serious undesirable effects to the authority without delay, together with any corrective action, and FDA can now order a mandatory cosmetic recall. Prepare before launch: a contact route on the label, a complaint log, lot codes on every unit, distribution records and a written recall plan.
Key terms
- Adverse event (US): any health-related event associated with the use of a cosmetic that is adverse, from mild redness to a hospital visit.
- Serious adverse event (US, MoCRA): an adverse event that results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, a congenital anomaly or birth defect, an infection, or significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant change of appearance) other than as intended; or one that needs medical or surgical intervention to prevent such an outcome.
- Serious undesirable effect, SUE (EU and UK): an undesirable effect that results in temporary or permanent functional incapacity, disability, hospitalization, congenital anomalies, an immediate vital risk or death. The UK describes it as a reaction that leaves the user temporarily or permanently unable to carry out their usual day-to-day tasks.
- Responsible person: in the US, the manufacturer, packer or distributor whose name is on the label, which for private label skincare is usually your brand. In the EU and UK, the Responsible Person (RP) is the company established there that is named on the label and keeps the product information file.
- Recall: removing or correcting a product already on the market because it breaks the rules or may harm people. A market withdrawal is the same action for a minor issue that FDA would not take legal action on, such as normal stock rotation.
- Lot or batch number: the code that links each unit to one production batch, its records and its test results. Without it you cannot limit a recall to the affected batch.
Reporting rules at a glance
| Market | What must be reported | Who reports | Deadline | Records |
|---|---|---|---|---|
| US (cosmetics, MoCRA) | Serious adverse events associated with use in the US | Responsible person on the label | 15 business days after the report is received; new and material medical information within 1 year, also in 15 business days | All adverse event reports kept 6 years; 3 years for qualifying small businesses |
| US (OTC drugs, such as sunscreen) | Serious adverse events for nonprescription drugs | The company named on the label | 15 business days (FD&C Act section 760) | Kept under the drug rules |
| EU | Serious undesirable effects, and corrective measures taken | Responsible Person and distributors | Without delay, to the authority of the member state where it happened | SUE data go into the product information file and safety report |
| UK (Great Britain) | Serious undesirable effects, with batch number and corrective measures | UK Responsible Person | Immediately, to OPSS | Kept in the product information file |
| Canada (cosmetics) | No mandatory incident report under the consumer product law, which excludes cosmetics; Health Canada accepts reports | Manufacturer or importer | Act promptly; Health Canada can act under the Food and Drugs Act | Keep your own records |
United States: MoCRA adverse event duties
MoCRA (the Modernization of Cosmetics Regulation Act of 2022) added section 605 to the Federal Food, Drug, and Cosmetic Act. For a brand selling a cosmetic in the US it means four things:
- A contact route on the label
Every cosmetic label must include a domestic address, a domestic phone number or electronic contact information, which may be a website, through which the responsible person can receive adverse event reports. A Korean address alone does not meet this.
- Report serious adverse events in 15 business days
Send FDA each serious adverse event report you receive for use in the US no later than 15 business days after you receive it, with a copy of the product's label. FDA recommends MedWatch Form FDA 3500A, sent with supporting material such as label scans and photos, and accepts reports electronically or on paper. If you receive new and material medical information within 1 year of the first report, send it within 15 business days too. The clock runs from when your company receives the report, and reports arrive through every channel: email, chat, marketplace messages, social comments, retailers. Route them all to one log so none sits unread.
- Keep records of every adverse event
Keep records of each adverse event report, serious or not, for 6 years. A responsible person that qualifies as a small business under MoCRA and does not make the higher-risk products listed in the law (products that regularly touch the eye's mucous membrane, injected products, products for internal use, and products meant to change appearance for more than 24 hours) keeps them for 3 years. FDA may inspect these records.
- Keep safety substantiation
You must hold adequate evidence that each product is safe. A pattern of adverse events is something FDA can look at when it judges whether that evidence is adequate.
Not every complaint is a report to FDA. Mild, short-lived redness that went away after the customer stopped using the product is an adverse event you log, not a serious one you report. When you are unsure whether an event is serious, get a medical or regulatory opinion quickly: the 15 business days keep running while you decide. For the whole MoCRA picture, including facility registration and product listing, see our MoCRA compliance guide and MoCRA registration for skincare brands.
A sunscreen, acne treatment or other OTC drug follows the drug rules instead: serious adverse events for nonprescription drugs are also reported within 15 business days, under section 760 of the FD&C Act. See cosmetic vs drug claims.
US recalls, voluntary and mandatory
Most recalls are started by the company. FDA's recall rules in 21 CFR part 7 ask a firm that removes or corrects a product it believes is violative to tell FDA right away. FDA then classifies the recall:
| Class | Meaning (21 CFR 7.3) | Skincare example |
|---|---|---|
| Class I | Reasonable probability that use will cause serious adverse health consequences or death | A product contaminated with a dangerous microorganism used around the eyes |
| Class II | May cause temporary or medically reversible adverse health consequences, or serious harm is remote | A cream with microbial contamination or a banned ingredient |
| Class III | Not likely to cause adverse health consequences | A labeling error, such as a missing ingredient, with no health risk |
A recall strategy sets three things: the depth (to consumers, retailers or wholesalers), whether a public warning is needed for a serious hazard, and effectiveness checks to confirm that everyone who received the product was told and acted.
Mandatory recall. MoCRA added section 611: if FDA finds a reasonable probability that a cosmetic is adulterated or misbranded and that use of it will cause serious adverse health consequences or death, it must first give the responsible person a chance to stop distribution and recall voluntarily. If the company does not, FDA can order it to stop distribution and recall, with an opportunity for an informal hearing, and FDA publishes a notice, with an image of the product where available. On October 22, 2026 FDA finalized its guidance "Questions and Answers Regarding Mandatory Cosmetics Recalls", with no substantive changes from the December 2025 draft. FDA still encourages companies to recall voluntarily.
European Union
Under Article 23 of Regulation (EC) No 1223/2009, when a serious undesirable effect occurs, the Responsible Person and distributors notify without delay the competent authority of the member state where it happened. The notice covers all serious undesirable effects known to them, or which may reasonably be expected to be known, the product name so it can be identified, and the corrective measures they have taken. The Commission's SUE reporting guidelines provide the forms and the seriousness criteria. Non-serious undesirable effects are not reported one by one but are part of the product's safety record: undesirable and serious undesirable effect data belong in the product information file and the safety report.
The Responsible Person must also act when a product is not compliant: take corrective measures, withdraw or recall it as needed, and, when the product presents a risk to health, inform the authorities of the countries where it was made available. Authorities can order withdrawal or recall themselves, and serious risks are published on Safety Gate, the EU's rapid alert system (formerly RAPEX).
Since December 13, 2024 the General Product Safety Regulation (EU) 2023/988 also applies to products covered by sector laws, such as cosmetics, for aspects that the sector law does not cover. The Commission lists among these the Safety Business Gateway notifications and the rules on recalls and consumer remedies, including a standard recall notice. Ask your Responsible Person how it applies to your product. More in our EU cosmetics regulation guide.
United Kingdom (Great Britain)
OPSS, the Office for Product Safety and Standards, says a reaction that leaves the user temporarily or permanently unable to carry out their usual day-to-day tasks must be reported to it immediately as a serious undesirable effect. Examples include disability, hospitalization, congenital abnormalities, risk to life and death. The report gives the Responsible Person, all serious effects, the product name and batch number, and any corrective measures, on the forms on GOV.UK. Effects that do not stop day-to-day tasks, such as allergic reactions, irritation and cosmetic acne, do not need to be reported, but they still belong in your log. See our UK cosmetics guide.
Canada
Canada's Consumer Product Safety Act, with its duty to report incidents, does not apply to cosmetics: Schedule 1 of the Act excludes cosmetics as defined in the Food and Drugs Act. Cosmetics are regulated under the Food and Drugs Act and the Cosmetic Regulations, which prohibit selling a cosmetic that may cause injury or that was made under unsanitary conditions. Health Canada takes incident reports from consumers and industry and publishes cosmetic recalls on its Recalls and safety alerts site. One real example: in 2019 a moisturizing cream was recalled in Canada because of mould contamination, after one incident report and about 800 units sold there. If your product is a natural health product or a drug in Canada, such as a sunscreen, the stricter adverse reaction rules for those products apply. See our Canada guide.
Set up before your first sale
Incidents are handled well by brands that prepared. Most of this costs nothing but time.
- Contact route on the label
For the US, a domestic address, phone or website for adverse event reports; for the EU and UK, the Responsible Person's name and address.
- One inbox for complaints
Route customer service email, chat, marketplace messages, social comments and retailer reports to one log, checked every business day.
- Lot code on every unit
A batch number on each container and box, readable after use, with the production or expiry date your market needs.
- Distribution records
Which lot went to which warehouse, retailer, Amazon fulfillment center or country, and when. Your 3PL and marketplace reports are part of this.
- Roles and a written procedure
Name who triages, who decides on reports and recalls, who talks to authorities, retailers and customers, and a backup for each. Include your Responsible Person, insurer and manufacturer contacts.
- Insurance
Product liability insurance, and recall cover if your retailers ask for it. See product liability insurance.
- A mock recall
Once a year, pick a lot and trace where every unit went within a day. If you cannot, fix the records before a real incident.
Incident plan: when a customer reports a reaction
- Intake (same day)
Reply kindly, without admitting fault or diagnosing. Ask the customer to stop using the product and, if the reaction is more than mild, to see a doctor. Record the date and time you received the report: in the US that starts the 15 business day clock if it turns out to be serious.
- Collect the facts
Product, size, lot number and expiry date (ask for a photo of the code), where it was bought, when and how it was used, other products used, the reaction, its timing and outcome, any medical treatment, and photos if the customer agrees. Ask them to keep the product.
- Triage
Is it serious under the definitions above? Is it a known, labeled effect such as mild tingling from an acid? Is it one report or the third on the same lot? Use the triage table below.
- Check the batch
Pull the lot's certificate of analysis, microbiology result, production date and stability data, and check other complaints for the same lot. Ask your manufacturer to review the batch record.
- Report on time
US serious adverse event: MedWatch Form FDA 3500A within 15 business days with the label. EU: notify the competent authority without delay. UK: notify OPSS immediately. Keep a copy of each submission.
- Decide the action
No action beyond logging; monitor the lot; change the label or directions; stop sale of the lot; or recall. A trend matters more than a single mild report.
- Close and learn
Write the root cause if one was found, the action taken and what changes, and keep the file for the full record period.
Recall plan step by step
- Stop shipping
Put the affected lots on hold at your warehouse, 3PL and fulfillment centers, and pause listings if needed.
- Define the scope
Which lots, units made, units shipped and units still in stock. Good lot coding is what keeps a recall to one batch instead of your whole range.
- Assess the hazard and depth
How serious is the risk, and must the recall reach consumers or only retailers? This drives the US class and the public warning.
- Notify the authorities
US: tell FDA's recall staff at once for a firm-initiated recall. EU: inform the competent authorities and your Responsible Person; serious risks go through the Safety Business Gateway. UK: inform OPSS. Canada: contact Health Canada.
- Notify customers and the trade
Retailers, distributors, marketplaces (Amazon, TikTok Shop, Shopify customers by email) and, for a consumer-level recall, a public recall notice.
- Retrieve and reconcile
Collect or destroy the units in line with the authority's instructions, and count: shipped minus returned minus destroyed tells you what is still out there.
- Check effectiveness
Confirm every consignee received the notice and acted. FDA calls these effectiveness checks.
- Root cause and corrective action
Formula, raw material, packaging, process, storage, transport or misuse. Fix the cause and document the corrective and preventive action (CAPA).
- Close out
Send the authority your final status, keep all records, and update your procedure with what you learned.
A recall notice should name the product with a photo, the lot codes and dates, the hazard in plain words, what the customer should do (stop using it, return or dispose), the remedy (refund or replacement) and how to contact you. FDA's mandatory recall press releases follow the same idea: product name, the risk, and an image where available.
Log templates you can copy
1. Complaint and adverse event log (one row per report)
| Field | Example |
|---|---|
| Report ID | AE-2026-014 |
| Date and time received, and channel | 2026-11-03 14:20, marketplace message |
| Market where used | United States |
| Product, size, lot, expiry | Barrier cream 50 mL, lot 26K031, EXP 2029-10 |
| Reporter (customer, doctor, retailer) | Customer, contact kept on file |
| What happened and when | Redness and itching on cheeks after day 3 of use |
| Outcome and medical care | Stopped use; resolved in 4 days; no doctor visit |
| Serious? (yes, no, under review) and why | No: no criterion met |
| Reported to (authority, date, reference) | Not reportable |
| Batch check result | COA and microbiology within specification; no other reports on lot |
| Action and closing date | Logged, customer refunded, closed 2026-11-10 |
2. Seriousness triage
| If the report says | Treat as | Next step |
|---|---|---|
| Death, life-threatening event, hospital admission, eye injury needing treatment, burns, infection, lasting rash, significant hair loss or disfigurement | Serious (US) and likely a SUE (EU, UK) | Report on time; consider stopping the lot |
| Saw a doctor and got a prescription to prevent a worse outcome | Possibly serious (needs medical intervention) | Get a medical or regulatory opinion within days |
| Mild redness, stinging or breakouts that went away after stopping | Non-serious adverse event | Log; watch for a trend on the lot |
| Product smells off, separated, changed color, mould visible | Quality complaint, possible contamination | Check the lot; hold stock if more than one report |
3. Batch trace sheet (one per lot)
| Field | What to record |
|---|---|
| Lot number and production date | From the unit and the manufacturer's records |
| Units produced, received, in stock | From the packing list and your warehouse |
| Where it went | Each warehouse, 3PL, fulfillment center, retailer and country, with dates and quantities |
| Test documents | COA, microbiology result, stability data and specification for the product |
| Complaints on this lot | Report IDs from log 1 |
- No US contact route on the label, so adverse event reports cannot reach you as MoCRA requires.
- Starting the 15 business day clock late, from when a manager read the complaint instead of when the company received it.
- Logging only serious events. MoCRA requires records of every adverse event report.
- No lot code on units, or a code only on the outer box, so a one-batch problem becomes a full recall.
- Telling customers the reaction is "normal" without checking, or asking them to throw the product away before you have the lot number.
- No distribution records from the 3PL or marketplace, so you cannot tell who received a lot.
- Waiting for your manufacturer to report. In the US, EU and UK the duty sits with the brand or its Responsible Person.
- Deleting negative reviews that describe a reaction instead of following them up.
- US label carries a domestic address, phone or website for adverse event reports
- EU and UK label names the Responsible Person
- All complaint channels feed one log, checked every business day
- Complaint log, triage table and batch trace sheet set up
- Lot code and date on every unit and box
- Distribution records by lot from every warehouse and marketplace
- Named owner and backup for triage, reporting and recalls
- MedWatch Form FDA 3500A process ready for the US (15 business days)
- Responsible Person agreement covers SUE reporting in the EU and UK
- Adverse event records kept 6 years (3 if you qualify as a small business)
- Recall notice template drafted
- Product liability and, if needed, recall insurance in place
- Mock recall run once a year
How KoreanOEM helps
The brand holds the reporting duty, but the batch facts come from the maker. We make sure you have them for every lot.
- A certificate of analysis (COA) and microbiology results for every batch, included in the price.
- The batch number and the date your market needs printed on every unit, so each unit traces back to one batch.
- MSDS (SDS), product specification and, for ready library formulas, stability data on file in your My page.
- A separate accredited-lab microbiology report on a batch when an authority, retailer or insurer asks for one: about USD 300 per product per batch. Challenge test (ISO 11930) from USD 1,000 per formula. See product testing and fees.
- If a customer reports a reaction, send us the product and batch number: we match it to that batch's COA and microbiology results.
- For the EU and UK, a Responsible Person through our partner (USD 240 per product per year for the UK, USD 335 for the UK and EU), and US MoCRA product listing filed by our team for USD 150 per SKU. See certifications and export.
Frequently asked questions
What do I do if a customer has a reaction to my skincare product?
What counts as a serious adverse event under MoCRA?
How long do I have to report a serious adverse event to FDA?
How long must I keep adverse event records in the US?
Can FDA force a cosmetic recall?
Who reports serious undesirable effects in the EU?
Do I report every allergic reaction in the UK?
Does my manufacturer report adverse events for me?
Sources
- 21 U.S.C. 364a (FD&C Act section 605): adverse events
- 21 U.S.C. 364e (FD&C Act section 609): labeling, adverse event contact information
- 21 U.S.C. 364g (FD&C Act section 611): mandatory recall authority
- FDA: Modernization of Cosmetics Regulation Act of 2022 (MoCRA), key terms
- FDA: How to report a cosmetic product related complaint (how industry reports serious adverse events)
- FDA: FDA issues final guidance on mandatory cosmetic recalls (October 22, 2026)
- FDA: Recall policy for cosmetics
- eCFR: 21 CFR part 7, enforcement policy and recalls
- EUR-Lex: Regulation (EC) No 1223/2009, Articles 5, 23 and 25
- European Commission: SUE reporting guidelines for cosmetic products
- EUR-Lex: General Product Safety Regulation (EU) 2023/988
- European Commission: GPSR presentation, obligations for businesses (PDF)
- GOV.UK (OPSS): Making cosmetic products available to consumers in Great Britain
- GOV.UK (OPSS): Cosmetic products, reporting SUEs
- Justice Laws Canada: Canada Consumer Product Safety Act, Schedule 1
- Health Canada: Recall of a moisture cream due to mould contamination (2019)
Checked against these sources in October 2026. Rules and fees change; check with the authority or your importer before you sell.