Cosmetovigilance is the system a cosmetic brand uses to collect, assess, record and, where the law requires it, report complaints and adverse reactions after launch. In a private-label or OEM (Original Equipment Manufacturer) setup the legal duty sits with the brand as the Responsible Person, not with the factory, so you need your own intake route, a triage rule, a causality assessment and a batch-linked log. Deadlines are short: EU guidelines allow 20 calendar days to notify a serious undesirable effect, and US law requires serious adverse events to reach FDA within 15 business days. It applies to skincare, hair and colour cosmetics sold in the EU, UK, US and ASEAN; most complaints are not reportable, but all should be logged. Start by writing down who in your team owns the inbox.
Key takeaways
- The clock belongs to the brand. Your manufacturer handles quality complaints under its GMP (good manufacturing practice) system, but the obligation to notify the authority sits with the Responsible Person, which is usually the brand owner or its appointed EU or UK representative.
- The clock starts early. Under the EU guidelines the 20 days run from the moment any employee becomes aware of a serious case, including a customer-service agent reading a DM or a marketplace review. Your intake route has to reach a decision-maker in days, not weeks.
- Triage on two questions. Is it a quality defect or a reaction on skin? If it is a reaction, does it meet the legal “serious” definition in that market? The answers decide who investigates and whether a regulator deadline applies.
- Every entry needs a batch code. A complaint without a batch number cannot be traced to production records or retained samples, and a signal you cannot trace is a signal you cannot close.
- Your contract should say what the factory owes you, including how fast it pulls batch records and retained samples, who tests them, and who pays if the root cause is in manufacturing.
Who is this guide for?
This guide is for founders, brand managers and regulatory leads who sell cosmetics made by a contract manufacturer and now receive customer feedback through a web shop, marketplace, retailer or social media. It suits brands launching their first product that need a workable process before day one, and growing brands that have handled complaints informally and want a system an auditor or a retailer’s compliance team would accept. It does not replace a qualified safety assessor or a Responsible Person service. If you have not yet mapped your obligations market by market, read our overview of expanding a beauty brand into the EU, UK and US first.
What is cosmetovigilance, and what does it cover?
Cosmetovigilance is post-market safety monitoring for cosmetics: capturing reports of reactions and problems from real users, judging whether the product caused them, and acting on what you learn. It is the cosmetics counterpart of pharmacovigilance for medicines, but it runs on lighter rules and a shorter, more practical toolkit.
Two kinds of report arrive through the same inbox and need to be separated at once. A quality complaint is about the product itself: a separated cream, an off smell, a leaking pump, a colour that does not match the last batch, a foreign particle. An undesirable effect is about the person: redness, itching, stinging, a rash, swelling, hair breakage, or anything worse. EU Regulation (EC) No 1223/2009 defines an undesirable effect as an adverse reaction for human health attributable to the normal or reasonably foreseeable use of a cosmetic product. A single report can be both, for example a contaminated batch that caused an eye infection, and those cases need the quality investigation and the safety assessment to run together.
The output of cosmetovigilance is not only a regulator notification. Undesirable-effect data feeds back into your safety file: under the EU regulation, information on undesirable and serious undesirable effects forms part of the cosmetic product safety report (CPSR), and the safety assessor is expected to review it when the report is updated. Quality complaints feed back into your specification, your supplier corrective actions and, sometimes, your formula.
Who is legally responsible: the brand or the manufacturer?
The brand is. In every major market the duty to monitor and report adverse reactions sits with the company that places the product on the market under its name, not with the contract manufacturer that made it. The factory’s role is to support the investigation with records, samples and testing.
In the EU and Northern Ireland that company is the Responsible Person named on the label, and Article 23 of the regulation requires the Responsible Person and distributors to notify serious undesirable effects to the competent authority of the country where the effect occurred, together with any corrective measures taken. In Great Britain the same framework applies through the Cosmetic Products Enforcement Regulations 2013, and the Office for Product Safety and Standards publishes a page on SUE and safeguarding notifications with the form Trading Standards and industry use. In the United States, section 605 of the Federal Food, Drug, and Cosmetic Act, added by the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), places the duty on the “responsible person”, defined as the manufacturer, packer or distributor whose name appears on the label. For a private-label product that is almost always the brand.
What the manufacturer does own is complaint handling inside its quality system. ISO 22716, the international cosmetics GMP guideline, has a clause on complaints and recalls that expects a factory to review complaints, investigate the batches concerned and follow up with corrective action. Our guide to cosmetic GMP and ISO 22716 for brand owners explains what that system should look like from the outside. The practical rule is simple: you run the safety side and the regulator clock; the factory runs the manufacturing investigation; your contract joins the two.
Which reactions must be reported, and how fast?
Only serious cases carry a mandatory reporting deadline, and each market defines “serious” slightly differently; everything else is logged, assessed and kept on file. The table below compares the four regimes most private-label brands meet first.
| Market | What must be reported | Deadline | Who reports, and to whom | What else is required |
|---|---|---|---|---|
| European Union | Serious undesirable effect (SUE): temporary or permanent functional incapacity, disability, hospitalisation, congenital anomaly, immediate vital risk or death | “Without delay”, read in the Commission guidelines as within 20 calendar days of any employee becoming aware | Responsible Person or distributor, to the national authority where the effect occurred, using SUE form A | Keep SUE and undesirable-effect data in the product information file; make existing data publicly accessible on request (Article 21) |
| Great Britain | SUE, using the same definition as the EU text retained in UK law | Without delay; follow the OPSS guidance | Responsible Person, to the Office for Product Safety and Standards | Consult OPSS before safeguarding action on a technically compliant product that still poses a serious risk |
| United States | Serious adverse event: death, life-threatening experience, inpatient hospitalisation, persistent disability, congenital anomaly, infection, or significant disfigurement such as serious and persistent rashes, second- or third-degree burns or significant hair loss, or a case needing medical or surgical intervention to prevent those outcomes | 15 business days from receipt; new medical information received within one year must follow within 15 business days | Responsible person, to FDA via the Safety Reporting Portal, electronic gateway or Form FDA 3500A, with a copy of the label | Keep adverse-event records (six years, or three for qualifying small businesses, under section 605); label must carry a US address, phone number or electronic contact for adverse-event reports |
| ASEAN | Serious adverse reactions, as defined by each national regulator under the ASEAN Cosmetic Directive framework | Set nationally; confirm with each regulator | The company that notified the product, to the national regulator (in Singapore, HSA) | Product information file must be available for post-market surveillance |
Three details catch brands out. First, the EU guidelines ask for every SUE to be notified unless the causality assessment classifies it as “excluded”, so a case you judge “unlikely” still goes in. Second, the US definition is wider than the EU one: an infection or a persistent rash can make a case serious in the US that would not meet the EU threshold, so a brand selling in both markets should triage against the stricter definition. Third, the clock does not wait for the investigation. You notify with what you know and send follow-up information later; you do not hold a report back until the factory has tested the batch.
The authoritative texts are the European Commission’s market surveillance page, which hosts the SUE reporting guidelines and forms A, B and C, and FDA’s page on how to report a cosmetic product related complaint, which sets out the industry submission routes. Both were checked in September 2026.
How should you triage a complaint when it arrives?
Triage every report within one working day by answering three questions in order: is it about the product or the person, is it potentially serious, and is it isolated or part of a pattern? The answers decide who investigates and how fast. The matrix below is the one we recommend brands copy into their standard operating procedure.
| Category | Typical example | First action (within 1 working day) | Who investigates | Regulator deadline? |
|---|---|---|---|---|
| A. Quality defect, no reaction | Phase separation, leaking pump, wrong shade, off odour | Get batch code and photos; check other complaints on the same batch | Manufacturer QC, under the supply agreement | No, unless a defect creates a safety risk |
| B. Mild, self-limiting reaction | Stinging or redness that resolved after stopping use | Advise stopping use; record product, batch, body site, onset time, resolution | Brand, with safety assessor review in periodic trend reports | No; log and keep on file |
| C. Reaction needing medical care | Rash treated by a doctor, eye irritation needing examination | Request medical details with consent; open a causality assessment; quarantine the batch record | Brand plus safety assessor; manufacturer pulls batch record and retained sample | Check against the US definition; may be serious there even if not in the EU |
| D. Potentially serious | Hospitalisation, burn, infection, significant hair loss, facial swelling | Escalate to the Responsible Person the same day; start the regulator clock log | Responsible Person, safety assessor, manufacturer; microbiology on retained sample | Yes: EU 20 calendar days, US 15 business days |
| E. Signal (cluster) | Three or more similar reactions on one batch, or a rising rate across batches | Pause shipment of the batch; review production and raw-material lots | Brand and manufacturer jointly; supplier corrective action where relevant | Depends on individual cases; consider withdrawal or recall |
The pattern question matters more than any single report. One person with a stinging sensation is information; ten people on the same batch in a fortnight is a signal that points to manufacturing, a raw-material lot or a packaging change. A cluster on one batch usually points to production or a material lot. A steady rate across all batches usually points to the formula, the claim, or the way the product is being used. A rise after a label or marketing change often points to use instructions, such as a leave-on direction for a product designed to be rinsed off.
How do you judge whether the product caused the reaction?
Use a structured causality assessment rather than a gut call, and have it done by someone with a professional background in skin reactions, usually your safety assessor or a dermatologist they work with. The European Commission’s SUE guidelines describe a method that scores the case and combines the scores into five levels: very likely, likely, not clearly attributable, unlikely and excluded.
The method looks at two groups of evidence. The first is chronology: did the reaction appear in a plausible time after use, did it fade when use stopped, and did it return when the person used the product again? The second is symptomatology: is the reaction consistent with what the product and its ingredients could cause, and have other explanations such as a new medicine, another product used at the same time, sunburn or an existing skin condition been ruled out? Where a dermatologist carried out patch testing with the product or its ingredients, that result carries heavy weight.
Two habits make causality work much easier. Collect the right facts at intake: the exact product and batch code, the body site, how much and how often it was used, the time to onset, other products in use, and whether the person has known allergies. Our guide to declaring fragrance allergens on cosmetic labels is useful here, because fragrance allergens are among the most common causes of confirmed contact allergy and a dermatologist will ask whether the label disclosed them. And never argue with the customer about cause. Your job at intake is to record, reassure and gather information; the assessment happens afterwards.
What should your OEM manufacturer do when a complaint comes in?
Your manufacturer should pull the batch manufacturing record, test the retained sample of the batch concerned, check the raw-material and packaging lots used, and report a root cause and corrective action to you in writing within an agreed number of days. None of that happens reliably unless the supply agreement says so.
Retained samples are the key evidence. A factory working to GMP keeps a retained sample of each finished batch for a defined period, and testing it tells you whether the batch left the plant in specification. If the retained sample passes and the returned unit fails, the problem probably started after release: heat in a warehouse, a damaged closure, or contamination during use. If both fail, the root cause is in production or materials. Our explainer on shelf life, PAO and batch codes covers how long samples and records should be kept and why the batch code is what makes any of this possible. For what the release documents themselves should show, see our tutorial on reading a spec sheet and certificate of analysis.
Put these five commitments into your agreement, ideally in the quality agreement that sits alongside the commercial contract:
- Response time. The factory acknowledges a complaint within two working days and pulls the batch record within five. For a potentially serious case, it confirms within 48 hours whether the batch met specification at release.
- Retained sample access. Retained samples are kept for at least the shelf life plus a margin, and the brand can have them tested by the factory or an independent laboratory.
- Traceability. The factory can identify every raw-material and packaging lot used in a finished batch, and every other batch that used the same material lots, within a set time.
- Root cause and CAPA. Manufacturing-related complaints get a written root-cause analysis and a corrective and preventive action (CAPA) plan with an owner and a deadline.
- Cost allocation. The agreement states who pays for testing, withdrawal, recall and replacement stock when the root cause is manufacturing, materials, or use.
Our review of what a good manufacturing contract looks like shows where these clauses usually sit. If you are still comparing factories, ask each shortlisted supplier for its complaint-handling procedure and a redacted example of a closed complaint file; the manufacturer directory is a practical starting point for building that shortlist.
What should a cosmetovigilance log record?
A usable log records enough to trace the product, reconstruct the case, prove your timeline and spot patterns: at minimum twelve fields per entry. A spreadsheet is fine for a young brand; what matters is that every entry is complete and nothing is deleted.
| Field | Why it matters | Common gap |
|---|---|---|
| Date received and date any employee first saw it | Starts the regulator clock | Only the date the complaint reached the quality team is recorded |
| Channel (email, marketplace, retailer, social, phone) | Shows where reports are coming from and whether any channel is not monitored | Marketplace reviews and social comments never enter the log |
| Product name, size and batch code | Links the case to production records and retained samples | Batch code not asked for, or the customer has thrown the pack away |
| Country where the effect occurred | Decides which authority receives any report | Recorded as the country of the web shop, not the user |
| Category (A–E from the triage matrix) | Decides investigation route and deadline | Mixed quality and safety cases filed under quality only |
| Description, body site, onset time, duration | Core input to the causality assessment | Free-text notes with no onset time |
| Other products used and relevant history | Rules alternative causes in or out | Never asked |
| Medical treatment and outcome | Decides seriousness | Outcome not followed up after the first reply |
| Causality level and assessor | Documents the judgement and who made it | Assessed informally by customer service |
| Reported to authority? Date and reference | Proves compliance with the deadline | Report sent but reference not stored |
| Manufacturer investigation result | Closes the quality loop | Factory reply never received or never filed |
| Corrective action and closure date | Shows the issue was handled, not just recorded | Cases left open indefinitely |
Review the log monthly for patterns and quarterly with your safety assessor. A simple rate helps: complaints per 10,000 units sold, split by category and by batch. The absolute number means little on its own; a batch whose rate is several times the running average is the one to investigate, even if no single case was serious.
How do you set up cosmetovigilance before launch?
Set it up before the first unit ships: a published contact route, a named owner, a written triage procedure, a log, a safety assessor who will review cases, and matching clauses in your manufacturing agreement. Brands that build the process after the first serious complaint usually miss the first deadline.
- Publish a contact route on pack and online. In the US the label must carry a domestic address, phone number or electronic contact through which the responsible person can receive adverse-event reports; FDA’s Cosmetics Labeling Guide covers labelling basics. A monitored email address on the website works as the common route for every market.
- Name an owner and a deputy. One person is accountable for triage within one working day, with a deputy for holidays. For EU or UK sales, agree in writing how your Responsible Person service receives cases and who files the notification.
- Train everyone who touches customers. Customer-service agents, community managers and marketplace sellers need a one-page script: express concern, advise stopping use and seeking medical advice if symptoms persist, ask for the batch code and a photo, and forward the case the same day.
- Monitor marketplace reviews and social comments. A reaction described in a public review is a report you are aware of. Assign someone to check these channels at least weekly and log anything that describes a reaction.
- Agree the factory’s commitments in the quality agreement, using the five points above.
- Prepare templates. Keep ready-to-use customer replies, an internal case form and copies of the authority forms, such as EU SUE form A and FDA Form 3500A, so a serious case does not start with a search for paperwork.
- Link it to recall readiness. Know which retailers and distributors received which batches. The same distribution records you need for a recall are the records that turn a signal into a defined, containable problem.
Pre-launch testing reduces the volume of reactions but never removes it. The tests in our checklist of cosmetic product testing before the first batch, such as challenge testing, compatibility and patch testing, reduce what you will see after launch, but they involve dozens of people, while your first production run may reach thousands. Cosmetovigilance is how you learn what testing could not show.
What mistakes do brands make with complaints?
The costly mistakes are procedural, not scientific: slow intake, missing batch codes, and treating the factory’s complaint file as if it were the brand’s safety system.
- Refunding and moving on. A refund resolves the customer relationship, not the safety question. Log the case before you close the ticket.
- Letting the clock run in a shared inbox. The EU guideline clock runs from awareness by any employee. A case that sits unread for three weeks is already late.
- Forwarding everything to the factory. The manufacturer can investigate the batch but cannot file your notification or assess the case on your behalf unless the contract says so.
- Arguing about cause with the customer. It damages trust and it can end up quoted in a public review. Gather facts; assess afterwards.
- Ignoring the stricter market. A brand selling in the EU and US that triages only against the EU definition will under-report US cases involving infection or persistent rash.
- Never feeding cases back to the safety assessor. Undesirable-effect data belongs in the safety report. A product information file that says “no undesirable effects recorded” after two years on sale will not persuade an inspector.
Frequently asked questions
Is cosmetovigilance a legal requirement for small brands?
Yes, in substance. The EU and UK regulations require every Responsible Person to notify serious undesirable effects and keep undesirable-effect data in the product information file, whatever the company’s size. In the US, MoCRA’s serious adverse event reporting applies to small businesses too; only the record-keeping period is shorter. A spreadsheet log and a written procedure are enough to start.
Do I have to report a mild rash to the authorities?
Usually not. Mandatory reporting applies to serious cases as each market defines them, such as hospitalisation, disability or, in the US, significant disfigurement or infection. A mild reaction that resolves after stopping use is logged, assessed and kept on file. Review the case again if new information shows it was more serious than first reported.
Can my manufacturer handle adverse event reporting for me?
Only if it is also your Responsible Person or your agreement formally delegates the task, and even then the legal duty remains with the company named on the label. Most OEM factories handle quality complaints, not regulatory safety reporting. Put the split of responsibilities in writing in your quality agreement.
What if the customer will not give me the batch code?
Log the case anyway, with the purchase date, retailer and product size, which often narrow it to one or two batches. Ask again politely, and explain that the code helps you check the product. Print the batch code where it survives use, such as on the tube crimp or the bottle base, not only on the outer carton.
How long should I keep complaint records?
Keep them at least as long as any law requires and ideally for the product’s time on the market plus several years. In the US, section 605 requires adverse-event records to be kept for six years, or three years for qualifying small businesses. In the EU, the product information file must be kept for ten years after the last batch was placed on the market, and undesirable-effect data forms part of it.
Does a reported reaction mean my product is unsafe?
No. The UK Office for Product Safety and Standards notes that a SUE notification does not necessarily mean a product is unsafe or non-compliant, since reactions can arise from an individual allergy or sensitivity. What matters is how you assess the case, whether a pattern emerges and what you do about it. Keep the investigation factual and documented.
Sources and limitations
- European Commission, Cosmetics legislation (Regulation (EC) No 1223/2009, including Articles 2, 21 and 23), and Market surveillance, which hosts the SUE reporting guidelines (20-calendar-day timeframe, five-level causality method) and SUE forms A, B and C.
- UK Office for Product Safety and Standards, SUE and safeguarding notifications for cosmetics and Cosmetic products: reporting SUEs; Cosmetic Products Enforcement Regulations 2013.
- US FDA, How to Report a Cosmetic Product Related Complaint (15-business-day rule, serious adverse event definition, submission routes), MoCRA, MedWatch and the Cosmetics Labeling Guide.
- Health Sciences Authority Singapore, ASEAN Cosmetic Directive.
- ISO 22716 (cosmetics good manufacturing practices), referenced by name for its complaints and recalls clause.
This guide summarises post-market safety obligations for cosmetics as published on the official pages above, checked on 18 September 2026. It is general guidance, not legal or medical advice. Definitions, deadlines and forms change, and ASEAN member states set their own reporting routes, so confirm current requirements with each authority or your Responsible Person. The triage matrix, factory response times and log fields are our recommended practice drawn from typical OEM supply arrangements, not regulatory text; adapt them to your products, volumes and markets.
This article is general educational information for cosmetic brand owners. Seek advice from a qualified safety assessor, a dermatologist where a reaction needs medical judgement, and your Responsible Person before deciding whether a specific case must be reported.