MoCRA Serious Adverse Event Reporting: A Step-by-Step Procedure for Cosmetic Brands
Since MoCRA took effect, every cosmetic brand whose name is on the label must report serious adverse events to FDA within 15 business days. It applies to the one-person skincare startup as much as to the multinational: unlike registration and listing, there is no small-business exemption. The only relief for small businesses is a shorter record retention period.
Most brands already get complaints by email, through product reviews or via a customer service inbox. What MoCRA changes is that some of those complaints now start a legal clock. If nobody on your team can tell a serious event from an ordinary complaint, or nobody knows where the report goes, the deadline passes before anyone notices.
This guide walks through the duty clause by clause, from the statute at 21 U.S.C. 364a, and ends with the written procedure a brand needs to meet it every time.
What counts as a serious adverse event
MoCRA defines an adverse event broadly: any health-related event associated with the use of a cosmetic product that is adverse (21 U.S.C. 364). Only serious events must be reported. An event is serious if it results in any of the following:
Death.
A life-threatening experience.
Inpatient hospitalization.
A persistent or significant disability or incapacity.
A congenital anomaly or birth defect.
An infection.
Significant disfigurement, including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance, other than as intended, under conditions of use that are customary or usual.
An event is also serious if, based on reasonable medical judgment, it requires medical or surgical intervention to prevent one of those outcomes.
Two items on that list catch brands out. Infection is serious on its own, with no hospital stay needed: an eye infection after using a mascara, or a skin infection after a contaminated cream, qualifies. Disfigurement covers the outcomes cosmetic users actually complain about: a rash that will not clear, a chemical burn from a hair relaxer, hair loss after a treatment, or skin discoloration that persists.
Serious or not: worked examples
Mild redness after a face cream that cleared in a day: No. Not persistent; record it as a complaint.
Rash that lasted three weeks and needed a prescription steroid: Yes. Serious and persistent rash; medical intervention.
Eye infection after using a mascara: Yes. Infection.
Second-degree scalp burn from a hair straightening product: Yes. Second-degree burn.
Hair falling out in patches after a dye: Yes. Significant hair loss.
Hair color came out darker than the box showed: No. Not health-related; product quality complaint.
Hospital visit for an allergic reaction to a body lotion: Yes. Inpatient hospitalization (or intervention to prevent a life-threatening outcome).
When in doubt, treat it as serious and investigate. A report filed for an event that later proves minor costs little; a missed report is a violation of the FD&C Act that an FDA inspector can find in your complaint files.
Who reports, by when, and what to send
Who: the responsible person, meaning the manufacturer, packer or distributor whose name appears on the product label (21 U.S.C. 364). If you sell a private-label product made by a contract manufacturer, and your brand is on the label, the duty is yours, not the manufacturer's. Your contract with the manufacturer should require them to pass on any adverse event they receive within one or two business days, so your clock does not run down in their inbox.
By when: no later than 15 business days after the responsible person receives the report. The clock starts when anyone in your company, or anyone acting for you, receives the information: a customer service agent, a social media manager, a retailer passing on a complaint. It does not start when the quality manager finally reads it.
What to send:
The serious adverse event report itself. FDA accepts the MedWatch Form 3500A on paper or electronic submission; check FDA's cosmetics adverse event page for the current routes before your first report.
A copy of the product label on or within the retail packaging.
Follow-up: if you receive new and material medical information about a reported event within one year of the initial report, you must send it to FDA within 15 business days of receiving it. Typical examples: a doctor's diagnosis, test results, or news that the person was hospitalized after you filed.
Not an admission: the statute says that submitting a report shall not be construed as an admission that the product caused or contributed to the event. You may also attach a statement denying that the report is an admission, and FDA must include it if the report is released publicly (21 U.S.C. 364a).
Building the procedure, step by step
A working adverse event procedure turns a 15-business-day legal duty into a routine that does not depend on any one person remembering it. These are the steps it should cover, in order.
Capture every channel. List each place a complaint can arrive: the contact address on the label, customer service email and phone, website chat, product reviews, social media comments and messages, marketplaces (Amazon, Walmart, TikTok Shop), retailers, distributors and your contract manufacturer. Assign an owner to each channel and require them to forward any health-related complaint to quality on the day it arrives.
Log it with a receipt date. Enter every health-related complaint in an adverse event log the day it is received. The receipt date is day zero for the 15-business-day clock, so record it exactly, along with who received it and through which channel.
Gather the facts. Contact the consumer to collect product name, batch or lot number, where and when it was bought, how it was used, symptoms, when they started, any medical treatment, and the outcome. Ask for photos and permission to contact their doctor. Keep the batch's retained sample.
Decide whether it is serious. A trained person compares the facts to the statutory definition and records the decision and the reasoning on the intake form. If the information is incomplete, the default is to treat it as serious. Set an internal target, such as a decision within 5 business days, so there is time to file.
Prepare and submit the report. Complete the report form, attach a copy of the label, have it reviewed, and submit it to FDA before day 15. Keep the submission confirmation.
Investigate the product. Separately from the FDA report, investigate the batch: review the batch record, test the retained sample (microbial count, preservative level, pH), check for other complaints on the same batch, and decide whether a CAPA, a hold or a recall is needed.
Track follow-up for one year. Diary a follow-up for each reported event. Any new and material medical information received within one year of the initial report goes to FDA within 15 business days.
Trend and review. Review the log at least quarterly and at management review: complaint rates by product, by batch and by type of reaction. A cluster of non-serious rashes on one product is an early warning worth acting on.
Train the people on the front line. Customer service staff and social media managers are the most likely to receive the first report. Train them to recognize health-related complaints and forward them the same day, and keep training records.
Forms the procedure needs
Adverse event intake and assessment form (facts, seriousness decision, reviewer sign-off).
Adverse event log (receipt date, due date, status, FDA submission date, follow-up due date).
Consumer follow-up script and medical information request.
Quality agreement clause for contract manufacturers and distributors on forwarding complaints.
Records, inspections and fragrance requests
Keep records for 6 years. The responsible person must keep records of each adverse event report for 6 years. A small business that does not make the higher-risk products listed below may keep them for 3 years (21 U.S.C. 364a). Keep the non-serious complaints too: FDA will judge your seriousness decisions by reading them.
FDA can read them. During an inspection, an authorized FDA officer may access and copy these records. An inspector will typically compare your complaint log against your FDA submissions and ask why each health-related complaint was or was not reported.
Fragrance and flavor ingredients on request. If FDA has reasonable grounds to believe a fragrance or flavor ingredient caused or contributed to a serious adverse event, it may ask in writing for the list of those ingredients. You must provide it within 30 days. Most brands do not hold their fragrance formula, so your supply agreement with the fragrance house must oblige them to disclose it to you or directly to FDA within that time.
Small businesses are not exempt
MoCRA's small business exemption (average US cosmetic sales under $1,000,000 a year over the previous three years, adjusted for inflation) covers only facility registration, product listing and the coming GMP rule (21 U.S.C. 364h). It does not cover adverse event reporting. And no business qualifies for the exemption if it makes products that regularly contact the eye's mucous membrane, injected products, products for internal use, or products meant to alter appearance for more than 24 hours that the consumer does not remove.
Your label must also carry a domestic address, domestic phone number or electronic contact (such as a website) through which you can receive adverse event reports. That requirement has applied since December 29, 2024 (21 U.S.C. 364e).
Common mistakes
Starting the clock late. The 15 days run from when anyone acting for the brand received the report, not from when quality reviewed it.
Ignoring social media. A comment describing a burn is a report received. Someone must be watching.
Relying on the contract manufacturer. If your brand is on the label, the duty is yours.
Treating infection as minor. Infection is serious by definition.
No fragrance disclosure clause. Without one, you cannot meet a 30-day FDA request.
No written decision. An undocumented "not serious" call is hard to defend in an inspection.
Put it in writing
A.P. Lyon's MoCRA Compliance Procedures ($345) include a complete Serious Adverse Event Handling and Reporting procedure, written to the statute, with the intake and assessment form, adverse event log and complaint channel register described above, all as editable Word documents. They are also part of the Cosmetic GMP and MoCRA Quality System ($995), which adds ISO 22716 production, laboratory and release procedures.
Browse all cosmetics documents, or contact A.P. Lyon about consulting.
The procedures need to be adapted to your products, suppliers and organization, and your regulatory contact should confirm FDA's current submission route. They are documentation, not legal advice or certification.
Comments