Cosmetovigilance in France: Your SUE Reporting Obligations Under EC Regulation 1223/2009

Most European cosmetics brands file their CPNP notifications, appoint their Responsible Person, and consider their EU regulatory homework largely done. Then a consumer reports a serious reaction — hospitalisation, a worsening dermatological condition that required medical intervention, or an acute systemic response — and the brand’s quality team isn’t entirely sure what the obligations are from that point forward.

That uncertainty is exactly what Article 23 of Regulation (EC) No 1223/2009 is designed to address. And in France — where the ANSM (Agence nationale de sécurité du médicament et des produits de santé) is one of the EU’s most methodical competent authorities for cosmetic adverse event oversight — getting cosmetovigilance wrong isn’t an abstract compliance risk. It’s an exposure that can escalate from a missed notification into a full product dossier review faster than most brands are prepared for.

What Qualifies as a Serious Undesirable Effect?

Before you can report correctly, you need to know precisely what you’re reporting on. Article 2(1)(p) of Regulation (EC) No 1223/2009 defines a Serious Undesirable Effect (SUE) as an undesirable effect that results in one or more of the following:

• Temporary or permanent functional incapacity
• Disability
• Hospitalisation
• Congenital anomaly
• An immediate vital risk
• Death

That’s a specific, legally bounded list — not a catch-all for any consumer complaint. A report of mild redness, fragrance sensitivity, or product-related dryness is a non-serious undesirable effect (UE). It belongs in your Product Information File and feeds your post-market safety monitoring programme, but it doesn’t trigger Article 23 notification obligations.

The distinction matters operationally. We see brands treat every adverse event report as a potential SUE, which creates internal escalation noise and can desensitise QA teams to genuine signals. Occasionally, the opposite happens: a brand dismisses what looks like minor contact dermatitis, unaware that if the consumer subsequently sought emergency care, the original report could be retroactively reclassified as an SUE — and the notification clock would be judged from when the brand first received information, not from when the hospitalisation was confirmed.

Document your triage rationale. Every time you determine a report doesn’t meet the Article 2(1)(p) threshold, that determination needs a paper trail. ANSM inspectors have flagged cases where brands couldn’t demonstrate how they arrived at a non-SUE classification — not because the classification was wrong, but because there was no documented review process behind it.

France’s Cosmetovigilance Framework: ANSM, DGCCRF, and Their Respective Roles

France operates a dual-authority structure for cosmetics oversight, and it trips up a lot of non-French regulatory teams working with French market access for the first time.

ANSM is the designated competent authority under Regulation (EC) No 1223/2009 for cosmetovigilance. It receives SUE notifications, investigates emerging safety signals, can request access to your PIF during a market surveillance action, and — under Article 23(3) — has the authority to proactively inform the public about adverse events where consumer protection justifies it. Critically, ANSM also coordinates with competent authorities in other member states and with the European Commission under Article 23(4). A report filed in France doesn’t stay in France.

DGCCRF (Direction générale de la concurrence, de la consommation et de la répression des fraudes) handles a structurally different piece of the regulatory landscape: labeling accuracy, claims compliance, market surveillance sampling, and consumer fraud. If your product appears in French distribution with a non-compliant INCI list, an unauthorised efficacy claim, or a missing mandatory mention, it’s DGCCRF that acts. They conduct unannounced inspections at retail level, test products collected from shelves, and refer serious cases through to the public prosecutor where warranted.

Both agencies can initiate product recalls, but through different legal mechanisms and for different underlying reasons. Understanding which authority is relevant to a given issue determines your response timeline, your documentation priorities, and whether you need legal expertise in health product regulation or in consumer and competition law. Treating them as interchangeable is a common mistake.

SUE Reporting: What Must Be Notified, and When

Article 23(1) of Regulation (EC) No 1223/2009 establishes the operative rule: when a Responsible Person becomes aware of a Serious Undesirable Effect that occurred in a member state, notification to that member state’s competent authority must be made “without delay.” ANSM interprets this to mean as soon as the SUE has been evaluated and categorised — not after an extended internal sign-off cycle.

The notification must include, at minimum:

• The identity of the cosmetic product, including name, reference, and batch number
• The name and contact address of the Responsible Person
• The member states where the product is placed on the market
• The nature of the SUE — a clinical description, the reported outcome, and any supporting medical documentation available
• Any corrective or preventive measures taken or under consideration

There is a clause in Article 23(2) that many brands overlook entirely: distributors who become aware of an SUE carry independent notification obligations. They must inform the Responsible Person and notify the competent authority directly. This creates a parallel reporting chain that operates regardless of whether the Responsible Person has acted. Brands selling into France through pharmacies, parapharmacies, or general retail chains should audit their distribution agreements to confirm that SUE escalation protocols are explicitly written in — not assumed. A distributor’s silence on a received adverse event report doesn’t extinguish the brand’s compliance exposure; it compounds it.

What Goes in the PIF After a Reported SUE

The Product Information File is not a one-time document. Under Article 11 of Regulation (EC) No 1223/2009, the PIF must be kept up to date throughout the product’s commercial life. Annex I, Part B — the cosmetic safety report — explicitly requires that post-market safety monitoring data be reflected, including reported undesirable effects, serious or otherwise.

In practice, this means every confirmed UE and SUE should feed back into the safety monitoring section of the PIF. Some brands manage this through a running adverse event annex updated in real time; others conduct periodic Part B reviews, typically on an annual basis or immediately following any material new safety signal. Both approaches can be defensible, but the documentation must exist and must be current.

A PIF that hasn’t been updated to reflect two years of adverse event data isn’t just a document gap — it’s the first thing an ANSM inspector flags when conducting a surveillance review of a product that has generated complaints.

The safety assessor, who under Annex I must hold at minimum a degree in pharmacy, toxicology, medicine, or an equivalent discipline, carries direct responsibility for reviewing post-market data and determining whether it changes the safety assessment conclusions. If an ingredient that appeared well-tolerated at the time of initial assessment is generating a clustering of sensitisation reports, the Part B safety report needs to be revised — and the formulation itself may need to be reconsidered. The assessor’s professional judgement, applied to real post-market data, is the mechanism the regulation relies on. It only functions if the data reaches the assessor.

GMP Compliance and Its Practical Link to Cosmetovigilance Readiness

There’s a direct operational connection between a brand’s ISO 22716:2007 GMP compliance status and how effectively it can respond to an SUE event. ISO 22716 requires documented batch traceability, systematic complaint handling procedures, internal audit mechanisms, and clearly assigned quality responsibilities — all of which feed directly into SUE triage speed and reporting accuracy.

A brand operating with a functioning ISO 22716-aligned quality management system will typically be able to:

• Identify affected batches within hours, not days, when a product is linked to an adverse event
• Trace the complaint through a documented escalation pathway to a designated quality function
• Produce supplier documentation and raw material CoAs that support causality assessment when a specific ingredient is implicated
• Demonstrate to ANSM that corrective and preventive measures are being managed through a structured CAPA process

Brands without this infrastructure consistently struggle under the time pressure that an SUE event creates. Approximately 60–70% of adverse event reports that brands initially escalate as potential SUEs don’t ultimately meet the Article 2(1)(p) threshold after proper review. But the triage still has to happen, and it has to be documented. A brand that can’t produce a clear record of how it evaluated and classified each report is vulnerable during any ANSM inspection — even when its original decisions were entirely correct.

The Cross-Border Dimension: Why a French SUE Report Reaches Further Than You Think

If your product is sold in France and at least one other EU member state — which is true of virtually any brand operating through pan-European retail or cross-border e-commerce — an SUE reported in France has regulatory implications that don’t stop at the French border.

Under Article 23(4) of Regulation (EC) No 1223/2009, competent authorities are required to share SUE data with each other and with the European Commission. If the same ingredient, formulation, or batch is generating adverse event reports in multiple member states simultaneously, those signals converge at Commission level and can move quickly from aggregated data to formal regulatory review.

This is particularly relevant for brands distributing through Amazon’s European fulfilment network, where a single product listing can supply consumers across France, Germany, Spain, Italy, and the Netherlands from a shared inventory pool. A single serious adverse event originating from one consumer in Lyon can, in the right circumstances, trigger regulatory attention in four or five markets at once.

The SCCS (Scientific Committee on Consumer Safety) publishes opinions on specific cosmetic ingredients, and these opinions are sometimes initiated by patterns in cosmetovigilance data rather than by individual member state requests. Brands formulating with ingredients under active SCCS monitoring should track those opinion cycles closely. A formal SCCS restriction opinion typically precedes an Annex II or Annex V listing by 12 to 24 months — enough lead time to reformulate proactively, but only if you’re watching.

---

If your adverse event handling process hasn’t been reviewed against Article 23 requirements in the last 12 months, that review is overdue. Map the full chain from first consumer contact to ANSM notification. Identify where the process could stall — in a CRM queue, in a distributor’s inbox, in an internal approval loop that adds days without adding accuracy. Confirm that your French distribution agreements explicitly address the Article 23(2) distributor notification obligation. And make sure your safety assessor is receiving post-market data regularly enough to keep Part B current. A few hours of structured internal review is considerably less disruptive than an inspection request you weren’t expecting to receive.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and cosmetovigilance compliance support. Contact us

Related from our network

• EU Cosmetic Ingredient Testing & Safety Documentation — Qalitex Laboratories provides ISO 17025-accredited safety and stability testing to support EU PIF requirements and post-market monitoring programmes.
• Health Canada NHPD Compliance for European Cosmetics Brands — Androxa supports European brands entering the Canadian market with NHPD registration, GMP compliance, and ingredient compliance documentation.