MoCRA Serious Adverse Event Reporting: The FDA Obligation European Cosmetics Exporters Are Still Missing

Two years after the FDA’s Modernization of Cosmetics Regulation Act changed the rules for the US market, most European cosmetics brands have heard of MoCRA. Far fewer have properly implemented its serious adverse event reporting (SAER) obligations — and the gap is starting to matter.

The FDA now has explicit authority to request adverse event records from responsible persons with as little as 15 business days’ notice. That’s the same 15 business days brands have to file a serious report in the first place. Running both processes without a documented system in place is nearly impossible. Yet when European quality managers prepare their first MoCRA compliance audits, formal SAER procedures are almost always the item missing from their documentation package.

Here’s what MoCRA actually requires, where European brands most commonly fall short, and what a workable reporting programme looks like.

---

What Qualifies as a “Serious Adverse Event” Under MoCRA

The Modernization of Cosmetics Regulation Act — signed into law on December 29, 2022 and codified at 21 U.S.C. § 364b — defines a serious adverse event with more precision than many European exporters expect. An event is “serious” if the use of a cosmetic product results in:

• death
• a life-threatening experience
• inpatient hospitalisation
• a significant disability or incapacity
• a congenital anomaly or birth defect
• a medical intervention required to prevent permanent impairment

That list closely mirrors the EU standard under Article 23 of Regulation (EC) No 1223/2009, which covers “serious undesirable effects” (SUEs). But the procedural obligations diverge sharply — and those differences are exactly where European exporters get caught.

Under Article 23, the notification timeframe is 20 working days from when the responsible person or distributor becomes aware of a serious undesirable effect. Under MoCRA, the clock is tighter: 15 business days from receipt of information. European brands accustomed to the EU cosmetovigilance framework routinely miss this distinction when drafting their US procedures. They transpose the EU timeline, and the discrepancy sits quietly in their SOPs until an FDA inspector asks to see them.

Non-serious adverse events are handled differently under each regime as well. MoCRA requires that they be documented and retained for 3 years — but does not require active reporting to FDA. That 3-year record is, however, subject to FDA inspection on demand, which matters more than it might appear.

---

The “Responsible Person” Question European Brands Cannot Sidestep

Under MoCRA, the responsible person (RP) is the manufacturer, packer, or distributor whose name appears on the cosmetic product’s label. That designation carries real legal weight: the RP bears primary responsibility for SAER compliance, facility registration, product listing, and safety substantiation.

For European brands exporting to the US, RP status is often genuinely unclear — and that ambiguity is itself a compliance problem. Three scenarios we see repeatedly:

Scenario A: A French skincare brand sells through a US distributor. The distributor’s name and address appear on the label. The distributor is the RP. But the French brand never confirmed whether that distributor has a functioning SAER system, or even knows they’re obligated. If a serious adverse event is reported and the distributor hasn’t filed within 15 business days, the enforcement action lands on the RP — not the European brand. But the European brand supplied the product.

Scenario B: A German supplement company sells direct-to-consumer via its own US-facing website, shipping from an EU warehouse. The brand’s name is on the label. The brand is the RP — which means it must maintain a US mailing address, a SAER procedure, and a system for monitoring adverse signals from US consumers.

Scenario C: A Belgian contract manufacturer produces cosmetics for a US brand under private label. The US brand’s name is on the label, so the US brand is the RP. But if the formulation causes an adverse event and the root cause is a raw material from the Belgian manufacturer, the traceability chain and the contract language both become central to any FDA investigation.

Clarifying RP status in writing before the first adverse event arrives is not bureaucratic overhead. FDA enforcement in the MoCRA era focuses on whether systems exist — not just whether individual events were reported correctly.

---

The 15-Business-Day Clock and How to Actually Meet It

The SAER obligation became effective December 29, 2023 — exactly one year after MoCRA’s enactment. Responsible persons must submit a report to FDA within 15 business days of “receiving information” suggesting a cosmetic product may have caused or contributed to a serious adverse event.

“Receiving information” is not limited to formal complaints or physician reports. A customer email describing a hospitalisation, a social media comment, a retailer message forwarded by a logistics partner — any of these can start the clock. European brands that treat their US market as an arm’s-length export relationship, with no systematic monitoring of US consumer feedback channels, will routinely miss the trigger moment entirely.

Reports are submitted via FDA MedWatch Form 3500A, through the FDA Safety Reporting Portal. The submission must include:

• the product name and, where available, the lot or batch number
• the responsible person’s name and contact information
• a description of the adverse event as reported by the consumer or healthcare provider
• consumer contact information (optional, and only with their consent)

Critically, MoCRA does not require the brand to have concluded a causality investigation before reporting. The standard is receipt of credible information — not confirmed causation. Filing late because an internal investigation was still pending is not a defensible position with FDA. Submit within 15 business days, then submit follow-up information as it becomes available.

And it does keep coming: any new medical information received within 1 year of the original report must be submitted as a follow-up, again within 15 business days of receipt.

---

Record-Keeping: The Obligation Most Programmes Miss

The record-keeping requirement under MoCRA is broader than the reporting requirement, and European brands consistently underestimate it. Responsible persons must maintain records of all adverse events — serious and non-serious — for a minimum of 3 years from the date of receipt.

For a European brand receiving consumer feedback across multiple channels — email, Amazon Seller Central messages, retailer return notes, social media tags — this requires a centralised log that:

• timestamps exactly when information was received
• categorises each event as serious or non-serious, with the reasoning documented
• retains the original consumer communication in its original form
• records any follow-up submissions made to FDA

That log is precisely what FDA will request during an inspection or in the aftermath of a voluntary safety recall. Brands that cannot produce it within the 15-business-day inspection response window face the kind of enforcement exposure that makes the original reporting obligation look manageable by comparison.

One detail that consistently surprises European quality teams: the 3-year clock runs from the date of receipt, not from the resolution of the event or the conclusion of any investigation. An adverse event report received in January 2024 must be retained through at least January 2027, regardless of whether the event was ever characterised as causally linked to the product.

---

Packaging Must Tell US Consumers Where to Report

MoCRA also imposed a labelling obligation that’s straightforward in theory but operationally awkward for European exporters: every cosmetic product sold in the US must carry contact information — a name and physical US address or a US phone number — where consumers can report adverse events to the responsible person.

For European exporters, this means the RP’s US contact details must appear on the label — not the European manufacturer’s address. A French brand whose label carries only a Paris address and a French country-code phone number has given US consumers no domestic reporting channel. That’s a clear non-conformance that FDA can cite during a label review, independent of whether any adverse event has ever been reported.

Updating label artwork to include US-specific contact information sounds like a minor change. For brands managing multilingual artwork across the EU, North America, and potentially other markets, it’s a formal change control event — one that can take 3 to 6 months to move through design, legal review, print procurement, and inventory transition. Starting that process after a compliance audit is considerably more painful than starting it before the product ships.

---

Building a SAER-Ready System Before You Need It

The brands that handle MoCRA’s adverse event obligations most cleanly aren’t the ones that respond well to individual events — they’re the ones that built the infrastructure before any event occurred. In practice, that means five things:

1. Confirm responsible person status in writing. Contract language with US distributors and co-packers should explicitly name who holds RP obligations, and should include an attestation that the RP maintains a functional SAER procedure.

2. Set up a US consumer feedback monitoring protocol. At minimum, a weekly review of US-facing email inboxes, Amazon messages, retailer portals, and social media tags specifically for adverse event language — hospitalisations, allergic reactions requiring medical care, unexpected injuries.

3. Train whoever receives US consumer communications. Customer service staff need a simple escalation rule: if a consumer describes any hospitalisation, medical intervention, or serious injury linked to a product, escalate immediately to the quality team. The 15-business-day clock does not pause while the complaint routes through three inboxes.

4. Prepare MedWatch Form 3500A as a working template. Complete the static fields — product name, responsible person contact details — in advance, and annotate the event-specific fields so the person completing it under time pressure knows exactly what’s required.

5. Maintain a single adverse event log. One shared document or system that captures every adverse event, the date received, the seriousness determination, the reasoning behind non-serious classifications, and any FDA submissions made. Simplicity matters more than sophistication here.

None of this demands complex software. It demands a documented procedure and a named owner — and it demands that both exist before an adverse event arrives.

---

Where Care Europe supports European brands in this process is in mapping RP structure before US launch, reviewing existing distributor contracts for SAER compliance gaps, and connecting brands with US-based partner labs that can generate the underlying safety substantiation data. A cosmetic that’s been properly tested for microbial limits, heavy metals, stability, and challenge testing produces fewer serious adverse events — and when events do occur, that testing record becomes the backbone of the FDA causality response.

The reporting obligation is real. The enforcement environment around MoCRA is maturing steadily. Treating SAER as a compliance checkbox is a reasonable strategy right up until the moment FDA comes looking for the records.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about US market entry, MoCRA responsible person structure, and safety substantiation for EU-origin cosmetics. Contact us

Related from our network

• ISO 17025-accredited cosmetics safety testing for MoCRA substantiation — Qalitex Laboratories supports European brands with the US-standard testing documentation required to underpin MoCRA product safety claims.
• Health Canada NHP compliance testing for European supplement exporters — Androxa provides Canadian market-entry testing for European natural health product brands navigating the NHPR licensing process.