Cosmetics Vigilance Reporting in France: What Article 23 of Regulation 1223/2009 Actually Demands

France accounts for roughly 30% of Europe’s total cosmetics export value — a market position built on decades of regulatory rigour as much as on brand heritage. Yet the compliance gap we most often see in brands entering the French market isn’t labelling or CPNP registration. It’s Article 23 of Regulation (EC) No 1223/2009: the obligation to notify serious undesirable effects to the competent authority within 20 calendar days.

Most brands have the documentation side of EU cosmetics compliance reasonably well managed by the time they launch. Far fewer have built the internal processes to catch, classify, and report a serious undesirable effect in time. That gap is where regulatory liability accumulates — quietly, until it isn’t.

What Exactly Qualifies as a “Serious” Undesirable Effect?

The Regulation defines an “undesirable effect” broadly: any adverse reaction to a cosmetic product under normal or reasonably foreseeable conditions of use. A persistent rash following application of a facial cream qualifies. So does a scalp reaction to a hair dye applied exactly as instructed on the label.

A serious undesirable effect (SUE) is a subset with five specific criteria. An effect becomes legally “serious” if it results in:

• Temporary or permanent functional incapacity
• Disability
• Hospitalisation
• Congenital abnormalities
• An immediate vital risk or death

In practice, hospitalisation is the criterion that triggers the highest proportion of notifications. A severe allergic reaction requiring emergency treatment — even one from which the consumer fully recovers — meets the SUE threshold. Permanent scarring, vision impairment following use of an eye product, or a respiratory event serious enough to require clinical intervention all qualify.

What brands consistently miss: you don’t need to believe your product caused the event. If a consumer reports any of these five outcomes and attributes them to your product, the 20-day clock begins. The standard isn’t established causation; it’s plausible consumer association. Causality assessment comes later in the process.

The clock runs from the date the responsible person (RP) — or any distributor — first becomes aware of the incident. “Aware” is interpreted broadly. A complaint email received by a brand’s customer service team counts. A retailer platform review describing hospitalisation may count. You do not need a formal medical report in hand. You need awareness of the event.

How France’s ANSM Handles Article 23 Notifications

In France, the designated competent authority for cosmetic safety matters — including SUE notifications — is the ANSM (Agence nationale de sécurité du médicament et des produits de santé). This surprises some brands who associate cosmetics enforcement primarily with the DGCCRF (Direction générale de la concurrence, de la consommation et de la répression des fraudes). The DGCCRF handles market surveillance, labelling compliance, and fair trade practices; SUE reports under Article 23 go to ANSM.

The notification must include, at minimum:

• The product name and batch number (or another identifier if the batch is unknown)
• The country where the SUE occurred
• The nature of the adverse event and its clinical presentation
• Any corrective measures already taken or planned by the RP

Where the process becomes more procedurally demanding: Article 23 requires the notification to be filed simultaneously with ANSM and with the competent authority of the Member State where the SUE occurred, if that’s a different country. A German consumer using your product in Berlin and suffering a severe reaction? The notification goes to ANSM as the RP’s Member State authority, and to the BfR in Germany. A Spanish consumer in Madrid? ANSM plus AESAN. Each Member State designates its own competent authority, and Article 23 requires parallel filing, not sequential. Many brands discover this only when a foreign authority contacts them directly.

Brands with RPs established in France — a common arrangement for non-EU companies using French regulatory service providers — also find that ANSM’s internal handling of cosmetics notifications reflects France’s longer cosmetovigilance history. Notifications submitted in French are processed more smoothly. The Commission has not mandated a specific language for Article 23 filings, but in practice French-language submissions navigate ANSM’s administrative systems with fewer delays and fewer requests for clarification.

The Distributor Obligation That Most Supply Chains Miss

Article 23 imposes notification obligations not only on the responsible person but also on distributors. This is the provision overlooked most consistently across the supply chain.

If a major pharmacy group, an e-commerce fulfilment partner, or a retail distributor operating in France becomes aware of a SUE involving a product it stocks, that distributor has a legal obligation to notify the RP without delay — and to notify ANSM directly if the RP has not yet done so. Most distributors operating in France have no idea this obligation exists. Their standard trading terms don’t address it. Their customer service and logistics teams aren’t trained to recognise the five SUE criteria, let alone to treat a consumer complaint as a potential regulatory trigger.

For brands, this creates a specific and underappreciated exposure. If a distributor fails to escalate a SUE promptly and the 20-day window closes before the RP is even informed, the brand may still bear responsibility for the missed notification. The fix is contractual and operational. Distribution agreements for the French market should explicitly define SUE escalation timelines — a 48-hour escalation requirement from distributor awareness to RP notification is a practical standard — and should identify a named regulatory contact for the RP. The majority of French distribution agreements we review are entirely silent on Article 23. That silence is a traceable enforcement risk.

What ANSM Expects Beyond the Legal Minimum

France developed a national cosmetovigilance framework before the EU harmonised post-market surveillance requirements in Regulation 1223/2009. That institutional history means ANSM inspectors apply Article 23 with considerable experience and expect a level of documentation that goes beyond what the Regulation’s text alone prescribes.

ANSM’s internal handling of SUE notifications typically includes a request for additional information within approximately 30 days of receipt. In that follow-up, inspectors commonly ask for a chronological timeline of consumer contact, a cross-reference to the relevant sections of the Cosmetic Product Safety Report (CPSR), and the RP’s preliminary assessment of causality. The causality assessment point is worth underlining: ANSM expects you to have considered whether your product is a plausible contributing factor, even at the initial notification stage, not only after their follow-up request arrives.

In cases where a product category has generated multiple SUE notifications — certain hair colourants, nail systems, and high-fragrance leave-on products appear with regularity in ANSM’s surveillance activity — the agency may request the full CPSR. A safety report drafted at product launch and never subsequently updated will not survive that scrutiny. Article 10(1) of Regulation 1223/2009 explicitly requires the safety assessor’s report to address post-market surveillance. If your CPSR has no mechanism for incorporating adverse event data, you have a documentation gap that a SUE notification can expose very quickly.

Building an Internal Cosmetovigilance Process That Functions

The brands that handle Article 23 most effectively have built cosmetovigilance into their standing regulatory governance rather than treating it as an emergency protocol activated when something goes wrong. Three operational commitments make a consistent difference.

Define every intake channel. Customer service email, social media monitoring, distributor contacts, healthcare professional reports, and post-purchase survey data are all potential SUE sources. Each requires a nominated person who knows the five criteria and understands that a consumer message — not a clinical report — can start the 20-day clock. Untrained customer service staff who route complaint emails to a general inbox without any regulatory flagging are one of the most consistent sources of Article 23 notification delays. Building a simple screening question into any complaint intake process — “Does this describe hospitalisation, disability, or another of the five serious criteria?” — is a low-cost safeguard.

Implement a 48-hour internal triage rule. The 20-calendar-day window sounds comfortable until you’re simultaneously trying to gather batch records, contact a consumer through a third-party retailer, draft a bilingual notification for two competent authorities, and identify the correct national contact in the country of occurrence. A firm 48-hour internal escalation rule from any plausible SUE report gives your regulatory team the time they actually need to prepare a complete, well-documented submission.

Maintain a consistent ANSM notification contact. ANSM case handlers can match new notifications to prior communications when the same regulatory contact and consistent reference formats are used. Rotating contacts, inconsistent product identifiers, and ad hoc submission formats all signal to inspectors that the brand’s cosmetovigilance process isn’t fully operational — which tends to generate more scrutiny, not less.

The Enforcement Reality

ANSM does not maintain a public register of Article 23 enforcement actions for cosmetics in the way that the FDA publishes Warning Letters. But France’s DGCCRF publishes annual market surveillance results, and Article 23 non-compliance appears in the context of broader regulatory action — typically alongside labelling failures or CPNP notification gaps that formed part of the same inspection. Fines under French consumer protection law for legal entities can reach €300,000 for serious regulatory non-compliance, and repeat violations create the conditions for product withdrawal orders.

The more significant business consequence of a poorly managed SUE is its downstream effect on trade relationships. France’s pharmacy buyers and major retail groups actively monitor ANSM communications. A public safety notification arising from an unmanaged SUE can close distribution channels faster than any financial penalty, in a market where safety perception is foundational to purchasing decisions.

Getting Article 23 right is, ultimately, about building a system that reflects what Regulation 1223/2009 actually intended: documented, ongoing accountability for product safety after launch — not a compliance exercise completed at the point of first notification.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• Cosmetic safety and stability testing for US market entry — ISO 17025-accredited laboratory services for European cosmetic brands preparing FDA compliance documentation, including challenge testing, stability studies, and INCI verification.
• Health Canada cosmetic and NHP product testing — Canadian GMP-compliant testing for European brands navigating Health Canada notification and natural health product licensing requirements.