France's Cosmetovigilance Rules: What EU Responsible Persons Must Report — and When

The most common compliance gap we encounter in European cosmetics isn’t in the formulation file or the CPSR. It’s in the cosmetovigilance system — or more precisely, the total absence of one.

Most brands have a Cosmetic Product Safety Report. Most have a Product Information File assembled with reasonable care. But Article 23 of Regulation (EC) No 1223/2009 imposes an additional, ongoing obligation: reporting serious undesirable effects (SUEs) to national competent authorities, and maintaining a register of all undesirable effects — serious and non-serious alike — for at least 10 years. In France, that means engaging directly with the ANSM (Agence nationale de sécurité du médicament et des produits de santé). And the ANSM has been paying closer attention to this area than most brands realise.

What Qualifies as a “Serious Undesirable Effect” Under Article 23?

The threshold matters enormously, and the Regulation defines it precisely. Under Article 2(1)(q), a serious undesirable effect is any adverse reaction to normal or reasonably foreseeable use of a cosmetic product that results in:

• Temporary or permanent functional incapacity
• Disability
• Hospitalisation
• Congenital abnormalities
• An immediate vital risk
• Death

Everything below that threshold — contact dermatitis, localised redness, minor allergic reactions, scalp irritation — falls into the non-serious category. Those don’t trigger a notification obligation to ANSM, but they absolutely require documentation. The 10-year register requirement under Article 23(3) applies to the full universe of adverse effects, not just the serious ones.

In practice, the gray area clusters around hospitalisation. A consumer who visits an emergency department after a severe systemic allergic reaction to a hair dye almost certainly meets the SUE definition. A GP appointment for persistent localised irritation probably doesn’t. That distinction requires a documented internal triage process — which most brands simply don’t have.

And this ambiguity matters because under-reporting carries regulatory risk. An ANSM inspector finding a history of serious consumer complaints in your customer service system, none of which were escalated or assessed against SUE criteria, is not a situation you want to be in.

Who Must Report — and the Cross-Border Complications

This is where brands regularly get surprised: the notification obligation doesn’t rest solely with the responsible person. Article 23 is explicit that distributors who become aware of a serious undesirable effect must also report it to the competent authority of the Member State where the effect occurred, and notify the responsible person without delay.

So a French distributor handling a Belgian brand’s finished products on the French market has its own cosmetovigilance obligations, entirely independent of what the Belgian RP does or doesn’t do. Most distribution agreements in this industry don’t address this at all. The question of who files the report, who maintains the register, and what happens when a distributor receives a consumer complaint directly through their own channels — these are questions that should be resolved in contract before products reach shelves.

In France, reports go to the ANSM via its dedicated cosmetovigilance portal. The notification must include the identity of the responsible person, the product name and batch number (where available), the country where the effect occurred, and the nature and severity of the SUE. The Regulation requires notification “without delay” — the European Commission’s technical guidance, published when Article 23 came into force in 2013 and refined through subsequent working group discussions, has broadly interpreted this as within 20 calendar days of becoming aware of the effect. Some ANSM guidance references 15 working days. Treat 20 calendar days as your operational ceiling and build internal escalation to flag potential SUEs far earlier than that.

The cross-border picture is genuinely complex. If you are a French responsible person and an SUE occurs in Germany, Spain, or the Netherlands, the notification goes to the competent authority of that Member State — not ANSM. But if the same product is on the French market, ANSM should also be informed. A product distributed across 8 EU countries has potential reporting pathways into 8 national systems, each with its own portal, its own contact points, and subtly different documentation expectations. This is not a theoretical problem. It’s one that catches growing mid-market French brands by surprise when they start meaningful cross-border distribution.

How ISO 22716 GMP Connects to Your Vigilance Obligations

ISO 22716:2007 — the international GMP standard for cosmetics that underpins both EU compliance expectations and a growing number of retailer requirements — addresses this directly under Section 15: Complaints. The standard requires a documented procedure for receiving, evaluating, and tracking consumer complaints, with defined escalation criteria and clear responsibilities.

That complaint procedure should be the front end of your cosmetovigilance system. Every consumer contact that comes in — whether through your customer service team, a retailer, an e-commerce return form, or even a social media message — needs to be assessed against the SUE criteria of Article 23(1) before the file is closed. In far too many companies, complaints are handled entirely by customer service or logistics teams who have no training on what a serious undesirable effect is, let alone how to escalate it.

The linkage is direct and auditable: if your ISO 22716 complaint SOP doesn’t include a documented triage step explicitly asking “does this complaint meet the criteria of a serious undesirable effect under Article 23?”, your GMP quality system and your regulatory post-market surveillance obligations are operationally disconnected. An ANSM inspector — or a DGCCRF market surveillance audit — will find this gap quickly.

Three things your complaint SOP needs to address in writing, as a minimum:

Severity triage criteria. The Article 23(1) definitions rendered into operational language your customer service team and quality manager can apply consistently. Not legal boilerplate — practical descriptions of what hospitalisation or functional incapacity looks like in a real complaint.

Escalation triggers and decision authority. Who in the organisation has authority to classify a complaint as a probable or confirmed SUE? What’s the internal timeline for that decision? This cannot be left to informal judgment.

ANSM notification workflow. Named individual with portal access, internal documentation template, confirmation that the responsible person has been notified if the reporter is a distributor, and a file reference connecting the ANSM submission to the internal complaint record.

The Most Common Gaps We See in Practice

Having reviewed cosmetovigilance systems across brands from independent formulators to mid-size European exporters with 5–20 SKUs on the French market, the same failures recur with striking consistency.

No register of non-serious effects. Brands focus on SUE reporting because it’s the visible, mandatory obligation. But the 10-year register of all undesirable effects is equally required and equally auditable. An ANSM inspector asking to see your non-serious effect register should not result in a blank stare and a folder of unstructured email threads.

Consumer-facing channels disconnected from the vigilance system. DM complaints on Instagram, one-star reviews mentioning skin reactions, return forms describing adverse effects — these are legitimate data sources under Article 23. Most brands have no documented procedure for routing these inputs into the formal vigilance system. The obligation doesn’t distinguish between channels.

Causality assessment absent or undocumented. Not every consumer complaint is causally linked to the product. But you need a documented framework for assessing causality — not just “we checked and it wasn’t us.” ANSM expects to see at minimum a rudimentary assessment framework: product batch check, formulation review against known sensitisers, consumer profile where available.

No named cosmetovigilance contact. For brands operating across multiple EU markets, designate a single individual — typically the Cosmetic Safety Assessor, the RP representative, or a dedicated regulatory function — as the cosmetovigilance manager. This person needs portal access for each relevant Member State, an up-to-date country-by-country escalation list, and clear authority to file. Without a named owner, notifications fall between teams.

Getting Your System in Order

You don’t need complex infrastructure. For most cosmetic brands with products on the French market, a functional cosmetovigilance system is roughly 2–3 days of focused regulatory work to build from scratch, and a half-day per year to maintain. What that work produces:

A written procedure referencing Article 23 criteria and your ANSM portal submission timeline. A register template structured for all undesirable effects — serious and non-serious — linked to product references and batch numbers. A trained named contact with portal access, escalation authority, and a clear handoff protocol from customer service. A complaint intake process that routes all adverse consumer contacts through SUE triage before closure.

That’s the complete system. The cost of not having it — a DGCCRF non-compliance notice, an ANSM request for information on a product already in market surveillance, or the reputational impact of a delayed serious incident response — is considerably higher than the setup investment.

If you’re placing products on the French market and haven’t formalised this yet, the right time was when Article 23 became applicable in 2013. The second-best time is now.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• ISO 17025-accredited cosmetic ingredient testing — Qalitex Laboratories provides safety and identity testing for cosmetic raw materials and finished products destined for the US market, with full COA documentation.
• Regulatory compliance support for Canadian market entry — Androxa helps European cosmetic and supplement brands meet Health Canada’s NHP and cosmetics regulatory requirements, including GMP certification pathways.