MoCRA's Serious Adverse Event Reporting Requirement: What Cosmetic Brands Must Know and Do

On December 29, 2023 — exactly one year after MoCRA was signed into law — cosmetics companies in the United States became subject to a mandatory federal adverse event reporting obligation for the first time in history. Before that date, if a consumer suffered a serious injury from a cosmetic product and reported it to the brand, reporting to FDA was entirely optional. Most companies didn’t.

That changed. And based on the conversations we have with cosmetics brands at various stages of MoCRA compliance, the Serious Adverse Event Reporting (SAER) requirement is the piece that’s getting the least attention — even though it carries some of the most immediate operational and legal implications.

---

What MoCRA’s SAER Requirement Changed

Prior to MoCRA, FDA’s authority over cosmetics was strikingly limited. The agency couldn’t require recalls, couldn’t mandate safety testing before a product launched, and couldn’t compel companies to share consumer complaint data. The cosmetics industry operated on a framework that hadn’t been meaningfully updated since 1938.

MoCRA — formally enacted as part of the Consolidated Appropriations Act of 2023 — changed all of that. Among the new authorities it granted FDA were mandatory facility registration, product listing, safety substantiation requirements, and the adverse event reporting obligations that took effect at the end of 2023.

The supplement industry has operated under a similar SAER framework since 2007 under DSHEA. That’s 16 years of institutional muscle memory for how to handle these reports. For cosmetics, that infrastructure is being built from scratch, in real time, while the reporting clock is already running.

---

The Definition of “Serious Adverse Event” — It’s Broader Than You Think

Under 21 U.S.C. § 364(j) — as added by MoCRA — a “serious adverse event” for a cosmetic product is defined as one that results in any of the following:

• Death
• A life-threatening experience
• Inpatient hospitalization
• A persistent or significant disability or incapacity
• A congenital anomaly or birth defect
• Infection
• Significant disfigurement — including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance, other than as intended under the terms of use of the cosmetic

Or any health event that required medical or surgical intervention to prevent any of the above outcomes.

Two of those categories — infection and significant disfigurement — don’t appear in the dietary supplement SAE definition and are specific to cosmetics. They’re also the most operationally relevant.

A consumer who develops a scalp infection after using a contaminated shampoo — and who goes to a clinic and gets a prescription antibiotic — has experienced a serious adverse event under this definition. So has a consumer who experiences second-degree chemical burns from a hair relaxer used as directed, or significant hair loss from a product that was supposed to be gentle. And critically, that last clause matters: a consumer who visits urgent care for a severe allergic reaction that required epinephrine to prevent anaphylaxis has experienced a serious adverse event, even if they fully recover and feel fine the next day.

The “required medical or surgical intervention” language is what most brands misread. It doesn’t require permanent harm. It requires that the consumer sought and received medical care to prevent the harm from escalating.

---

The 15-Business-Day Clock — Where Brands Are Getting Caught

The 15-business-day reporting window begins the moment your company receives information about the serious adverse event. Not when you’ve confirmed it internally. Not when your regulatory team has reviewed it. Not when you’ve attempted to reach the consumer for more details. When you receive it.

“Received” is interpreted broadly. A customer service email. A direct message on Instagram. A BBB complaint. A phone call to your 1-800 number. A retailer forwarding a complaint they received. Any of these triggers the clock.

This creates a real operational problem for brands that route consumer contacts through call centers, e-commerce platforms, or third-party distributors: information may arrive at multiple touchpoints simultaneously, and the regulatory team may be the last to know. By the time someone flags it as a potential SAE, several business days may have already elapsed.

Brands need intake protocols before an event occurs. In practice, that means:

• Customer service representatives trained to recognize the SAE indicators (medical treatment, hospitalization, infection, significant burn or hair loss, allergic reaction requiring care)
• A standardized intake form that captures: date first received, consumer contact information, product name and lot number, nature of the event, and whether the consumer sought medical care
• An escalation path with defined SLAs — complaint received → regulatory/compliance notified within 24 hours → submission decision made within 5 business days of receipt

FDA accepts SAER submissions via Form FDA 3500A (MedWatch). The submission must include a copy of the product label as it appears on or within the retail packaging. This sounds administrative until you’re trying to locate the label artwork for a product that was reformulated 14 months ago and is no longer in active production.

---

Recordkeeping Requirements: Six Years, Everything

MoCRA requires cosmetics “responsible persons” — the manufacturer, packer, or distributor whose name appears on the label — to maintain records of serious adverse events for 6 years. That retention period applies to the reports themselves and all documentation related to them.

But here’s what’s less widely understood: FDA’s implementing regulations also expect brands to have systems for capturing non-serious adverse events, because that data forms the baseline against which you identify whether a signal exists. A cluster of non-serious complaints about the same lot, product, or symptom pattern can be the early indicator that a more serious event is going to surface.

The 6-year retention requirement means that for any product launched in 2024, complaint records must be maintained through 2030 — even if the product is reformulated or discontinued next year. Companies that treat consumer complaints as routine customer service records, disposed of after 2 or 3 years, are out of compliance.

---

How Your Pre-Market Testing Package Affects Post-Launch SAER Exposure

The connection between laboratory testing and adverse event reporting isn’t theoretical. The categories of events most commonly reported for cosmetics map directly to testable failure modes.

Microbial contamination is the leading cause of product-associated infections. Water-containing formulations — lotions, serums, toners, shampoos, conditioners — support microbial growth if preservative systems are inadequate or if manufacturing conditions aren’t controlled. USP <51> Antimicrobial Effectiveness Testing (preservative efficacy testing) challenges your formulation against five reference organisms: Staphylococcus aureus, Pseudomonas aeruginosa, Escherichia coli, Candida albicans, and Aspergillus brasiliensis. A product that passes challenge testing at launch and maintains its preservative efficacy through its labeled shelf life at the labeled storage conditions is demonstrably less likely to contaminate. A product that didn’t get tested — or that passed testing in a clean room but was then manufactured in a facility with inadequate environmental controls — is a contamination event waiting to occur.

Sensitizing ingredients are behind the largest share of allergic reaction SAEs. Fragrance compounds, methylisothiazolinone (MI), formaldehyde-releasing preservatives, and certain botanical extracts are established sensitizers at concentrations that appear in commercial formulations. A finished-product safety substantiation file that includes a dermal sensitization assessment — either through a read-across from published data on individual ingredients or through a Human Repeat Insult Patch Test (HRIPT) study — documents that the formulator considered this risk and had a basis for concluding it was acceptable. The absence of that documentation doesn’t mean the risk didn’t exist; it means you have nothing to show an inspector.

Heavy metals in color cosmetics remain a persistent issue. FDA’s testing of lipstick samples found lead in 99% of products tested, with concentrations ranging from 0.026 to 7.19 ppm — and those were commercially available, nationally distributed products. FDA’s recommended maximum lead concentration in lip products is 10 ppm, but the agency has also signaled that it views any detectable lead in cosmetics as undesirable, particularly for products used by children. An ICP-MS screen of your finished color cosmetic costs a fraction of a product recall and adds a quantified data point to your safety file.

None of this testing eliminates adverse event risk entirely. But it documents due diligence in a way that becomes critically important when an event occurs and FDA is reviewing your safety substantiation file.

---

What FDA Is Doing With the Reports

FDA is required under MoCRA to publish an annual report summarizing SAER data by product category. The first of these reports — covering the period since the December 2023 effective date — is expected to inform the agency’s inspection targeting priorities for cosmetics. Product categories that generate disproportionate SAE volumes (historically: hair dyes, chemical relaxers, eye makeup, skin lightening products) will likely receive closer attention.

What many brands don’t anticipate is that FDA can share SAE report data with state agencies and, in some circumstances, with foreign regulators. An event reported in California can, in theory, inform regulatory scrutiny in other jurisdictions. The data isn’t siloed inside FDA.

FDA has also made clear it will use SAER signals to evaluate whether mandatory recalls — another new MoCRA authority — are warranted. Three or four serious adverse events linked to the same lot number, product, or manufacturing facility creates exactly the kind of signal that triggers that evaluation.

---

Build the Infrastructure Before You Need It

The brands best positioned under MoCRA’s SAER requirements aren’t the ones that have never had a consumer complaint. They’re the ones that built a functioning intake, escalation, and documentation system before they needed it — and who backed it up with a pre-market testing record that shows FDA the product was substantiated for safety before it shipped.

If your company doesn’t yet have an SAE intake process, a 6-year complaint retention policy, or a current safety substantiation file for your cosmetic products, those are the three things to address first. Not because FDA is going to inspect you tomorrow — but because they might.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• MoCRA Facility Registration and FDA Inspection Readiness — Aurora TIC covers FDA regulatory strategy, including inspection preparation and compliance documentation for cosmetics manufacturers.
• Cosmetic Safety Substantiation and EU Compliance for International Brands — Ayah Labs offers raw material testing and supplier qualification to support cosmetic safety dossiers across global markets.