Serious Adverse Events, Reporting Deadlines and Product Liability Insurance: What Every Cosmetic Brand Must Have in Place, Market by Market

The clock starts when you know, not when your internal process ends

A serious adverse event is not simply a customer complaint. It is a defined regulatory category with a defined clock, and the clock starts the day the responsible person becomes aware - not the day the investigation concludes, and not the day an internal escalation form finally reaches the right team. Most brands lose their first 48 hours to a vague internal process: an e-commerce agent forwards a reaction to a shared inbox, the inbox forwards it to the factory, the factory asks for more information, and two weeks have quietly gone. If you sell into more than one market you may be running several clocks at once - some measured in business days, some in calendar days, and one with no numeric deadline at all. This article sets out each one, and the insurance position that sits behind them.

United States: 15 business days, six years of records

Under MoCRA, the responsible person must report a serious adverse event to FDA within 15 business days of becoming aware of it. The same 15-business-day window covers newly received medical information about a case that has already been reported, for one year after the initial filing. Records must be kept for six years, or three if you qualify as a small business. Facility registration renews every two years, and - a material change from the pre-MoCRA era - FDA holds mandatory recall authority over cosmetic facilities. The practical consequence is commercial rather than technical: a US distributor, marketplace storefront or retail buyer will usually ask to see your serious-adverse-event process before they will list a new product. Name an owner, define a single intake channel, and keep a pre-drafted filing template with the fields FDA expects.

EU: immediate notification, and no fixed SUE deadline

Two articles matter. Article 12 of Regulation (EC) No 1223/2009 requires that in the event of a serious incident caused by a cosmetic product, the responsible person shall immediately inform the competent authority of the member states in which the product is made available. Article 23 covers seriously undesirable effects and requires that the data be reported without undue delay, together with a trend analysis of the data. Note what is deliberately missing: the EU sets no number of days. That is why the workable standard across the bloc is immediacy rather than a calendar date. It also means the sentence we will file within 30 days is not a safe answer to a national authority reading Article 12. Check the local transposition, because national competent authorities differ in how strictly they read immediate.

A market-by-market read of the timelines

Beyond the US and the EU, the outlines look like this. Always confirm the current figure with the authority before you file; these regimes have changed within the last three years and continue to.

• United Kingdom - GOV.UK guidance gives 30 calendar days from awareness for a suspected serious adverse reaction. Great Britain and Northern Ireland are separate systems, so the same product can sit under two different obligations.
• China - general adverse reactions are reported within 30 days, serious ones within 15, and those likely to cause significant social impact within 3 days. Records must be retained for at least 3 years by the responsible entity in China.
• Japan - the MHLW framework expects 15 days where a death or an unknown serious outcome is involved, 30 days for a known serious adverse reaction, and 30 days for reports from research institutions. E2B(R3) electronic reporting is the recommended route.
• Australia - there is no pre-market registration for cosmetics, but you must register as an AICIS introducer and keep records for at least 5 years. Sunscreens are TGA therapeutic goods and carry a separate set of duties.
• Brazil (ANVISA) - a local license holder is required, and notification obligations run through that holder rather than through your manufacturer.
• Indonesia (BPOM) - an NA notification number sits behind the registration, and adverse-event reporting is handled by the local notification holder.
• Saudi Arabia - conformity is confirmed batch by batch through SFDA, GHAD and FASEH, so a single formula change can restart documentation work.

The four things that make a vigilance file fail

Filing software rarely fails an inspection. These four gaps do, and all four are process gaps rather than legal ones.

• No single intake channel. Reactions arrive through marketplace reviews, customer service DMs, retail staff and call centres. If any of those sit outside the process, your awareness date becomes undefined, and an undefined start date is an unfiled report.
• No defined awareness trigger. Write down which event types count as reportable and who has authority to decide that a case is serious. Delegating that judgment down the org chart is how a 15-day clock becomes a 40-day problem.
• No traceability path to the factory. You cannot file within 15 business days if getting batch records, the formula, raw material origin and specifications out of your supplier takes a week of chasing.
• No trend analysis. The EU and the UK both expect routine signal review, not one-off filings. A cluster that looks like a preservative failure is exactly the pattern authorities look for between submissions.

Product liability insurance: the clause that quietly voids the cover

This is where cosmetic brands make the most expensive and least visible mistake - naming the wrong party as the insured. It is common for an OEM agreement to place the factory on the brand's policy, or worse, to leave the brand as an unnamed additional insured under a factory policy that lapses at the end of the policy year. If a consumer sues and the named insured is an overseas supplier with no assets in the claimant's jurisdiction, the claim can be contested on that basis alone before anyone reaches the merits. The following should be checked with your broker, not assumed.

• Who is the insured? It should be the entity that is legally the producer or importer in that market - usually your local entity, not the factory.
• Territory and product schedule. Confirm the policy covers the formulations and SKUs you actually sell, including anything reformulated in-market after launch.
• Limit and retention. Test per-claim and aggregate limits against real distribution volume, not against your launch-year forecast.
• Notice and cooperation clauses. Several policies void cover for late notification. Your 15-business-day regulatory clock can collide with a condition requiring prompt notice - read both documents together.
• Evidence. Ask the broker for a certificate of insurance naming your entity, dated before the first shipment lands, not after the first claim arrives.

The directive that changes the cost of being wrong

Directive (EU) 2024/2853, the new product liability directive, entered into force on 8 December 2024 and will apply from 9 December 2026. It removes the caps and thresholds that previously limited damages for personal injury, and it extends the period during which latent health damage can be claimed - in some cases up to 25 years after exposure. For a cosmetic brand this is a step change in downside rather than a paperwork change: defence costs, compensation and regulatory follow-on now sit with whichever entity in the chain of commerce the consumer can actually identify. It also raises the pressure on every upstream contract, because recovery from a manufacturer will be pursued harder once recovery from your own balance sheet is unlimited.

What to put in the contract with your OEM

The reporting duty sits with the local market operator, which means your Chinese manufacturer has no MoCRA filing obligation and no direct channel to FDA. That is not a reason to relax - it is a reason to make sure your own filing can be built on factory evidence. Vague clauses do not survive an incident.

• Data access with a clock on it. Batch records, formula, raw material origin and specification within 24 to 48 hours of a written request.
• Notification to you first. The factory must tell you about a quality complaint or a regulatory inspection within one business day and must not brief your distributor directly.
• Advance change-control notice. Formula changes, raw material source changes, site changes and new equipment must be disclosed before implementation, not disclosed afterwards.
• Retained samples and stability data held for the full claimed shelf life, at a location you have been told about in writing.
• Recall cooperation with defined cost allocation for logistics, consumer communication, refunds and destruction.

Build the system before you need it

Vigilance and insurance are boring right up to the week they are the only thing between a single reaction and a multi-market recall. The work that actually protects a launch is unglamorous: one intake channel with a named owner, an event-triage rule written down before the first case, a data request template sent to every factory at contract signature, and a policy that names the right insured party. If you are assembling that file for a new launch, the cheapest starting point is choosing a manufacturer whose GMP certification already covers the markets you plan to sell in. On QuickOEM, brand-side access is free and factory quotes come direct with no added margin - brief us with your target markets and we will shortlist accordingly.