If someone has a bad reaction to your cosmetic product and reports it to you, you now have a legal clock running. Since December 29, 2023, MoCRA (the Modernization of Cosmetics Regulation Act of 2022) has required cosmetics companies to report serious adverse events to FDA, and to keep records of every adverse event they hear about, serious or not. A lot of brands know this rule exists in the abstract but haven’t worked out what it actually means day to day. Here’s the breakdown.
Who this applies to
The obligation falls on the Responsible Person, which MoCRA defines as the manufacturer, packer, or distributor of a cosmetic product whose name appears on the product’s label. If your company’s name is on the label, you’re the Responsible Person, and this is your job, not your manufacturer’s and not your distributor’s, unless one of those parties happens to also be the named label owner.
What counts as an adverse event, and what makes one “serious”
An adverse event is any health-related event associated with using the product that’s adverse, basically anything bad that a customer connects to your product. Most of what comes in through customer service, an itchy patch, a mild breakout, won’t cross the line into “serious.”
A serious adverse event does. FDA’s definition covers an event that results in:
Death. A life-threatening experience. Inpatient hospitalization. A persistent or significant disability or incapacity. A congenital anomaly or birth defect. An infection. Significant disfigurement, including serious and persistent rashes, second or third degree burns, significant hair loss, or a persistent or significant change in appearance, beyond what you’d normally expect from using the product as intended.
It also counts as serious if a doctor reasonably believes medical or surgical treatment was needed to prevent one of those outcomes, even if it didn’t ultimately happen.
The 15 business day clock
Once you receive a report that qualifies as a serious adverse event, you have 15 business days to report it to FDA. Not 15 calendar days, business days, so weekends and federal holidays don’t count against you, but the clock starts the moment you receive the information, not when you finish investigating it.
Your report has to include a copy of the label on or within the retail packaging of the product. If you later get new medical or other information about that same event, and it’s within a year of your original report, you have another 15 business days to send that follow-up to FDA too.
How to actually submit a report
You have three options: submitting E2B(R3) XML data directly through FDA’s Electronic Submissions Gateway, using the web-based Safety Reporting Portal, or filling out a paper MedWatch Form 3500A and sending it by email or mail. FDA strongly encourages electronic submission because it’s faster on both ends, but the paper option is still valid if that’s what your process supports.
Non-serious adverse events don’t have to be reported to FDA at all. You’re allowed to submit them voluntarily using the same Form 3500A process, but MoCRA doesn’t require it.
Recordkeeping: this is the part people miss
Reporting serious adverse events to FDA is only half of it. MoCRA also requires you to receive and keep records of every adverse event you’re told about, not just the serious ones, for six years. If you qualify as a small business under MoCRA’s definition, that drops to three years.
This matters because FDA doesn’t just take your word for what happened. Under Section 605 of the FD&C Act, FDA can access your adverse event records during an inspection. That includes your communications with whoever reported the event to you, your own internal assessment of whether it was serious or non-serious, and, for serious events, your actual report to FDA plus any follow-up information you submitted. In January 2026, FDA released draft guidance spelling out exactly how it plans to use this access authority, so this isn’t a theoretical inspection risk, it’s an area FDA is actively building enforcement clarity around.
The small business exemption doesn’t cover this
MoCRA’s small business exemption is a common source of confusion. If your average gross annual U.S. sales of cosmetic products were under $1,000,000 over the prior three years, you’re exempt from facility registration and product listing. You are not exempt from adverse event reporting or recordkeeping. Small businesses still have to report serious adverse events within 15 business days and keep records, just for three years instead of six rather than being let off the hook entirely.
There’s also a separate wrinkle worth knowing: even if you qualify as a small business by revenue, the registration and listing exemption itself doesn’t apply if you manufacture or process products that regularly touch the mucous membrane of the eye, that are injected, that are intended for internal use, or that are meant to alter appearance for more than 24 hours where the consumer isn’t expected to remove the product. If your product falls into one of those categories, treat yourself as a standard-obligation company across the board, not a small business exception.
Why this is getting harder to ignore
FDA launched a public dashboard in September 2025 that lets anyone search real-time adverse event data for cosmetic products, including the serious adverse event reports Responsible Persons are required to submit. It updates daily. In March 2026, FDA announced it’s folding cosmetics adverse event data into a single, unified reporting system that already covers drugs, devices, food, tobacco, and veterinary products. The direction is clear: adverse event data that used to sit quietly in an FDA database is now visible to consumers, journalists, and competitors in close to real time. A missed or late report isn’t just a compliance gap anymore, it’s something a customer or reporter could plausibly notice on their own.
The practical version
Set up a real intake process for anything a customer, doctor, or salon professional reports as a reaction to your product. Someone at your company needs to see every one of those reports and make a documented call on whether it meets the serious adverse event definition. If it does, you have 15 business days, full stop. If it doesn’t, you still have to keep the record. And if you’re relying on the small business exemption to skip paperwork, make sure you’re clear on which paperwork it actually exempts you from, because adverse event reporting isn’t one of them.
If you’re not sure your intake and recordkeeping process would hold up during an FDA inspection, or you want a U.S. Agent who can help you build one before you need it, FDA Entry can help you get it right.
FAQ
No. You only have to report serious adverse events, ones involving death, hospitalization, a life-threatening experience, significant disfigurement, or similar outcomes, within 15 business days. Non-serious complaints don’t have to be sent to FDA, but you still have to record and keep them.
MoCRA makes failing to report a serious adverse event within the required timeframe a prohibited act under the FD&C Act, which exposes your product to enforcement action. Beyond the legal exposure, FDA’s public adverse event dashboard now makes gaps between when an incident occurred and when it was reported more visible than they used to be.
No. The small business exemption only applies to facility registration and product listing. Every Responsible Person, regardless of size, has to report serious adverse events within 15 business days and keep adverse event records, small businesses just get a shorter three year retention period instead of six.
Six years for most companies, three years if you qualify as a small business under MoCRA’s revenue threshold. This applies to all adverse event records you receive, not just the serious ones you reported to FDA.