By Anthony Girand, Esq.
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) did something cosmetics law has never done before: it gave FDA a statutory adverse event reporting requirement with real teeth. For the first time, companies that manufacture, pack, or distribute cosmetic products sold in the United States must report serious adverse events to the FDA within 15 business days of learning about them. For an indie brand running lean, with founders juggling production, marketing, and customer service, this obligation can feel like an afterthought — until a customer reports a severe allergic reaction, and suddenly the clock is running on a federal deadline you didn't know existed.
This guide walks founders through the practical steps of building an internal adverse event intake system that satisfies MoCRA's requirements, without requiring a compliance department you don't have yet.
Step 1: Understand Who Is the "Responsible Person"
MoCRA's reporting obligation falls on the "responsible person" — the manufacturer, packer, or distributor of a cosmetic product whose name appears on the product label. If your brand name is on the bottle, you are almost certainly the responsible person, even if you use a contract manufacturer. This obligation cannot be outsourced or waived by a manufacturing agreement; FDA will look to the name on the label.
Importantly, unlike facility registration and product listing, the adverse event reporting duty is not waived for small businesses. MoCRA's small business exemption applies to registration and listing obligations based on revenue thresholds, but every responsible person, regardless of size, must report serious adverse events. Founders should not assume their exemption from registration also excuses them from this requirement.
Step 2: Learn the Legal Definition of a "Serious Adverse Event"
Not every complaint triggers the 15-day clock. MoCRA defines a serious adverse event as one that results in:
- Death
- A life-threatening experience
- Inpatient hospitalization
- A persistent or significant disability or incapacity
- A congenital anomaly or birth defect
- Significant disfigurement, including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance
- An infection
- Or any other event that, based on reasonable medical judgment, requires medical or surgical intervention to prevent one of the outcomes above
A customer complaining their serum "broke them out" is not, by itself, a serious adverse event. A customer reporting a chemical burn requiring emergency room treatment is. Founders should train anyone handling customer communications to recognize these categories, because the 15-business-day countdown begins the moment your company becomes aware of a qualifying event — not when legal counsel confirms it.
Step 3: Centralize Every Channel Where Complaints Arrive
Adverse event information rarely arrives through a single, tidy channel. It shows up in:
- Customer service emails and chat logs
- Social media comments and DMs
- Amazon, Sephora, or Ulta product reviews
- Retail partner complaint forwards
- Influencer or affiliate outreach
Your intake system must funnel all of these sources into one place. A simple shared inbox or ticketing system (even a well-managed spreadsheet in the earliest stages) works, provided every customer-facing team member is trained to escalate anything resembling a health complaint immediately, rather than responding with a standard refund script and moving on.
Step 4: Build a Standardized Intake Form
When a complaint comes in, your team should capture consistent information every time:
- Product name, SKU, and lot or batch number
- Date of first use and date of the reported event
- Detailed description of the adverse event, including any medical treatment sought
- Complainant's contact information
- Whether the product was used as directed
This data maps directly to what FDA requires on its MedWatch Form 3500A, the form used for cosmetic adverse event reports. Capturing it immediately, in the complainant's own words where possible, prevents gaps that complicate the eventual filing and protects your company's credibility if FDA follows up.
Step 5: Create a Triage and Escalation Protocol
Every incoming report needs a documented triage review within 24 to 48 hours, conducted by whoever serves as your quality or compliance lead (often the founder in early-stage companies). That review should ask:
- Does this meet the statutory definition of "serious"?
- Is there enough information to proceed, or do we need to follow up with the complainant?
- Should we consult outside regulatory counsel before making the call?
Document the triage decision itself, even if you conclude an event is not reportable. FDA can request your underlying adverse event records, and a documented rationale demonstrates good-faith compliance rather than ad hoc guesswork.
Step 6: Calendar the 15-Business-Day Deadline Immediately
Once an event is classified as serious, treat the clock as already running. The deadline is 15 business days, not calendar days, from the date your company first becomes aware of the event — which can be earlier than the date a formal written complaint is received. Assign a specific person ownership of the filing deadline and build in buffer time for internal review before the deadline, not on it.
Step 7: File Through FDA's Reporting Channels
Serious adverse event reports are submitted using FDA Form 3500A. Founders should identify in advance who within the organization — or which outside regulatory consultant or counsel — will handle the actual submission, rather than discovering this process for the first time during an active incident.
Step 8: Maintain Records for the Required Retention Period
MoCRA requires responsible persons to maintain records related to each adverse event report, including any later-received medical information, for six years (three years for smaller businesses, as defined by revenue thresholds under the statute). This recordkeeping obligation applies even to non-serious adverse events your company chooses not to report, since FDA can request your complaint files during an inspection.
Step 9: Build a Follow-Up Reporting Habit
If you receive new medical information about a previously reported event — for example, a complainant later discloses a hospitalization that wasn't initially mentioned — MoCRA requires a follow-up report within 15 business days of receiving that new information. Your intake system should flag previously filed cases for ongoing monitoring, not treat the original filing as the end of the matter.
Step 10: Review and Train Annually
As your product line grows and customer volume increases, revisit your intake protocol at least annually. Retrain customer service staff, confirm your triage lead is still current, and consider periodic review with regulatory counsel, particularly before launching higher-risk product categories like those involving actives, exfoliants, or injectable-adjacent devices.
Building this system before your first serious complaint arrives is far less costly than reconstructing one under deadline pressure. A documented, consistently applied intake and reporting protocol is also one of the clearest ways to demonstrate good-faith MoCRA compliance if FDA ever comes asking.