Adverse Event Reporting Under MoCRA: Building a Compliant System

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) represents the most significant expansion of the Food and Drug Administration’s (FDA) authority over the cosmetic industry since 1938. For corporate counsel and executive leadership, this shift represents a fundamental pivot from a self-policed industry to one defined by mandatory, rigorous regulatory oversight. Central to this new framework is the duty to report serious adverse events, a mandate that requires not merely a reactive process, but a proactive, enterprise-wide compliance architecture.

At Anthony Girand Law, we advise our clients that compliance with MoCRA is not a check-the-box exercise; it is an integrated component of risk management and brand protection.

The Statutory Mandate: Serious Adverse Event Reporting

Under MoCRA, the "responsible person"—generally the manufacturer, packer, or distributor whose name appears on the product label—is now legally obligated to report "serious adverse events" associated with the use of a cosmetic product to the FDA. The regulatory clock begins ticking the moment the responsible person receives a report of such an event, requiring a formal submission via the FDA’s MedWatch portal within 15 business days.

Compliance does not conclude with the initial submission. MoCRA imposes a continuing duty to investigate and report. If a company obtains new, material medical information related to the initial report within one year, it is required to submit a supplemental report to the FDA. For general counsel, this necessitates a robust document management system capable of tracking correspondence, medical records, and analytical data long after the initial filing.

Defining the Threshold: What Constitutes a Serious Adverse Event

Distinguishing between a standard consumer complaint—such as a subjective report of irritation—and a "serious adverse event" is the cornerstone of regulatory risk mitigation. MoCRA defines a serious adverse event as one that:

• Results in death;
• Results in a life-threatening experience;
• Results in inpatient hospitalization;
• Results in a persistent or significant disability or incapacity;
• Results in a congenital anomaly or birth defect;
• Requires, based on reasonable medical judgment, a medical or surgical intervention to prevent one of the outcomes listed above.

While the statutory definition is narrow, sophisticated legal strategy demands a broader operational lens. Companies should treat "lower-severity" complaints with a high degree of scrutiny. A cluster of minor complaints may serve as a precursor to systemic product failures or hidden contaminants. Furthermore, the FDA retains the authority to request records associated with all adverse events, not just those categorized as "serious." Consequently, maintaining a clean, comprehensive record of all consumer feedback is essential for demonstrating regulatory due diligence during an FDA inspection.

Architecting a Compliant Internal Reporting Infrastructure

An ad-hoc approach to consumer complaints is a vulnerability that MoCRA will expose. To achieve compliance, companies must institutionalize a structured reporting ecosystem characterized by four pillars:

1. Centralized Intake: Establish a single, documented channel for the receipt of all consumer complaints. Whether via a dedicated email, portal, or call center, data must be captured consistently.
2. Standardized Triage Protocol: Implement an internal rubric that empowers designated compliance officers to categorize reports immediately upon receipt. This triage process must distinguish between standard feedback, adverse events, and serious adverse events.
3. Escalation Pathways: Define a clear chain of command that triggers internal review by legal and regulatory affairs teams when a report meets the "serious" threshold. Time is of the essence; the 15-day window does not allow for bureaucratic delay.
4. Rigorous Recordkeeping: MoCRA requires that records of all adverse events—serious or otherwise—be maintained for at least six years. Records must be audit-ready, organized, and easily retrievable to satisfy potential FDA requests or investigations.

Data Feedback Loops: Bridging Safety Substantiation and Compliance

One of the most critical aspects of MoCRA is the requirement for "adequate safety substantiation." Too often, companies view their safety data and their adverse event reporting as siloed functions. In the eyes of the FDA, these systems are inextricably linked.

An effective compliance system creates a closed loop where adverse event data informs the product’s ongoing safety substantiation file. If a pattern of adverse events emerges, the responsible person must be prepared to conduct a root cause analysis and, if necessary, update the safety dossier or consider a voluntary recall. The inability to show how a company uses incoming adverse event data to adjust its safety profile is a major red flag for regulators.

Strategic Implications for Leadership

As we advise our clients at Anthony Girand Law, the cost of non-compliance under MoCRA extends far beyond the threat of warning letters or mandatory recalls. It invites heightened scrutiny that can paralyze product launches and irreparably damage brand equity. Conversely, a transparent, high-functioning reporting system acts as a defensive moat. By demonstrating mastery over product safety and regulatory adherence, companies position themselves to navigate the evolving beauty and personal care landscape with confidence.

Building a compliant system is not merely about satisfying a statutory requirement; it is about establishing a corporate culture of safety and accountability that resonates with consumers and regulators alike. We encourage our clients to audit their existing consumer communication channels and, where necessary, re-engineer their reporting frameworks to ensure they meet the rigorous demands of the modern regulatory environment.