osmetics have entered a new regulatory era. The US Modernization of Cosmetics Regulation Act of 2022 (MoCRA) created enforceable safety requirements with firm timelines, including serious adverse event reporting, safety substantiation, and facility registration and product listing. In the European Union (EU), Regulation (EC) No 1223/2009 continues to drive structured reporting of serious undesirable effects, while new environmental restrictions are accelerating reformulation. For many organizations, the pressure is practical: Teams must meet new regulatory clocks, improve data quality, and maintain consumer and regulator trust all at the same time.

While this article focuses on the US and EU because they’re currently the most prescriptive frameworks shaping cosmetovigilance operating models, the topic is not limited to those markets. For example, Great Britain requires notification of Serious Undesirable Effects (SUEs) to the Office for Product Safety and Standards (OPSS), and other jurisdictions maintain incident-reporting pathways and expect robust post-market safety monitoring (with various local thresholds and timelines).

US: Already in Force

The FDA’s MoCRA requirements establish the regulatory foundation for cosmetovigilance in the US. These obligations are enforceable and already in effect:

• Serious Adverse Event (SAE) reporting: The “responsible person” (the manufacturer, packer, or distributor named on the label) must submit SAE reports to FDA within 15 business days, include a copy of the product label from the retail package, and send follow-up information received within one year. This makes first-contact intake and label capture essential.
• Safety substantiation and records: Companies must have evidence that each product is safe under labeled or customary conditions of use and must retain adverse event records for six years (three years for certain qualifying small businesses).
• Facility registration and product listing: Manufacturers and processors must register facilities, and responsible persons must list each marketed product and update listings annually. Formula and label change control should trigger listing review.

US: Near-Term Rulemaking to Watch

Two FDA rulemakings will likely increase the need for clean ingredient data and quality-system discipline. (Note: projected dates in the Unified Agenda can change.):

• Fragrance-allergen labeling: FDA is expected to propose a rule that will require disclosure of specific fragrance allergens. Reduce future rework by harmonizing ingredient master data now, including International Nomenclature of Cosmetic Ingredients (INCI) names and variant control.
• Cosmetics good manufacturing practice (GMP): MoCRA directs FDA to establish mandatory good manufacturing practice (GMP) through rulemaking. Many organizations are already aligning procedures with ISO 22716:2007, a widely used cosmetics GMP guideline.

European Union: Ongoing Safety and Environmental Expectations

EU requirements emphasize consistent case documentation, medical review, and cross-border reporting.

• SUE reporting (ongoing): Responsible persons and distributors must report serious undesirable effects (SUEs) to competent authorities. European Commission guidance standardizes case forms and causality assessment; “causality” is the documented judgment of how likely it is that the product contributed to the event.
• Microplastics restriction (REACH): Regulation (EU) 2023/2055 under the EU chemicals framework known as REACH (Registration, Evaluation, Authorisation and Restriction of Chemicals) restricts microplastics intentionally added to products with staged transition periods by category. Companies should screen portfolios early because reformulation and claims updates take time.

What Does a Sustainable Cosmetovigilance System Look Like?

To operationalize the regulatory expectations outlined above (MoCRA/SAE reporting, EU SUE guidance, and related requirements), organizations typically build cosmetovigilance programs with the following core elements:

• One intake “front door” that collects product identifiers (brand, variant, lot or batch, where purchased) and requires label photos.
• A triage workflow that starts the clock at first contact, applies clear seriousness criteria, and routes cases for medical review when needed.
• Label version control so the company can attach the correct label copy for the product involved.
• Consistent causality documentation and a clear follow-up plan for missing information.
• Report-ready case files with an audit trail that supports inspections and trend review.

Types of Metrics that Demonstrate Control:

The metrics below are examples of practical key performance indicators (KPIs) used to demonstrate process control and regulatory readiness. They are not industry benchmarks but are targets that can be adjusted to reflect specific portfolio risk, case volume, and staffing.

• US SAE timeliness: Percent filed to FDA within 15 business days and average days to file from first contact.
• EU SUE performance: Percent notified within local timelines and average time to case closure.
• Intake quality: First-pass completeness rate and percent of cases missing label or lot/batch information.
• Signal hygiene: Duplicate-case rate and misclassification rate (for example, nonserious cases escalated as serious).
• Regulatory readiness: Percent of cases with a complete audit trail and percent of facility/product listing updates completed on schedule.

90-Day Launch | 12-Month Scale Plan

When preparing to launch and subsequently scale a cosmetovigilance program, the author has learned through several projects and experiences that it is essential to assign clear business owners across safety, regulatory affairs and quality, legal, customer care, and brand teams, and then to build the program in phases as explained below.

0–90 days: Stand up the basics: Regulatory affairs and quality should assign responsible-person ownership for the US and EU and publish a responsibility matrix. Safety operations should deploy a single intake channel and implement a 15-business-day SAE workflow with required label capture. Quality should audit safety substantiation files and close gaps for the highest-volume products first, while regulatory operations reconcile marketed products against FDA listings.

3–6 months: Make it durable: Safety and regulatory teams in the EU should train staff on SUE criteria and implement the Commission’s forms and notification steps. Data owners should build an ingredient and label “source of truth” (useful across markets) to support future fragrance-allergen disclosure and faster case processing. Product stewards in the EU should screen for microplastics exposure and align a reformulation and claims roadmap within the REACH (see above) transition periods.

6–12 months: Scale and prepare for GMP: Leadership from the quality team should expand the quality management system toward cosmetics GMP, including supplier controls, change control, deviation handling, and corrective and preventive actions. Safety and quality should run monthly KPI reviews and periodic mock inspections of SAE and SUE files.

Cosmetovigilance: No Longer Optional

MoCRA has made safety substantiation, SAE reporting, and registration and listing enforceable in the US, while the EU continues to expect structured SUE reporting while environmental restrictions accelerate product change. Organizations that build a simple, auditable intake-to-report process now can prevent compliance fire drills later and strengthen trust with regulators and consumers.