How to Report a Cosmetic Serious Adverse Event Under MoCRA: A 2026 Responsible Person's Guide

If you're the Responsible Person for a cosmetic brand — a founder whose name is on the label, a regulatory or QA lead, a contract manufacturer, or whoever just got handed "MoCRA compliance" — and a customer complaint has landed that might be serious, this guide is for you. It's aimed at the many cosmetics companies that now have a federal adverse-event reporting obligation but don't run an enterprise drug-safety system like Oracle Argus or Veeva Vault Safety.

We'll cover what changed under MoCRA, what actually counts as a serious adverse event for a cosmetic, who is on the hook, when the clock starts, what goes in a report, and — the part most people get stuck on — the three ways FDA now lets you submit. If you've never filed an FDA case before, the mechanics are more approachable than the drug world, but the deadline is short and unforgiving.

One-paragraph summary: Since December 29, 2023, the Modernization of Cosmetics Regulation Act (MoCRA) has required the Responsible Person for a cosmetic product to report serious adverse events to FDA within 15 business days of receiving the information, with a copy of the product label attached. As of the March 11, 2026 launch of the Adverse Event Monitoring System (AEMS), cosmetic reports flow through the same infrastructure as drug and device reports. You can submit one of three ways: database-to-database E2B(R3) XML through the Electronic Submissions Gateway, the web-based Safety Reporting Portal, or a paper Form FDA 3500A by email or mail. Non-serious events don't have to be submitted, but you must still receive, record, and retain them.

The 2026 landscape

A few facts worth knowing before going further:

MoCRA is the biggest change to cosmetics regulation since 1938. Enacted December 29, 2022, MoCRA added section 605 to the Federal Food, Drug, and Cosmetic Act and, for the first time, made serious adverse event reporting for cosmetics mandatory. Enforcement of the reporting requirement began December 29, 2023. Before MoCRA, mandatory adverse event reporting in the U.S. applied to drugs and medical devices; cosmetics were essentially on the honor system.

FAERS is now AEMS, and cosmetics are inside it. On March 11, 2026, FDA consolidated its separate reporting systems — drugs, biologics, devices, tobacco, food, cosmetics, and veterinary products — into one Adverse Event Monitoring System (AEMS), and moved the FAERS data into it. For cosmetics, the practical effect is that your serious adverse event reports now travel the same electronic pipes as drug ICSRs, using the same E2B(R3) message standard if you submit electronically at scale.

Your reports are public. FDA runs an AEMS Public Dashboard for Cosmetic Products that lets anyone query cosmetic adverse event data — including the serious adverse event reports submitted by Responsible Persons — and filter by product name, reaction term, severity, and date. That raises the reputational stakes: a mishandled cluster of reports is now something journalists, competitors, and plaintiffs' attorneys can search.

The registration portal is not the reporting portal. FDA's Cosmetics Direct system is for facility registration and product listing. It does not accept adverse event reports. Sending a SAER there is one of the more common ways to think you've complied when you haven't.

What counts as a "serious" adverse event for a cosmetic

This is the single most important call you'll make, because it decides whether the 15-day clock is running. MoCRA defines a serious adverse event as one that:

results in death;
is life-threatening;
requires inpatient hospitalization;
causes a persistent or significant disability or incapacity;
is a congenital anomaly or birth defect;
is an infection;
causes significant disfigurement — and for cosmetics the statute spells this out: serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance — other than as intended under customary or usual conditions of use; or
requires, based on reasonable medical judgment, a medical or surgical intervention to prevent one of the outcomes above.

Two phrases do a lot of work here. The first is "other than as intended": a chemical peel that produces redness as designed is not a reportable disfigurement; a moisturizer that causes second-degree burns is. The second is the intervention clause — even if nothing on the list has happened yet, if a clinician's judgment is that intervention is needed to prevent it, the event is serious.

When in doubt, the safer reading is "serious." Over-reporting a borderline case carries little downside; missing a true serious event means a blown statutory deadline that an FDA inspector can see in your own records.

Serious vs. non-serious — and why non-serious still matters

MoCRA only requires you to submit serious adverse events. A non-serious complaint — mild, transient irritation that doesn't meet any criterion above — does not have to be sent to FDA.

That does not mean non-serious events are nothing. The Responsible Person is expected to receive and record all adverse events, serious or not, and to retain those records — six years for most companies, three years for small businesses meeting MoCRA's size thresholds. FDA can request these records during an inspection. So the obligation is really two-track: submit the serious ones on a 15-day clock, and keep a clean, retrievable file on everything.

You may also submit non-serious events voluntarily, using the same Form FDA 3500A process described below. Some companies do this for products under scrutiny to demonstrate diligence; most don't.

Who is the Responsible Person

MoCRA defines the Responsible Person as the manufacturer, packer, or distributor whose name appears on the product label. In practice:

If you're an indie brand that has products made by a contract manufacturer but sells them under your name, you are almost certainly the Responsible Person — not the factory.
If you're a contract manufacturer whose name does not appear on the label, you generally are not the RP for that product, though your customer may contractually push receiving and recordkeeping duties onto you.
Only one RP is designated per product, but the role can be assigned by agreement, and an authorized agent can be hired to manage reporting on the RP's behalf.

Separately, MoCRA requires that each cosmetic label carry a domestic address, phone number, or electronic contact through which consumers can report adverse events. That contact channel is, in practice, where most of your reportable events will first arrive — which is exactly why your intake process matters.

The 15-business-day clock

The deadline is 15 business days, and it starts when the Responsible Person receives the information — not when the event happened, and not when someone in the company decides it's serious. A complaint sitting unread in a support inbox is still "received." This is the most common way companies miss the deadline: the clock was running for a week before anyone with reporting responsibility saw the email.

Two more timing rules:

Label copy is mandatory. Every serious adverse event report must include a copy of the label on or within the retail packaging of the product. A report without it is incomplete.
One-year follow-up. If you receive new medical or other information about a reported event within one year of your initial report, you must submit that update to FDA within 15 business days of receiving it.

The practical implication: you need a triage step that runs on receipt, not on convenience. Whoever monitors customer service, social channels, and the label contact line has to be able to flag a possible serious event the day it lands.

What goes in a report

Cosmetic serious adverse events are reported on Form FDA 3500A — the same mandatory MedWatch form used for drug and device reporting. If you submit electronically at volume, the equivalent is an E2B(R3) ICSR (Individual Case Safety Report) carrying the same data. Either way, a usable report needs:

Patient information — age, sex, and relevant history, collected and anonymized appropriately.
Event details — a clear description, the outcome, date of onset, and any medical treatment given.
Suspect product information — product name, and lot number or SKU if known, plus how it was used.
A copy of the product label — required, as noted above.
Supporting documentation — images of the reaction where available, and any medical records you've received.

If filling out the 3500A is new to you, our companion guide on how to fill out FDA Form 3500A walks the form field by field. The cosmetic case uses the same data model; you simply won't touch the sections that are specific to clinical drug use.

How to actually submit: the three paths

FDA gives Responsible Persons three submission options. They differ mostly by volume and engineering effort, not by what you're reporting.

Option A — ESG database-to-database (XML ICSRs)

If you have systems that can transmit machine-to-machine, you can submit serious adverse event reports as XML ICSRs directly through FDA's Electronic Submissions Gateway (ESG) — the same gateway used for drug and biologic reports. This suits a company filing at volume, or a vendor filing on behalf of many brands; it requires ESG registration, certificate management, and an emitter that produces valid ICSR XML. One wrinkle specific to cosmetics is easy to miss: FDA directs responsible persons to submit cosmetic ICSRs using the older E2B(R2) standard — not the E2B(R3) standard that drug and biologic reporting is migrating to. So while our companion guide on generating valid E2B(R3) XML is useful for the ESG mechanics and the validation mindset, a cosmetic message itself should be built to E2B(R2). Setup inquiries go to FDA at AEMSeSub@fda.hhs.gov. In practice this path is rare for cosmetics; most brands use Option B or the paper route below.

Option B — the Safety Reporting Portal (SRP)

The SRP is FDA's web-based form for companies that don't have ESG infrastructure. You register for credentials (request an account through AEMSeSub@fda.hhs.gov), then enter each serious adverse event manually into a web form, one case at a time. There's no batch upload. For a brand filing a handful of cases a year, this is often the most proportionate electronic option.

Option C — paper Form FDA 3500A by email or mail

You can complete a fillable Form FDA 3500A and send it to FDA as a single combined PDF that bundles the form with your supporting material — label scans and images of the reaction. Email it to CosmeticAERS@fda.hhs.gov, or mail it to the FDA CDER Mail Center (Attn: Cosmetics MedWatch reports, White Oak Campus, Building 22, G0207, 10903 New Hampshire Ave., Silver Spring, MD 20993). FDA encourages electronic submission, but the paper/email route remains valid and is the simplest way for a small brand to file its first case.

Which one should you pick? Most small and mid-size cosmetics brands will land on Option B (SRP) or the email route — they require no engineering and handle low volume fine. Reserve Option A for when you're filing enough cases that manual entry becomes the bottleneck, or when a vendor is filing on your behalf across many products. The reporting content is identical across all three; only the plumbing changes.

Common mistakes

Starting the clock late. The 15 business days run from receipt, including a complaint sitting unseen in an inbox. Build intake that triages on arrival.
Misjudging "serious." The disfigurement and infection criteria are broad for cosmetics. When a borderline case could plausibly meet a criterion, treat it as serious.
Omitting the label copy. A SAER without the product label attached is incomplete, full stop.
Treating non-serious events as nothing. You still have to receive, record, and retain them for inspection — six years, or three for qualifying small businesses.
Reporting to the wrong place. Cosmetics Direct is for registration and listing, not adverse events. Serious events go through ESG, the SRP, or the CosmeticAERS email/mail route.
No designated owner. "One RP per product" only works if someone actually owns the receiving, triage, and filing workflow. Diffuse responsibility is how deadlines slip.

A practical checklist for getting compliant

Confirm you're the Responsible Person. Check whose name is on each label. If it's yours, the obligation is yours.
Put adverse-event contact info on every label. A domestic address, phone, or electronic contact, prominent enough for a consumer to use.
Stand up an intake funnel. Route customer service, the label contact line, social mentions, and retailer feedback into one place that a named person reviews daily.
Write a one-page seriousness triage. Turn the MoCRA criteria into a yes/no checklist your intake reviewer can apply on day one.
Pick a submission path. Email/3500A or the SRP for low volume; ESG E2B(R3) if you're filing at scale or through a vendor.
Pre-build the report package. Have the fillable 3500A, a current label scan per SKU, and an image-collection step ready before you need them, so 15 days is plenty.
Set up recordkeeping. A retrievable file of all adverse events, serious and not, retained for the required period.
Plan for the one-year follow-up. Tag filed cases so new information that arrives later triggers a timely update.

Where to go from here

If you're at the "I think I just received a reportable event" stage, the fastest path to a clean, complete filing is to generate the Form FDA 3500A from your case details rather than hand-assembling it. Our free cosmetic adverse event reporting tool does exactly that: it fills out the 3500A from what you enter, maps the MoCRA seriousness criteria onto the form, and bundles the completed PDF with your label images and event photos into one package ready to email to FDA's CosmeticAERS inbox. You stay the reporter of record — the tool prepares the draft; you submit it through FDA's channel. It's free and needs no signup.

A note for beauty brands that also sell OTC drug products — sunscreens, acne treatments, anti-dandruff shampoos, antiperspirants, and the like: those are drugs, not cosmetics, and they carry the separate drug ICSR reporting regime under FDA's postmarketing rules, not MoCRA. If part of your catalog is OTC drugs, see our guide on E2B(R3) submission and our drug reporting workflow.

Further reading:

FDA — How to Report a Cosmetic Product Related Complaint — the official submission instructions, including all three paths
FDA — Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
FDA — AEMS Electronic Submissions — for Option A (ESG database-to-database)
How to Fill Out FDA Form 3500A — the underlying form, field by field

The reporting obligation is real and the deadline is short, but the actual filing — once your intake and triage are in place — is a contained, repeatable task. The hard part is being ready before the first serious event arrives, not the paperwork itself.