Most brands focus heavily on launch day, the formula, packaging, marketing, and finally getting the product to market. It feels like the finish line, but it isn’t. In reality, launch is just the beginning of ongoing legal responsibilities.
Under regulations like the EU Cosmetics Regulation (EC) No 1223/2009 and the Modernization of Cosmetics Regulation Act (MoCRA), your obligations continue long after release. You must monitor product safety, track and respond to complaints, practice cosmetovigilance, and update your cosmetic product safety report whenever needed
This guide will help you understand cosmetovigilance to knowing exactly when your CPSR needs updating, we’ll cover it all, starting from the basics and working up to the stuff that even experienced formulators sometimes miss.
Understanding Cosmetovigilance:
Cosmetovigilance is essentially the cosmetics industry’s version of pharmacovigilance. It’s the organized, proactive monitoring of safety signals once a product is live.
The term gets thrown around in regulatory circles a lot, but what does it actually look like in practice?
What is Post-Market Surveillance in Cosmetics?
Post-market surveillance (PMS) is the system you put in place to collect, review, and act on information about your product after it’s been placed on the market.
For cosmetics specifically, this includes monitoring consumer reactions, tracking complaints, reviewing new scientific literature on your ingredients, and watching for regulatory updates that could affect your product.
It sounds like a lot. And honestly? It is. But when it’s set up properly, it’s not chaos, it’s just a system. And a good system or an expert assessor protects you, your brand, and your customers.
Adverse Event Tracking: Who’s Watching the Complaints?
Every complaint matters. Even the ones that seem minor.
When a consumer contacts you about a rash, an allergic reaction, or unexpected hair loss after using your product, that’s an adverse event. Your company needs a clear, documented system for capturing these reports, investigating them, and deciding whether they signal a broader safety issue.
This isn’t optional. It’s part of your post-market surveillance obligations.
A good adverse event tracking system will:
- Record every complaint with date, product batch, and reported symptoms
- Categorize complaints by severity
- Flag patterns, because one complaint might be nothing, but fifteen complaints about the same reaction in three months? That’s a signal worth investigating
Most brands start with a simple spreadsheet. That works at a small scale. As you grow, you’ll want something more structured, dedicated complaint management software or a built-in module within your quality management system.
Serious Undesirable Effects (SUEs): What Counts and What to Report
Not every adverse reaction requires the same response. The EU regulation distinguishes between undesirable effects (mild, temporary reactions) and serious undesirable effects (SUEs), and the latter trigger mandatory reporting.
An SUE is defined as any adverse reaction that results in:
- Temporary or permanent functional incapacity
- Disability
- Hospitalisation
- Congenital abnormalities
- An immediate vital risk
- Death
If any consumer reports an effect that falls into these categories, you’re legally required to report it to the relevant national competent authority, and in the EU, this typically involves the Cosmetic Products Notification Portal (CPNP).
How Timelines Work for SUE Reporting in the EU
Speed matters here. Under the EU Cosmetics Regulation, SUEs must be reported without delay. In practice, that means you need a clear internal escalation path, so when a serious complaint lands, it doesn’t sit in someone’s inbox for two weeks.
Build that process before you need it. Because when a real SUE happens, you won’t have time to figure out the process on the fly.
What Is a Cosmetic Product Safety Report (CPSR)?
This is probably the most misunderstood part of post-launch compliance. So let’s be very direct about it.
The cosmetic product safety report is the cornerstone document proving your product is safe. Every cosmetic product placed on the EU market must have one before it goes live.
The CPSR has two parts:
- Part A, the cosmetic product safety information (ingredients, formulation, toxicological profile, etc.)
- Part B, the cosmetic safety assessment, which is the qualified safety assessor’s conclusion based on Part A
It’s prepared by a qualified cosmetic safety assessor, someone with specific qualifications in toxicology or a related field, and it forms the heart of your Product Information File.
But here’s what makes people confused: the CPSR report isn’t filed once and forgotten. It needs to stay current.
When Does Your CPSR Need Updating?
Your cosmetic product safety assessment should be reviewed and updated whenever:
- New scientific findings emerge: If a study comes out showing that one of your ingredients has previously unknown sensitisation potential, your safety assessor needs to know. That data needs to be incorporated into your assessment.
- You change the formulation: Even small changes matter. A switch from one preservative to another, a change in fragrance concentration, a raw material supplier switch that alters the ingredient specification, any of these can affect the safety profile and may trigger a CPSR update.
- The conditions of use change: If your product was originally intended for adults and you’re now marketing it to children (or vice versa), that’s a significant change. The exposure assumptions in your safety assessment will need revisiting.
- Adverse trends appear: If complaint data shows a rising pattern in severity or frequency of reactions, the safety assessor must re-evaluate the existing conclusions.
- Regulations change: The EU regularly updates restricted and prohibited ingredient lists. When a substance you’re using moves into a new regulatory category, your CPSR needs to reflect that.
Who Is Responsible for Keeping the CPSR Current?
The Responsible Person (RP), the legal entity responsible for the product in the EU, carries the obligation to make sure the CPSR stays up to date. But in practice, it’s a collaboration between the RP, the safety assessor, and often the regulatory affairs team.
If you’re a brand owner selling into the EU without an EU-based entity, you’ll need an EU RP. That RP takes on real legal liability, which is why they’ll want to make sure your CPSR assessment is solid and current.
The Product Information File (PIF):
What Goes Into the PIF After Launch?
Your Product Information File doesn’t close at launch either. It’s a living document, and after launch, it needs to absorb all the post-market data you’re collecting.
Post-launch additions to the PIF typically include:
- Updated adverse event logs
- Revised CPSR versions (with version history)
- Correspondence with regulatory authorities about SUEs
- Evidence of any corrective actions taken
- Updated stability or microbiological testing data if reformulation occurs
- Documentation of any batch-specific issues
Think of the PIF as the complete story of your product, from pre-launch development all the way through its market life.
The 10-Year Rule You Cannot Ignore
Here’s the legal requirement that surprises a lot of brands: you must keep the PIF available for 10 years after the last batch of your product is placed on the market.
Not 10 years from launch. 10 years from the last batch.
So if you make a final production run in 2028 and discontinue the product, you’re legally required to maintain that PIF until 2038. Market surveillance authorities can request access to it at any time during that window.
Make sure your document management system accounts for this. It sounds like a small admin detail, but it’s a legal requirement, and failing to produce a PIF on request can trigger serious regulatory consequences.
Key Post-Launch Compliance Responsibilities:
Monitoring Regulatory Changes, Ingredients, Bans & Labeling
Regulations don’t stay still. The EU Cosmetics Regulation has been amended multiple times since it came into force, and those amendments affect real products on real shelves.
Your post-market surveillance system needs to include a process for monitoring regulatory updates. This means:
- Subscribing to regulatory alerts from bodies like the European Commission or SCCS (Scientific Committee on Consumer Safety)
- Checking updates to Annexes II, III, IV, V, and VI of the EU Cosmetics Regulation (these cover prohibited substances, restricted substances, colorants, preservatives, and UV filters)
- Reviewing new SCCS opinions that may affect ingredients in your formulations
If a substance you’re using gets restricted or banned, you need to know, fast. Not three months later, when a market surveillance authority flags your product.
Supply Chain Traceability and Batch-Level Testing
Traceability is more than just having supplier documentation on file. It means being able to trace any unit of your product back to a specific batch, and that batch back to specific raw material lots.
Why does this matter for post-market surveillance? Because if a safety issue emerges, you need to know whether it’s isolated to one production batch or systemic across your entire product line. That distinction changes everything, from the scope of a potential recall to the nature of your regulatory reporting.
Batch coding, clear supplier records, and regular incoming quality checks are the foundation of good traceability.
When a Product Recall Becomes Necessary
Nobody wants to think about recalls. But if post-market surveillance identifies a genuine safety risk, acting fast is always better than waiting.
A product recall under EU cosmetics law isn’t just about pulling the product off shelves. It involves notifying the relevant competent authorities, informing distributors and retailers, and communicating transparently with consumers where necessary.
The brands that handle recalls well are the ones that already have a recall procedure written down before anything goes wrong. Seriously, write the procedure now, test it internally, and hope you never need it.
Building a Cosmetic Safety Monitoring System:
Setting Up Internal Feedback Loops
The goal of a cosmetic safety monitoring system is to make sure information flows from consumers to your team, from your team to your safety assessor, and from your safety assessor back into your documentation.
Here’s a simple structure that works for most brands:
- Collection: All adverse events, complaints, and feedback are captured in a single system
- Triage: Someone reviews incoming reports and categorizes them by severity
- Escalation: SUEs go up the chain immediately; minor complaints are batched for periodic review
- Review: Quarterly or biannual review of complaint trends with your safety assessor
- Action: Any required updates to the CPSR, PIF, or product formula are documented and implemented
Using Consumer Data to Strengthen Your Safety Assessment
Here’s something that doesn’t get discussed enough: post-market data isn’t just a compliance burden. It’s actually useful.
Real-world consumer feedback can tell you things your pre-launch stability testing couldn’t. Maybe a product performs differently in humid climates. Maybe a specific demographic is reporting sensitivity that wasn’t caught in your safety assessment. That’s valuable product intelligence, and feeding it back into your cosmetic product safety assessment makes your safety case stronger over time, not weaker.
The brands that treat surveillance as an asset rather than an obligation tend to end up with better products. Which is, honestly, the whole point.
Tools and Tech That Help With Cosmetic Product Monitoring in the EU
You don’t need enterprise software on day one. But as your portfolio grows, manual spreadsheets start to break down.
Some tools worth knowing about:
- QMS platforms (like Qualio, MasterControl, or Veeva), these can manage complaints, CAPAs, and document control in one place
- Regulatory intelligence services, subscription tools that alert you to changes in EU, UK, or US cosmetics regulations
- CPNP, the EU’s Cosmetic Products Notification Portal, where SUE reports are submitted, and product notifications are maintained
The right tools depend on your scale and budget. But the system matters more than the software; a well-run spreadsheet beats a poorly configured QMS every time.
Post-Launch Cosmetic Compliance Checklist
Use this as a quick reference after your product goes live:
Immediately after launch:
- Confirm the SUE reporting procedure is documented, and the team is trained
- Set up an adverse event tracking system
- Make sure CPNP notification is current and accurate
- Confirm PIF is complete and accessible
Ongoing (quarterly):
- Review and categorize consumer complaints
- Check for regulatory updates affecting your ingredients
- Confirm supplier specifications haven’t changed
- Brief your safety assessor on any complaint trends
Annually (or when triggered):
- Full CPSR review with safety assessor
- PIF update incorporating post-market data
- Traceability audit, confirm batch records are complete
- Regulatory landscape review (new SCCS opinions, Annex amendments)
When triggered by events:
- SUE occurs → report without delay, escalate to safety assessor
- Formulation change → update CPSR before relaunching
- New scientific data on ingredient → notify safety assessor immediately
- Regulatory change affecting your formula → assess impact, update CPSR if needed
FAQs
What is the post-market surveillance process for cosmetics?
Post-market surveillance, also called cosmetovigilance, means checking your product’s safety after launch. It includes tracking complaints, reporting serious issues, reviewing new data, watching regulation changes, and updating CPSR and PIF. It’s an ongoing process, not a one-time task.
How long does post-marketing surveillance last?
Post-market surveillance continues as long as your product is sold, and even after that. EU rules require you to keep your Product Information File for 10 years after the last batch is sold, ensuring long-term safety and compliance.
What is the purpose of market surveillance for cosmetics?
Market surveillance has two main purposes. It helps regulators check that products are safe and follow the rules. It also helps brands spot safety issues early, before they become serious problems or lead to recalls. Authorities can request your safety documents anytime.
Why is post-marketing surveillance important?
Because things change. Ingredients get new safety data, people use products differently, and rules are updated. Post-market surveillance helps you track issues early, keep your records updated, and show regulators that your product stays safe.
Does a CPSR need to be updated after launch?
Yes, the cosmetic product safety report must be updated whenever there’s a change in formulation, new scientific findings relevant to your ingredients, a change in the target audience, a trend in adverse reactions, or a regulatory change. It’s a living document, not a one-time filing.
What happens if you don’t comply with PMS requirements?
If you don’t follow the rules, you may face warnings, fines, or even product bans. Authorities can ask for your PIF and CPSR anytime. Missing or outdated documents can lead to action, and safety issues can seriously damage your brand reputation.
