Cosmetic Adverse Reaction Complaints: How to Document Them and Set the Escalation Path

What is an undesirable effect, and when is it “serious”?

SFDA’s guideline defines an undesirable effect as an adverse reaction to human health attributable to the normal or reasonably foreseeable use of a cosmetic product. It includes irritation or allergic reactions of the skin, eyes or mouth, and excludes effects caused by misuse. ^[1]

An effect is “serious” if it results in temporary or permanent functional incapacity, disability, hospitalisation, a congenital anomaly, an immediate risk to life, or death. The guideline stresses that “serious” is not the same as “severe”: the first describes the outcome and the second the intensity of the symptom, and where in doubt a doctor confirms seriousness. ^[1] The EU guidelines use almost the same definition and the same distinction. ^[2]

This distinction sets the path. Intense redness that settled within two days may remain non-serious, while eye swelling that led to a hospital admission falls within mandatory reporting.

What should you record when a report comes in?

The most common mistake is for the contact centre to note only “customer complains of allergy”. A report that cannot be traced cannot be assessed. From the first call, collect:

• Product: full name and size, batch number and expiry date, or a photo of the pack.
• Use: start date of use, where it was applied, how often, and whether directions were followed.
• Event: the symptoms as the reporter describes them, when they began and how they developed.
• Current outcome: whether symptoms have resolved, and whether a doctor’s visit or hospital admission was needed.
• Other products: anything used over the same period, if the reporter mentions it.
• Reporter: a contact method for follow-up, and consent to keep photos and health data.

SFDA’s guideline sets mandatory fields for a report to the authority, including the company name, the reporter’s name, email and phone number, the product name, a description of the effect, its seriousness and the user’s current status, and asks reporters to complete optional fields as far as possible. ^[1] FDA’s GMP guidance expects a complaint file to record the kind and severity of the injury and the body part involved, the product and its code, and any medical treatment received. ^[4]

Customer service staff should not diagnose the condition or recommend treatment. If the reporter describes worrying symptoms, such as facial swelling, difficulty breathing or an eye injury, direct them to appropriate healthcare at once, then complete the record.

How do you triage a report and set its priority?

After receipt, the designated person in the business assesses the report with two questions: is the effect serious by the regulatory definition, and is there anything that clearly rules out a link to the product? The EU guidelines offer a standard causality method that considers time sequence, symptoms, test results and re-exposure, grades the relationship on five levels from “very likely” to “excluded”, and is applied to each product separately. ^[2]

The value of this assessment is that it prevents two errors: ignoring a report because the cause is “uncertain”, or condemning the whole product on a single report. The assessment concerns the link between the product and that individual user’s case, not the general risk of the product, and it may change as new information arrives. ^[2]

What are the mandatory reporting deadlines?

SFDA issued the first version of its guideline on reporting undesirable effects of cosmetics in August 2022, and it took effect in September of that year, so always confirm you are working from the latest published version. ^[1]

In Saudi Arabia, the “notifier” is the person or entity placing the product on the market, whether manufacturer, importer or distributor. It reports serious effects occurring in the Kingdom that it knows of or may be expected to know of, and manufacturing errors identified as the root cause of a serious effect, within 20 calendar days, and, within 10 calendar days, recalls of affected batches marketed in the Kingdom or of affected batches abroad of a similar-formula product sold in the Kingdom. ^[1]

Reports go through the Saudi Vigilance system using the company option, or by completing the reporting form and submitting it through the system or to SFDA’s dedicated cosmetics email address. ^[1] The guideline draws on Article 10 of the Cosmetic Products Law, which requires manufacturers, importers and marketers to have procedures for responding to reports of undesirable effects. ^[1]

If the business also exports to other markets, each regime has its own deadline. In the US, the responsible person reports a serious adverse event within 15 business days with a copy of the label, and sends any new medical information received within a year of the first report, also within 15 business days. ^[3] Do not mix these deadlines up, and do not import one market’s deadline into another market’s policy without checking.

Hypothetical example: two reports from one batch

Hypothetical example: within a week, an online retailer in Riyadh receives two reports of redness and itching after using a face wash, and both packs turn out to share a batch number. Neither reporter needed hospital care, and the symptoms cleared after stopping use.

The quality team links both reports to the batch number, searches the complaints log for similar reports from that batch or others, and reviews distribution and storage records and the batch certificate of analysis. It classes both effects as non-serious by definition, so the 20-day deadline does not apply, but escalates the case to the assessment owner because repeated reports from one batch are a signal worth reviewing. Two reports arriving together do not prove a cause, but they justify examining the pattern and deciding on the evidence.

How do you decide corrective action and close the file?

The EU guidelines call for analysing similar reports for trends or signals, taking into account their nature, severity, frequency and possible predisposing factors. ^[2] Corrective action should match the finding: changing the directions for use, adding a warning, amending the label, reformulating or recalling. ^[2]

Do not close a report until the file contains: a summary of the assessment and its reasoning, the decision and who took it, what was reported to the competent authority and when, and the communication with the reporter. The EU guidelines also require serious-effect data to be included in the product safety report, and say users should not be named or have their address given in reports exchanged between authorities. ^[2]

Who owns the process in the business?

Appoint a single owner for assessing reports and deciding on notification, even when reports arrive through many channels: the contact centre, social media, shops and distributors. Train every channel on the minimum data set and on passing the report to the central log the same day. In your policy, separate regulatory reporting deadlines from internal targets for replying to the customer, and review the policy when entering a new Gulf market.

What should the reporter be told?

Give intake staff a short, consistent script that does four things:

1. Thank the reporter and confirm the report is logged, with a reference number they can quote.
2. Advise them to stop using the product and keep the pack until the review is complete, as the business may need to examine it.
3. Direct them to a health professional if symptoms persist or worsen, without diagnosing or reassuring them that it is “nothing serious”.
4. Tell them when the next follow-up will be and through which channel.

At this stage, avoid either admitting or denying that the product is the cause, because the assessment is not complete. Also avoid asking for health data the assessment does not need, and store what is collected in line with the business’s data protection policy.

Conclusion

Log the report on receipt with the minimum data, judge seriousness by outcome rather than intensity, and keep the causality assessment separate from the decision to notify. Keep each market’s deadlines exactly as its competent authority sets them.