Adverse events and drug or device products (MoCRA)

This article covers the Adverse events section on a cosmetic product's page and the question "Is this product also regulated as a drug or medical device?". The law behind both is the Modernization of Cosmetics Regulation Act (MoCRA), in the 2024 US Code (21 U.S.C. 364, 364a, 364h and 364i). The duties fall on the responsible person, the company whose name is on the label.

1. What to log

Log every complaint you receive about the product, serious or not. On the product's page, open Adverse events, fill in Log an adverse event — the Date received, Who told you, What was reported, and Is it serious? (Yes, No or Not sure) — and click Log adverse event. The optional Label document can be any document you have uploaded for the product, such as a copy of the label; Aleph has no separate label document type. Your company's records of each report received are what the law asks you to keep (21 U.S.C. 364a(e)(1)).

2. What counts as serious

The law defines a serious adverse event (21 U.S.C. 364(5)) as an adverse event that:

• (A) results in death; a life-threatening experience; inpatient hospitalization; a persistent or significant disability or incapacity; a congenital anomaly or birth defect; an infection; or significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), other than as intended, under conditions of use that are customary or usual; or
• (B) requires, based on reasonable medical judgment, a medical or surgical intervention to prevent an outcome described in (A).

Aleph does not decide this for you. You answer the question on each event.

3. The FDA deadline

The responsible person sends FDA a serious adverse event report, with a copy of the label on or within the retail packaging, no later than 15 business days after it receives the report (21 U.S.C. 364a(b)(1)). New and material medical information about that event, received within 1 year of the initial report to FDA, is sent no later than 15 business days after it is received (21 U.S.C. 364a(b)(2)).

The law does not define "business days". Aleph counts weekdays, skipping the 11 US federal holidays and their observed days (a holiday on a Saturday is observed the Friday before, and one on a Sunday the Monday after). Inauguration Day and one-off closures ordered for a single year are not skipped. The day Aleph shows is a count, not a ruling. The duty and its deadline are the statute's, so check any date near the edge yourself.

Choosing Not sure on whether an event is serious counts like Yes for the reminder: Aleph shows a due day and a dashboard reminder until you change the answer to No or record an FDA report.

4. What to send and where

This is FDA's instructions (Dec 2023), from FDA's page on serious adverse event reporting for cosmetic products, which FDA dated 12/14/2023. FDA may have changed the method since, so read its page before you send.

• FDA recommends the MedWatch Form 3500A, sent with supporting information such as label scans and images.
• Send it by email to CosmeticAERS@fda.hhs.gov, or by mail to the FDA CDER Mail Center (Attn: Cosmetics MedWatch reports).

Aleph does not send anything to FDA. When you have sent the report, use Record the FDA report on the event to record the date sent and the FDA reference. A follow-up, such as new medical information, is logged on the same event and has its own due day.

5. Keeping records

Keep the records of every adverse event report you receive for 6 years (21 U.S.C. 364a(e)(1)). Aleph shows 6 years for every company. The statute lets a small business (21 U.S.C. 364h) that makes or processes none of the products listed in 364h(b) keep them 3 years, but keeping them longer is always allowed. Because of this, Aleph does not let you delete a product that has adverse events logged. FDA can ask for access to these records during an inspection (21 U.S.C. 364a(e)(2)). Deleting your Aleph account erases them: the account page warns you first, and its data export includes them in adverse_events.json, so download your data before you delete.

6. Products that are also a drug or medical device

A cosmetic product that is also subject to the drug and device requirements of the Federal Food, Drug, and Cosmetic Act is exempt from MoCRA's sections on adverse events (364a), good manufacturing practice (364b), registration and listing (364c), safety substantiation (364d), label contact (364e(a)), records (364f) and mandatory recall (364g) (21 U.S.C. 364i(a)). A facility that also makes cosmetic products that are not drugs or devices is not exempt for those products (364i(b)). Answer the question on each product: with Yes, MoCRA's rows that match those sections show as not applicable and no adverse event reminder is raised. Events you already logged stay visible as history.

The drug and device rules are FDA's and outside Aleph, which says nothing about what they require. FDA's own pages are the place to start: FDA drugs and FDA medical devices. Aleph records your answer. It does not decide whether the product is a drug or device.

7. Who sees this

Your company only. Aleph administrator support can read it when helping you. FDA reviewers, auditors, partners, share links, compliance packages and the buyer summary never include it, and the checklist those people see leaves the adverse event records row out.