Cosmetics Europe Guidelines on the Management of Undesirable Effects and Reporting of Serious Undesirable Effects from Cosmetics in the European Union

The European Union (EU) Cosmetics Regulation (EC) No. 1223/2009 requires companies to collect and assess reports of adverse health effects from the cosmetic products (undesirable effects) they market. Furthermore, undesirable effects that are considered as serious need to be reported to the national competent authorities. Cosmetics Europe, representing the European cosmetics industry, has developed these guidelines to promote a consistent practical approach for the management of undesirable effects and the notification of serious undesirable effects. Following these guidelines allows companies concerned to demonstrate due diligence and compliance with the legal requirements.


Introduction
Cosmetic products placed on the European Union (EU) market have high standards of safety and quality. Undesirable effects as a result of normal or reasonably foreseeable use of cosmetic products are rare and are typically mild in nature and completely reversible. Companies have procedures to enable them to react appropriately to reports of undesirable effects, including recording, assessment, understanding of their nature and future prevention. For companies, this plays an important role in the post-marketing surveillance of cosmetic products and their performance in the marketplace.
The main purpose of post-marketing surveillance is the protection consumer health by monitoring the occurrence and reducing the likelihood of reoccurrence of Undesirable Effects (UE). It includes the evaluation of Serious Undesirable Effects (SUEs) and, where appropriate, the dissemination of information which could be used to prevent such repetitions, or to alleviate the consequences of such effects. The EU Cosmetovigilance System is intended to facilitate a direct, early and harmonized implementation of such actions across the EU Member States, in contrast to action taken on a country by country basis.
The EU Cosmetics Regulation (EC) No. 1223/2009, hereafter referred to as the Regulation, has created the basis for a uniform approach to the management of Serious Undesirable Effects caused by the use of cosmetics. The previous requirements of Directive 76/768/EEC regarding the inclusion of Undesirable Effects in the Product Information File and access to certain information for the public have been kept in the Regulation. However, new requirements have been added on the reporting of Serious Undesirable Effects [1,2].
Cosmetics Europe, representing the European cosmetics industry, has developed guidelines to promote a consistent procedure for the management of UEs and the reporting of SUEs to Competent Authorities. To ensure easy access to these guidelines by all interested stakeholders, it was decided to publish them in the open literature rather than as an industry document. They are consistent with the "SUE Reporting Guidelines" [3] issued by the European Commission services in charge of the management of the Regulation because of discussions with National Competent Authorities, industry and other interested parties in the Market Surveillance sector (for more information on the EU Commission Guidelines, see Appendix A).
Following these guidelines will allow Responsible Persons and distributors to demonstrate compliance with the legal requirements and assure the public and Competent Authorities of the credibility and accuracy of the data supplied, whilst at the same time protecting the privacy of the relationship between the healthcare professional and the individual consumer who experienced an undesirable effect.
These present guidelines are an evolution of earlier industry guidelines on the management of undesirable event reports [4] and will continue to be revised and amended as necessary to take account of developments in science, technology and regulations.

Definition of Terms
For the purpose of these guidelines and in line with the definitions given in Article 2 of the Regulation, the following definitions apply: Undesirable or adverse event is a human adverse health event which is voluntarily reported by a consumer, healthcare professional, Competent Authority, or any other individual to have occurred during or after normal or reasonably foreseeable use of a cosmetic product, but is not necessarily attributable to the product use.
An undesirable event is distinct from anecdotal consumer complaints of a non specific nature or reports of sensorial perceptions that can be expected from the normal and reasonably foreseeable use of a specific cosmetic product. Undesirable Events typically include, but are not limited to, irritant or allergic reactions that can affect the skin, eyes or mouth.
A reported undesirable event will be considered as a genuine undesirable event when the following minimum information can be obtained: • A reporter who is identifiable by initials, age or gender, plus the name and address if the reporter is a Health Professional; • A consumer who is identifiable by one or more of the following: date of birth, age (or age category, e.g., adolescent, adult elderly), gender, initials; • The precise nature of the event with a description of the reaction (complete verbatim with the symptoms; the term "reaction" alone should not be considered as sufficient) and the date of onset of the event (year at the minimum); • A cosmetic product that is identified by the exact commercial name and/or a combination of other identifying elements such as brand name, category, type, batch number, notification number-as long as they are sufficient to enable the product's specific identification.
NOTE: The term identifiable in this context refers to the verification of the existence of the reporter and consumer. This information is important to avoid case duplication, detect fraud, and facilitate appropriate case processing. Undesirable effects caused by product misuse and abuse are not included in this definition.
Undesirable effect (UE) means an adverse reaction for human health attributable to the normal or reasonably foreseeable use of a cosmetic product.
A reported undesirable event becomes considered as an undesirable effect if a causality assessment is performed that demonstrates a causal link between the product use and the adverse reaction.
Serious undesirable effect (SUE) means a UE that has resulted in one of the following outcomes: • Temporary or permanent functional incapacity, corresponding to a substantial disruption of a consumer's ability to carry out normal physical, or occupational life functions for a significant span of time. Such disruption may, for example, be caused by severe and prolonged impacts on sensory or physiological functions. Impairment of body functions is considered as a relevant seriousness criterion only if assessed on the basis of objective, medical criteria. Such functional incapacity should be demonstrated, for instance, on the basis of a medical certificate, in order to confirm that a report of adverse effect qualifies as an SUE. • Disability, corresponding to permanent damage or disruption in the patient body structure or function, or in activity limitation. In order to confirm that a report of an undesirable effect qualifies for this SUE criterion, it should be documented by a medical certificate with an objective percentage of disability.

•
Hospitalisation, corresponding to admission to the hospital on inpatient basis, documented by an admission note. An emergency room visit, examination or treatment delivered as an outpatient, which does not result in admission to the hospital, does not qualify for this criterion. In cases where sufficiently precise information on inpatient admission is not available, a duration of hospitalisation of at least 24 h may be used as a simple criterion. • Congenital anomalies, corresponding to a physiological or structural anomaly that develops at birth or before, and is still present at the time of birth. This excludes hereditary diseases. • An immediate vital risk, corresponding to an event/effect in which the consumer was at risk of death at the time of the event/effect if no medical intervention had been taken. This criterion is fulfilled if an emergency medical intervention took place and is documented. "Vital risk" does not refer to an event/reaction which hypothetically might have caused death if it were more severe. • Death, should be considered fulfilled if the undesirable event/effect is the direct cause of death.
The term serious is not synonymous with severe. Severe is used to describe the intensity (severity) of the effect as in mild, moderate or severe, whereas the term serious refers to the ultimate outcome/consequences of the effect for the patient.
In case of doubts, the seriousness of the undesirable effects should be confirmed by a medical doctor [5].
Causality assessment is the analysis of the probability that a well identified product used by a consumer is responsible for a genuine undesirable event, i.e., whether the event is attributable to the use of a cosmetic product and should therefore be considered as an Undesirable Effect. A causality assessment is done for a specific use of the product by an individual consumer. It does not give an evaluation of the risk of a product to the general population. Causality assessment should use a standardized methodology such as the one developed in the frame of the European Commission SUE Reporting Guidelines [4]. See below for more details.
Medical confirmation means that a fact has been assessed and validated by a healthcare professional (e.g., physicians, dentists). It is important to differentiate between medical confirmation of the presence of a particular health impairment (i.e., diagnosis) and substantiation of a suspected cause based on scientifically robust information (e.g., a Patch Test identifying an allergen).
Cosmetovigilance is defined as the collection, evaluation and monitoring of spontaneous reports of undesirable events (serious and non serious) observed during or after normal or reasonably foreseeable use of a cosmetic product. Post Marketing Surveillance includes a set of methods and technical tools allowing the surveillance and evaluation of the safety profile of a given cosmetic product in user populations and contributing to the decision making process for risk management. Together with other tools, cosmetovigilance, based on the management of spontaneous reports, contributes to the detection of signals and to post marketing surveillance.
Spontaneous report refers to unsolicited communication by a member of the public or by healthcare professionals to a company and/or its supply chain (e.g., manufacturer, importer distributor, retailer, salons, . . . ), regulatory authority or other organization that describes one or more suspected health related events in a person who has used one or more cosmetic products. Although not providing absolute figures on the occurrence of desirable effects, spontaneous reporting is a useful indicator to identify and describe possible safety signals.
Safety signal refers to new information with the potential to modify the safety assessment of a product or trigger further investigation. A signal usually arises from an unexpected modification of a pre-existing level of reporting in terms of the number of reports or the nature of reported reaction.

Basic Responsibilities
In order to be able to fulfill the legal obligations with regard to Serious Undesirable Effects under the EU Cosmetics Regulation (in particular related to Safety Assessment, Information to the public, Notification of Serious Undesirable Effects, and Inclusion of Undesirable Effects in the Cosmetic Product Safety Report) the cosmetic company placing a cosmetic product on the EU market (i.e., the Responsible Person-RP) should put a comprehensive system in place, including:

•
To make clear to consumers how they can contact the company; • To encourage, if appropriate, consumers to consult a Healthcare Professional when they notice a UE suspected of being linked with the use of a cosmetic product; • To establish and maintain an adequate internal post marketing surveillance system to ensure that any information about a suspected UE reported to the personnel of the company is collected and collated in order to be analyzed; • To make sure that their personnel are appropriately informed and trained about their cosmetovigilance obligations; • To establish a clear relationship between Responsible Person and Distributor regarding the management and reporting of SUEs; • To set up internally the appropriate processes for the management and reporting of SUEs; • To identify when possible a contact for each country who will be the contact person for the National Competent Authority in case of local enquiry or action plan; • To maintain records of all reported UEs on cosmetics marketed in the EU and to readily provide access to the information, upon request, to the Competent Authority in the Member State where the Product Information File is kept; • To set up an internal process and methodologies allowing to identify from their cosmetovigilance data any potential change in the safety profile for their product and take preventive/corrective action if appropriate; • To update the Cosmetic Product Safety Report (CPSR) considering the available data on the UEs and SUEs to the cosmetic product; • To ensure that information on UEs and SUEs resulting from use to the cosmetic product are made easily accessible to the public by any appropriate means; • Communicate any subsequent actions resulting from the SUEs to the Competent Authorities

•
To ensure the monitoring of eventual subsequent actions.

Scope
The Cosmetics Regulation [1] sets the following scope for the requirements in relation to UEs and SUEs: "Article 10: Safety assessment-in order to demonstrate that a cosmetic product complies with Article 3 (general safety requirements), the responsible person shall, prior to placing a cosmetic product on the market, ensure that the cosmetic product has undergone a safety assessment on the basis of the relevant information and that a cosmetic product safety report is set up in accordance with Annex I . . . ." Annex I, Part A (9) of the Regulation states the following should be included in the safety report: "All available data on the undesirable effects and serious undesirable effects to the cosmetic product or, where relevant, other cosmetic products. This includes statistical data." In the accompanying Guidelines on Annex I of the Regulation [6], this is explained in more detail to mean that: "The cosmetic product safety report is to include all of the available data, including statistical data, on the undesirable effects and serious undesirable effects of the cosmetic product or, where relevant, other cosmetic products. In particular, information on undesirable effects which, according to the causality assessment, are found to be very likely, likely, not clearly attributable or unlikely to be attributable to the cosmetic product in question are to be included in the safety report. Data on undesirable effects may be included in this part of the safety report in the form of statistical data such as the number and type of undesirable effects per year." Regarding SUEs, Article 23 of the Regulation requires that: "In the event of serious undesirable effects, the responsible person and distributors shall without delay notify the following to the competent authority of the Member State where the serious undesirable effect occurred: (a) all serious undesirable effects which are known to him or which may reasonably be expected to be known to him; (b) the name of the cosmetic product concerned, enabling its specific identification; (c) the corrective measures taken by him, if any." Lastly, Article 21 of the Regulation enables members of the public to request from the Responsible Person certain information on UEs and SUEs.
"Without prejudice to the protection, in particular, of commercial secrecy and of intellectual property rights, the responsible person shall ensure that . . . existing data on undesirable effects and serious undesirable effects resulting from use of the cosmetic product are made easily accessible to the public by any appropriate means." It can be inferred from the text that all UEs or SUEs that are attributable to a product marketed in the EU, need to be included in the Product Safety Report. SUEs that occurred on EU territory need to be reported to the authorities of the EU Member State of the country where the SUE occurred. However, even if not reportable to the EU authorities (because the effect occurred outside the EU), such SUEs are still valuable cosmetovigilance information for the company concerned. In addition, if requested by members of the public, certain information about them needs to be provided.
Knowledge of undesirable events would be reasonably expected in case of spontaneous reports to the company, irrespective of the type of reporter (consumer, health professional, distributor, authorities, or others). Knowledge would also be expected for cases revealed as part of Europe-based post-market surveillance studies or any epidemiological studies commissioned by the Responsible Person.
Other sources of information may include published studies, scientific and medical literature. The screening policy of scientific and medical literature is determined by each company but should be proportionate.
Information in the press and on social media is far less precise and may be purely anecdotal. Cases identified through EU national media should be followed up, trying to obtain sufficient information to assess the case. When confirmed and attributable to the product use, the case should be included in the Product Safety Report and-in case of an SUE-reported to the appropriate EU authorities.
It is unfeasible, nor is it necessary, that companies would systematically monitor external websites or blogs. If a company becomes aware of UEs or SUEs being discussed in such forums, action should be taken on a case-by-case basis.

Management of Undesirable Effects
Each Responsible Person and distributor should put an appropriate management system of alleged undesirable event reports in place to be able to fulfill their legal obligations under the Cosmetics Regulation, take responsibility for the cosmetic products and ensure that appropriate action can be taken, when necessary. Considering the time frame (20 calendar days, see Section 5.4.3) for reporting SUE to the National Competent Authority (NCA), the process of the management of SUEs should be clearly described in the company system.
In particular, each Responsible Person should: • Record all contacts in relation to undesirable events; • Determine which undesirable events are genuine undesirable events (see Section 2); • Document, investigate, validate and evaluate cases that fulfill the criteria to be classified as undesirable effects in accordance with the Regulation; • Classify these documented reports in terms of causal relationship; • Identify the cases that fulfill the criteria to be classified as Serious and report SUEs to the NCA in accordance with the Regulation; • Store the documentation of each report; • Evaluate this information in terms of frequency, medical significance and causes; • Ensure that healthcare professionals' and/or consumers' privacy protection is maintained; • Include updated and substantiated relevant information into the Cosmetic Product Safety Report; • Be in position to answer questions addressed by the National Competent Authorities and/or the public under the requirements of the Regulation.

Reception
Spontaneous reports from consumers, National Competent Authorities, or healthcare professionals can be reported to a company by different ways (mail, e-mail, telephone, direct contact) and received by different employees.
The company needs to ensure that all these reports are made available without delay to the appropriate person in the organisation. During this first contact attempts should be made to obtain necessary information required for the opening of a case file (see Section 2, Definition of undesirable or adverse event).
In recognition of the difficulties posed by the lack of detail in some consumer reports and the difficulty sometimes experienced in obtaining additional or sufficient information, it is important that the person who oversees the documentation and evaluation of the undesirable event exercises judgment in relation to how such reports are recorded, classified and followed up on.
A standardized questionnaire can be used in consumer contacts to ensure that the maximum information is obtained at the initial consumer contact (see example of questionnaire in Appendix B).
At the time of report, an undesirable event is to be considered as an alleged undesirable event. It will only become a genuine undesirable event when there is evidence that the event has indeed happened and care must be taken to exclude the possibility of malicious reports. Additional follow-up or medical confirmation may not be necessary for an apparently non-genuine undesirable event. A non-genuine undesirable event would be characterized in particular by the impossibility to obtain information that should be considered as evidence: consumer or health care professional identity and contact details, description of the reaction (symptoms and delay of onset), complete product identification, etc. (see definition of undesirable event in Section 2).
When necessary, the initial consumer contact may be followed up with additional contacts with the consumer or the treating healthcare professional in order to complement the information. Note that it may be necessary to obtain a formal authorisation by the consumer to contact their healthcare professional. Reasonable efforts should be made either to obtain voluntary informed consent to contact the treating healthcare professional or to have the consumer provide additional, medically relevant, information.
All complementary information obtained during the initial or follow-up contacts needs to be documented, dated and included in the case file. Whatever the type of documents obtained during the inquiry, protection on data privacy should be applied (see Section 5.5).
When necessary, the consumer should be encouraged by the company to consult a healthcare professional. Information should be offered by the company to physicians, dermatologists, dentists or other healthcare professionals to aid in the diagnosis in terms of documentation and/or testing whenever requested.
Reports linked to product abuse or misuse, whilst they may provide information relevant for cosmetic manufacturers, fall outside the scope of this document and should be classified separately.

Internal Recording
The recording procedure should include the date of initial receipt of the undesirable event; this is the date when the company has first been informed of the undesirable event, whatever the role and function of the first recipient of the information in the company. Procedures should be in place to ensure any such report is transmitted to the appropriate person or department within the company without delay.
A file is opened for each report of a genuine undesirable event and a specific company reference number should be used to identify each case file. This reference number should be included on all the documents related to the case.
It is up to each company to define their numbering system. As an example, the following identification system could be used: OECD coding for the country of origin, the year of reporting, the code of company, and the serial number of the case.
It is up to each company to define their internal policy but it is recommended to use a standardized listing or dictionary of medical terms to code for symptoms/diagnosis.
Similarly, the product category system of the EU Cosmetic Product Notification Database (CPNP) should be used for standardised classification of the product type [7].

Causality Assessment
Once non-genuine undesirable events have been excluded, it needs to be determined whether a reported undesirable event has to be considered as an undesirable effect. A causality assessment enables estimation of the probability by which the use of a specific, well identified cosmetic product was attributable to the adverse health event.
A causality assessment is done for a specific use of the product by an individual consumer. It does not give an evaluation of the risk of a product to the general population.
This needs to be carried out on all genuine reports of undesirable events, regardless of the source of the information (i.e., consumer contact reports and healthcare professional reports). Note, however, that throughout the gathering of further information, the assessment of whether a reported event is genuine or non-genuine may change and the reported event may be subsequently in or excluded from the final causality assessment.
It is important to note that a useful causality assessment can only be performed if there is sufficient minimum information on the case history (in particular symptoms and chronology). If this minimum information is not obtained, the case should be considered as unassessable or "not classifiable". As long as additional information can be reasonably expected to be obtained, which could change the assessment of the case, the case report is considered as not closed. It is, however, possible to close a case report as 'not-classifiable' after a minimum of two documented contacts without any additional information.
To ensure a common understanding and uniform approach to the performance of causality assessments, a standardized methodology should be used, such as the one developed in the frame of the European Commission SUE Reporting Guidelines. A detailed description of the EU wide accepted method for causality assessment can be found in the Annex to these European Commission Guidelines [4]. Under this method, the level of causality is determined using a decision table in which scores are combined for three parameters: symptoms, time sequence and re-exposure. According to the method, five levels of causality can be obtained: "very likely", "likely", "not clearly attributable", "unlikely" and "excluded".
It is possible that the outcome of an initial assessment changes at a later stage in the process as a result of additional information obtained from detailed questionnaires or from medical investigation. A causality assessment should only be considered final if it is unlikely that further information will be obtained that could change the assessment.
It is possible that a cause other than the cosmetic product is clearly identified through the investigation and causality assessment. In this case, the relationship between the undesirable effect and the product is considered as "excluded". Similarly, if there is an incompatible temporal relationship with the use of the product (e.g., adverse event occurring before the use of the product) the causal relationship should be considered "excluded".
A causality assessment is extremely difficult in cases where a complaint links a chronic disease with application of a particular cosmetic product. Such health impairments are known to have a multi-factorial etiology and/or need multiple insults over a prolonged period of time (i.e., chronic hand eczema).
A person who is trained in complaint handling and has an appropriate background should be responsible for conducting the causality assessment. In certain cases, it may be advisable to seek the support of an external or in-house healthcare professional when conducting the causality assessment in order to obtain a high degree of confidence in the result. This should be recorded in the case file documentation and the product information.
As a rule, if several products are reported as possible causes of an undesirable event, a causality assessment should be done separately for each cosmetic product, without taking into account the level of causality of the associated products.

Reporting of Serious Undesirable Effects to National Competent Authorities
This section is based on the European Commission "SUE Reporting Guidelines" [4] and aims to provide the reader with additional, practice oriented guidance (see also flowchart in Appendix C).

General Principles
Upon knowledge of an SUE to a Responsible Person or to a distributor, this RP or distributor has to notify it without delay to the National Competent Authority (NCA) of the country where the undesirable effect occurred, using a standardised Serious Undesirable Effect Report Form [1,5].
If the minimum information referred to in Section 2 (if the definition of undesirable or adverse event cannot be initially obtained, the Responsible Person and/or distributor should continue to undertake all reasonable efforts to obtain the information and notify the SUE without delay. In case the minimum information cannot be obtained, the existence of an SUE cannot be confirmed and notification would not be required. It is recognised that the initial notification may be incomplete due to time constraints (see Section 5.4.3) and may have to take place before a causality assessment has been carried out. This can be indicated on the initial report form.
It is highly recommended that all the exchanges regarding SUEs, those sent to the NCAs and those received from the NCAs should be appropriately stored according to a well defined internal traceability process (see Section 9.1).
The act of reporting an SUE to a NCA is not to be considered as an admission of liability for the SUE and its consequences.
The principles of interaction between the Responsible Person, Distributor and Competent Authorities on the management of SUEs and the notification/transmission forms to be used are described in European Commission SUE Reporting Guidelines [4].

Criteria for an Undesirable Effect Being Reportable to NCA as an SUE
Both the definition of a UE as well as the seriousness criteria defined in Section 2 need to be fulfilled to make a case report notifiable to the NCA.
SUEs resulting from an abuse or misuse of the cosmetic product are excluded from the reporting obligation as they are not part of normal or foreseeable use of the product.
Due to the potential medical seriousness, all SUE cases, except those classified as "excluded" should be reported to the NCA where the SUE occurred.
Where there is a doubt about the notification requirement on an SUE, the case should be reported in an initial report within a 20 day time frame (see Section 5.4.3) rather than waiting for complete information. However, as long as the company has reason to believe that it is in the position to obtain additional relevant information, which could change the assessment of the case, the case report is considered as not closed. A final report should always be sent when the company considers the case as closed.
Responsible Persons and distributors should designate (a) person(s) qualified to assess the seriousness of the cases. In case of doubts, the seriousness of the undesirable effects should be confirmed by a medical doctor [5].
If a report received refers to groups of unknown size, such as "some" or "a few" SUEs, the company should follow up to find out the number and then submit to the NCA a separate report for each identifiable consumer. Each case should be identified separately so that it is clear for the NCA that it is not a duplicate report of a single SUE.

Time Frames
For the interpretation of the time frames referred to in Article 23 of the Regulation, "without delay" or "immediately" should be understood as within 20 calendar days from the date at which any employee of the Responsible Person or distributor becomes aware of the SUE, whatever their role or function [4].
Thus, the notification by the company of the SUE to the NCA of the country where the SUE occurred should be carried out as soon as possible, and, in any case, no later than 20 calendar days following the date of initial receipt of the SUE. This is not necessarily the date of receipt by the person in charge of expediting the SUE form.

SUE Report Form
The reporting of an SUE to the NCA should be done using a harmonised Serious Undesirable Effect Report Form. Appendix A provides links to the appropriate report forms and fill-out guides issued by the European Commission.
If the case is not closed at the time it is initially reported, it should be clearly mentioned on the SUE report form.
The report form should be sent to the NCA by appropriate means to ensure confidentiality. An acknowledgement of the reception of the case should be sent back to the Responsible Person or the local national contact where the SUE occurred. This acknowledgment should be kept in the case file if received.
All subsequent communication on the SUE, including follow-up or exchange of information on the SUE between European Member States, should be kept in the case file with the company reference number.
All communications should refer to the reference number of the initial report and great care should be taken to avoid duplicate reporting of the same case.
When there are two or several cosmetic products reported as suspected, their full name should be listed in field (6d) in SUE reporting form A [5]. To avoid duplicate counting of the same SUE, separate reporting on two reporting forms should only be considered if necessary by the specific case circumstances.
The information corresponding to fields (6a), (6b) and (6c) of SUE reporting form A for the other suspected products, if available, should be attached to the same form or described in the narrative section in field 13 of form A [5].
If an SUE involves suspected cosmetic products from more than one Responsible Person, the NCA who receives the case should inform the other concerned Responsible Persons of the SUE. In this circumstance, the concerned companies should not re-notify the case to their NCA.
It is up to each company to inform initial reporters, consumers or healthcare professionals of the transmission of their reported case to the NCA.

Follow-Up to an Initial SUE Notification
Information on the reported SUEs should be kept available by the Responsible Person for the Competent Authority of the Member State where the Responsible Person is established.
Whenever necessary, the initial report of a suspected SUE should be followed-up to obtain sufficient information for a complete and appropriate causality assessment; reasonable additional efforts should be made to obtain voluntary informed consent from a consumer to contact the treating healthcare professional or to have the consumer provide additional medically relevant information.
Complementary information obtained should be registered in the report file with the date of their receipt. If the collected information has significant impact on the outcome or the assessment of the case, it should be sent to the NCA within the 20 calendar days following their reception. This should be done in the form of a follow up report, simply adding the complementary information to the SUE report form initially used. The company reference number should be clearly indicated to avoid the generation of a duplicate by the concerned NCA.
The causality assessment is performed once there is sufficient information and no chance to receive further information on the case. The causality assessment of each SUE should be performed by a suitably trained person within the company, or delegated, if necessary, to an appropriately trained third party (see Section 5.3). The result of causality assessment should be transmitted to the NCA and the case then be considered as closed.

Serious Undesirable Effect Received from National Competent Authorities
According to Article 23 (2) of the Regulation, when an NCA is made aware of an SUE on its territory and whatever the source of information (distributors, end users or health professionals), they should transmit the case with all available details to the Responsible Person. Before doing so, the NCA should obtain the required minimum level of information to identify the exact name/category/notification number of the product and validate the case report against the seriousness criteria defined in Section 2.
Several possibilities exist for NCAs to contact the Responsible Person: direct contact in the country where the RP is established, contact details on previous SUE Notification forms, existing national contacts with local authorities, and Cosmetics Europe Website for Public Information.
Causality assessment of the cases reported directly to NCA should be made preferably by the authorities. If this is not possible, they should inform the Responsible Person and exchange all available information to allow a causality assessment to be made by the Responsible Person without delay.
If there is no consensus on the final causality assessment of the SUE between the NCA and the Responsible Person, both causality assessments can be integrated in the case file and included in the follow up documents or exchanges regarding the case.
SUEs initially transmitted by NCA will be included in the records of the Responsible Person. Such cases should have a double identification: the company reference number and the NCA reference number.

Data Privacy Protection and Confidentiality Issue
Consumers should not be identified by name or address when reporting SUE to the NCA. Instead, the company or the initial reporter, such as a healthcare professional should assign a code (e.g., consumer's initials) to each case report.
In particular, the company and its representatives should be familiar with and discharge obligations to the collection, use and disclosure of personal information in accordance with the national regulations transposing the EU Personal Data Protection Directive (Directive 95/46/EC) [8]. In case of request for personal information, the transmission of personal data shall follow the provisions of the EU Data Protection Directive and local laws.
In situations where a consumer explicitly withholds consent to the recording of his/her personal data, the person who is in charge of complaint handling should indicate in the case file that it is a consumer report and that the name and contact details have been withheld at the request of the consumer.
All communications about SUE between Responsible Person and NCA, or between different NCA, should guarantee the confidentiality of the information. The reception and the storage of the SUE report forms received from companies or health professionals should not be accessible to non-authorized persons.

Archiving
The company should define clear procedures for archiving records and for the destruction of old documents.
It is the responsibility of each company, based on legal requirements of each EU Member State, to specify their retention policy for the case files.
All information relevant for inclusion into the Product Information File has to be kept for 10 years following the date on which the last batch of the cosmetic product was placed on the market.

Monitoring of Undesirable Effects
It is the responsibility of each Responsible Person to define their policy for the market monitoring of their products and the types of summary documents they provided for their management review.
It may be useful to have reporting rates available in the company summaries/information, at the level of product classes, product categories or at individual product level. This can facilitate data analysis actions and the identification of trends or signals. Similarly, separate analysis and evaluation of Undesirable Effects medically confirmed from with non-medically confirmed cases should be considered (see definition Section 2).
Such reports/information will allow companies to manage in-house UE/SUE reports for their products in a transparent and easily accessible manner, demonstrating that a high professional standard was followed.
A part of these summaries and statistical information will have to be included in the Cosmetic Product Safety Report and used for the information to the public (see Sections 7 and 8). Two main indicators are generally used for market monitoring:

•
Reports number: the number of new cases reported during a given period of time; • Estimation of the reporting rate: the total number of reported cases observed during a given period, over the total number of cosmetic units sold (or the total number of users estimated from cosmetic units distributed) during the same period of time.

Signal Analysis
A safety signal is any new information with the potential to modify the safety assessment of a product or trigger further investigation. A signal usually arises from an unexpected modification of a pre-existing level of reporting in terms of the number of reports or the nature of reported reaction.
Usually, the validation of an identified signal and its impact require further investigations using other sources of information, the identification of possible risk factors and the characteristics of the population exposed.
Caution should be exercised in evaluating spontaneous reports, especially when comparison is made between different countries where the cosmetovigilance systems are recently implemented. The data accompanying spontaneous reports are often incomplete, and the rate at which cases are reported is dependent on many factors including the time since market launches, media attention or environmental/public health concerns. In order to minimize bias, breaking out analysis and evaluation of medically confirmed SUEs with non-medically confirmed cases should be considered.
Identification by a Competent Authority of a signal or a trend based on the report of SUEs could lead to a specific enquiry in the country concerned; the Responsible Person should be informed of the enquiry so that they can provide the investigating Competent Authority with the information needed to evaluate the trend or signal. The analysis of the signal should follow state-of-the-art risk assessment principles, e.g., those described by the International Risk Governance Council [9]. If the Competent Authority decides to investigate further at the European level, the Responsible Person and the European Commission should be informed.
Except in cases where immediate action is necessary on the grounds of a serious risk to human health, the Responsible Person should be given the opportunity to put forward his viewpoint before any decision is taken.

Corrective Actions
When necessary, corrective actions should be undertaken by the Responsible Person or distributor following the assessment of the SUEs or the validation of a trend or signal. The appropriate corrective actions may, for example include a change in usage instructions, labeling, warnings, formula modification or any other action necessary to protect the health of the consumer. Measures taken should be proportionate to the nature and frequency of the Undesirable Effects and be subject to a rigorous risk assessment.

Cosmetic Product Safety Report
Annex I of the Regulation, which describes the Cosmetic Product Safety Report, requires the inclusion of: "All available data on the undesirable effects and serious undesirable effects to the cosmetic product or, where relevant, other cosmetic products. This includes statistical data." This requirement affects all UEs and SUEs reported to the Responsible Person, except if the causality assessment qualifies the link between the product and the SUE/UE as 'excluded'. If there is a disagreement between the Responsible Person and the Competent Authority on the outcome of a causality assessment, this should be mentioned.
Different levels of detail are expected for the inclusion of SUEs and UEs, and it is therefore recommended to separate them in the Cosmetic Product Safety Report.

•
Data on UEs may be in the form of statistical data such as number and type of undesirable effects per year. It may be useful to make a distinction in the presentation between UEs that are medically confirmed and those based solely on consumer reports. • Data on SUEs, which have been notified to the National Competent Authority, should be included via a copy (physical or electronic) of the notification form(s) sent to the National Competent Authority.
Companies should have clear internal procedures for inclusion of this information, updating it and making available to the safety assessor, who may revise his assessment and/or take the information into account when assessing similar products.
The Responsible Person's follow up to the reported Serious Undesirable Effect should be stated. Corrective as well as preventive measures taken should be described.
For further information, refer to the comprehensive guidelines issued by the European Commission on Cosmetic Product Safety Report and on the reporting of SUEs [4,6].

Information to the Public
Under Article 21 of the Regulation, it is foreseen: "Without prejudice to the protection, in particular, of commercial secrecy and of intellectual property rights, the responsible person shall ensure that the qualitative and quantitative composition of the cosmetic product and, in the case of perfume and aromatic compositions, the name and code number of the composition and the identity of the supplier, as well as existing data on undesirable effects and serious undesirable effects resulting from use of the cosmetic product are made easily accessible to the public by any appropriate means . . . "

When Is This Information to Be Made Available to the Public and by Whom?
All the information concerned is already accessible to the Competent Authorities of the Member States under the specific requirements of Article 11 (Product Information File) of the Regulation.
The key difference is that some of the information must also be made easily accessible to the public on their request. The obligation to make the information mentioned in Article 21 easily accessible to the public is clearly with the Responsible Person. Member States authorities have to ensure that these obligations are fulfilled. All Undesirable Effects that are assessed as "very likely" or "likely" linked to the use of the product should be considered when the Responsible Person gives information to the public. The companies have the possibility to inform the public if Undesirable Effects have been medically confirmed or not.

What Information
Appropriate information on the frequency and nature of Undesirable Effects linked to the product placed on the market of the Member States must be provided. Companies have the possibility when informing the public to additionally compute a value for the number of undesirable effects per 1,000,000 units placed on the market.

How Should the Information Be Made Accessible to the Public?
The information outlined above has to be made accessible to the public upon request, but it does not have to be published. For companies that do not have consumer help-line numbers or websites, the public will always have the option of writing to the address indicated on the package. In accordance with Article 19 (1) (g) of the Regulation, the label of every cosmetic product placed on the EU market must bear the name or style and the address or registered office of the Responsible Person marketing the cosmetic product who is established within the Community [1].
Moreover, in order to facilitate public access to the relevant product information, industry has made known to the Commission that it has created a central public directory of companies placing cosmetic products on the EU market [11]. The directory is available on the internet and contains company names and contact details (address, telephone, fax, e-mail, website). The directory is a central listing of contact points, designed to enable the public to locate the companies, and is not the source of the information itself. Companies themselves will reply directly to the public.
In order to make the information easily accessible to the public, the party responsible for answering a request for information, according to Article 21, should ensure that an answer is given promptly without unnecessary delay, taking into account the nature and the volume of the information. If a member of the public does not receive an answer from the company or if the answer is not complete, they may complain to competent authorities who may then contact the competent authorities of the Member State concerned. The answer should be in a language easily understood by the public, and companies should keep a record of all requests and answers given.

Management System for Handling of UE/SUEs
To ensure a well controlled management of Undesirable Effects and to rapidly provide information when necessary, it is recommended to set up an appropriate system which ensures reception of all incoming information about UE/SUE, their fast and targeted transmission to the responsible function within the company, and a good traceability of the SUEs, including those sent by the Competent Authorities. Especially for multi-sited and/or multinational companies, clear interfaces and workflows should be described.

Determination of Tasks and Responsibilities
The tasks and responsibilities from all company functions involved in the handling of UE/SUE (e.g., administrators, causality assessors, personal authorized for communication with NCA) should be clearly described. Written Standard Operating Procedures (SOPs) or workflow-diagrams are recommended to ensure transparency among the functions involved.

Outsourcing
When activities are outsourced partly or in total, the company should have written agreements with the third party, in which obligations, responsibilities and interfaces are fixed.
Due to the importance of the management of SUEs, any outsourcing activity should be carefully selected, taking into account the know-how, resources and credibility of the third party.

Legal Compliance with EU Data Protection Rules
All company personnel involved in the processing of UE/SUEs should be familiar with the applicable regulations on data protection (e.g., the national transpositions of the EU Personal Data Protection Directive 95/46 CE) [8].
Acknowledgments: These Guidelines were developed between 2013 and 2016 in the frame of the Cosmetics Europe Task Force on Cosmetovigilance and adopted by the Cosmetics Europe Board of Directors in March 2016. Contribution of past members of the Task Force to this final version is acknowledged.
Author Contributions: All authors are or were active members of the Cosmetics Europe Task Force on Cosmetovigilance and provided their personal and professional experience into on the drafting and editing of these Guidelines.

Conflicts of Interest:
The authors declare no conflict of interest.

Appendix A. Information on European Commission Guidelines on Management of UEs and SUEs
The European Commission Directorate General for Internal Market, Industry, Entrepreneurship and SMEs (DG GROW) has issued a number of documents as implementing guidance for the SUE notification requirements under Article 23 of the Regulation as well as the inclusion of UE/SUE into the Cosmetic Product Safety Report.
Documents related to SUE Reporting, as well as their translation, are available here [12]. The European Commission Guidelines on Annex I of the Cosmetics Regulation, which include implementing guidance on the inclusion of SUEs and UEs into the Product Safety Report are available online [6].

Appendix B. Example of Questionnaire for Collection of Information on an Undesirable Event
Date of contact Consumer: • Name or initials • Contact details • Sex Figure C1. Reporting process for serious undesirable effects (SUE).