Adverse Event Reporting: What Supplement Brands Are Required to Do

What the Law Requires

The Dietary Supplement and Nonprescription Drug Consumer Protection Act (DSNDCPA) was enacted in December 2006. It established mandatory adverse event reporting for dietary supplements. The law applies to the "responsible person," defined as the company whose name appears on the product label.

If you are the brand owner and your company name is on the label, you are the responsible person. This is true even if a contract manufacturer produces the product and a third-party fulfillment company ships it. The reporting obligation follows the label, not the manufacturing process.

Your product label must include a domestic address or domestic phone number through which consumers can report adverse events. This contact information is a legal requirement under the act. Email or website may supplement these methods but cannot replace them on the label.

Serious vs Non-Serious Adverse Events

The law distinguishes between serious and non-serious adverse events. Only serious events trigger the 15-business-day mandatory reporting requirement. Both types must be documented and retained.

When in doubt about whether an event is serious, treat it as serious and consult your regulatory attorney.

The 15-Business-Day Reporting Rule

When you receive a report of a serious adverse event, you have 15 business days to submit a report to the FDA. The statutory deadline is written around reports that arrive through the address or phone number on your label; FDA asks you to apply the same 15-business-day window to serious reports that arrive by email, social media, a contact form, or a marketplace review. FDA's guidance starts the clock (Day 0) on the date you know all five minimum data elements listed below, not the day the event occurred. If an element is missing from the first report, FDA asks you to seek it, and the 15 business days run from the date you receive the information that completes the report.

How to File: MedWatch and the FDA Safety Reporting Portal

Serious adverse event reports are submitted on the MedWatch form: either through the FDA Safety Reporting Portal (the electronic channel) or on paper Form FDA 3500A, which is mailed to FDA (FDA does not accept it by fax). Electronic submission is voluntary. The portal is the electronic version of the mandatory-reporting form, not a replacement for it.

After filing the initial report, you must submit any new medical information received within one year of the initial report. These follow-up reports are also required within 15 business days of receiving the new information.

Your regulatory counsel should review your first several reports before submission to ensure they meet FDA requirements. Building this process correctly from the start prevents compliance problems later.

Six-Year Record Retention

You must maintain records of all adverse event reports for six years. This includes both serious and non-serious reports. During an FDA inspection, you must give FDA access to these records.

Keep records organized by product and date. FDA's guidance lists what to keep: your report to FDA with its attachments, any new medical information and your reports of it, your communications with the person who reported the event and anyone else who supplied information, and, for a non-serious event, your record of assessing it as non-serious. Electronic records are allowed, but they must meet FDA's electronic-records rule, 21 CFR Part 11.

Building an Adverse Event Response Process

Don't wait for your first report to build your process. Set up the following before you sell your first unit:

• Designate a responsible person. Someone in your organization must own AE reporting. For small brands, this is typically the founder. That person needs to understand the process and the deadlines.
• Create an intake form. When a customer reports a health problem, you need to capture specific information: product name, lot number, date of use, description of the event, medical treatment received, and consumer contact information.
• Establish assessment criteria. Define how you will determine if an event is serious or non-serious. Document the criteria. Work with regulatory counsel to create a decision tree.
• Train customer-facing staff. Anyone who interacts with customers (support, social media, returns processing) must know how to recognize and escalate an adverse event report.
• Set up record-keeping. Create a system for logging, tracking, and storing AE reports. This can be as simple as a secure spreadsheet for small brands or a dedicated quality management system for larger operations.
• Retain regulatory counsel. Have a regulatory attorney identified before your first report. When a serious event occurs, you need legal guidance immediately, not a two-week search for counsel.

Discontinued Products Still Require Reporting

If you discontinue a product, your reporting obligation continues. Consumers may still have the product in their homes. Retailers may still have it on shelves. If a serious adverse event involves a discontinued product, you must still submit the report to FDA; you may note on the form that the product has been discontinued.

This is one reason product liability insurance is essential even after you stop selling a product. Claims can arise years after the last sale.

For more on regulatory enforcement, see our compliance risks guide and 21 CFR Part 111 overview.