Who is the 'responsible person' if I use a contract manufacturer?

It's whoever's name appears on the label under section 403(e)(1) of the FD&C Act, usually the brand rather than the contract manufacturer, unless the manufacturer's own name is the one on the label. The obligation follows the label, not who physically made the product.

When does the 15-business-day clock start?

On the day the responsible person has all five minimum data elements: an identifiable patient, an identifiable initial reporter, the responsible person's own identity and contact information, the suspect supplement, and a description of the serious event. That date is 'Day 0' on the MedWatch form.

Are retailers required to report adverse events to FDA?

Usually not. Only if the retailer's own name is on the label, and even then not if it has an agreement forwarding reports to the manufacturer or packer whose name also appears, so long as the retailer honors that agreement.

How long do I have to keep records of adverse events I receive?

Six years, for every report of a serious adverse event and its related records, and also for non-serious adverse event reports, even though those don't have to be submitted to FDA at all.

Guide

Serious adverse event reporting: what a supplement brand is required to do

By Jake, founder · Published 2026-08-17 · Updated 2026-08-17

Under the Dietary Supplement and Nonprescription Drug Consumer Protection Act, the manufacturer, packer, or distributor named on a supplement's label, the 'responsible person', must submit a serious adverse event report to FDA on a MedWatch form within 15 business days of receiving it, and retain records for 6 years whether or not the event had to be reported.

The law behind the obligation

The Dietary Supplement and Nonprescription Drug Consumer Protection Act, signed into law on December 22, 2006, amended the FD&C Act to create a mandatory reporting duty for dietary supplements, effective December 22, 2007. FDA's guidance is explicit about scope: “The requirements of this law only apply to dietary supplements. No other types of food are covered.” The Act uses the term “responsible person” for the party who must report. FDA's guidance treats it as shorthand for “manufacturer, packer, or distributor.”

What counts as a serious adverse event

The statute defines an “adverse event” broadly, as “any health-related event associated with the use of a dietary supplement that is adverse” (section 761(a)(1)). A “serious adverse event” is narrower. It is one that:

Results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, or a congenital anomaly or birth defect; or
Requires, based on reasonable medical judgment, a medical or surgical intervention to prevent one of those outcomes.

FDA's guidance adds a specific clarification worth knowing: “FDA considers inpatient hospitalization to include initial admission to the hospital on an inpatient basis, even if the patient is released the same day, and prolongation of an existing inpatient hospitalization.” A same-day discharge does not take an event out of scope.

The 15-business-day MedWatch obligation

Reports received “through the address or phone number on the label of a dietary supplement,” along with follow-up reports of new medical information received within one year of the initial report, “must be submitted to FDA no later than 15 business days after the report is received by the responsible person” (section 761(c)(1) and (2)). FDA's guidance recommends applying the same 15-business-day window to reports received by any other means, email, fax, or otherwise, even though the statute's explicit deadline language is tied to the label's contact information.

The clock has a specific start point: “As soon as all of the minimum data elements… are known to the responsible person, the 15-business-day time clock begins to run. That date is Day 0.” The five minimum data elements are:

Minimum data elements that trigger the reporting clock
Element	What FDA means by it
Identifiable patient	Enough detail to confirm a specific person was affected: an age category, sex, initials, or similar. 'Some consumers' isn't sufficient on its own.
Identifiable initial reporter	The person who first told the responsible person (patient, family member, doctor, or pharmacist) identified by name, professional role, or contact information.
Responsible person's identity and contact information	Who is submitting the report and how to reach them.
Suspect dietary supplement	The specific product associated with the event.
A serious adverse event or fatal outcome	The description of what happened.

FDA does not expect the impossible: “We do not intend to take enforcement action for failure to report a serious adverse event where, after diligent efforts, the responsible person is unable to obtain all of the five minimum data elements”, but the guidance also recommends documenting those efforts, since the file itself is subject to the same recordkeeping duty below.

Record retention: six years

Separately from the reporting duty, “the responsible person must maintain all records related to each report of a serious adverse event for a period of 6 years” (section 761(e)(1)), including correspondence with the reporter and any follow-up medical information, even information received more than a year after the initial report, when submission to FDA is no longer required but retention still is. The same six-year window applies to non-serious adverse event reports too: “you must keep the report along with any related records… All such records of non-serious adverse events must be kept for six years, just as with records of serious adverse events.” FDA may examine these records during an inspection under its section 704 authority.

Who the “responsible person” is when you don't manufacture

The statute ties the obligation to the label, not to who ran the production line: “The manufacturer, packer, or distributor whose name… appears on the label of a dietary supplement marketed in the United States is required to submit to FDA all serious adverse event reports associated with use of the dietary supplement” (section 761(b)(1)). For a brand that contracts out manufacturing, that almost always means the brand itself: the responsible person is whoever's name and address are on the label under 21 U.S.C. 343(e)(1), which for a private-label product is typically the brand, not the contract manufacturer.

A retailer selling under its own store brand is in the same position if its name is on the label, unless it has struck an agreement with the manufacturer or packer to forward adverse event reports it receives, in which case the retailer is relieved of the FDA submission duty so long as it honors the forwarding agreement.

Confirm which entity's name and address are printed on the label. That's the presumptive responsible person, whatever the manufacturing arrangement.
Set up a route for adverse event reports that reach your manufacturer, your customer service inbox, or a marketplace message to land with whoever is the responsible person, rather than getting stuck with the party who happened to receive it first.
Build a file per event from the day you have the five minimum data elements, and start counting business days from that date, not from when you get around to reviewing it.
Keep every adverse event record, serious and non-serious, for six years, even ones you weren't required to report to FDA.

Related: what your contract manufacturer is responsible for and 21 CFR Part 111 explained for brand owners. Compliant Always tracks document status for a SKU; it does not receive, triage, or submit adverse event reports on a brand's behalf.

Sources

FDA, Guidance for Industry: Questions and Answers Regarding Adverse Event Reporting and Recordkeeping for Dietary Supplements as Required by the Dietary Supplement and Nonprescription Drug Consumer Protection Act (September 2013, final) accessed 2026-08-17

Frequently asked questions

What counts as a 'serious adverse event'?: One that results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability, or a birth defect, or that requires medical or surgical intervention to prevent one of those outcomes, per section 761(a)(2) of the FD&C Act. FDA counts even a same-day-release hospital admission as inpatient hospitalization.
Who is the 'responsible person' if I use a contract manufacturer?: It's whoever's name appears on the label under section 403(e)(1) of the FD&C Act, usually the brand rather than the contract manufacturer, unless the manufacturer's own name is the one on the label. The obligation follows the label, not who physically made the product.
When does the 15-business-day clock start?: On the day the responsible person has all five minimum data elements: an identifiable patient, an identifiable initial reporter, the responsible person's own identity and contact information, the suspect supplement, and a description of the serious event. That date is 'Day 0' on the MedWatch form.
Are retailers required to report adverse events to FDA?: Usually not. Only if the retailer's own name is on the label, and even then not if it has an agreement forwarding reports to the manufacturer or packer whose name also appears, so long as the retailer honors that agreement.
How long do I have to keep records of adverse events I receive?: Six years, for every report of a serious adverse event and its related records, and also for non-serious adverse event reports, even though those don't have to be submitted to FDA at all.