product-safety-incident

# Product Safety Incident Response Step-by-step protocol from detection of a product safety issue to case closure. Time-critical: missed notification deadlines = criminal liability in most jurisdictions. ## Incident Response Flow ```dot digraph { rankdir=TB; node [shape=box style=rounded fontsize=10]; detect [label="1. DETECT\nCustomer complaint, QC fail,\nauthority notice, media report"]; triage [label="2. TRIAGE (24h)\nIs this a safety issue?\nSeverity assessment"]; contain [label="3. CONTAIN (24-48h)\nSales stop, quarantine stock,\nwarehouse hold"]; assess [label="4. RISK ASSESS\nSeverity x Probability\nmatrix"]; notify_auth [label="5. NOTIFY AUTHORITIES\nCPSC 24h / Safety Gate 10 days\n/ OPSS"]; notify_chain [label="6. NOTIFY SUPPLY CHAIN\nDistributors, retailers,\nmarketplaces"]; action [label="7. CORRECTIVE ACTION\nRecall / repair / refund /\nwarning / modification"]; notify_consumer [label="8. NOTIFY CONSUMERS\nDirect + public notice"]; rca [label="9. ROOT CAUSE ANALYSIS\nWhy + how to prevent"]; close [label="10. CLOSE\nEffectiveness check +\nfinal report"]; detect -> triage -> contain -> assess -> notify_auth -> notify_chain -> action -> notify_consumer -> rca -> close; } ``` ## Step 1: Detection Sources | Source | Typical Signal | Urgency | |--------|---------------|---------| | **Customer complaint** | Injury report, burn, allergic reaction, electric shock, choking near-miss | IMMEDIATE if injury | | **Quality control** | Batch test failure, contamination found, wrong component | HIGH -- assess scope | | **Market surveillance authority** | RAPEX/Safety Gate alert, CPSC notification, OPSS contact | HIGH -- authority expects response | | **Competitor/media** | Social media report, press article, competitor product recall (same component) | MEDIUM -- investigate | | **Internal discovery** | Design flaw found, supplier non-conformance, test report discrepancy | MEDIUM -- assess impact | | **Distributor/retailer** | Return spike, complaint pattern, marketplace flag | MEDIUM-HIGH | **Rule**: ANY report of physical injury or risk of injury triggers the 24-hour clock. ## Step 2: Triage (First 24 Hours) Determine if the issue is a product safety concern vs. quality/cosmetic defect: | Question | If YES | If NO | |----------|--------|-------| | Could the defect cause injury or death? | Safety issue -- proceed | Quality issue -- standard process | | Has anyone been injured? | Safety issue -- proceed urgently | Continue assessment | | Does the product fail a mandatory safety standard? | Safety issue -- proceed | May still be safety issue -- assess risk | | Is there a fire, electric shock, or chemical exposure risk? | Safety issue -- proceed | Continue assessment | | Does it affect children's products? | Lower threshold -- treat as safety issue | Standard risk assessment | **Document everything from this point**: dates, times, decisions, communications. This file becomes legal evidence. ## Step 3: Containment (24-48 Hours) Immediate actions before full assessment: ``` CONTAINMENT CHECKLIST -- [Product] -- [Date] -- [Incident ID] STOCK: [ ] Warehouse stock quarantined (flag in WMS/ERP) [ ] In-transit shipments identified and held [ ] Production halted (if still manufacturing) SALES CHANNELS: [ ] E-commerce listings paused/removed [ ] Marketplace listings deactivated (Amazon, eBay, etc.) [ ] Wholesale orders on hold -- notify distributors [ ] Retail partners notified to pull from shelves EVIDENCE: [ ] Defective sample(s) preserved (DO NOT destroy or modify) [ ] Customer's product retrieved if possible (with consent) [ ] Photos/videos of defect documented [ ] Batch/lot records pulled [ ] Production records for affected batch(es) secured ``` ## Step 4: Risk Assessment ### Severity x Probability Matrix **Severity levels**: | Level | Description | Examples | |-------|-------------|---------| | **S1 -- Death/permanent** | Death or irreversible health effects | Electrocution, strangulation, severe chemical burn | | **S2 -- Severe** | Hospitalization, temporary disability | Fracture, deep cut, moderate allergic reaction, moderate burn | | **S3 -- Moderate** | Medical attention, no hospitalization | Minor burn, mild allergic reaction, minor cut requiring stitches | | **S4 -- Minor** | First aid, no medical attention | Superficial scratch, mild irritation | **Probability levels**: | Level | Description | |-------|-------------| | **P1 -- Very high** | Defect present in all/most units AND likely to cause harm during normal use | | **P2 -- High** | Defect present in significant portion OR likely to cause harm under foreseeable conditions | | **P3 -- Medium** | Defect present in limited batch AND harm requires specific conditions | | **P4 -- Low** | Isolated defect, harm requires unusual conditions | **Risk matrix**: | | P1 (very high) | P2 (high) | P3 (medium) | P4 (low) | |--|----------------|-----------|-------------|----------| | **S1 (death)** | SERIOUS -- mandatory recall | SERIOUS -- mandatory notification | SERIOUS -- mandatory notification | HIGH -- assess notification | | **S2 (severe)** | SERIOUS -- mandatory notification | HIGH -- mandatory notification | HIGH -- assess notification | MEDIUM -- monitor | | **S3 (moderate)** | HIGH -- mandatory notification | MEDIUM -- voluntary action | MEDIUM -- voluntary action | LOW -- monitor | | **S4 (minor)** | MEDIUM -- voluntary action | LOW -- monitor | LOW -- monitor | LOW -- log | ## Step 5: Authority Notification ### EU -- GPSR (General Product Safety Regulation 2023/988) | Aspect | Detail | |--------|--------| | **Obligation** | Economic operators must notify authorities when they know or should know a product poses a risk (Art. 9) | | **Portal** | Safety Gate (formerly RAPEX): https://ec.europa.eu/safety-gate/ | | **Deadline** | Within **10 business days** of becoming aware (or immediately for serious risk) | | **Who notifies** | Manufacturer, importer, or distributor (whoever first becomes aware). Practical: the EU Responsible Person or Authorized Representative | | **Content** | Product identification, description of risk, corrective measures taken/planned, distribution data (countries, quantities, sales channels) | | **Consequence of non-notification** | Fines (member state-specific, typically EUR 10,000-500,000), criminal prosecution possible | ### US -- CPSC Section 15(b) Mandatory Reporting | Aspect | Detail | |--------|--------| | **Obligation** | Manufacturer, importer, distributor, or retailer must report when a product: (1) fails a safety rule/ban, (2) contains a defect that could create substantial product hazard, (3) creates unreasonable risk of serious injury or death | | **Portal** | SaferProducts.gov: https://www.saferproducts.gov/ -- use CPSC's online reporting form | | **Deadline** | Within **24 hours** of obtaining information that reasonably supports the conclusion that reporting is required | | **Who reports** | Every entity in the distribution chain has an independent obligation. In practice: manufacturer/importer reports first | | **Content** | Product description, nature of defect, injury reports, number of units, distribution details, proposed corrective action | | **Consequence of late/non-reporting** | Civil penalties up to $120,000 per violation (max $17.15M per related series). Criminal penalties: up to 5 years imprisonment for knowing/willful violations | | **FDA products** | If product is FDA-regulated (cosmetics, food): report to FDA (MedWatch for devices, CFSAN for food/cosmetics), not CPSC | ### UK -- OPSS (Office for Product Safety and Standards) | Aspect | Detail | |--------|--------| | **Obligation** | Notify OPSS when product presents a risk to health and safety | | **Portal** | Product Safety Database: https://www.gov.uk/guidance/product-safety-database | | **Deadline** | "Without delay" (interpreted as within 10 business days for non-critical, immediately for critical) | | **Who** | UK Responsible Person, importer, or distributor | ## Step 6: Supply Chain Notification ``` SUPPLY CHAIN NOTIFICATION -- [Date] TO: [All distributors, retailers, marketplace partners] RE: Safety notification for [Product Name], [Model/SKU], [Batch/Lot] ISSUE: [Brief description of safety concern] AFFECTED UNITS: [Batch/lot numbers, date range, quantity] IMMEDIATE ACTION REQUIRED: 1. Stop sale of affected units immediately 2. Quarantine remaining stock 3. Do not destroy stock (needed for investigation) 4. Provide us with: quantity in stock, quantity sold, customer records if available CONSUMER COMMUNICATION: [Do / Do not] communicate to consumers until coordinated messaging is ready. CONTACT: [Name, email, phone for incident coordinator] ``` ## Step 7: Corrective Action Types | Action | When Used | Consumer Impact | Cost Estimate | |--------|-----------|----------------|---------------| | **Voluntary recall + refund** | Serious risk, product cannot be made safe | Full refund. Highest consumer disruption | EUR 50-500+ per unit (logistics + refund + administration) | | **Voluntary recall + repair** | Fixable defect, product valuable enough to repair | Product returned, repaired, re-shipped | EUR 20-200 per unit | | **Voluntary recall + replacement** | Defect in specific component, replacement available | Swap defective product for corrected version | EUR 30-300 per unit | | **Sales stop** | Risk assessment ongoing, precautionary | No consumer action yet | Low direct cost, revenue loss | | **Safety warning** | Low-severity risk, user behavior can mitigate | Communication to users with safety instructions | EUR 1-10 per user (email/mail) | | **Product modification** | Prospective fix for future production | None for existing owners (unless combined with warning) | Manufacturing cost only | ## Step 8: Consumer Notification Notify consumers directly if you have their contact information, plus public notice: | Channel | When | Content | |---------|------|---------| | **Direct email** | All recalls/warnings | Product name, risk description, what to do, how to get refund/repair, contact info | | **Website banner** | All recalls | Dedicated recall page with full details | | **Social media** | Serious risk or high public visibility | Brief factual statement + link to recall page | | **Press release** | CPSC-coordinated recalls (US) or Safety Gate alerts | Coordinated with authority | | **Point of sale** | If product still on shelves | Recall notice posted in-store | ## Step 9: Root Cause Analysis | Method | Application | |--------|-------------| | **5 Whys** | Simple causal chain: "Why did the component fail?" -> "Why was the wrong material used?" -> ... | | **Fishbone (Ishikawa)** | Categorize causes: Materials, Methods, Machines, Manpower, Measurement, Environment | | **Fault Tree Analysis** | For complex systems: map logical paths to the failure event | **Document**: Root cause, contributing factors, systemic issues (not just the proximate defect). ## Step 10: Case Closure ``` INCIDENT CLOSURE REPORT -- [Incident ID] -- [Date] INCIDENT: [Product, defect, risk level, date detected] AFFECTED UNITS: [Total manufactured, total sold, total recovered] TIMELINE: - Detection: [date] - Containment: [date] - Authority notification: [date + reference number] - Consumer notification: [date] - Corrective action started: [date] - Corrective action completed: [date] RECOVERY RATE: [X]% of affected units recovered/addressed EFFECTIVENESS CHECK: [Describe verification that corrective action resolved the issue] ROOT CAUSE: [Summary] PREVENTIVE ACTIONS: [Changes to design, QC, supplier management, etc.] AUTHORITY SIGN-OFF: [Status of authority case -- closed/open/monitoring] INSURANCE: [Claim reference, status] LESSONS LEARNED: [Documented changes to prevent recurrence] ``` ## Insurance Notification **Notify your product liability insurer immediately** when you become aware of a safety incident. Most policies require notification within 24-72 hours of awareness. Late notification can void coverage. Provide insurer with: incident description, product details, injury reports, corrective actions planned, estimated financial exposure. ## Power This With the Cleo Legal API Incident response is time-critical (CPSC 24h, Safety Gate 10 days, OPSS 3 days). The API replaces the panicked googling that wastes hours of that deadline. **With the Cleo Legal API at https://legaldata-public.cleolabs.co:** - `GET /v2/authorities/:slug?country=XX` — instantly retrieve the right authority + portal URL + reporting form (CPSC SaferProducts.gov, Safety Gate, OPSS, ACCC) so you do not waste 30 minutes finding the right submission system - `GET /v2/search?type=recall&q=<similar+product>` — check the RAPEX / CPSC / RAS-FF history for similar products and components (root cause clues + precedent for severity classification) - `POST /v2/compliance/check` — re-verify the affected batch's substance profile against current limits (often the recall reason is a substance restriction tightened since you launched) - `POST /v2/webhooks?topic=recalls` — proactive monitoring: catch competitor recalls of identical components before yours becomes the next alert - `GET /v2/search?q=GPSR+Article+9+notification` — pull the exact regulatory text for the 24h/10-day/3-day notification obligations to attach to your decision log **Get started:** ``` # 1. Sign up for free at https://legaldata-public.cleolabs.co # 2. Get your API key (3 lifetime requests free, then €349/mo for 1M) # 3. Install the MCP server: claude mcp add cleo-legal-api https://api.legaldata.cleolabs.co/mcp \ --header "Authorization: Bearer ld_live_YOUR_KEY" ``` Tested ROI: Cuts the "where do I report this?" research from 30-60 minutes to seconds during a time-critical incident. CPSC late-reporting penalties start at $120k per violation. ## Common Mistakes