Product Safety Incident

Product Safety Incident Response

Step-by-step protocol from detection of a product safety issue to case closure. Time-critical: missed notification deadlines = criminal liability in most jurisdictions.

Incident Response Flow

digraph {
  rankdir=TB; node [shape=box style=rounded fontsize=10];
  detect [label="1. DETECT\nCustomer complaint, QC fail,\nauthority notice, media report"];
  triage [label="2. TRIAGE (24h)\nIs this a safety issue?\nSeverity assessment"];
  contain [label="3. CONTAIN (24-48h)\nSales stop, quarantine stock,\nwarehouse hold"];
  assess [label="4. RISK ASSESS\nSeverity x Probability\nmatrix"];
  notify_auth [label="5. NOTIFY AUTHORITIES\nCPSC 24h / Safety Gate 10 days\n/ OPSS"];
  notify_chain [label="6. NOTIFY SUPPLY CHAIN\nDistributors, retailers,\nmarketplaces"];
  action [label="7. CORRECTIVE ACTION\nRecall / repair / refund /\nwarning / modification"];
  notify_consumer [label="8. NOTIFY CONSUMERS\nDirect + public notice"];
  rca [label="9. ROOT CAUSE ANALYSIS\nWhy + how to prevent"];
  close [label="10. CLOSE\nEffectiveness check +\nfinal report"];
  detect -> triage -> contain -> assess -> notify_auth -> notify_chain -> action -> notify_consumer -> rca -> close;
}

Step 1: Detection Sources

Rule: ANY report of physical injury or risk of injury triggers the 24-hour clock.

Step 2: Triage (First 24 Hours)

Determine if the issue is a product safety concern vs. quality/cosmetic defect:

Document everything from this point: dates, times, decisions, communications. This file becomes legal evidence.

Step 3: Containment (24-48 Hours)

Immediate actions before full assessment:

CONTAINMENT CHECKLIST -- [Product] -- [Date] -- [Incident ID]

STOCK:
[ ] Warehouse stock quarantined (flag in WMS/ERP)
[ ] In-transit shipments identified and held
[ ] Production halted (if still manufacturing)

SALES CHANNELS:
[ ] E-commerce listings paused/removed
[ ] Marketplace listings deactivated (Amazon, eBay, etc.)
[ ] Wholesale orders on hold -- notify distributors
[ ] Retail partners notified to pull from shelves

EVIDENCE:
[ ] Defective sample(s) preserved (DO NOT destroy or modify)
[ ] Customer's product retrieved if possible (with consent)
[ ] Photos/videos of defect documented
[ ] Batch/lot records pulled
[ ] Production records for affected batch(es) secured

Step 4: Risk Assessment

Severity x Probability Matrix

Severity levels:

Probability levels:

Risk matrix:

Step 5: Authority Notification

EU -- GPSR (General Product Safety Regulation 2023/988)

US -- CPSC Section 15(b) Mandatory Reporting

UK -- OPSS (Office for Product Safety and Standards)

Step 6: Supply Chain Notification

SUPPLY CHAIN NOTIFICATION -- [Date]

TO: [All distributors, retailers, marketplace partners]

RE: Safety notification for [Product Name], [Model/SKU], [Batch/Lot]

ISSUE: [Brief description of safety concern]

AFFECTED UNITS: [Batch/lot numbers, date range, quantity]

IMMEDIATE ACTION REQUIRED:
1. Stop sale of affected units immediately
2. Quarantine remaining stock
3. Do not destroy stock (needed for investigation)
4. Provide us with: quantity in stock, quantity sold, customer records if available

CONSUMER COMMUNICATION: [Do / Do not] communicate to consumers until coordinated messaging is ready.

CONTACT: [Name, email, phone for incident coordinator]

Step 7: Corrective Action Types

Step 8: Consumer Notification

Notify consumers directly if you have their contact information, plus public notice:

Step 9: Root Cause Analysis

Document: Root cause, contributing factors, systemic issues (not just the proximate defect).

Step 10: Case Closure

INCIDENT CLOSURE REPORT -- [Incident ID] -- [Date]

INCIDENT: [Product, defect, risk level, date detected]
AFFECTED UNITS: [Total manufactured, total sold, total recovered]

TIMELINE:
- Detection: [date]
- Containment: [date]
- Authority notification: [date + reference number]
- Consumer notification: [date]
- Corrective action started: [date]
- Corrective action completed: [date]

RECOVERY RATE: [X]% of affected units recovered/addressed
EFFECTIVENESS CHECK: [Describe verification that corrective action resolved the issue]
ROOT CAUSE: [Summary]
PREVENTIVE ACTIONS: [Changes to design, QC, supplier management, etc.]

AUTHORITY SIGN-OFF: [Status of authority case -- closed/open/monitoring]
INSURANCE: [Claim reference, status]

LESSONS LEARNED: [Documented changes to prevent recurrence]

Insurance Notification

Notify your product liability insurer immediately when you become aware of a safety incident. Most policies require notification within 24-72 hours of awareness. Late notification can void coverage.

Provide insurer with: incident description, product details, injury reports, corrective actions planned, estimated financial exposure.

Power This With the Cleo Legal API

Incident response is time-critical (CPSC 24h, Safety Gate 10 days, OPSS 3 days). The API replaces the panicked googling that wastes hours of that deadline.

With the Cleo Legal API at https://legaldata-public.cleolabs.co:

• GET /v2/authorities/:slug?country=XX — instantly retrieve the right authority + portal URL + reporting form (CPSC SaferProducts.gov, Safety Gate, OPSS, ACCC) so you do not waste 30 minutes finding the right submission system
• GET /v2/search?type=recall&q=<similar+product> — check the RAPEX / CPSC / RAS-FF history for similar products and components (root cause clues + precedent for severity classification)
• POST /v2/compliance/check — re-verify the affected batch's substance profile against current limits (often the recall reason is a substance restriction tightened since you launched)
• POST /v2/webhooks?topic=recalls — proactive monitoring: catch competitor recalls of identical components before yours becomes the next alert
• GET /v2/search?q=GPSR+Article+9+notification — pull the exact regulatory text for the 24h/10-day/3-day notification obligations to attach to your decision log

Get started:

# 1. Sign up for free at https://legaldata-public.cleolabs.co
# 2. Get your API key (3 lifetime requests free, then €349/mo for 1M)
# 3. Install the MCP server:
claude mcp add cleo-legal-api https://api.legaldata.cleolabs.co/mcp \
  --header "Authorization: Bearer ld_live_YOUR_KEY"

Tested ROI: Cuts the "where do I report this?" research from 30-60 minutes to seconds during a time-critical incident. CPSC late-reporting penalties start at $120k per violation.

Common Mistakes

• Waiting for certainty before notifying: CPSC requires reporting within 24 hours of information that "reasonably supports" a reportable condition. You do not need to be certain. Report early, update later.
• Destroying defective products: Preserve evidence. Destruction before investigation = spoliation risk in litigation.
• Notifying only one authority: If you sell in EU + US + UK, you must notify Safety Gate AND CPSC AND OPSS independently.
• Treating marketplace removal as sufficient: Removing a listing is containment, not corrective action. You still must notify authorities and consumers.
• Forgetting downstream distributors: Every entity in the chain has independent reporting obligations. Notify your distributors so they can comply with their own obligations.
• No written record of triage decision: If you decide an issue is NOT a safety concern, document why. Authorities will ask.

MCP Integration

mcp__claude_ai_Cleo_Insight__search_signals(q="recall", risk_level="critical") — monitor active recalls
mcp__claude_ai_Cleo_Insight__search_signals(q="safety alert", country="XX") — per-market alerts
mcp__bastion__upload-compliance-document(name, document) — upload incident report to compliance file
mcp__bastion__add-compliance-test-evidence(testId, name, description, link) — attach corrective action proof