E-commerce
June 28, 2026
Selling cosmetics, food, or dietary supplements in DTC means accepting that an enthusiastic agent or a poorly calibrated bot can turn an innocent question into an unauthorized health claim. "This serum cures acne", "this supplement replaces your treatment": a single careless formulation is enough to fuel a dispute, a Signal Conso report, or a DGCCRF complaint.
The regulated product customer support must reassure without prescribing, inform without diagnosing, and refer to a healthcare professional as soon as the question goes beyond a commercial scope. Since January 2024, the DGCCRF is the sole controller of cosmetics in France; Anses is taking over cosmetovigilance (DGCCRF, 2024 cosmetics control).
This guide #119 covers cosmetics, food, and supplements: EU/FR framework, safe formulations, AI bots, agent training, and escalations. An angle missing from generic support guides: responding quickly and humanly without overpromising on sensitive products. Distinct from complex products (#108) and general support strategy: this is the regulated vertical.
Summary
Why is support for regulated products different?
The e-commerce regulated products support combines legal caution with relational requirements. Your customers expect warmth; the law requires restraint.
Symptoms of unstructured support
Divergent responses: agent A promises results, agent B refuses
Generative bot: dosage or ingredient invented
UGC used as-is: customer quotes TikTok, agent validates
Missing escalation: skin reaction treated as standard return
Ads vs support: ad promises more than customer service can deliver
Concrete risks
Misleading claim (DGCCRF, ARPP), dispute over "I was told it would cure it", documented negative review, exclusion of professional liability insurance if unauthorized medical advice is given. Florian Simonneau (DGCCRF) points out that any cosmetic claim must be demonstrable and verifiable (LSA Conso, cosmetic claims control 2025).
Operational objective
Provide information on the product as formulated and authorized. Cite PDP, leafet, INCI. Refer to a healthcare professional. Never diagnose, cure, prescribe, or guarantee a health result.
This guide is not legal advice
Validate policies and REG-* macros with your regulatory officer or lawyer. This document = operational support method for Shopify/Gorgias.
What EU/FR regulatory framework does the support need to be familiar with?
Support staff do not need to be lawyers, but must know the regulatory framework that governs each response.
Cosmetics (Regulation EC 1223/2009)
Claims: criteria regulation 655/2013, no therapeutic claims
INCI: official PDP/label list, only source of ingredients
PIF/DIP: internal brand file, not shared with client
Cosmetovigilance: reporting adverse effects via Anses
Food Products (Regulation EU 1169/2011)
14 allergens: mandatory mention, never assume absence
Use-by date / Best-before date: documented near-expiration batch return policy
Nutri-Score: quote if displayed, do not extrapolate
Food Supplements (1924/2006 + 2002/46/EC)
Health claims: authorized EFSA list only
Mandatory warnings: daily dose, not a meal replacement
Notification: placing on the market declared to authorities
Support Role vs Regulatory
Support quotes approved marketing/regulatory text. Never create a new claim in conversation. Validated packaging claim = quotable. Unvalidated ad claim = prohibited for customer service.
Pharmanager reminds: customer service trained in the specificities of regulated products, batch traceability, recall procedures (Pharmanager, online sale of regulated products).
What can support say, and what must they absolutely avoid?
Document a CAN / CANNOT page before any REG macro. This is the filter for every response.
Support CAN
Quote the PDP: description, INCI list, official directions for use
Explain usage: according to brand instructions, not personalized
Compare the range: factual specs, not medical efficacy
Refer to a pro: doctor, dermatologist, pharmacist, dietitian
Apply return policy: skin reaction included
Support MUST NOT
Diagnose: "you probably have eczema"
Cure / treat: "this supplement cures your fatigue"
Modify a treatment: "stop taking your medication"
Personalize dosage: "take 3 capsules instead of 2"
Guarantee result: "effective in 7 days, guaranteed"
Validate pregnancy: without a regulatory-approved macro
4-Question Decision Tree
Medical or diagnostic question? → refer to a pro + immediate handoff
Ingredient / usage question? → quote PDP + REG-GEN disclaimer
Adverse reaction? → empathy + return + quality escalation
Efficacy comparison? → authorized packaging claims only
Which disclaimers and safe formulations should be used on a daily basis?
Disclaimers are not legal filler: they define the agent's boundaries and protect the customer.
Standard disclaimers to integrate
General health: our advisors are not healthcare professionals
Supplements: do not substitute for a varied diet
Cosmetics: results vary by skin type
Allergy: check INCI list, consult a doctor if in doubt
Pregnancy: seek medical advice before use
Recommended phrasing
"According to the official product description..."
"The ingredients listed on the product sheet include..."
"For any medical questions, please consult..."
"We cannot confirm suitability for your personal situation"
Prohibited phrasing
Cures, heals, treats, remedy, prescription, therapeutic dosage, 100% effective, no side effects possible.
Where to place disclaimers
Gorgias footer macros, bot welcome message, site terms hub, contact page. EN/DE/ES markets: legally approved translations, never auto-translated.
How to manage cosmetic support without overpromising?
The cosmetics support handles pre-purchase skin tickets and post-use reactions.
Frequently Asked Questions and Safe Answers
Sensitive skin: PDP INCI + 24-hour patch test + dermatologist if in doubt
Acne: non-comedogenic claim if authorized, never "treats acne"
Anti-aging: validated packaging claims only
Pregnancy: REG-COS-003 macro + human handoff
Product routine: order according to brand guide, not a prescription
Skin reaction: stop use, return, consult a doctor
Example of a Safe Macro
"Our serum is formulated for [authorized cosmetic objective]. The complete INCI is on the product page. For reactive skin, test on a small area for 24 hours and consult a dermatologist in case of doubt."
Cosmetics Escalation
Allergic reaction reported: empathy, immediate return, batch number, photos if possible, alert quality manager within 24 hours, cosmetovigilance reporting if severe.
Clean Beauty and SPF
"Paraben-free": cite PDP formulation. Do not guarantee "natural = risk-free". SPF: cite official index, no personalized exposure advice.
See chatbot limits.
How to handle allergies and traceability in food support?
Food support requires strict adherence regarding allergens and batch numbers.
5-step allergen protocol
Customer mentions allergy X
Agent opens PDP + Shopify allergen metafield
Quotes official list, word for word
Never guarantees "risk-free"
Recommends reading the received label + consulting a doctor if severe
Frequently asked questions
Vegan / halal / kosher: PDP certification or "not certified"
Gluten-free: regulatory claim or factual "contains oats"
Cross-contamination: factory info if documented, otherwise "not confirmed"
Received Best Before Date (BBD): documented batch policy + commercial gesture if applicable
Food incident
Foreign body, mold, illness: empathy, batch recall if applicable, immediate quality escalation, never minimize. Document SKU, batch number, photos, communication timeline.
Food bot
Intent allergen_check: pull structured metafield. Never infer absence of unlisted allergen. Keto, FODMAP, diabetes diets: quote nutritional macros, refer to dietician. Learn more about allergies and restrictions: guide #261.
What limits should be set for food supplement support?
Dietary supplements pose the highest risk for health advice.
Frequently asked questions
Efficacy: EFSA claims authorized on PDP only
Dosage: daily dose from label, zero customization
Drug interactions: refer to doctor/pharmacist
Sport / weight loss: no unauthorized performance promises
Children: product suitable for age if indicated on PDP
Macro REG-SUPP-001 type
“Our supplements are formulated in accordance with regulations. The claims on the product page are the authorized ones. For any health questions, ongoing treatments, or pregnancy, consult a healthcare professional before use.”
Red flags for immediate escalation
Adverse effect, overdose, child ingestion, pregnancy/breastfeeding, associated pathology (diabetes, hypertension). Customer cites influencer saying “this supplement makes you lose weight”: correct with official PDP claims, not UGC.
Distinction #119 vs generic guides
This guide covers the cross-cutting regulatory framework. See help choosing supplements (#147) to delve deeper into the prudent quiz and product range comparisons.
How do I configure an AI bot and automation for sensitive products?
On regulated products, the AI bot is an approved text distributor, not a health advisor.
Non-negotiable principles
Locked corpus: PDP, policies, validated REG macros
No generative advice: Approved corpus RAG, no improvisation
90%+ confidence threshold: otherwise human handoff
Auto disclaimer: append REG-GEN on sensitive intents
Blocklist: cure, treat, prescribe, diagnose
Bot identification: non-human announcement from the 1st message
The FTC is intensifying scrutiny of health claims via AI content; operators must be able to justify every claim, explicit or implicit (Mondaq, Operation AI Comply FTC 2025).
Secure intents vs mandatory handoff
Secure: ingredients_list, allergen_info, usage_how, return_reaction, certifications. Handoff: medical_question, pregnancy_safe, drug_interaction, adverse_reaction, child_dosage, diagnose_symptom.
Monthly audit
100 test questions for health/allergy/pregnancy. Zero tolerance for non-compliant answers. Logs kept for 24 months in case of quality investigation.
How do we train agents and validate REG-* macros?
Regulated training conditions the autonomy of agents.
5-step onboarding
1 hr Module: CAN/CANNOT framework + 3 verticals
Quiz on 15 prohibited scenarios (90% score required)
Review of 8 mandatory REG-* macros
Roleplay: allergy, pregnancy, adverse reaction
Signed certification before solo healthcare tickets
REG-* macro library
REG-GEN-001: general health disclaimer
REG-COS-002: sensitive skin + INCI
REG-COS-003: pregnancy cosmetics
REG-FOOD-001: official allergen list
REG-FOOD-002: food quality incident
REG-SUPP-001: standard supplement disclaimer
REG-SUPP-002: drug interaction → professional
REG-ESC-001: regulatory escalation to manager
Validation and reinforced QA
Each REG macro must be signed by the regulatory manager before being published in Gorgias. Notion review date. Audit of 20% of healthcare-category tickets vs. 5% standard. BPOs without REG certification do not handle pregnancy/allergy/pathology tickets. Annual 30-min refresher + quiz.
How do you escalate incidents and manage risks?
Documented escalation turns an incident into a controlled process.
4-level Matrix
L1 agent: INCI, usage, official allergen list
L2 lead: product reaction, dissatisfaction with effect
L3 regulatory: health incident, batch recall
L4 management/legal: DGCCRF threat, lawyer, press
Incident form (6 fields)
Customer verbatim, batch number, photos, timeline of exchanges, exact SKU variant, return/replacement action. Quality notification within 24 hours.
Recall and marketing alignment
Separate crisis playbook: macro RECALL-*, proactive bot message, SKU sales pause. "ad claimed cure" ticket: marketing + regulatory escalation, support does not contradict ads without approval.
Social media
Instagram DM and story replies: same rules as email. No medical advice in public.
How does Qstomy secure regulated support?
Qstomy integrates into the regulated product support as a cautious bot execution + compliance analytics layer.
Key Features
Locked corpus: PDP and validated policies only
Health intent guard: blocking generative medical advice
Disclaimer injection: auto append REG macros
Allergen metafield: Shopify structured data sync
Handoff rules: medical keywords → human agent
Audit export: health conversations for QA (#116)
Encrypted DTC Scenario
Supplements brand with 400 conversations/month, 2 agents. Before Qstomy: 3 incidents of an agent promising unauthorized efficacy within 6 months. After deployment: locked corpus, 100% pregnancy handoff, auto disclaimers, Q3 audit zero non-compliance, stable CSAT of 4.4. 95% confidence threshold on REG intents vs 80% standard.
14-Day Setup
Import PDP corpus + validated policies
Configure health intents blocklist
Map allergen/INCI metafields
Agent training on REG macros
50-question compliance audit test
Go-live with daily monitoring in W1
Explore AI support, Shopify, request a demo.
Which operational playbooks should be launched this week?
Playbook 1: audit of 20 health conversations
Export the last 20 tickets tagged with allergy, pregnancy, efficacy, reaction. Identify high-risk phrasing. List the top 5 macro corrections. Deadline: 2 hours.
Playbook 2: CAN/CANNOT page
Write a 1-page Notion document with a decision tree in section 3. Share during Day 1 onboarding. 15-scenario quiz based on real ticket cases. Deadline: 3 hours.
Playbook 3: 8 REG-* macros
Publish REG-GEN, REG-COS-002/003, REG-FOOD-001/002, REG-SUPP-001/002, REG-ESC-001. Each macro must be linked to a playbook section. Regulatory validation required before publishing. Deadline: 1 day.
Playbook 4: food allergen protocol
Shopify allergen metafields on the top 20 SKUs. Bot intent allergen_check tested on 10 products. Macro REG-FOOD-001 ready. Deadline: 4 hours ops + dev.
Playbook 5: regulated bot go-live
Corpus locked, bot identification in message 1, health blocklist, pregnancy/medical handoff, 50-question audit, 95% threshold. Bot admin owner appointed. Deadline: 2 weeks.
Useful links
A non-compliant support ticket regarding a regulated product costs more than a thousand well-managed fashion tickets. Prudence is not coldness: empathy + clarity + professional orientation = regulated excellence.
Enzo
June 28, 2026
