MoCRAModernization of Cosmetics Regulation Act

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is the most substantive expansion of FDA cosmetics authority since the Federal Food, Drug, and Cosmetic Act of 1938. It was enacted as Title III Subtitle E of the Consolidated Appropriations Act, 2023 and signed into law on 29 December 2022. Before MoCRA, the FDA's cosmetics authority was extraordinarily thin: no mandatory registration, no mandatory product listing, no mandatory adverse-event reporting, no mandatory GMP, no mandatory recall. MoCRA replaced almost all of that.

MoCRA added a new Chapter VII to the FD&C Act (Sections 601A through 614) imposing six core obligations: (1) facility registration, (2) product listing, (3) safety substantiation, (4) adverse-event reporting and record-keeping, (5) GMP compliance (rulemaking under way), (6) FDA mandatory recall authority. It also imposed two specific labelling rules — a domestic contact for adverse-event reporting on every product label, and fragrance-allergen disclosure once FDA finalises the list.

MoCRA applies to any 'responsible person' — defined as the manufacturer, packer or distributor whose name appears on the product label — and to any owner or operator of a 'facility' that engages in manufacturing or processing of cosmetic products distributed in the US. Foreign facilities are included if their product reaches US commerce. The Act also covers contract manufacturers, who must register their own facilities even when they only make product on behalf of a brand owner.

Section 612 carves out 'small businesses' — responsible persons and facilities with average gross annual US cosmetics sales below USD 1,000,000 over the previous three years (adjusted annually for inflation). Small businesses are exempt from the registration, listing, and (forthcoming) GMP requirements. They are NOT exempt from the adverse-event-reporting, record-keeping, safety-substantiation or recall obligations. The small-business carve-out does not apply if any of the products fall into higher-risk categories: products that come into contact with the mucous membrane of the eye under conditions of customary use, injectables, products intended for internal use, or products intended to alter appearance for more than 24 hours and not customarily removed by the consumer (essentially long-wear and tattoo-adjacent products).

Every covered facility that manufactures or processes cosmetic products for distribution in the US must register with the FDA. New facilities must register within 60 days of beginning operation; pre-existing facilities had to register by 1 July 2024 (deadline extended from 29 December 2023). Registrations must be renewed biennially. Registration is submitted through the FDA's 'Cosmetics Direct' electronic portal (or via SPL XML submission for high-volume registrants).

Required content includes the facility name, physical address, contact information, brand names of products manufactured or processed at the facility, and a unique facility identifier (most use a D-U-N-S number). Contract manufacturers register on their own behalf; the brand owner whose products they make does not need to register that facility, but does need to list the products. A single facility can be associated with multiple responsible persons.

The responsible person must submit a product listing for every cosmetic product they market in the US. The listing must include the product's facility registration number(s), category, ingredient list (including fragrance and flavour ingredients), product image or label, and brand. Listings are submitted via the same Cosmetics Direct portal and must be updated annually (or sooner if material information changes — formulation change, ingredient swap, label change, discontinuation).

The data the FDA collects through listings is non-public for proprietary content (e.g. concentrations), but the agency uses it to triage inspections, screen for unsafe ingredients, and feed adverse-event investigations. The listing is the FDA's first inventory of what is actually on the US cosmetics market — until MoCRA, no such inventory existed.

Section 608 requires the responsible person to ensure and maintain records supporting 'adequate substantiation of safety' for each cosmetic product. 'Adequate substantiation' is defined as tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that the product is safe under labelled or customary conditions of use.

MoCRA does not prescribe specific test methods. In practice, safety substantiation files include: ingredient safety reviews from CIR (Cosmetic Ingredient Review), SCCS (EU's Scientific Committee on Consumer Safety) and peer-reviewed literature; finished-product testing (microbiological, stability, preservative-efficacy, patch testing, sometimes HRIPT or RIPT for sensitisation); manufacturing controls and batch records; complaint history and adverse-event data. The substance closely parallels the EU's PIF (Product Information File) requirement under 1223/2009, and most multinational brands maintain one dossier that satisfies both regimes.

Records must be available for FDA inspection. The FDA can inspect any facility manufacturing cosmetics; under Section 704(a)(1) the agency now has authority to access and copy records related to safety substantiation. Refusal or destruction is an FD&C Act violation.

Section 605 requires the responsible person to maintain records of all 'health-related adverse events' and to report any 'serious adverse event' to the FDA within 15 business days of receipt. A serious adverse event is one that results in death, a life-threatening experience, in-patient hospitalisation, persistent or significant disability or incapacity, congenital anomaly, an infection, a significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), or that requires medical or surgical intervention to prevent any of these outcomes.

Reports are submitted via the FDA's MedWatch (3500A) form. Records of all adverse events (serious or not) must be kept for six years (three years for small businesses). The responsible person must also maintain copies of any reports submitted to the FDA.

Section 609 requires every cosmetic product label to include a domestic address, domestic phone number, or electronic contact information through which the responsible person can receive adverse-event reports. This labelling requirement took effect 29 December 2024 for products introduced or delivered for introduction after that date.

Section 606 directs the FDA to issue regulations establishing GMP for cosmetics. The Act required a proposed rule by 29 December 2024 and a final rule by 29 December 2025. The FDA issued a Request for Information in March 2024 to inform the proposed rule and indicated it would draw heavily on existing voluntary frameworks — ISO 22716 (Cosmetics GMP) and FDA's 2013 draft cosmetic GMP guidance — adapted to the MoCRA statute.

Until the final rule is in force, the practical baseline is ISO 22716. Most multinational cosmetics manufacturers, contract manufacturers, and any brand that has ever exported to the EU already operate to ISO 22716 because the EU Cosmetics Regulation references it as the harmonised GMP standard. Companies that have not yet adopted 22716 should consider it the safe-harbour starting point for MoCRA GMP readiness.

Topics expected to be central to the MoCRA GMP rule, based on the RFI questions: facility hygiene and pest control; equipment qualification and cleaning validation; raw-material identity testing and supplier qualification; batch records and master formulas (in cosmetics, the master formula plays the role the MMR plays in pharma); microbiological control of water and finished product; preservative efficacy; complaint handling and recall procedures; training and personal hygiene; and traceability sufficient to support a recall.

Section 611 gives the FDA, for the first time, mandatory recall authority over cosmetics. If the agency determines there is a reasonable probability that a cosmetic is adulterated or misbranded and the use of, or exposure to, the product will cause serious adverse health consequences or death, it must first provide the responsible person an opportunity to voluntarily recall. If the responsible person refuses or fails to voluntarily recall, the FDA may order the recall.

The procedure mirrors the FDA's existing recall authority for food (FSMA) and devices: an order can require ceasing distribution, providing notice to immediate consignees, and recalling product from distribution and consumers. The FDA must provide a hearing within 10 days if requested. Non-compliance is an FD&C Act prohibited act subject to civil and criminal penalties.

The practical consequence: a cosmetics manufacturer must be able to identify, contact and recover product from every immediate consignee within hours, not weeks. Lot-level traceability — what went where, when — is now an FDA expectation, not a voluntary best practice.

A brand selling in both markets typically maintains one PIF/safety-substantiation dossier, generates two notifications (CPNP + Cosmetics Direct), holds one set of batch records meeting both 22716 and MoCRA-GMP expectations, and uses one global adverse-event system that routes to both authorities on the shorter of the two clocks.

1. Brand assumes its contract manufacturer registered the facility, did not confirm, and the registration was never filed.
2. Listing relies on the formulation as launched; reformulation goes into production without updating the listing.
3. Safety-substantiation file is a binder of CIR monographs with no finished-product testing — adequate for the ingredient, not the product.
4. Adverse-event intake routes to customer-service email with no triage; a serious AE sits unread past the 15-day clock.
5. Label does not carry the domestic contact required by Section 609 — affects products introduced after 29 December 2024.
6. GMP gap: water system, preservative-efficacy testing or supplier qualification programme that would not survive an ISO 22716 audit, let alone a finalised MoCRA GMP rule.
7. Traceability gap: cannot produce within hours a list of immediate consignees who received a specific lot, so a Section 611 recall cannot be executed in the required timeframe.

V5's cosmetics industry profile maps MoCRA's obligations onto the same QMS and execution backbone the platform uses for pharma and dietary supplements. Master formulas, batch records, supplier qualification, deviations, CAPA, training and recall traceability are existing capabilities; the cosmetics profile adds the MoCRA-specific record types and the labelling rules.

• Facility registration and product listing data live as managed records linked to the facility and SKU; renewals and material-change updates appear on the compliance calendar.
• The safety-substantiation file is a structured document with sections for ingredient reviews, finished-product testing (microbiological, stability, PET, patch), batch consistency evidence and complaint summary — linked to the formula version and updated on every reformulation.
• Adverse-event intake is a first-class workflow with a 15-business-day clock, MedWatch 3500A field mapping, and a hard escalation if not actioned in time.
• Section 609 label content is enforced by the label-control system: every approved label artwork must include a valid domestic contact field; missing or empty is a blocking validation.
• GMP-aligned controls (ISO 22716 baseline, MoCRA-rule-ready): cleaning validation, preservative-efficacy testing, water-system monitoring, supplier CoAs, allergen segregation, training records — all enforced at the kiosk and audit-visible.
• Recall traceability: a lot search returns every immediate consignee (with quantities and dates) in seconds, supporting Section 611 timelines.