MoCRA Readiness: The First Real US Cosmetics Regulation in 85 Years

MoCRA introduces the concept of the Responsible Person — the manufacturer, packer, or distributor whose name appears on the product label. The Responsible Person carries the bulk of MoCRA's legal obligations: product listing, safety substantiation, adverse-event reporting, and recall cooperation. Brand owners who outsource manufacturing must understand that the contract manufacturer is not the Responsible Person unless their name is on the label. Get this clear in your manufacturing agreement before you sell a single unit — many indie brands discover the gap only after FDA contacts them.

Every facility that manufactures or processes cosmetic products for the US market must register with FDA and renew every two years. The Responsible Person must list each marketed cosmetic product, including its ingredients (using International Nomenclature of Cosmetic Ingredients names), category, and facility of manufacture. Listings must be updated annually and within 60 days of any material change. Small businesses with average annual gross sales under $1 million over the preceding three years are exempt from both registration and listing, although the exemption is narrower than it sounds — certain product categories (injectables, eye products, internal-use, products that alter appearance for more than 24 hours) are not eligible for the small-business exemption.

Section 608 of MoCRA requires the Responsible Person to ensure and maintain records supporting adequate substantiation of the safety of each cosmetic product. There is no prescribed test list — FDA recognises that safety can be demonstrated through tests, studies, research, analyses, or other evidence or information that experts qualified by scientific training and experience would consider sufficient. In practice, expect to maintain: ingredient-level safety assessments (often referencing CIR or SCCS reviews), a finished-product safety assessment by a qualified toxicologist or safety assessor, stability and preservative-efficacy testing, and a documented risk assessment for any novel ingredient or exposure scenario. Keep the dossier current as formulations or claims change.

The Responsible Person must report serious adverse events to FDA within 15 business days of receipt, and maintain records of all adverse events — serious or not — for six years (three years for small businesses). A serious adverse event is one that results in death, a life-threatening experience, inpatient hospitalisation, persistent or significant disability, congenital anomaly, infection, or significant disfigurement, including persistent or significant alteration of appearance. Build a standard intake form, train customer-service and DTC support staff to recognise reportable events, and pre-define the medical reviewer who will assess seriousness. Late reports are the most common MoCRA finding to date.

MoCRA directs FDA to issue cosmetic Good Manufacturing Practice regulations, with a proposed rule expected and a final rule following. Until the US GMPs are finalised, the de facto international standard is ISO 22716. Aligning to ISO 22716 today positions you to meet the eventual US GMPs with minimal rework and is increasingly demanded by major retailers (Sephora, Ulta, Target) as a condition of shelf space. Core ISO 22716 chapters cover personnel, premises, equipment, raw materials and packaging, production, finished products, the quality control laboratory, treatment of out-of-spec product, wastes, subcontracting, deviations, complaints and recalls, change control, internal audit, documentation. Each chapter maps cleanly to an eQMS module.

MoCRA requires the Responsible Person's domestic address, phone number, or electronic contact (e.g., website) to appear on the product label so consumers can report adverse events. Section 609 also directs FDA to issue regulations on fragrance allergen disclosure, aligning the US more closely with the EU's 26-allergen list (now expanding to over 80 under the EU's 2023 update). Update artwork management to capture the responsible-person contact field on every SKU, and start collecting fragrance-allergen data from your fragrance houses now — the final FDA rule will not give long lead times.

Before MoCRA, FDA could only request a voluntary cosmetic recall. Section 605 gives FDA mandatory recall authority when there is a reasonable probability that a cosmetic is adulterated or misbranded and use will cause serious adverse health consequences or death. The Responsible Person must cooperate fully — providing distribution records, customer lists, and product disposition data. Maintain a documented recall procedure, test it at least annually with a mock recall, and aim to reconstruct downstream distribution within 24 hours.