The Modernization of Cosmetic Regulations Act of 2022 (MoCRA) is part of the Food and Drug Omnibus Reform Act of 2022 (FDORA) that President Biden signed into law late last year. MoCRA greatly expands the FDA’s oversight authority over cosmetic products and their manufacturers, marketers, and distributors. However, many of these companies still do not know about the new requirements under MoCRA, and the clock is quickly ticking for compliance, despite the FDA’s recent extension of several key deadlines. As the purpose of MoCRA is to ensure that the cosmetic products a United States consumer uses are safe, it is safe to assume that the FDA will aggressively enforce the requirements of MoCRA. So all companies in this space should act quickly to ensure compliance.

So, what’s MoCRA?

In general, MoCRA provides at least the following new FDA cosmetic regulation requirements:

1. Track and report serious adverse events within 15 days of notice of event.

2. Retain records of adverse events for a period of years.

3. Submit cosmetic product facility registrations (facility requirement) and product listings (responsible person requirement) by the recently extended deadline from December 29, 2023 to July 1, 2024 under  the FDA’s final guidance entitled Compliance Policy for Cosmetic Product Facility Registration and Cosmetic Product Listing (“FDA final guidance”) which issued on November 8, 2023, with the FDA stating that it will be ready to accept submissions by the statutory deadline of December 29, 2023, however, it does not intend to enforce the requirements until July 1, 2024.¹

4. Offer product labeling (adding certain company information).

5. Follow good manufacturing processes (GMP) /safety substantiation (rules for GMP to be promulgated by FDA by December 23, 2024).

6. Provide fragrance allergen disclosure (rules to be promulgated by FDA by June 29, 2024).

7. Perform talc testing (FDA to promulgate proposed regulations for standardized testing methods for detecting asbestos in talc-containing cosmetic products by December 29, 2023).² 

To understand these requirements, it is helpful to have some understanding of what and who MoCRA covers, more details on the requirements themselves, and what authority the FDA has gained under MoCRA.

1. What is a cosmetic product?

Because MoCRA is limited to “cosmetic products” it is helpful to understand the FDA’s definition of “cosmetic.” In general, a cosmetic is a product, except soap, intended to be applied to the human body for cleansing, beautifying, promoting attractiveness or altering the appearance. The raw materials used as ingredients of cosmetic products are by law also cosmetics. Specifically, the Federal Food, Drug, and Cosmetic Act (FD&C Act) defines cosmetics by their intended use, as “articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body . . . for cleansing, beautifying, promoting attractiveness, or altering the appearance.” 21 U.S.C. § 321(i). This definition would include, but is not limited to, skin moisturizers, perfumes, lipsticks, fingernail polishes, eye and facial makeup, cleansing shampoos, permanent waves, hair colors, and deodorants, as well as any substance intended for use as a component of a cosmetic.

According to 604(2) of the FD&C Act, a “cosmetic product” is a preparation of cosmetic ingredients with a qualitatively and quantitatively set composition for use in a finished product. Thus, a cosmetic product is simply the combination of ingredients that has a set qualitative and quantitative composition which will be used in a final product.

 MoCRA therefore covers many makeup products, skincare products and personal care products. Examples include, but are not limited to, traditional makeup products, including blush, lipstick, eye powders and eye liner products, false lashes, including glues, and nail products, including oils, lotions, glue, polish; skincare products, including moisturizers, foundations, serums, oils; and child and adult personal care products, including shampoo, hair styling and coloring products, perfume, lotions, mouthwashes, deodorants, and shaving products.   

2. Who needs to comply with these new requirements?

Each and every “responsible person,” which MoCRA defines as “the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product in accordance with section 609(a) [of the FD&C Act] or section 4(a) of the Fair Packaging and Labeling Act” must comply with MoCRA.

There are two exemptions to compliance.

First, is an exemption from facility registration and product listing compliance which applies to responsible persons, and owners and operators of facilities who are “small businesses” which has been defined as those whose average gross annual sales in the U.S. of cosmetic products for the previous three-year period is less than $1,000,000, adjusted for inflation, and who do not engage in the manufacturing or processing of

(a) cosmetic products that regularly come into contact with mucus membrane of the eye under conditions of use that are customary or usual;

(b) cosmetic products that are injected;

(c) cosmetic products that are intended for internal use; or

(d) cosmetic products that are intended to alter appearance for more than 24 hours under conditions of use that are customary or usual and removal by the consumer is not part of such conditions of use that are customary or usual.

Any responsible person and/or owners and operators of facilities engaging in one or more of (a)-(d) listed above must comply with the product listing and facility registration requirements despite their business size.  

Second, “drug manufacturers” or companies that only manufacture or process cosmetic products that otherwise would qualify as drugs under chapter V of the FD&C Act are exempt from maintaining adverse event reports, complying with good manufacturing practices, product listing, facility registration, safety substantiation and certain labeling requirements unless such facilities also manufacture or process any cosmetic product that would not qualify does not qualify as a drug under chapter V of the FD&C Act.

3. What are the requirements?

Tracking and reporting serious adverse events

(a) Requirement starts on December 29, 2023.

(b) Who and what? Responsible persons must submit to the FDA any report received of a serious adverse event associated with the use of their products in the United States within 15 business days after receipt of the serious adverse event report. The FDA has provided a form and instructions for submitting that form, but it is still developing a process for submitting electronic mandatory adverse event reports for cosmetics.

(c) “Serious adverse events” are adverse events that are severe enough to result in, or require medical or surgical intervention, based on a reasonable medical judgment, to prevent:

(i) death;
(ii) a life-threatening experience;
(iii) inpatient hospitalization;
(iv) a persistent or significant disability or incapacity;
(v) a congenital anomaly or birth defect;
(vi) an infection; or
(vii) significant disfigurement (including serious and persistent rashes, second, or third-degree burns, significant hair loss, or persistent or significant alteration of appearance) other than as intended, under conditions of use that are customary or usual. 

(d) Responsible persons must also submit to FDA any “new and material” medical information received within one year of the initial report to FDA, and that information must also be submitted within 15 business days after receipt.

Adverse event records

(a) Requirement starts on December 29, 2023.

(b) Who and what? Responsible persons must maintain records related to each report of an adverse event associated with the use in the United States of their cosmetic products for six years, except small businesses who do not engage in the manufacturing or processing of the cosmetic products described in section 612(b) of the FD&C Act, who only need to maintain the records for three years. Defined as “any health-related event associated with the use of a cosmetic product that is adverse” in section 604 of the FD&C Act, an adverse event may be considered anything not as severe as a “severe adverse event” that a consumer would present while using a cosmetic product. 

Facility registration

(c) The facility registration requirement will be enforced beginning July 1, 2024, but the FDA will begin accepting registrations on the statutory deadline of December 29, 2023 (the registration system is not active yet). The FDA’s final guidance issued on November 8, 2023 indicates that the FDA will not enforce failures to register facilities until July 1, 2024, but the FDA is still encouraging December 29, 2023 registration compliance for those companies that are able to do so.

(d) Who? Every person who owns or operates a facility³ that engages in the manufacturing or processing of a cosmetic product for distribution in the United States. Thus, it applies to manufacturers and packers whether or not they are United States based (FD&C Act, Section 607), but a responsible person whose products are manufactured or processed at a facility may submit the facility registration for the facility. The draft guidance issued in August 2023 defined manufacturing or processing as “engaging in one or more steps in the making of any cosmetic product by chemical, physical, biological, or other procedures, including manipulation, sampling, testing, or control procedures applied to the product.” 

(e) What? Every cosmetic product manufacturer and packer who is not exempt from facility registration must register their facilities with FDA and renew their registration every two years. Updates to facility registrations or products are to be submitted annually. A facility only needs one registration even if it manufacturers for one or more responsible person (e.g., contract manufacturers). MoCRA and the FDA draft guidance provides information required for facility registration. 

Product listing

(a) The product listing requirement will be enforced beginning July 1, 2024, but the FDA will begin accepting product listings on the statutory deadline of December 29, 2023 (the registration system is not active yet). FDA’s final guidance issued on November 8, 2023 indicates that the FDA will not enforce failures to product list until July 1, 2024, but the FDA is still encouraging December 29, 2023 registration compliance for those companies that are able to do so.

(b) Who? Applies to each responsible person of a cosmetic product.

(c) What? Each responsible person, who is not exempt from product listing must list each marketed cosmetic product with FDA, including product ingredients, and provide any updates annually. MoCRA and the FDA draft guidance provides information required for product listing.

Product labeling

(a) By December 29, 2024, cosmetic labels must include contact information through which the responsible person can receive adverse event reports. The contact information can take the form of a domestic address, a domestic phone number or electronic contact information (e.g., website).

(b) By July 29, 2024, cosmetic labels must identify each fragrance allergen in a product once the FDA issues the fragrance allergen rule. 

(c) All cosmetic products for professional use must have a label which bears a notice that the cosmetic product is intended to be used by a professional. 

Safety substantiation / good manufacturing processes

(a) By December 29, 2023, companies are required to substantiate the safety of each of their cosmetic products. Previously neither the law nor FDA regulations required specific testing to demonstrate the safety of cosmetic products and/or cosmetic product ingredients; cosmetic manufacturers could simply place a label on their products noting that the safety of the product had not been determined. Now, however, under MoCRA, a responsible person is required to ensure and maintain records supporting adequate safety substantiation of their cosmetic products. Adequate safety substantiation means tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe (i.e., not injurious to users under its intended, customary or usual use).

(b) Section 606 of MoCRA provides the FDA authority to establish good manufacturing practices (GMP) for facilities that are consistent, to the extent practicable and appropriate, with national and international standards.⁴  MoCRA indicates the GMP regulations should take into account the size and scope of businesses, and provide, flexibility such as longer compliance times, and not cause undue economic hardships.  

4. What are the changes with FDA authority given these new requirements?

The FDA maintains its ability to inspect “any factory, warehouse, or establishment in which drugs . . . or cosmetics . . . [are] manufactured, processed, packed, or held for introduction into interstate commerce, or after such introduction.” The FDA can “inspect, at reasonable times and within reasonable limits and in a reasonable manner, such factory, warehouse, establishment, or vehicle and all pertinent equipment, finished and unfinished materials, containers, and labeling therein.” However, now the FDA can now seek records of adverse events during inspections, and it will be able to seek records of GMPs during inspections. Additionally, MoCRA gives the FDA the authority to seek other records when there is a reasonable belief that a cosmetic product or ingredient in a cosmetic product is likely adulterated, and the use or exposure to the cosmetic product presents a threat of serious adverse health consequences or death, and the records are needed to assist the FDA in determining whether the cosmetic product is adulterated and presents a threat of serious adverse health consequences or death.

Moreover, the FDA now has the authority to suspend a facility’s registration if the agency determines that a cosmetic product manufactured or processed by the registered facility and distributed in the United States has a reasonable probability of causing serious adverse health consequences or death to humans, and the agency has a reasonable belief that other products manufactured or processed by the facility may be similarly affected because of a failure that cannot be isolated to a product or products, or is sufficiently pervasive to raise concerns about other products manufactured in the facility. 

5. Conclusion 

The guidance surrounding MoCRA has been updated several times this year, and we believe that trend will continue for the next several months and potentially years. But, there is no need for any company in the cosmetics space to wait and see what happens. Some of these requirements start as soon as next month. As such, companies should proactively seek to comply with these new requirements now. Additionally, beyond what is set forth in this article, there are various other requirements which should be examined.

So, the question is: Are you ready, or are you just getting started? Either way, we can assist you in developing best practices to ensure compliance with MoCRA. We are also available to provide any guidance to get you in compliance before the first December 29 deadlines, and well in advance of the July 1, 2024 facility registration and product listing deadlines. 

If you have any questions about this article, please contact Julie L. Langdon at jlangdon@vedderprice.com or any other Vedder Price attorney with whom you have worked.

[1] The deadline of December 29, 2023 is still in force for some other MoCRA requirements, as discussed herein.

[2] The rules for requirements 6 and 7 have yet to be promulgated, and thus are not discussed herein. We will provide updates as rules are issued.

[3] MoCRA does define what is not a facility, which we do not discuss herein, but examples include beauty shops and salons, unless such establishment manufactures or processes cosmetic products at that location, and entities providing complimentary cosmetic products to customers incidental to other services (i.e., hotels). A more detailed list can be found in section 604 of MoCRA. 

[4] There is rule making on this issue on or by December 29, 2024 and a Final Rule due by December 29, 2025.