This checklist outlines key regulatory compliance considerations that are specific to personal care products marketed in the United States following the enactment of the federal Modernization of Cosmetics Regulation Act (MoCRA) on December 23, 2022.

For a full listing of beauty and personal care product content see, Food, Dietary Supplement, and Cosmetic Resource Kit

For information about beauty and personal care product regulation, see FDA Regulation of Cosmetics, FDA Cosmetics Labeling Regulations, CBD Cosmetic Product Labeling, and FDA Warning Letters Tracker.

Background

MoCRA, Pub. L. No. 117-328, represents the first major statutory change to the authority of the Food and Drug Administration (FDA) to regulate cosmetics since the Food, Drug, and Cosmetics Act (FDCA), 21 U.S.C. § 361 et seq., in 1938 and the Fair Packaging and Labeling Act (FPLA), 21 C.F.R. § 701.3, in 1966.

To summarize:

  • The FDCA requires finished cosmetic products to be safe when used by customers in accordance with product labeling or customary usage and to not be misbranded or adulterated
  • The FPLA requires cosmetics marketed on a retail basis to consumers in interstate commerce to be honestly and informatively labeled

Passed with bipartisan and industry support, MoCRA creates substantial new compliance obligations for manufacturers, packers, and distributors of personal care products intended for sale in the United States.

Personal care products are generally defined by the FDCA as “articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body . . . for cleansing, beautifying, promoting attractiveness, or altering the appearance.” 21 U.S.C. § 321(i).

This definition includes skin moisturizers, perfumes, lipsticks, fingernail polishes, eye and facial makeup, cleansing shampoos, permanent waves, hair colors, and deodorants, as well as any substance intended for use as a component of a cosmetic product.

Key Areas of Compliance Focus Post-MoCRA

Scope

MoCRA defines cosmetic products as “a preparation of cosmetic ingredients with a qualitatively and quantitatively set composition for use in a finished product.” 21 U.S.C. § 364.

Unless otherwise specified, MoCRA generally applies to finished cosmetic products.

Facility Registration

Newly added Section 607 of the FDCA, 21 U.S.C. § 364c, requires an owner or operator of an existing facility that “manufactures or processes cosmetic products for U.S. distribution, whether the facility is located in the U.S. or abroad, to register with the FDA” by December 29, 2023. The FDA will announce any subsequent changes in this deadline.

The registration requirement applies to existing cosmetic product facilities either in the U.S. or that distribute products to the U.S.

Additionally, any new facility will have 60 days from startup to register with the FDA.

Because the facility registration deadline is one of the earliest compliance regulations to take effect under MoCRA, cosmetic manufacturers and processors must determine whether they need to register any facilities with the FDA.

With respect to contract manufacturers, MoCRA requires that “if a facility manufactures or processes cosmetic products on behalf of a responsible person, the Secretary shall require only a single registration for such facility.” 21 U.S.C. § 364c(a)(3). That registration may be submitted by the facility or any responsible person whose products are manufactured or processed at that facility.

Notably, this requirement excludes salons (unless they manufacture or process cosmetic products that are not sold directly to consumers at the location) or cosmetic product retailers, including individual sales representatives, direct sellers, or retail distribution facilities.

MoCRA exempts small businesses (i.e., those with less than $1 million in gross annual sales for the past 3 years) from this requirement.

Because MoCRA requires mandatory facility registration, as well as product listing, the FDA is creating a new system to receive the large number of mandatory submissions.

As a result, the FDA stopped accepted submissions to Voluntary Cosmetic Registration Program (VCRP) as of March 27, 2023. Notably, information previously submitted to the VCRP will not transfer over for registration and listing and purposes under MoCRA.

The FDA will announce the availability of the new system and has encouraged companies to wait to register until the new system is announced. The FDA has also encouraged companies to regularly visit the FDA's website on MoCRA for new updates and announcements, and to follow the FDA on Twitter (@FDACosmetics).

Product Listing

Newly added Section 607 of the FDCA, 1 U.S.C. § 364c, requires that a “responsible person” must list each marketed cosmetic product intended for sale in the United States with the FDA by December 29, 2023, and provide any updates annually, in accordance with guidance to be released by the FDA.

MoCRA defines a “responsible person” as the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product in accordance with Section 609(a) of MoCRA, 21 U.S.C. § 364, or Section 4(a) of the FPLA.

The product listing deadline is another one of MoCRA's earlier deadlines. To comply with this new requirement, companies should gather the required information for each marketed product as soon as possible, including:

  • Identifying a “responsible person” for FDA contact purposes—can be the same “responsible person” for adverse event reporting
  • Identifying the location of the product's manufacturing facility by registration number
  • Identifying product ingredients –and–
  • Determining the ingredients for any fragrances and/or flavor additives

Companies should ensure that there are reporting and compliance policies in place for updating the FDA annually as to product listing and for notifying the FDA within 60 days of product changes, or 120 days of marketing new products.

MoCRA exempts small businesses (businesses with less than $1 million in gross annual sales for the past 3 years) from this requirement.

Safety Substantiation

Newly added Section 608 of the FDCA, 21 U.S.C. § 364d, requires “responsible persons” to ensure and maintain records supporting “adequate substantiation” showing that a cosmetic product is “safe,” and establishes a safety standard that products must meet to be marketed in the U.S. by December 29, 2023.

This requirement applies to finished products and ingredients except coal tar hair dye and defines “adequate substantiation of safety” and “safe.

  • “Adequate substantiation of safety” means
    • “Tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe”
  • “Safe” means
    • “Not injurious to users under the conditions of use prescribed in the labeling thereof, or under such conditions of use as are customary or usual” –and–
    • “Not injurious to users solely because it can cause minor and transient reactions in some users”

The FDA will consider cosmetic products that do not have adequate safety substantiation to be adulterated under Section 601 of the FDCA.

Companies should review their documentation to ensure that they support a reasonable certainty of safety under product use / typical use conditions, including for fragrances.

At minimum, companies should maintain current documentation of the following:

  • Certificates of analysis and safety data sheets for cosmetic ingredients
  • Supplier data supporting ingredient safety
  • Disclosure of existing and proposed allergens under Annex III of the European Commission's Cosmetics Regulation No. 1223/2009 –and–
  • California's Proposition 65 and Safe Cosmetics Act reporting

Product Labeling

Newly added Section 609 of the FDCA, 21 U.S.C. § 364e, updates the FDA's current cosmetic labeling requirements in three ways:

  • Professional cosmetics product labels must include the same information that is required of cosmetic products intended for sale to consumers and to state that only licensed professionals may use the product by December 29, 2024.
  • Cosmetic product labels must include contact information through which a responsible person can receive adverse event reports by December 29, 2024.
  • Cosmetic labels must identify each fragrance “allergen” in a product once FDA issues its final rule determining fragrance allergens. MoCRA contemplates an FDA rulemaking deadline of June 29, 2024.

This requirement will renew every 2 years from the date of compliance.

Companies should ascertain whether their product labels currently comply with these requirements, or ensure compliance by the relevant deadlines noted above, and identify a “responsible person” to receive adverse event reports.

Recordkeeping and Reporting

MoCRA requires that a “responsible person” maintain records of any health-related adverse events associated with the use of its product for 6 years, defined as “[a]ny health-related event associated with the use of a cosmetic product that is adverse.” 21 U.S.C. § 364a, 21 U.S.C. § 364f.

Additionally, MoCRA requires a “responsible person” to report to FDA any serious adverse events no later than 15 days after learning about the issue, with mandatory followup as to any new and material medical information related to event for 1 year after the initial submission. 21 U.S.C. § 364a.

Adverse event reports should be submitted via MedWatch, the FDA's online product safety reporting program.

MoCRA broadens the scope of what constitutes a “serious adverse event” to include infections or “significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), other than as intended, under conditions of use that are customary or usual.” 21 U.S.C. § 364(5).

However, a product will not be considered injurious because it causes minor or transient reactions to certain users.

Companies should:

  • Review recordkeeping policies and procedures to ensure that records for all adverse events are maintained for 6 years (small businesses – 3 years) –and–
  • Review reporting policies to ensure that “serious adverse events” are reported to the FDA within 15 days of learning of the event, with mandatory follow-up reporting for 1 year.

Small Business Considerations

MoCRA makes two accommodations for small businesses, defined as owners and operators whose average gross annual domestic sales for the previous 3 years is less than $1 million, adjusted for inflation. 21 U.S.C. § 364h.

  • CGMP regulations issued by FDA under newly added Section 606, 21 U.S.C. § 364b, must offer flexibility, simplified requirements, and a longer compliance period for small businesses.
  • Small businesses are exempt from newly added Sections 606 (for CGMP, 21 U.S.C. § 364b) and 607 (registration and listing, 21 U.S.C. § 364c) and they must maintain records of any health-related adverse events associated with the use of a product for only 3 years, rather than 6 years, with the exception of businesses that manufacture the following products:
    • Injectables
    • Cosmetics intended for internal use
    • Products that alter appearance for more than 24 hours under normal use –or–
    • Products that touch the mucus membrane of the eye

Expanded FDA Enforcement Authority

In addition to these new obligations, the FDA has mandatory recall authority under FDCA Section 610, 21 U.S.C. § 364b, if it determines that:

  • There is a “reasonable probability” that cosmetics are adulterated or misbranded under the FDCA
  • Use or exposure will cause serious adverse health consequences –and–
  • The responsible individual or entity has refused to voluntarily recall the product or cease distribution

The FDA also may suspend a facility's registration if FDA:

  • Determines that a product manufactured or processed at that facility has a “reasonable probability of causing serious adverse health consequences to humans” –and–
  • The FDA “reasonably believes” that other products manufactured or processed by the facility may be similarly affected

FDCA Section 607, 21 U.S.C. § 364c(f).

Suspended facilities are entitled to notice and an opportunity for a hearing to determine whether the suspension is necessary. If a suspension is necessary, suspended facilities will be required to develop corrective action plans.

Keep in mind that the FDA may access certain records pertaining to serious adverse event reporting, GMPs, and cosmetic products and their ingredients that FDA reasonably believes may be adulterated to present a threat of serious adverse health consequences or death. FDCA Section 610, 21 U.S.C. § 364f.

Expanded FDA Rulemaking Authority

MoCRA requires FDA to enact new regulations addressing:

  • Good manufacturing practices (GMP) to ensure product safety and non-adulteration, consistent with national and international standards that will be simplified for small businesses (proposals by December 29, 2024, with a final rule no later than December 29, 2025 (21 U.S.C. § 364b))
  • Fragrance allergens that must be disclosed on cosmetics labels, considering European Union (EU) and other international requirements (proposed rule within 18 months after enactment (i.e., June 29, 2024), and a final rule no later than 180 days after the close of the public comment period for the proposed rule) (21 U.S.C. § 364e(b)) –and–
  • Standardized testing methods for detecting and identifying asbestos in talc-containing products with timelines for the issuance of proposed rules by December 29, 2023, with a final rule no later than 180 days after the close of the public comment period for the proposed rule (21 U.S.C. § 364d)

Further, no later than December 29, 2025, the FDA must issue a report assessing the use of per- and polyfluoralkyl substances (PFAS) in cosmetic products and the scientific evidence supporting or negating the safety risks associated with such use.

Additional Regulatory and Preemption Considerations

MoCRA preempts state and local government requirements for cosmetics that differ from MoCRA, with limited exceptions for prohibitions or limitations on the amount of an ingredient that can be used in a cosmetic under state law and existing reporting requirements that predated MoCRA. Examples of state laws and reporting requirements that predated MoCRA include California's Proposition 65 and Toxic Free Cosmetics Act, and Maryland's House Bill 643 (passed on May 30, 2021, and effective on January 1, 2025), which bans the manufacturing and sale of cosmetic products in the state that contain ingredients such as dibutyl phthalate (DBP), diethylhexyl phthalate (DEH), formaldehyde, isobutylparaben and isopropylparaben, and 13 types of per- and polyfluoroalkyl substances (PFASs) and their salts, including PFOS and PFOA.

Originally published by Practical Guidance

Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.