MoCRA: US Cosmetic Compliance Requirements

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA), enacted on 29 December 2022 within the Consolidated Appropriations Act 2023 (Pub. L. 117-328), is the first substantial reform of US cosmetic law since the Federal Food, Drug, and Cosmetic Act (FD&C Act) of 1938. It added a series of new sections to the FD&C Act and applies to any business marketing cosmetics in the United States, wherever it is based.

The Responsible Person

MoCRA’s Responsible Person is the manufacturer, packer or distributor whose name appears on the product label. That entity carries the listing, safety-substantiation and adverse-event obligations set out below.

Facility registration (section 607)

Every facility that manufactures or processes cosmetics for US distribution must register with the FDA through the Cosmetics Direct portal. Facilities operating on 29 December 2022 had to register by 29 December 2023, with enforcement deferred to 1 July 2024; a facility beginning activity later must register within 60 days. Registration is renewed every two years under section 607(a)(2). Failure to register is a prohibited act under section 301(hhh) of the FD&C Act (21 U.S.C. 331(hhh)).

Product listing (section 607)

Each marketed cosmetic product must be listed with the FDA, including its ingredients, with annual updates, and a new product must be listed within 120 days of being marketed. There is no fee for registration or listing.

Safety substantiation (section 608)

The Responsible Person must ensure, and maintain records supporting, adequate substantiation of the safety of each product. Adequate substantiation means tests, studies, analyses or other evidence that experts qualified by training and experience would consider sufficient to support that the product is not injurious to users under labelled or customary conditions of use.

Good Manufacturing Practice (section 606)

The FDA is directed to establish cosmetic GMP regulations, expected to align with the international standard ISO 22716, with longer timelines or simplified requirements available to smaller businesses. Until the rule is final, the statutory direction stands and practice is assessed against recognised standards.

Adverse event reporting (sections 605 and 609)

The Responsible Person must maintain records of health-related adverse events for six years, reduced to three years for qualifying small businesses, and must report a serious adverse event to the FDA within 15 business days, with any new and material medical information for one year after the initial report. The label must carry a US contact, a domestic address, telephone number or electronic contact, through which adverse events can be reported (section 609).

Labelling (section 609)

Beyond the adverse-event contact, section 609 introduces fragrance allergen labelling, with the specific allergens to be set by FDA rule, and requires professional-use products to carry the appropriate statement. The existing FD&C Act misbranding provisions continue to apply.

FDA records access and recall (sections 610 and 611)

The FDA may access and copy records where it has a reasonable belief that a product is likely to be a danger to health, and holds mandatory recall authority where a product is adulterated or misbranded and there is a reasonable probability of serious adverse health consequences or death, after first offering the opportunity for voluntary action.

Small business exemptions

Businesses whose average gross annual US cosmetic sales over the previous three years are under $1,000,000 are exempt from the GMP (section 606) and registration and listing (section 607) requirements. The exemption does not apply to products that, under customary use, come into contact with the mucous membrane of the eye, are injected, are intended for internal use, or are intended to alter appearance for more than 24 hours where removal is not part of customary use.

Preemption and the state overlay

MoCRA preempts differing state and local requirements on registration, listing, GMP, records, recalls, adverse-event reporting and safety substantiation. It does not preempt state laws that prohibit or limit cosmetic ingredients, or that require ingredient reporting. California’s Proposition 65, Safe Cosmetics Act and Toxic-Free Cosmetics Act therefore continue to apply alongside MoCRA, as do equivalent measures in Washington, New York and Minnesota, so US compliance is federal and state.

Talc and PFAS

MoCRA further directs the FDA to establish standardised methods for detecting and identifying asbestos in talc-containing cosmetics, and to report on the use of, and any safety risks from, per- and polyfluoroalkyl substances (PFAS) in cosmetics.

We prepare the MoCRA safety substantiation as a Toxicological Risk Assessment and address the state overlay. See our US MoCRA service and the North America page.