Visit Website →
← Back to blog

FDA Cosmetic Regulations for Manufacturers: MoCRA Compliance

August 9, 2026
FDA Cosmetic Regulations for Manufacturers: MoCRA Compliance

Under current U.S. law, the Federal Food, Drug, and Cosmetic Act (FFDCA) combined with the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) sets every core obligation for cosmetic manufacturers, distributors, and responsible persons. FDA does not preapprove cosmetics or their ingredients before they reach consumers — the single exception is color additives, which require premarket approval. That means the safety burden sits entirely with your company, not the agency.

Here is what your compliance team must act on now:

  • Register your facility with FDA (domestic and foreign facilities that manufacture or process cosmetics for U.S. distribution).
  • List every product with FDA, including a full ingredient declaration covering fragrances, flavors, and colors.
  • Substantiate safety for each product and maintain records the responsible person can produce on request.
  • Build a serious adverse event (SAE) reporting workflow capable of filing within 15 business days of awareness.
  • Prepare for GMP rules by implementing batch records, sanitation controls, and supplier qualification now.
  • Audit every label for misbranding risks, unapproved drug claims, and color additive compliance.
  • Know your recall exposure — MoCRA gives FDA authority to order mandatory recalls.

Pro Tip: Assign a named responsible person for each product line before you register. That person's contact information goes into both the facility registration and the product listing, and they own the SAE reporting obligation. Deciding this late creates submission errors that trigger 60-day update filings.

Key Takeaways

MoCRA transformed FDA cosmetic oversight from a largely post-market enforcement model into an ongoing compliance obligation — facility registration, product listing, safety substantiation, SAE reporting, and GMP readiness are now mandatory, not voluntary.

PointDetails
No FDA preapproval (except color additives)Safety responsibility rests entirely with the responsible person, not the agency.
60-day update ruleAny change to a registration or product listing must be filed within 60 days of the change.
15-business-day SAE reportingThe clock starts when the responsible person becomes aware, not when the event occurred.
Six-year record retentionStandard retention period for safety substantiation and SAE records under MoCRA.
QueenCompares toolsThe Ingredient Checker and Label Scanner help teams organize ingredient data and flag compliance gaps faster.

Diagram showing MoCRA compliance timelines and requirements

Table of Contents

Which federal laws govern cosmetics in the U.S.?

The full legal map for cosmetics spans five federal statutes, each covering a distinct compliance layer:

  • Federal Food, Drug, and Cosmetic Act (FFDCA): The foundational statute. Prohibits adulterated and misbranded cosmetics; defines cosmetics and drugs; grants FDA enforcement authority.
  • Modernization of Cosmetics Regulation Act of 2022 (MoCRA): Enacted December 29, 2022, as part of the Consolidated Appropriations Act. The most significant expansion of FDA cosmetic authority since 1938.
  • Color Additive Amendments Act: Requires premarket approval for every color additive used in cosmetics. No color additive may be used without an approved petition.
  • Fair Packaging and Labeling Act (FPLA): Governs net quantity of contents, identity statements, and manufacturer/distributor name and place of business on cosmetic labels.
  • Microbead-Free Waters Act of 2015: Bans plastic microbeads in rinse-off cosmetics and OTC drugs.

FDA's enforcement role under the FFDCA is post-market: the agency can act against adulterated or misbranded products already in commerce. MoCRA layered on top of that a set of proactive, pre-incident obligations — registration, listing, safety substantiation, SAE reporting, and mandatory recall authority — that shift the compliance posture from reactive to ongoing.

Key regulatory signal: MoCRA is the most significant expansion of FDA's authority over cosmetics since 1938. Companies that treat it as a paperwork update rather than a structural compliance shift are underestimating their exposure.

How U.S. law defines "cosmetic" vs. "drug" — and why it matters

The FFDCA defines a cosmetic as an article intended to be applied to the human body for cleansing, beautifying, promoting attractiveness, or altering appearance. A drug is defined by its intended use: articles intended to diagnose, cure, treat, mitigate, or prevent disease, or to affect the structure or function of the body.

Intended use is the deciding factor, not the physical form of the product. A moisturizer that claims to "hydrate skin" is a cosmetic. The same moisturizer claiming to "treat eczema" is a drug. Products can be both simultaneously — a shampoo that conditions hair (cosmetic) and treats dandruff with zinc pyrithione (OTC drug) carries dual obligations.

Products that routinely trip up R&D and regulatory teams:

  1. Sunscreens — regulated as OTC drugs under monograph M020, not cosmetics. U.S. sunscreen regulations require active ingredient compliance with the monograph, not just cosmetic labeling.
  2. Anti-acne products — benzoyl peroxide and salicylic acid formulations are OTC drugs.
  3. Anti-dandruff shampoos — active ingredients like selenium sulfide or zinc pyrithione trigger drug classification.
  4. Teeth-whitening products — whitening claims can push a product into drug territory.
  5. Deodorants vs. antiperspirants — deodorants are cosmetics; antiperspirants are OTC drugs.

Classification decision checklist for product development:

  1. List every intended use claim planned for labeling, marketing, and social media.
  2. Check whether any claim implies a therapeutic effect, disease treatment, or structure/function change.
  3. If yes to any claim, determine whether an OTC monograph covers the active ingredient.
  4. If no monograph applies, a New Drug Application (NDA) or 505(b)(2) pathway is required.
  5. Document the classification rationale in writing and attach it to the product's safety file.

Pro Tip: Social media posts and influencer briefs count as labeling context under FDA's intended-use analysis. A product marketed as a "cosmetic" on the label but promoted as "clearing acne" on your brand's Instagram can be reclassified as a drug.

What MoCRA changed and why it matters for your business

MoCRA fundamentally restructured the FDA's relationship with the cosmetics industry. Before MoCRA, FDA had no authority to require registration, mandate safety records, or order recalls. Now it does.

The headline changes:

  • Facility registration: Mandatory for domestic and foreign facilities that manufacture or process cosmetics for U.S. sale.
  • Product listing: Every cosmetic product must be listed with FDA, with full ingredient disclosure.
  • Safety substantiation: Responsible persons must maintain records adequate to substantiate product safety.
  • SAE reporting: Serious adverse events must be reported to FDA within 15 business days.
  • GMP rulemaking: FDA is directed to issue regulations establishing good manufacturing practices.
  • Mandatory recall authority: FDA can order a recall when there is a reasonable probability of serious adverse health consequences or death.
  • Recordkeeping: Six-year retention standard for most records; potential three-year exception for qualifying small businesses.

The practical impact: companies that ran lean compliance programs under the old voluntary-registration model now have statutory obligations with enforcement teeth. FDA's ability to detect safety signals improves with every product listing and SAE report filed — which means the agency's surveillance capacity grows over time.

Facility registration and product listing: what to submit and when

What goes into a facility registration

Every domestic facility that manufactures or processes cosmetics for U.S. distribution must register with FDA. Foreign facilities that export cosmetics to the U.S. carry the same obligation. Required data elements include:

  • Facility name, physical address, and contact information
  • All brand names used at that facility
  • Product categories manufactured (using FDA's defined category list)
  • Name and contact information for the responsible person
  • Name and contact for a U.S. agent (foreign facilities only)

What goes into a product listing

Product listings must include the product name as it appears on the label, the product category, the responsible person's name and contact, and a complete ingredient list. That ingredient list must name every ingredient — including fragrances, flavors, and colors — using INCI nomenclature where applicable.

Timelines you cannot miss

Per MoCRA's registration and listing requirements:

  • Facility registrations must be renewed every two years.
  • Product listings must be renewed annually.
  • Any change to registration or listing content must be updated within 60 days of the change.

Steps to keep listings current:

  1. Build a product master list in a shared system (a spreadsheet or PLM tool) that flags renewal dates automatically.
  2. Assign one owner per product line responsible for triggering updates when formulas, labels, or responsible persons change.
  3. Set calendar reminders 90 days before biennial registration renewal and 60 days before annual listing renewal.
  4. Conduct a quarterly ingredient-change audit to catch formula revisions that trigger the 60-day update clock.
  5. Keep a submission log with FDA confirmation numbers for every registration and listing filed.

Pro Tip: FDA's Cosmetics Direct portal is the submission system for registrations and listings. Test your data format before the deadline — submission errors on ingredient lists are the most common cause of incomplete filings.

Safety substantiation: what evidence to collect and how long to keep it

MoCRA places the safety burden squarely on the responsible person. Registration and listing are administrative acts — they are not FDA safety endorsements. Your company must independently substantiate that each product is safe for its intended use.

Acceptable types of safety evidence:

  • Toxicology summaries and safety assessments for each ingredient and the finished formula
  • Formulation records and batch manufacturing records
  • Stability testing data (accelerated and real-time)
  • Microbial challenge testing results
  • Supplier certificates of analysis and safety data sheets
  • Fragrance allergen assessments (especially relevant for EU-aligned ingredient disclosures)
  • Asbestos-in-talc testing results when talc is a formulation ingredient
  • Consumer use studies or dermatologist testing where claims are made

Retention periods: The standard is six years from the date the record is created. Qualifying small businesses may be eligible for a three-year retention period under MoCRA's small-business provisions. Confirm your eligibility before applying the shorter period.

Operational controls that hold up in an inspection:

  • Maintain a version-controlled formula master with effective dates for every revision.
  • Use a chain-of-custody log for retained samples tied to specific batch numbers.
  • Include supplier qualification agreements that require notification of raw-material changes.
  • Build a record index so any document can be located within 24 hours of an FDA request.

Pro Tip: Structure your safety substantiation file the same way for every product: cover page with product name and responsible person, ingredient safety summaries, finished-formula assessment, stability data, and microbial results. Consistency makes audits faster and gaps obvious before FDA finds them.

Serious adverse event reporting and FDA recall authority

What counts as a serious adverse event

Under MoCRA, a Serious Adverse Event (SAE) is any health-related event associated with a cosmetic that results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, a congenital anomaly or birth defect, or that requires medical or surgical intervention to prevent one of those outcomes.

The 15-business-day reporting clock starts when the responsible person first becomes aware of the event — not when the event occurred. After the initial report, any new material medical information received within one year must be submitted to FDA as a follow-up.

SAE handling workflow:

  1. Intake: Capture all consumer complaints through a centralized channel (call center, email, social media monitoring).
  2. Triage: Screen every complaint against the SAE definition within 48 hours of receipt.
  3. Medical review: Route potential SAEs to a qualified medical reviewer for causality assessment.
  4. Report: File with FDA via MedWatch within 15 business days of awareness.
  5. Follow-up: Monitor the case for one year and submit updates when new material medical information arrives.
  6. Record retention: Retain all SAE records for six years.

FDA's recall authority under MoCRA

FDA can order a mandatory recall when there is a reasonable probability that a cosmetic is adulterated or misbranded and that use of or exposure to the product would cause serious adverse health consequences or death. Before issuing a mandatory recall order, FDA will typically give the responsible person an opportunity to voluntarily recall. Voluntary recalls move faster and carry less reputational damage — build a recall SOP before you need one.

Pro Tip: Map your distribution chain to the lot level now. If FDA issues a recall order, you will need to identify every customer, retailer, and distributor that received the affected lot within hours, not days. A distribution log tied to batch numbers is the single most time-sensitive piece of infrastructure to have ready.

Good manufacturing practices and key labeling rules

GMP status under MoCRA

FDA is directed by MoCRA to issue GMP regulations for cosmetics, but formal rules have not yet been finalized. In the interim, FDA's cosmetics guidance documents represent the agency's current thinking and are the practical reference for manufacturers preparing their systems now. High-level expectations include:

  • Written procedures for facility sanitation and pest control
  • Batch manufacturing records with ingredient lot numbers and quantities
  • In-process and finished-product testing protocols
  • Supplier qualification and incoming material verification
  • Equipment cleaning and maintenance logs
  • Personnel training records

Labeling requirements you must meet today

Required on every cosmetic label:

  • Identity of the product (what it is)
  • Net quantity of contents
  • Name and place of business of the manufacturer, packer, or distributor (the responsible person)
  • Ingredient declaration in descending order of predominance, using INCI names
  • Any required warnings or directions for safe use

Color additive exception: Every color additive used in a cosmetic must be from a batch certified by FDA or must be an approved exempt color additive. Using an unapproved or uncertified color additive makes the product adulterated by law — regardless of how safe the ingredient may be.

Common misbranding claims to avoid:

  • "Clinically proven to reduce wrinkles" (drug claim if it implies structural change)
  • "Repairs damaged DNA" (drug claim)
  • "Stimulates collagen production" (structure/function claim — drug territory)
  • "Dermatologist tested" without documentation to support it (deceptive if unsubstantiated)

Pro Tip: Run every label through a two-step review: first, a regulatory attorney screens for drug claims; second, a formulator confirms every listed ingredient matches the current formula. Do both steps every time a formula or label changes — not just at launch.

How FDA enforces cosmetic law and what penalties look like

FDA's enforcement toolkit expanded meaningfully with MoCRA. The agency can now act at multiple points in the supply chain and at multiple levels of severity.

Common enforcement actions:

  • Warning letters: The most frequent first step. Public, searchable, and damaging to brand reputation. Typically cite adulteration, misbranding, or failure to register/list.
  • Import alerts: Block shipments at the border. Foreign manufacturers who fail to register or whose products are found adulterated are common targets.
  • Seizure: Federal courts can authorize seizure of adulterated or misbranded products in commerce.
  • Injunction: Courts can prohibit a company from continuing to manufacture or distribute non-compliant products.
  • Criminal penalties: Knowing and willful violations of the FFDCA can result in criminal prosecution.
  • Mandatory recalls: MoCRA's newest tool — FDA can order a recall when a product poses a reasonable probability of serious adverse health consequences or death.

Common triggers for enforcement:

  • Asbestos contamination in talc-containing products
  • Microbial contamination (Pseudomonas, Burkholderia cepacia in water-based products)
  • Undisclosed drug ingredients (e.g., hydroquinone, tretinoin in skin-lightening products)
  • Unregistered facilities or unlisted products
  • Drug claims on cosmetic labels

Risk-mitigation measures: Conduct an annual internal audit against FDA's warning letter database to identify patterns relevant to your product categories. Maintain a dedicated regulatory affairs contact for FDA correspondence. Never ignore a Form 483 observation — respond within the timeframe FDA specifies.

A practical compliance checklist for manufacturers and distributors

A practical compliance checklist for manufacturers and distributors — overview diagram

Work through these steps in priority order. High-impact items come first.

30-day actions (High priority — do these now):

  1. Confirm all manufacturing facilities are registered in FDA's Cosmetics Direct system.
  2. Verify all products have active listings with complete ingredient declarations.
  3. Identify the responsible person for every product line and confirm their contact information is current in all submissions.
  4. Confirm you have a documented SAE intake and triage process.

60-day actions (High priority):

  1. Audit every product label for drug claims, color additive compliance, and FPLA requirements.
  2. Inventory your safety substantiation files — identify products with gaps in toxicology summaries or stability data.
  3. Establish a 60-day update protocol so formula or label changes automatically trigger a listing update review.

90-day actions (Medium priority):

  1. Implement or upgrade your batch record system to align with expected GMP requirements.
  2. Conduct supplier qualification reviews and update supplier agreements to require raw-material change notifications.
  3. Train customer-facing teams (sales, social media, customer service) on SAE recognition and escalation.

180-day actions (Medium priority):

  1. Complete a full safety substantiation review for your top 20% of SKUs by revenue.
  2. Build a distribution traceability log at the lot level for recall readiness.
  3. Schedule an internal mock audit against FDA's cosmetics inspection checklist.

Role matrix:

  • Responsible Person: Owns SAE reporting, safety substantiation records, and registration/listing accuracy.
  • Quality/Operations: Owns batch records, GMP controls, supplier qualification, and recall logistics.
  • Regulatory Affairs: Owns label review, classification decisions, and FDA correspondence.
  • Legal: Reviews drug-claim risk, recall SOPs, and enforcement response protocols.

Common compliance pitfalls and what industry usually gets wrong

The most expensive mistakes in cosmetics compliance are not obscure edge cases. They are predictable, recurring errors that show up in FDA warning letters year after year.

The biggest pitfalls:

  • Misclassifying a drug as a cosmetic. This is the leading cause of enforcement action. Teams decide classification at the marketing stage rather than R&D, after drug claims have already been embedded in promotional materials.
  • Treating registration as FDA approval. FDA does not vet the safety of registered products. A facility registration number is not a safety endorsement — communicating it as one is itself a misbranding risk.
  • Incomplete ingredient listings. Fragrance and flavor components are frequently omitted from product listings. MoCRA requires them. "Fragrance" as a catch-all is not sufficient for the product listing (though it may still appear on the consumer label under certain conditions).
  • Poor record retention. Six-year retention is the standard. Companies that purge records at three years without qualifying for the small-business exception create gaps that are indefensible in an inspection.
  • No version control on formulas. When a formula changes and the product listing is not updated within 60 days, the company is out of compliance — even if the change seemed minor.

Expert shortcuts that save time:

  • Use a centralized ingredient library (cross-referenced against your product listings) so any ingredient change flags automatically across all affected products.
  • Build your safety substantiation file template once, then replicate it for every new product at launch — not retroactively.
  • Conduct a classification review at the concept stage, before any marketing language is drafted.

Pro Tip: When FDA sends a warning letter, the public version appears on FDA's website within days. Search the warning letter database quarterly for your product categories — it is the fastest way to identify what the agency is currently prioritizing.

The regulatory trend your executive team needs to understand

The direction of FDA cosmetic oversight is unmistakable: more data, more transparency, and faster enforcement response. MoCRA's SAE reporting and product listing requirements are not just administrative — they are building a surveillance infrastructure that gives FDA real-time visibility into safety signals across the entire market.

What this means practically: companies that invest in SAE systems and searchable safety substantiation files are building a genuine competitive advantage, not just checking a compliance box. When FDA's surveillance flags a safety signal in a product category, the companies with clean, current data will navigate the response faster and with less disruption than those scrambling to reconstruct records.

The instinct to prioritize low-value labeling tweaks over SAE infrastructure is understandable — label changes are visible and feel productive. But from a risk-management standpoint, a single unmanaged SAE that escalates to a mandatory recall costs far more than a year of label compliance work. Executives should ask their regulatory teams one question: "If FDA called today requesting all SAE records and safety substantiation for our top ten SKUs, how long would it take to produce them?" The answer tells you where to invest.

QueenCompares helps you manage ingredient and label compliance faster

Keeping ingredient lists current, catching allergens before they reach a product listing, and organizing safety data across a full SKU catalog is genuinely time-consuming work. QueenCompares's Ingredient Checker and Label Scanner are built to speed up exactly that workflow — screening formulations, flagging restricted or allergen-flagged ingredients, and extracting label data into a structured format your regulatory team can actually use.

QueenCompares

The Ingredient Library gives your team a searchable reference for ingredient safety profiles, supporting the documentation work that safety substantiation requires. These tools do not replace legal or regulatory review — your responsible person and regulatory counsel still own those decisions. What they do is cut the time spent on data organization and ingredient lookups, so your team can focus on the judgment calls that actually require expertise. Head to QueenCompares and put your first product through the Label Scanner today.

Sources

Every manufacturer and distributor should have these primary sources in their regulatory folder:

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Are cosmetics regulated by FDA?

Yes. FDA regulates cosmetics under the FFDCA and, since 2022, under MoCRA — but it does not preapprove cosmetic products or ingredients before they reach consumers, with the exception of color additives.

What does MoCRA require manufacturers to do?

MoCRA requires facility registration, product listing with full ingredient disclosure, safety substantiation recordkeeping, serious adverse event reporting within 15 business days, and compliance with forthcoming GMP regulations.

Are sunscreens subject to FDA cosmetic regulations?

No. Sunscreens are regulated as OTC drugs under the FDA monograph system (M020), not as cosmetics. U.S. sunscreen regulations require active ingredient compliance with the applicable monograph, and any monograph amendments published in the Federal Register directly affect formulation and labeling obligations.

What is the 60-day update rule under MoCRA?

Any change to a facility registration or product listing — including formula revisions, label changes, or responsible person updates — must be submitted to FDA within 60 days of the change occurring.

How long must cosmetic safety records be retained?

The standard retention period under MoCRA is six years. Qualifying small businesses may be eligible for a three-year retention period, but eligibility must be confirmed before applying the shorter timeframe.