What "Safety Substantiation" Actually Means Under MoCRA
The Modernization of Cosmetics Regulation Act (MoCRA) requires every "responsible person" for a cosmetic product — generally the brand owner whose name is on the label — to maintain records that provide "adequate substantiation" that the product is safe. This is not a request for a specific test or a specific document. It is a performance standard: the file must contain tests, studies, research, analyses, or other evidence that a qualified expert (think toxicologist or cosmetic chemist) would consider sufficient to support a safety conclusion.
For indie founders, the good news is this: MoCRA does not require you to run a clinical trial, fund a dermatologist-supervised human study, or replicate what a multinational conglomerate does before launching a serum. What it requires is a defensible, well-organized paper trail showing that you thought seriously about safety and backed that thinking with real evidence.
Step 1: Understand What the FDA Expects — and What It Doesn't
FDA has been clear that "adequate substantiation" is flexible and risk-based. A rinse-off shampoo with common, well-studied ingredients needs a thinner file than a leave-on eye cream with a novel peptide complex. Before you build anything, categorize your product by:
- Route of exposure (rinse-off vs. leave-on vs. eye area vs. mucous membranes)
- Novelty of ingredients (well-established vs. emerging actives)
- Vulnerable-population exposure (children's products, products marketed for pregnancy, etc.)
This risk tier determines how much evidence you actually need — don't over-invest in testing a basic bar soap, and don't under-invest in a tingling lip plumper.
Step 2: Build Your Ingredient Safety Dossier First
Most safety substantiation work happens at the ingredient level before you ever touch the finished formula. For each ingredient, collect:
- The Cosmetic Ingredient Review (CIR) safety assessment, if one exists
- Any relevant GRAS (Generally Recognized as Safe) determinations from food or drug contexts
- Published, peer-reviewed toxicology or dermatology literature
- Safety Data Sheets (SDS) and supplier Certificates of Analysis
- Historical use data — ingredients with decades of safe cosmetic use carry real evidentiary weight
Supplier-provided Ingredient Safety Dossiers or Technical Data Sheets are legitimate substantiation evidence, provided they come from a reputable manufacturer and you keep the documentation on file rather than just taking a sales rep's word for it.
Step 3: Use "Read-Across" and Analog Reasoning Strategically
When an ingredient lacks its own dedicated study, qualified experts often rely on "read-across" — using safety data from structurally or functionally similar, well-studied compounds to infer safety for the ingredient in question. This is a recognized toxicological method, not a shortcut around the law. Document the analog ingredient, the structural or mechanistic similarity, and the expert reasoning connecting the two. This single technique can eliminate the need for expensive de novo testing on many botanical extracts and minor formulation tweaks.
Step 4: Fill Gaps With Targeted, Affordable Testing
You do not need a six-figure clinical trial, but some testing is genuinely hard to substitute:
- Patch testing / HRIPT (Human Repeat Insult Patch Test): Often available through independent labs for a few thousand dollars on a small panel — appropriate for leave-on or novel-ingredient products.
- Microbial and preservative efficacy testing (PET): Confirms your preservative system actually works; this protects against contamination-related safety claims, a frequent source of real-world cosmetic harm.
- Stability testing: Confirms the product remains safe and performs as expected over its intended shelf life.
- In vitro assays: Lower-cost alternatives to animal or clinical testing for irritation and sensitization screening.
Shop these out to accredited independent labs rather than relying solely on in-house impressions. A lab report with a methodology section carries far more weight than an internal memo.
Step 5: Document Formulation and Manufacturing Controls
Safety isn't just about ingredients — it's about consistency. Your file should include:
- Finalized formulation sheets with exact concentrations
- Batch records showing the product was actually made as formulated
- Manufacturing facility good manufacturing practice (GMP) documentation
- Packaging compatibility data, especially for actives sensitive to light, air, or pH drift
A beautifully substantiated formula is worthless if your contract manufacturer deviates from it without anyone noticing.
Step 6: Write an Expert-Reviewed Safety Assessment Summary
This is the capstone document — a written narrative, ideally reviewed or signed off by a qualified toxicologist or cosmetic chemist, that ties everything together: ingredient-level data, read-across reasoning, testing results, intended use, and risk-tier justification. Many independent cosmetic safety consultants offer this review service affordably for small brands, and it converts your scattered evidence into the kind of coherent expert conclusion FDA is actually looking for.
Step 7: Organize the File So It's Audit-Ready
FDA can request records during an inspection, and you may have as little as a short statutory window to produce them. Organize your substantiation file by product (not by ingredient) with:
- A one-page summary sheet per product
- Supporting documents indexed and dated
- Version control noting any reformulation history
A disorganized file undermines even strong underlying science.
Step 8: Treat the File as a Living Document
Reformulations, new suppliers, new claims, or new adverse event reports all trigger the need to revisit substantiation. Build a habit of updating the file whenever the formula or labeling changes — not just at launch.
A Note on Small Business Exemptions
MoCRA's limited exemptions for smaller businesses apply primarily to facility registration and product listing obligations. They do not exempt a responsible person from the safety substantiation requirement, which applies regardless of company size. Founders sometimes assume "small business" status offers broader relief than it actually does — don't make that mistake.
Final Thoughts
Building a MoCRA-compliant safety substantiation file is methodical, not magical. Lean on existing science, use read-across reasoning where appropriate, fill genuine gaps with targeted independent testing, and package everything into an expert-reviewed narrative. Done right, this process is well within reach of a resource-constrained founder — and it becomes a genuine asset, not just a compliance burden, the moment a retailer, investor, or regulator asks you to prove your product is safe.