The Regulatory Signal Beneath the Numbers
When a federal agency publishes updated burden-hour estimates under the Paperwork Reduction Act, the figures themselves rarely make headlines. Yet for cosmetic manufacturers, distributors, and responsible persons preparing for full implementation of the Modernization of Cosmetics Regulation Act (MoCRA), the FDA's recent recalibration of its safety substantiation burden estimates deserves close scrutiny. These numbers are not bureaucratic housekeeping—they are a window into how the agency expects companies to demonstrate compliance, and they foreshadow the intensity of enforcement scrutiny likely to follow.
MoCRA, enacted in December 2022, fundamentally altered the cosmetics regulatory landscape by requiring, among other things, that responsible persons maintain records supporting a reasonable basis to conclude that a cosmetic product is safe. The statute itself is relatively spare on the mechanics of "safety substantiation." It has fallen to FDA's implementing guidance—and now its burden estimates—to fill in the operational details. Companies that read these estimates carefully will find a roadmap to what the agency actually expects in a product file.
What the Burden Estimates Reveal
FDA's burden-hour calculations, submitted as part of its Information Collection Request process, translate abstract regulatory obligations into concrete time investments. When the agency estimates that a typical responsible person will need a substantial number of hours per product to compile, review, and maintain safety substantiation records, it is implicitly describing the scope and depth of documentation it considers adequate.
Several themes emerge from the latest estimates:
- Volume of data per SKU. The estimates assume that safety substantiation is not a one-time exercise but an ongoing file that grows with each formulation change, new ingredient, or updated toxicological study.
- Integration of multiple data streams. FDA's calculations account for time spent reconciling supplier certificates of analysis, ingredient safety data, historical use data, and any adverse event correlations—suggesting the agency expects a synthesized narrative, not a folder of disparate documents.
- Recurring review cycles. The burden hours are not front-loaded entirely into initial compliance; they anticipate periodic reassessment, particularly where formulations are reformulated or new scientific literature emerges.
Taken together, these assumptions indicate that FDA views safety substantiation as a living compliance function requiring dedicated resources, not a static checkbox satisfied at product launch.
From Compliance Checkbox to Data Infrastructure
The practical implication for cosmetic companies is significant: safety substantiation is evolving from a legal formality into a data governance obligation. Companies that previously relied on informal ingredient safety files or decades-old cosmetic industry precedent will need to reassess whether their documentation practices meet the more rigorous standard implied by FDA's own time-and-resource projections.
This shift tracks a broader pattern across FDA-regulated industries, where the agency has increasingly expected regulated parties to maintain structured, retrievable, and defensible data trails. In the drug and device context, this evolution took years and substantial enforcement activity to mature. MoCRA compresses that timeline considerably, particularly given the 2026 compliance horizon for related requirements such as facility registration renewals and product listing updates.
Key Questions for Responsible Persons
Companies preparing for 2026 compliance should consider several strategic questions in light of the burden estimates:
- Does our current safety file for each product reflect a genuine "reasonable basis" for safety, supported by adequate and reliable scientific evidence, or does it rely on general industry assumptions?
- Are we prepared to document not just the existence of safety data, but the process by which that data was evaluated and deemed sufficient?
- Do we have a system for tracking formulation changes and triggering corresponding updates to safety substantiation files?
- Have we allocated internal resources—legal, regulatory, and scientific—commensurate with the time investment FDA itself projects as necessary?
Companies that treat these questions as compliance afterthoughts risk finding themselves unprepared not only for FDA inspection, but for the private litigation exposure that increasingly follows regulatory noncompliance in the consumer products space.
Enforcement and Litigation Implications
The burden estimates also carry indirect litigation significance. Plaintiffs' counsel in consumer protection and product liability actions frequently look to regulatory frameworks to establish standards of care. If FDA's own estimates reflect an expectation of rigorous, data-intensive substantiation, a company's failure to meet that baseline could become powerful evidence in litigation—independent of any formal FDA enforcement action.
Moreover, as MoCRA's serious adverse event reporting requirements interact with safety substantiation obligations, companies should anticipate that any adverse event will trigger scrutiny not just of the incident itself, but of the underlying safety file that existed at the time the product was marketed. A thin or outdated substantiation record could materially weaken a company's litigation posture.
Preparing for 2026: A Practical Path Forward
With the compliance horizon approaching, cosmetic companies should consider a structured gap analysis now rather than later. This includes:
- Auditing existing safety files against the depth and structure implied by FDA's burden methodology.
- Establishing internal protocols for updating substantiation records in response to formulation changes or emerging science.
- Training regulatory and quality teams on the evidentiary standard "reasonable basis" is likely to require in practice, not merely in statutory text.
- Engaging counsel early to align documentation practices with both regulatory expectations and potential litigation exposure.
Conclusion
FDA's burden estimates are more than an administrative artifact—they are a quantified expression of regulatory expectation. Companies that read between the lines now, rather than waiting for enforcement guidance or adverse inspection findings, will be far better positioned as the 2026 compliance deadline approaches. In an increasingly data-driven regulatory environment, the depth of a company's safety substantiation file may prove to be one of its most consequential compliance assets.