MoCRA's New Liability Architecture for Cosmetics Supply Chains
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) has fundamentally altered the compliance calculus for cosmetics brands and the contract manufacturers who produce their products. For the first time, federal law imposes affirmative safety substantiation, adverse event reporting, facility registration, and forthcoming Good Manufacturing Practice (GMP) obligations on the cosmetics industry. These obligations do not simply layer onto existing commercial relationships—they require brands and contract manufacturers to renegotiate who bears regulatory risk, who controls compliance documentation, and who answers to FDA when something goes wrong.
For companies operating under legacy manufacturing and supply agreements drafted before MoCRA's enactment, the gap between contractual assumptions and regulatory reality has become a material liability exposure. Sophisticated parties are now revisiting these agreements with a specific focus on indemnification, audit rights, and record-sharing provisions.
The Responsible Person Designation and Why It Matters Contractually
MoCRA introduces the concept of a "Responsible Person"—generally the manufacturer, packer, or distributor whose name appears on the product label—who bears primary regulatory accountability. This entity must maintain safety substantiation files, report serious adverse events to FDA within fifteen business days, and cooperate with FDA recordkeeping requests.
Critically, the Responsible Person is typically the brand, not the contract manufacturer, even though the contract manufacturer often possesses the technical data underlying safety substantiation. This creates a structural asymmetry: regulatory liability sits with one party while operational knowledge and documentation often sit with another.
Well-drafted agreements must therefore:
- Expressly identify which party is the Responsible Person under MoCRA and confirm label control accordingly.
- Obligate the contract manufacturer to generate, retain, and promptly transmit data necessary for the brand's safety substantiation obligations.
- Address scenarios involving private label or white-label arrangements, where responsibility can shift depending on labeling control.
Reallocating Liability Through Indemnification
Indemnification clauses drafted before MoCRA rarely contemplate the statute's specific compliance failures—inadequate safety substantiation, failure to report adverse events, GMP nonconformance, or defective recordkeeping. Generic "defective product" indemnification language is insufficient to address these distinct regulatory failure modes.
Revised agreements should include indemnification provisions that separately address:
- Manufacturing-origin failures, such as contamination, mislabeling, or GMP violations attributable to the contract manufacturer's facility or processes.
- Brand-origin failures, such as inadequate safety substantiation review, marketing claims unsupported by data, or failure to timely report adverse events received directly by the brand.
- Shared or ambiguous failures, where causation is unclear—for example, when a formulation defect could stem from either the brand's specification or the manufacturer's execution.
Counsel should also negotiate caps, baskets, and survival periods that reflect the realistic timeline of cosmetics regulatory exposure, including FDA's ability to request records going back multiple years and the potential for delayed adverse event reporting to surface liability long after a product has left the shelf.
Audit Rights and GMP Readiness
FDA's forthcoming GMP regulations for cosmetics will formalize inspection expectations that many contract manufacturers have historically treated as discretionary best practices. Supply agreements should be updated to ensure brands retain meaningful audit rights, including:
- The right to conduct scheduled and, in limited circumstances, unannounced facility audits.
- Access to batch records, equipment maintenance logs, and quality control documentation sufficient to demonstrate GMP conformance.
- A defined corrective action process, with timelines, when an audit identifies deficiencies.
- Contractual consequences—up to and including termination rights—for repeated or unremediated GMP failures.
Contract manufacturers, for their part, should negotiate reasonable audit scope and frequency limitations, confidentiality protections for proprietary processes, and clarity regarding which party bears the cost of remediation when deficiencies are identified.
Record-Sharing Obligations Across the Supply Chain
MoCRA's recordkeeping requirements extend beyond the Responsible Person's own files. FDA has authority to request records related to adverse events and safety substantiation, and the Responsible Person must be able to produce them promptly. When manufacturing data resides with a third-party contract manufacturer, the brand's ability to comply depends entirely on contractual record-sharing mechanisms.
Agreements should specify:
- Categories of records the contract manufacturer must generate and retain, including formulation documentation, testing data, and batch production records.
- Response timeframes for record requests, calibrated to satisfy FDA's own regulatory deadlines rather than generic commercial norms.
- Data format and retention period requirements, ensuring records remain accessible and legible for the duration required under MoCRA and any applicable state law.
- Post-termination access rights, so that a brand can retrieve historical records even after the manufacturing relationship ends.
Coordinating Adverse Event Reporting
Because adverse event reports may originate from consumers, retailers, or the manufacturer itself, agreements should establish a clear notification chain requiring the contract manufacturer to forward any adverse event information to the brand within a defined, short window—well inside MoCRA's fifteen-business-day reporting deadline. Ambiguity here is one of the most common and avoidable sources of compliance failure.
Insurance and Practical Risk Transfer
Indemnification is only as valuable as the counterparty's ability to satisfy it. Brands should require contract manufacturers to maintain product liability and, where appropriate, regulatory defense insurance with limits calibrated to the scale of production, and should confirm additional insured status where feasible.
Conclusion
MoCRA has converted cosmetics supply agreements from largely commercial documents into instruments of regulatory risk allocation. Brands and contract manufacturers that fail to update indemnification, audit, and record-sharing terms are operating with contractual frameworks that no longer match their statutory exposure. Proactive renegotiation—undertaken with precise attention to Responsible Person status, GMP audit rights, and recordkeeping logistics—is now a baseline compliance necessity rather than a discretionary best practice.