The New Reality: Records Access Without Notice
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) fundamentally altered the FDA's posture toward the cosmetics industry. For the first time, the agency possesses explicit statutory authority to access and copy records related to a cosmetic product when it has a reasonable belief that the product is adulterated or misbranded and presents a threat of serious adverse health consequences or death.
This is not a theoretical power. FDA field offices have integrated Remote Regulatory Assessments (RRAs) into their standard compliance toolkit, and cosmetics companies are increasingly finding themselves on the receiving end of digital records requests that arrive with little warning and tight response deadlines.
Unlike the voluntary, cooperative posture that historically characterized FDA-cosmetics interactions, MoCRA's records access provision carries teeth. Refusal to permit access, when the statutory trigger has been met, constitutes a prohibited act under the Federal Food, Drug, and Cosmetic Act, exposing companies to injunctive relief, seizure actions, and other enforcement remedies.
What RRAs Actually Look Like in Practice
Remote Regulatory Assessments emerged from FDA's pandemic-era adaptations and have since become a permanent fixture of the agency's oversight architecture. In the cosmetics context, RRAs typically involve:
- Written requests for electronic production of specific categories of records, often with response windows of five to fifteen business days.
- Video-based facility walkthroughs conducted in lieu of, or as a precursor to, an in-person inspection.
- Requests for real-time access to document management systems, quality databases, or safety substantiation files.
- Follow-up interviews with quality assurance, regulatory affairs, or manufacturing personnel conducted by phone or videoconference.
Because RRAs are conducted remotely, companies often experience a false sense of informality. That perception is dangerous. Statements made during an RRA interview, and documents produced in response to an RRA request, can be used to support subsequent enforcement action just as readily as materials gathered during an on-site inspection.
The Scope of Records FDA May Demand
MoCRA's records access authority is not unlimited, but it is broad. FDA may request records that relate to:
- Safety substantiation supporting the reasonable safety of a cosmetic product.
- Adverse event records, including reports of serious adverse events that trigger the mandatory 15-business-day reporting requirement.
- Facility registration and product listing information.
- Records demonstrating compliance with the forthcoming Good Manufacturing Practice regulations FDA is developing under MoCRA.
Notably, the statute limits this authority to circumstances involving a reasonable belief of adulteration or misbranding tied to serious health risk. FDA cannot invoke this provision as a general auditing mechanism absent that predicate. Companies should scrutinize every records request against this statutory threshold rather than assuming any FDA inquiry automatically triggers full-disclosure obligations.
Legal Strategies for Managing Disclosure Risk
Sophisticated brands should treat RRA preparedness as a governance function, not merely a regulatory affairs task. Several strategies materially reduce legal exposure.
Establish a records response protocol before a request arrives. Companies should designate a single point of contact, typically outside counsel or in-house regulatory counsel, authorized to receive and triage FDA communications. Ad hoc responses from operational personnel create inconsistent positions and inadvertent admissions.
Distinguish between voluntary and compelled production. Not every FDA request rests on the statutory records-access trigger. Counsel should assess whether the agency has articulated a reasonable belief of adulteration or misbranding connected to serious health consequences. Where that predicate is absent, the company retains greater latitude to negotiate scope, timing, and format.
Apply privilege review before production. Digital production formats make it easy to over-disclose. Legal teams should implement a privilege screening layer for any RRA response, ensuring that communications with counsel, internal risk assessments, and draft safety substantiation documents are appropriately withheld or logged, subject to any applicable exceptions.
Maintain organized, audit-ready safety substantiation files. MoCRA's safety substantiation requirement is only meaningful if the underlying documentation can be produced quickly and coherently. Companies should maintain substantiation files in a format that maps directly to FDA's likely request categories, reducing both response time and the risk of incomplete production.
Train personnel on RRA interview conduct. Employees participating in remote interviews should understand that their statements are transcribed, quoted, and potentially used as evidence. Pre-interview briefings, conducted with counsel, should clarify permissible scope and establish protocols for deferring questions outside an employee's authority.
Document the RRA process contemporaneously. Companies should maintain their own record of what was requested, what was produced, and what representations were made by FDA personnel regarding scope and purpose. This internal record proves invaluable if a dispute later arises over the adequacy or voluntariness of production.
Positioning for the GMP Rulemaking Ahead
FDA's forthcoming Good Manufacturing Practice regulations will likely expand the categories of records subject to routine review, further increasing RRA frequency. Brands that build disciplined, defensible records governance now will be better positioned to manage both current enforcement activity and the compliance obligations the GMP rule will impose.
The Bottom Line
MoCRA's records access authority represents a structural shift in FDA's relationship with the cosmetics industry, one that rewards preparation and penalizes improvisation. Counsel and compliance leadership should treat every RRA notice as a legally consequential event requiring immediate, coordinated response, not a routine administrative inquiry to be handled by whichever employee happens to answer the email.