The enactment of the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) represents the most significant expansion of the U.S. Food and Drug Administration’s (FDA) regulatory authority over the cosmetic industry since 1938. For decades, cosmetic manufacturers operated within a framework that relied largely on self-policing, with the FDA possessing limited enforcement tools to intervene before products reached the market.
MoCRA effectively ends that era. By codifying affirmative requirements for safety substantiation and mandating the adoption of Good Manufacturing Practices (GMP), the legislation shifts the burden of proof squarely onto the “responsible person.” For businesses operating in this space, regulatory compliance is no longer a best practice—it is a condition of market access.
The Paradigm Shift: Affirmative Safety Substantiation
Prior to MoCRA, the absence of a mandate to provide proof of safety often led to a reactive regulatory posture. Under the new statutory regime, a cosmetic product is deemed adulterated if it is manufactured or processed under conditions that do not comply with safety standards, or if the responsible person lacks “adequate substantiation of safety.”
In the eyes of the FDA, “substantiation” is not a nebulous concept; it is an evidentiary requirement. It requires a body of data—tests, studies, research, or other evidence—that would be considered sufficient by experts qualified by scientific training and experience to evaluate the safety of the product. This means that if the FDA issues a request for your safety records, you must be prepared to present a robust, scientific justification that addresses the product’s intended use and its foreseeable misuse under customary conditions.
The law is intentionally flexible regarding methodology, acknowledging that one size does not fit all in the vast cosmetic landscape. However, flexibility should not be confused with leniency. Responsible persons should be prepared to leverage a multifaceted data strategy, which may include:
- Toxicological Profiles: Comprehensive assessments of individual ingredients, focusing on cumulative exposure risks.
- Clinical Data: Dermatological patch testing and human repeat insult patch tests (HRIPT) to evaluate irritation and sensitization potential.
- Scientific Literature: Peer-reviewed meta-analyses of ingredient safety, particularly for materials with long histories of use.
- Expert Attestations: Formalized safety reports signed by toxicologists or board-certified cosmetic chemists.
The Architecture of Compliance: The Safety Dossier
While MoCRA does not explicitly mandate a specific format, the industry is coalescing around the Cosmetic Product Safety Report (CPSR) model—a standard long utilized in the European Union. A defensible dossier should act as a single source of truth during an FDA inspection.
At a minimum, these reports must be rigorous enough to withstand scrutiny from federal investigators who are increasingly focused on supply chain transparency and ingredient purity. A well-constructed dossier typically includes:
- Product Identity: Full ingredient disclosure, including concentration levels and the function of each ingredient.
- Physicochemical Analysis: Data regarding stability, pH, and microbiological integrity.
- Toxicological Assessment: A deep dive into systemic toxicity, skin sensitization, and the potential for cumulative effects based on daily usage patterns.
- Expert Conclusion: A signed statement from a qualified individual asserting that the product is safe under the specified conditions.
Retention is equally critical. These records must be maintained for six years, a window that aligns with the FDA’s long-term enforcement strategy.
Good Manufacturing Practices: Aligning with Global Standards
Perhaps the most operationally demanding component of MoCRA is the directive for the FDA to promulgate mandatory Good Manufacturing Practice (GMP) regulations. While the final rules are currently in development, the trajectory is clear: the FDA is looking toward international standards like ISO 22716 as a baseline.
If your firm is currently operating in a vacuum of formal manufacturing standards, now is the time to pivot. Anticipated requirements will likely touch every aspect of the production lifecycle:
- Environmental Controls: Rigorous monitoring of facilities to prevent cross-contamination and ensure the sanitation of production lines.
- Supplier Qualification: The “responsible person” is now effectively accountable for the quality of their raw materials. This necessitates a proactive supplier audit program to verify the purity and safety of incoming ingredients.
- Laboratory Controls: Mandated finished-product testing to ensure batch-to-batch consistency and the absence of prohibited contaminants, such as heavy metals or microorganisms.
- Personnel Hygiene and Training: Documented proof that all employees involved in production have received adequate training and follow established SOPs (Standard Operating Procedures).
Strategic Implementation: A Roadmap for Stakeholders
Compliance under MoCRA is an iterative process that requires cross-departmental coordination between legal, product development, and supply chain teams.
First, conduct a comprehensive safety audit. Inventory every SKU currently in your portfolio. Identify products with “thin” documentation and prioritize them for toxicological review. A product currently lacking a formal safety dossier is a liability that should be addressed immediately.
Second, establish an expert network. MoCRA emphasizes the role of the “qualified” assessor. Ensure that the experts you retain possess the necessary toxicological credentials to testify to the safety of your formulations in the event of an agency inquiry.
Third, synchronize with your manufacturing partners. If you utilize contract manufacturers, their facilities are now part of your regulatory ecosystem. Review your manufacturing agreements to ensure that they include provisions for GMP compliance, audit access, and the sharing of batch documentation.
Finally, treat compliance as a continuous cycle. MoCRA is not a “check-the-box” exercise; it is an ongoing obligation to monitor safety, manage adverse event reports, and keep records current. By integrating these practices into your corporate DNA, you not only satisfy the FDA’s stringent new mandates but also enhance consumer trust—a vital currency in today’s competitive market.
The era of regulatory ambiguity has passed. Companies that proactively adapt to the standards set forth by MoCRA will find themselves better positioned to weather the increased oversight of the modern regulatory landscape.