Startup cosmetic founders often hear a comforting rumor: "We're too small for FDA regulation." That rumor is dangerous half-truth. The Modernization of Cosmetics Regulation Act (MoCRA), signed into law in December 2022, does carve out exemptions for "small businesses" from certain registration and Good Manufacturing Practice (GMP) requirements. But those exemptions are narrow, conditional, and do not touch the two obligations most likely to end a startup's existence overnight: safety substantiation and serious adverse event reporting.
As a firm that advises emerging beauty and personal care brands, we see founders conflate "exempt from registration" with "exempt from liability." That confusion is the trap. Below are the ten things every indie cosmetic founder must understand before another product ships.
1. The Small Business Exemption Is Not a Blanket Pass
MoCRA defines a "small business" generally as a company with average gross annual sales under $1 million in the prior three years (adjusted for inflation by FDA). If you qualify, you may be exempt from facility registration and product listing requirements, and from certain GMP recordkeeping. But the statute explicitly carves back in companies that manufacture or process specific higher-risk product categories, including products that regularly contact the eye area, are injected, are intended for internal use, or alter appearance for more than 24 hours (think certain eyelash and hair-coloring products). Many indie brands wrongly assume size alone guarantees exemption.
2. Safety Substantiation Applies to Everyone
Regardless of revenue, MoCRA requires every "responsible person" — generally the manufacturer, packer, or distributor whose name appears on the label — to maintain "adequate substantiation" that each product is safe for its intended use. This is not optional, and there is no small business carve-out. Substantiation can include toxicological data, published safety studies, ingredient history, or testing. If you cannot produce this file during an FDA inspection or in litigation, you are exposed regardless of your company's size.
3. "Safe" Has a Specific Legal Meaning
Under MoCRA, a cosmetic is not required to be risk-free, but it must be shown safe under conditions of use that are customary or reasonably foreseeable — including foreseeable misuse. Founders frequently underestimate this standard, assuming informal supplier assurances are enough. They are not. Your substantiation file must reflect analysis tied to your specific formulation, not generic claims borrowed from an ingredient supplier's data sheet.
4. Serious Adverse Event Reporting Is Mandatory, No Exceptions
MoCRA requires responsible persons to report serious adverse events to FDA within 15 business days of receiving the report, with an additional 15 days permitted for follow-up medical information. "Serious adverse event" includes death, hospitalization, significant disfigurement, a congenital anomaly, or any event requiring medical intervention to prevent such outcomes. This duty applies to small businesses exactly as it applies to multinational conglomerates. There is no exemption based on company size, funding stage, or product category.
5. You Need a Real Adverse Event Intake System
Many startups route complaints through a generic customer service inbox or a social media DM, with no formal escalation protocol. That is a compliance failure waiting to surface. You need a documented process: how complaints are logged, who evaluates medical severity, and how the 15-business-day clock is tracked. Founders should assume regulators will ask for this system during any inspection, and plaintiffs' counsel will ask for it during litigation discovery.
6. Your Label Must List a U.S. Contact
MoCRA requires cosmetic labels to include contact information — domestic address, phone number, or electronic contact — so consumers can report adverse events directly to you. This is not cosmetic (pun intended); it's foundational to the adverse event reporting pipeline. Missing or outdated contact information can itself trigger misbranding concerns.
7. Fragrance and Flavor Allergen Disclosure Is Coming
FDA is required to issue regulations identifying fragrance allergens that must be disclosed on labels, aligning more closely with international standards like the EU's. Founders formulating today should anticipate disclosure obligations rather than treating fragrance ingredients as a permanently protected trade secret shield.
8. Talc and PFAS Testing Carry Heightened Scrutiny
MoCRA directs FDA to issue regulations establishing testing methods for asbestos in talc-containing products and to assess the use of PFAS in cosmetics. Brands using talc, mineral-based powders, or certain water-resistant formulations should proactively document testing now, rather than waiting for enforcement guidance to catch them unprepared.
9. Recordkeeping Survives Even If Registration Doesn't
Even small businesses exempt from registration must retain safety substantiation and adverse event records and produce them upon FDA request. Treat these files as you would financial records for a tax audit: organized, dated, and retrievable within days, not weeks.
10. Exemption Status Can Change Overnight
Revenue growth, a new product line crossing into an exempt-ineligible category, or a change in manufacturing relationship can instantly eliminate your small business exemption. Founders should reassess exemption status at least annually, ideally alongside financial statement preparation, so compliance obligations scale with the business rather than trailing behind it.
The Bottom Line
MoCRA's small business exemptions offer genuine relief from certain administrative burdens, but they were never designed to excuse startups from the core safety infrastructure that protects consumers — and protects founders from catastrophic liability. Treat substantiation files and adverse event protocols as foundational business infrastructure, not back-office paperwork. The brands that survive FDA scrutiny and product liability exposure will be the ones that built compliance into their operations before they needed it, not after an adverse event report lands on their desk.