Answering the FAQs on MoCRA Compliance for Cosmetics Businesses

For cosmetics businesses that market products in the U.S., a new era of regulatory compliance is fast approaching. After many years of industry and consumer group advocacy for a revamped framework, the Modernization of Cosmetics Regulation Act (MoCRA) was signed into law at the end of 2022, and the first enforcement deadline is July 1, 2024.

As a professional who lives and breathes this market, you know this changes the face of cosmetics regulations, but unless you’ve studied the law in detail, you’ve likely got some questions about the specifics, as well as what it all means for your business. And even if you’ve done your due diligence, there may be additional considerations to take into account that you haven’t yet realized.

Knowing that MoCRA brings the first major changes to cosmetics business regulations since 1938’s Federal Food, Drug and Cosmetic Act (FDCA) was passed and significantly expands the FDA’s oversight in this space, we’re here to provide answers and offer solutions. Whether you’re wondering about your organization’s eligibility or need clarifications on the requirements, we’ve got you covered.

So, dive into this list of FAQs to learn how to best prepare your cosmetics company to meet more stringent standards. We’ll shed light on a number of matters, from the elevated expectations for registration and reporting to the enforcement timeline, and then we’ll share how industry-specific product lifecycle management (PLM) software facilitates compliance.

1. Why Is This New Law So Significant?

It's not just that it's been more than 80 years since the passing of the FDCA, but also the fact that it only provided general guidance outside of one requirement, that being that finished products be safe when used in accordance with labeling. The Fair Packaging and Labeling Act in 1966 only served to establish that products marketed to consumers in interstate commerce be honestly labeled.

Government records indicate that Congress recognized that cosmetics regulations were “in dire need of repair” as far back as 1988, but no legislation resulted from that consensus. Other legislation has been drafted in the meantime, including 2017’s Personal Care Products Safety Act, but none gained the traction or bipartisan support that was necessary for them to be made law.

The passage of MoCRA also ends the FDA’s Voluntary Cosmetic Registration Program, the previous system through which cosmetics businesses could choose to register with the administration. Guidance for the new method of registration has been issued, but we’ll cover that, as well as what’s required for registration, below.

2. How Do I Know if MoCRA Applies to My Business?

The criteria for exemption from MoCRA is fairly straightforward. Generally, the requirements apply to all cosmetics manufacturers, packers, importers and distributors in the U.S., as well as those outside the country that market their products in the U.S. However, if your U.S.-based cosmetics business has had average annual turnover under $1 million for the past three years, you could be exempt.

That said, MoCRA will likely still apply to your company if you deal in any of the following:

• Products that contact the eye’s mucus membrane

• Products that are injected

• Products that are intended for internal use

• Products that modify appearance for more than 24 hours and are not manually removed

If you’re still unsure whether your organization qualifies for exemption, ensure that you have an individual with adequate legal knowledge look into the matter for you.

3. What Does the Term “Responsible Person” Mean?

As defined by the bill, a “responsible person” is the manufacturer, packer, importer or distributor whose name, address, phone number and electronic contact information must appear on product labels. So, while the term implies it would be a single individual, it’s not—legally, it is your company, as registered with the FDA.

That said, you may find that assigning one qualified staff member or a team to serve as the leader for your MoCRA compliance may be beneficial. They can also be the point of contact between your organization and the FDA, which is important to establish given that the requirements entail much more communication between cosmetics businesses and the administration than ever was required before.

4. What Needs To Be Registered With the FDA Under MoCRA?

MoCRA requires that cosmetics businesses register both product listings and facilities with the FDA. Originally intended to take effect at the end of 2023, the deadline for such registrations has been pushed out to July 1, 2024. After that, new facilities will need to be registered within 60 days of the start of operations, and new products will need to be registered within 120 days of release.

Facility registration must be renewed biennially. The process requires:

• The facility’s name

• Physical address

• Phone number

• Email address for general inquiry

• Facility registration numbers assigned

• Brand names under which the business markets products

• Product categories served

• U.S.-specific contact, in the case of foreign facilities

Contract manufacturing facilities that manufacture or process on behalf of multiple responsible persons, including the owning business, are only required to file a single registration.

Cosmetic product registration also has to be renewed biennially, but there will be an abbreviated process for products that have not been changed since the last listing was filed. The process requires:

• Name of the product

• The product category

• A complete list of ingredients

• The facility registration of each facility where the product is manufactured or processed

• The name and contact of the “responsible person”

A single product listing can include multiple products if they have identical formulations or only differ in color, fragrance, flavor or quantity.

Lastly, there are new details to share from the FDA’s Draft Guidance on Registration and Listing of Cosmetic Product Facilities and Products. This included an announcement of a new electronic registration and listing submission portal; the establishment of FDA Establishment Identifier (FEI) to act as each facility’s registration number; and a Structured Product Labeling (SPL) Implementation Guide.

5. What Are the Additional Reporting and Records Requirements?

One of the other requirements to go into effect with the first deadline is mandatory serious adverse event reporting within 15 days of the incident. Serious adverse events are defined as any event that results in:

• Death

• Life-threatening experience

• Inpatient hospitalization

• Persistent or significant disability

• Congenital anomaly or birth defect

• Infection

• Significant disfigurement

Additionally, the “responsible person” must submit any new details and material medical information within 15 days of their receipt of the information. These records must not only be submitted to the FDA but also maintained by the reporting “responsible person” for six years, except in the case of small businesses as defined in subsection 612(b), for which the maintenance period is three years.

Also, if the FDA has reasonable grounds to believe that the ingredients in a fragrance or flavor caused the event, the administration has the right to request a detailed list of the ingredients in that fragrance or flavor within 30 days of the request.

Beyond that, cosmetics businesses are now required to establish and document safety substantiations for all of their products. These should provide an “adequate substantiation of safety,” defined as tests, studies, research, analyses or other evidence that would be considered by experts as proof of a reasonable certainty that the product is safe for use.

And further still, the FDA may now request copies of all records relating to any product that the administration has a reasonable belief to be adulterated or liable to cause a serious adverse event. This does not include exact formulations, financial data or personnel data related to those products.

6. What About Products That Are Both Cosmetics and Drugs?

Generally, MoCRA will not apply to products that are both cosmetics and drugs and the businesses that produce them, as drugs are even more strictly regulated given the potential effects they can have on a person’s health whether or not they have cosmetic properties. Drug regulations are based on the FDCA, as well as many supplementary acts like Food and Drug Administration Modernization Act of 1997.

However, if a facility manufactures or processes both products that are cosmetics and drugs as well as products that are cosmetics only, that facility and its products that are cosmetics only will be subject to all MoCRA requirements.

7. What Do the New Labeling Requirements Entail?

MoCRA establishes that all cosmetics products must bear a label that includes:

• The domestic address of the “responsible person” (likely the manufacturing facility)

• Contact phone number

• Electronic contact information for receipt of adverse event reports

Products that are intended for professional use must also bear that label. Additional guidance on labeling for fragrance allergens is due within 18 months of MoCRA’s passage.

8. How Will the FDA’s New Mandatory Recall Authority Function?

The Secretary of the FDA will first request a cessation in production and recall if the administration establishes a reasonable probability that a cosmetic product is adulterated, misbranded or liable to cause a serious adverse health consequence or death. If the "responsible person" does not comply voluntarily, the FDA can then mandate the cessation of production and recall of subject products.

An informal hearing between the “responsible person” and an FDA official will be held within 10 days of the request or order. The FDA can also mandate that the "responsible person" send a notice of the recall to all affected persons, or that they issue a detailed public notification.

9. What Is the Timeline for Enforcement of MoCRA?

The FDA’s phased approach to MoCRA enforcement allows for cosmetics companies to prepare for the new requirements, but the clock is ticking with the first deadline set for the end of 2023.

Here are the details:

• As of December 29, 2023, all applicable businesses must establish and document safety substantiations; report all adverse events; and comply with mandatory recall authority. The FDA will also issue the proposed rulemaking for standardized asbestos testing by this date, and it will be finalized within 180 days.

• As of July 1, 2024, all applicable businesses must register their facilities and product listings with the FDA. This deadline was originally set for the end of 2023, but the FDA has revised the timeline since initial publication.

• As of December 29, 2024, all applicable businesses must meet the new labeling requirements, including the incorporation of fragrance allergen disclosures, for all products. The FDA will also issue the proposed rulemaking for adherence to cosmetic Good Manufacturing Processes (GMPs).

• As of December 29, 2025, all applicable businesses will need to be able to provide proof of adherence to Cosmetics GMPs.

10. How Can Cosmetics PLM Software Support MoCRA Compliance?

A PLM solution designed specifically for cosmetics businesses can facilitate compliance with many different requirements of the new law by providing functionalities that streamline various steps in new product development (NPD). With the right system, you can manage important data required by the FDA, fine-tune your formulas in accordance with regulations and standardize manufacturing processes.

Here are some of the key features of cosmetics PLMs that support compliance with MoCRA:

• Electronic document management (EDM), which can act as a centralized, digital repository of reports, certificates and other documentation, such as safety substantiations

• Change management, which enables users to change individual formulations or several related formulations—like color variants in a single line—with simplified component replacement

• Formulation tools, which allow for precise product formulations in adherence with new ingredient-related requirements

• Manufacturing process management, which can help you establish consistent manufacturing processes that adhere to cosmetics GMPs

• Packaging development, which enable application of the new labeling requirements, including the upcoming fragrance allergen disclosures

• Compliance module, which is a dedicated module that can aid in ingredient statement creation, allergen screening and automatic generation of claims and certifications

Get Up To Speed for MoCRA Enforcement

There’s no doubt that the cosmetics industry in the U.S. will have a different look by the time all of the requirements of MoCRA have been rolled out. Regulation compliance will be a challenge given how much change the law brings, but it is entirely within your reach with proper preparation and the right software on your side.

A PLM system built for the cosmetics industry can be the difference between a rough start under the new paradigm and smooth sailing. That’s thanks to the features covered above, plus the fact that such a solution can act as a “single source of truth” for all your NPD projects and the teams involved. What’s more, a PLM can also drive greater efficiency in NPD so you can differentiate through innovation.

Aptean’s cosmetics PLM is designed with specifically cosmetics and personal care manufacturers in mind. It offers the functionalities discussed in this post and many more, and better still, it’s available via flexible cloud deployment on the Software as a Service (SaaS) model.

We’ve got even more on MoCRA and how PLM software can facilitate compliance. Take our short quiz, How MoCRA-Ready Is Your Business?, or check out our in-depth whitepaper, Navigating MoCRA: A Deep Dive Into the New Requirements and How PLM Software Supports Compliance.