For most of the last century, cosmetics were the least regulated category the FDA oversaw. A brand could formulate, fill, and sell a skincare product without registering a facility, listing the product, or reporting anything to the agency. The Modernization of Cosmetics Regulation Act of 2022, known as MoCRA, ended that era. It is the most significant expansion of FDA authority over cosmetics since the Federal Food, Drug, and Cosmetic Act of 1938, and it applies to emerging indie brands just as much as to global conglomerates. This guide explains what the law requires, who is responsible for each obligation, and how to build compliance into your product development process rather than bolting it on afterward.
A note on timing. MoCRA was signed into law in December 2022, and its core requirements have been in effect since 2024. Several implementing regulations, including the good manufacturing practice rule and fragrance allergen labeling rule, are being developed by FDA on their own timelines. This article reflects our understanding as of its publication date. Confirm current requirements with FDA's cosmetics guidance or a regulatory professional before you rely on them.
What Changed Under MoCRA
Before MoCRA, FDA's cosmetics program was largely voluntary. The Voluntary Cosmetic Registration Program existed, but participation was optional and the agency had no mandatory recall authority. MoCRA replaced that model with a framework that looks much more like what food and supplement brands already live with. The headline changes:
- Mandatory facility registration for facilities that manufacture or process cosmetic products for the U.S. market.
- Mandatory product listing for every cosmetic product marketed in the U.S., including its ingredients.
- Adverse event recordkeeping and reporting, including a deadline for reporting serious adverse events to FDA.
- Safety substantiation: brands must hold adequate evidence that each product is safe before it is marketed.
- New labeling requirements, including contact information for adverse event reporting and, once the rule is finalized, fragrance allergen disclosure.
- Mandatory recall authority for FDA when a product is adulterated or misbranded and poses a risk of serious health consequences.
- Good manufacturing practice (GMP) regulations that FDA is directed to establish for cosmetics facilities.
The "Responsible Person" Concept
MoCRA introduces a defined role called the responsible person: the manufacturer, packer, or distributor whose name appears on the product label. In practice, for a brand that uses a contract manufacturer, the responsible person is almost always the brand. Your name is on the label, so the legal obligations for product listing, adverse event reporting, safety substantiation, and labeling sit with you, not with the facility that filled the product.
This is the single most important thing for founders to understand. Choosing a well-run contract manufacturer is necessary but not sufficient. The manufacturer registers its facility. You list your products, keep your safety file, maintain your adverse event records, and make sure your label is compliant. If you assume your manufacturer is "handling MoCRA," you are probably wrong about half of it.
The Six Core Requirements
Facility Registration
Any facility that manufactures or processes cosmetics for U.S. distribution must register with FDA and renew registration every two years. Registration is done through FDA's Cosmetics Direct portal. Ask your manufacturer for their FDA Establishment Identifier (FEI) and confirm the registration is current before your first production run.
Product Listing
Each cosmetic product must be listed with FDA, including the product name, category, ingredients, and the facility where it is made. New products must be listed within 120 days of marketing, and listings must be updated annually if anything changes. Your manufacturer can submit on your behalf, but the obligation stays with you.
Adverse Event Reporting
You must keep records of every adverse event reported to you for six years (three years for qualifying small businesses). A serious adverse event, such as one resulting in hospitalization, significant disfigurement, or a medical intervention to prevent those outcomes, must be reported to FDA within 15 business days of receiving it.
Safety Substantiation
You must hold records showing "adequate substantiation" that the product is safe under its labeled or customary conditions of use. This typically means a documented safety assessment covering ingredient toxicology, formulation-level testing such as preservative efficacy and stability, and any relevant clinical or patch-test data.
Labeling
Labels must include a domestic address, domestic phone number, or electronic contact through which the responsible person can receive adverse event reports. Products for professional use only must say so. Fragrance allergen disclosure will be required once FDA finalizes its rule identifying which allergens must be declared.
Good Manufacturing Practice
MoCRA directs FDA to establish GMP regulations for cosmetics, consistent with international standards such as ISO 22716. Until a final rule is in effect, brands should treat ISO 22716 as the benchmark when evaluating manufacturers. Once the rule is final, non-compliance can render products adulterated.
The Small Business Exemption, and Its Limits
MoCRA exempts certain small businesses from the facility registration, product listing, and GMP requirements. The threshold is average gross annual sales of cosmetic products in the U.S. below $1 million over the prior three-year period, adjusted for inflation.
Two things founders often miss. First, the exemption does not cover adverse event reporting, safety substantiation, or labeling. Every brand of every size must do those. Second, the exemption is lost entirely for products in higher-risk categories, regardless of sales. Those categories include products that regularly come into contact with the mucus membrane of the eye, products that are injected, products intended for internal use, and products intended to alter appearance for more than 24 hours without removal. A tiny brand selling an eyeliner or a lash serum is not exempt.
Even when a brand qualifies, many contract manufacturers will not run product for an unlisted brand, and many retailers ask for evidence of listing during vendor onboarding. In practice, treating registration and listing as the default is the safer path for any brand with retail ambitions.
Who Does What: Brand vs. Contract Manufacturer
The most common compliance gap we see is not a brand ignoring MoCRA. It is a brand and its manufacturer each assuming the other is handling a task. Use the table below as a starting point for the conversation, and put the final division of responsibility in writing in your manufacturing agreement.
| Obligation | Contract Manufacturer | Brand (Responsible Person) |
|---|---|---|
| Facility registration | Registers and renews; provides FEI number to brand | Verifies registration is current before production |
| Product listing | May submit as an authorized agent if agreed | Legally responsible; confirms submission and keeps confirmation |
| GMP compliance | Operates the facility to GMP; maintains batch records | Audits or reviews evidence of GMP (ISO 22716 or equivalent) |
| Safety substantiation | Provides formulation data, stability, PET, and ingredient documentation | Commissions or compiles the safety assessment; retains the file |
| Adverse event handling | Reports complaints received to brand promptly | Maintains records; reports serious events to FDA within 15 business days |
| Label compliance | Applies the label; may flag obvious issues | Owns label content, claims, and required contact information |
| Recall execution | Provides lot traceability and distribution records | Leads communication and coordinates with FDA |
Building MoCRA Into Product Development
Compliance is cheap when it is planned and expensive when it is retrofitted. A few habits that keep it cheap:
Start the safety file at formula lock
The safety assessment depends on the final ingredient list at final concentrations. The moment the formula is approved, start assembling ingredient safety data, request the preservative efficacy test and stability protocol from your manufacturer, and engage a qualified safety assessor if the product warrants one. Doing this in parallel with packaging development, rather than after the first production run, keeps it off the critical path. See our formulation-to-launch timeline for where this stage sits.
Write the label with the regulation open
Beyond the standard ingredient declaration and net contents, MoCRA adds the adverse event contact requirement. A website URL alone may not satisfy it; check current FDA guidance on what qualifies as electronic contact information. Leave room on the dieline for fragrance allergen disclosure so a rule change does not force a packaging reprint.
Set up adverse event intake before launch
Decide where consumer complaints will land (a dedicated email address, a form, your customer service platform), who reviews them, how you classify "serious," and where the record lives. A simple log that captures date received, product, lot, description, and outcome satisfies the recordkeeping requirement and makes the 15-business-day clock manageable when a serious event does arrive.
Keep claims on the cosmetic side of the line
MoCRA did not change the definition of a cosmetic. A product intended to cleanse, beautify, promote attractiveness, or alter appearance is a cosmetic. A product intended to treat or prevent disease, or to affect the structure or function of the body, is a drug, and a drug claim on a cosmetic label makes the product an unapproved drug. "Reduces the appearance of fine lines" is cosmetic. "Reduces wrinkles by stimulating collagen" is not. The FTC separately requires that any claim be truthful and substantiated. Our FDA compliance guide covers claim substantiation for other categories, and the logic transfers directly.
Personal care at CalNutri: We support skincare, body care, and cosmetic brands through formulation, manufacturer selection, and launch, with MoCRA obligations mapped into the project plan from the first brief. If you are unsure which of these requirements apply to your product, that is a good first conversation to have. Tell us about your product →
A Launch Checklist
- Confirm your product is a cosmetic and not a drug, a soap under the CPSC definition, or a combination product.
- Obtain your manufacturer's FEI number and confirm their facility registration is active.
- Decide who submits your product listing, and calendar the annual update.
- Commission the safety substantiation file at formula lock; include stability and preservative efficacy results.
- Verify the label carries compliant adverse event contact information and, if applicable, professional-use language.
- Stand up an adverse event log and a review procedure before the first unit ships.
- Confirm lot traceability from raw material to finished goods so a recall, if ever needed, can be executed quickly.
- Review claims on the label, website, and social content against the cosmetic-versus-drug line.
Launching a Personal Care Product?
From formulation through manufacturer selection and launch, CalNutri builds regulatory compliance into the plan so it never becomes a surprise. Let's talk about your product.
Start the Conversation →