MoCRA GMP Compliance: Registration, Records, Safety Proof

Most cosmetic companies I talk to think of FDA oversight the way they think of the weather: something that happens to the pharmaceutical industry, not to them. That assumption held up reasonably well for seventy years. Then Congress passed the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), signed into law on December 29, 2022 as part of the Consolidated Appropriations Act, 2023, and the cosmetics industry got its first meaningful federal compliance framework since the Federal Food, Drug, and Cosmetic Act of 1938.

If you manufacture, pack, or hold responsibility for the label on a cosmetic product sold in the United States, MoCRA now touches your facility registration, your product records, your adverse event files, and — once FDA finalizes the rule — your manufacturing controls. I've watched a lot of consumer goods companies underestimate how much this changes. It's not just a new form. It's a new relationship with FDA, and it rewards the companies that build the recordkeeping habit early.

This guide walks through what's actually required today, what's coming, and how to build a file that would survive an FDA request without a scramble.

Who MoCRA Actually Applies To

MoCRA's obligations attach to two related but distinct actors: the facility and the responsible person.

A facility is any establishment that manufactures or processes cosmetic products for distribution in the United States, including contract manufacturers and repackagers. The responsible person is the manufacturer, packer, or distributor whose name appears on the product label under 21 CFR 701.12 — in practice, whoever owns the brand and controls what the label says.

Both roles carry separate obligations. The facility registers. The responsible person lists products, substantiates safety, and reports adverse events. A private-label brand that outsources manufacturing entirely is still the responsible person and still owes FDA a safety file, even if it never touches a mixing tank.

Facility Registration Requirements

Every facility that manufactures or processes cosmetics for the US market must register with FDA through the agency's electronic portal, Cosmetics Direct. Registration requires the facility's name, address, contact information, and the brand names of the cosmetic products manufactured or processed there.

FDA originally set the registration and listing compliance date at December 29, 2023, one year after enactment. The agency later exercised enforcement discretion and pushed the practical compliance date to July 1, 2024, after industry raised concerns about the readiness of the Cosmetics Direct submission system. New facilities that begin manufacturing after that date must register within 60 days of starting operations.

Registration is not a one-time event. Facilities must renew their registration every two years, during the window between October 1 and December 31 of each even-numbered year. Miss the renewal window and the registration expires — which means you're back to square one on an initial registration, not a late renewal.

Product Listing Requirements

Separately from facility registration, the responsible person must submit a product listing for each cosmetic product marketed in the US. The listing includes the product's name, category, ingredient list, and the facility or facilities where it's manufactured. Products marketed before the July 1, 2024 compliance date needed to be listed by that date; products first marketed afterward must be listed within 120 days of entering the market.

Listings need to be updated when there's a material change to the product's formulation. I tell clients to build listing updates into their formulation change control process directly — if a new claim or fragrance reformulation goes through your quality system, the MoCRA listing update should be a line item on the same change form, not a separate task someone remembers three months later.

The Small Business Exemption — And Its Limits

MoCRA exempts small businesses from facility registration, product listing, and (once finalized) the GMP rule. A small business is defined as one with average gross annual sales in the United States of cosmetic products under $1,000,000 over the prior three-year period.

That exemption sounds broad until you read the carve-outs. It does not apply to facilities or responsible persons dealing in products that:

• Regularly come into contact with the mucus membrane of the eye
• Are injected
• Are intended for internal use
• Are intended to alter appearance for more than 24 hours and aren't intended to be removed by the consumer under ordinary conditions of use

That last category sweeps in things like certain hair dyes, chemical hair relaxers, and semi-permanent color products regardless of the manufacturer's revenue. A $200,000-a-year indie brand selling a permanent hair color does not get the small business pass. This is the single most common misunderstanding I run into with small cosmetics manufacturers — they hear "small business exemption" and stop reading.

Safety Substantiation: The Part Most Companies Get Wrong

MoCRA requires the responsible person to ensure there is "adequate substantiation of safety" for each cosmetic product, and to maintain records supporting that substantiation. The statute defines adequate substantiation as tests, studies, research, analyses, or other evidence. The bar: would experts qualified by scientific training and experience consider that evidence sufficient to support a reasonable certainty that the product is safe under its labeled or customary conditions of use?

Notice what that definition does not require: it doesn't mandate animal testing, and it doesn't specify a fixed battery of tests. What it requires is a reasoned, documented judgment — built on real evidence — that a qualified toxicologist or safety assessor would sign their name to. In practice, an adequate substantiation file usually includes:

• A full ingredient safety review, ingredient by ingredient, referencing published toxicology data, CIR (Cosmetic Ingredient Review) panel conclusions where available, and any relevant regulatory restrictions
• Product-level testing appropriate to the use — patch testing, microbiological challenge testing, stability testing, and for leave-on or eye-area products, ophthalmological or dermatological assessment where warranted
• A written safety assessment, signed by a qualified individual, that ties the ingredient and product data together into an actual safety conclusion

The mistake I see most often is treating "we've never had a complaint" as substantiation. It isn't. The statute asks what a qualified expert would find sufficient looking at the evidence in front of them, not what your customer service inbox has or hasn't received. If FDA asks for your safety file during an inspection or in response to an adverse event, an empty binder with a marketing claim stapled to the front is not going to hold up.

Adverse Event Reporting and Recordkeeping

MoCRA requires the responsible person to report serious adverse events to FDA within 15 business days of receiving the report. A serious adverse event is one resulting in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability, a congenital anomaly, or one requiring medical or surgical intervention to prevent one of those outcomes. If the responsible person receives new and material medical information about a previously reported serious adverse event, that update also has to reach FDA within 15 business days — and this follow-up obligation runs for one year after the initial report.

Records supporting adverse event reports, along with your safety substantiation file, must be retained for six years. Small businesses get a shortened three-year retention period, but remember: if your product falls into one of the exception categories above, you don't get the small-business relief on the timeline either.

Build a simple intake system now if you don't have one. Every customer complaint that mentions a skin reaction, an injury, or a medical visit needs a documented triage step: is this a serious adverse event under the statute, does it trigger the 15-business-day clock, and is it filed where you can find it again in year five of a six-year retention window. A spreadsheet works. What doesn't work is complaints living in a shared customer service inbox with no review process behind them.

Good Manufacturing Practice: Where the Rule Actually Stands

This is the piece that generates the most confusion, so let me be precise about what's confirmed and what isn't. MoCRA directed FDA to issue regulations establishing good manufacturing practice requirements for cosmetic facilities no later than three years after enactment — that's December 29, 2025. FDA missed that deadline. As of this update, no final rule has been issued, and FDA's most recent unified regulatory agenda lists cosmetics GMP rulemaking under "long-term actions" with no proposed date, meaning a final rule isn't expected in the near term. FDA published its proposed rule on December 18, 2024, and the proposal draws heavily on ISO 22716:2007, "Cosmetics — Good Manufacturing Practices (GMP) — Guidelines on Good Manufacturing Practices," which has functioned as the de facto global standard for cosmetics manufacturing for years.

What that alignment means practically: if your facility is already operating to ISO 22716, you're building from a foundation FDA's own proposal already recognizes. That standard covers:

• Documented personnel training
• Controlled premises and equipment
• Raw material and product specifications
• Batch production records
• Deviation handling
• A complaint-and-recall system

If you're not operating to any documented quality system, this is the moment to start. Waiting on a final rule that has already blown its statutory deadline and been pushed to FDA's long-term agenda isn't a plan. I'd rather see a client six months ahead of a rule that shifts slightly than six months behind one that doesn't.

The December 18, 2024 proposed rule remains the best available signal of what the final requirements will look like, which is exactly why building toward ISO 22716 now is the right move regardless of when FDA acts. Check FDA's cosmetics GMP webpage periodically in case that timeline changes, but don't hold your compliance work hostage to it.

Talc Testing and Fragrance Allergen Disclosure

Two more MoCRA provisions are worth knowing even though they sit slightly outside the registration/records/substantiation core. MoCRA directed FDA to establish standardized testing methods for detecting and identifying asbestos in talc-containing cosmetic products, and FDA has moved on this through draft guidance to industry. Separately, MoCRA directed FDA to identify a list of fragrance allergens that must be disclosed on cosmetic labels — a provision aimed at giving consumers with fragrance sensitivities the same kind of ingredient transparency that's long existed for food allergens. If your product line includes talc-containing powders or fragranced formulations, track both of these separately from your core registration work, since they carry their own testing and labeling implications.

Building a MoCRA Compliance File: A Practical Checklist

When I sit down with a cosmetics client, this is roughly the order I work through:

1. Confirm your responsible person and facility structure. Map every facility that touches your product — including contract manufacturers — and confirm who is registering each one.
2. Register in Cosmetics Direct and calendar the two-year renewal window (October 1–December 31 of even years) as a recurring compliance task, not a one-off.
3. List every product currently on the market, and build listing updates into your change control process so new products and reformulations don't slip through.
4. Check the small-business exemption exceptions carefully against your actual product line — eye area, injectable, internal-use, and long-duration appearance-altering products don't get the pass regardless of revenue.
5. Build or audit your safety substantiation files, product by product, with a qualified safety assessor's signed conclusion — not just a stack of raw data.
6. Stand up an adverse event intake and triage process with the 15-business-day clock built in, and set retention rules (six years, or three for exempt small businesses).
7. Benchmark your manufacturing controls against ISO 22716 now, ahead of FDA's final GMP rule, so you're adapting an existing system rather than building one from scratch under deadline pressure.

Companies that treat MoCRA as a paperwork exercise tend to build a thin file that looks fine until FDA actually asks a follow-up question. Companies that treat it as a real quality system — with the registration and listing as the visible tip of a much more substantial safety and records program underneath — are the ones who aren't scrambling when an adverse event report or an FDA inspection request lands on their desk. If you're building out FDA inspection readiness alongside your MoCRA work, the two efforts should share the same underlying records system rather than running as parallel, disconnected projects.

Frequently Asked Questions

Does MoCRA apply to foreign cosmetics manufacturers selling into the US? Yes. If a facility manufactures or processes cosmetic products for distribution in the United States, it must register regardless of where the facility is physically located. A UK or EU manufacturer shipping finished product to the US market needs a US agent and must complete facility registration and product listing the same as a domestic facility.

What exactly counts as the "responsible person" under MoCRA? The responsible person is the manufacturer, packer, or distributor whose name appears on the cosmetic product's label under 21 CFR 701.12. That distinction matters most for private-label brands: if your name is on the bottle, every registration, listing, and safety-substantiation obligation in this guide is yours to satisfy — not your contract manufacturer's.

Is my small cosmetics brand exempt from MoCRA registration? Only if your average gross annual US sales of cosmetic products were under $1,000,000 over the prior three years, and only if your products don't fall into the excepted categories: eye-area contact, injected products, internally used products, or products intended to alter appearance for more than 24 hours without ordinary consumer removal.

When does the MoCRA GMP rule take effect? FDA missed that deadline. As of this update, no final rule has been issued, and FDA's unified regulatory agenda lists cosmetics GMP rulemaking as a long-term action with no proposed date — meaning a final rule isn't expected soon. The December 18, 2024 proposed rule, which aligns closely with ISO 22716:2007, is still the best indication of what's coming, so building toward that standard now is the practical move rather than waiting.

What happens if I don't register my facility with FDA? An unregistered cosmetic product can be deemed misbranded under the FD&C Act. MoCRA also gave FDA mandatory recall authority for cosmetics for the first time, along with the authority to suspend a facility's registration if there's a reasonable probability that a product manufactured there poses a threat of serious adverse health consequences. Registration isn't a courtesy filing — it's the gate that keeps your product legally marketable.

If you're building out a MoCRA compliance program from the ground up, our cosmetics GMP consulting work walks through facility registration, safety substantiation files, and ISO 22716 readiness with clients navigating exactly this transition.

Last updated: 2026-09-08