On December 29, 2022, President Biden signed the Omnibus appropriations bill into law. (Public Law No. 117-328). There are many provisions in the bill beyond appropriations, but one significant feature is a dramatic expansion of the Federal Food, Drug and Cosmetic Act’s (FDCA) provisions dealing with cosmetics. This document highlights some of the more significant features in the “Modernization of Cosmetics Regulation Act of 2022 (MCRA or ‘the Act’),” which is one of the many stand-alone bills incorporated in the spending bill. The MCRA expands the U.S. Food and Drug Administration’s (FDA) regulatory authority over cosmetic products and associated businesses. The following presents an overview of the major new provisions but is not intended to be an exhaustive analysis. 

The Modernization of Cosmetics Regulation Act 

The MCRA establishes several new requirements for cosmetic products and manufacturers, packers, and distributors. The Act defines a cosmetic product as a “preparation of cosmetic ingredients with a qualitatively and quantitatively set composition for use in a finished product.” (FDCA § 604(2)). Although this definition leaves some ambiguity as to whether the requirements are intended to apply only to finished cosmetic products or whether they also cover cosmetic ingredients, other terms and the language of the substantive provisions suggest that the new requirements only apply to finished cosmetics. It is possible that FDA may seek to apply some of the new provisions to cosmetic ingredients, but the Agency would need to provide a legal basis for doing so. Keller and Heckman will monitor FDA’s rulemaking proceedings and other efforts to implement the MCRA.  

In sum, the MCRA establishes the following requirements for cosmetic products:

• Adverse event reporting

• Facility registration and product listing

• Good manufacturing practices for cosmetic facilities

• Safety substantiation requirements

• Mechanisms permitting FDA to suspend registrations and order mandatory recalls

• Identification of fragrance allergens on product labels

• Expanded FDA authority to access, review, and copy records

The responsibility for compliance with several of the requirements in the MCRA now falls on the “responsible person,” which the Act defines as the “manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product.” (FDCA § 604(4)). This is similar to an existing requirement established for adverse event reporting for dietary supplements and over-the-counter (OTC) drug products.  

In addition, the MCRA contains a preemption clause and requires FDA to regulate talc-containing cosmetic products and evaluate per- and polyfluorinated alkyl substance (PFAS)-containing cosmetic products. The MCRA also reports the “sense of the Congress that animal testing should not be used for the purposes of safety testing on cosmetic products” and should be phased out. (MCRA § 3508).

Adverse Event Reporting (FDCA § 605)

The responsible person must submit to FDA any reports of “serious adverse events associated with the use” of their cosmetic products in the United States within 15 business days of the responsible person receiving the report. (FDCA § 605(b)(1)). A “serious adverse event” is one that results in death, a life-threatening experience, inpatient hospitalization, significant disability, birth defect, infection, significant disfigurement, or medical or surgical intervention to prevent any of these outcomes. (FDCA § 604(5)). The responsible person must maintain records of all adverse events (whether serious or not) for six years (although small businesses that are distributors only must hold such records for three years). (FDCA § 605(e)(1)). FDA may request a list of fragrance and flavor ingredients or categories of ingredients that it believes caused or contributed to a serious adverse event, and the responsible person must submit this information within 30 days of a request. 

Good Manufacturing Practices (FDCA § 606)

FDA will engage in rulemaking to establish final good manufacturing practices (GMP) for cosmetics manufacturers within three years of enactment of the MCRA. The GMP requirements must be “consistent, to the extent practicable, and appropriate, with national and international standards,” and be intended to protect the public health and ensure that cosmetic products are not adulterated. GMPs must also be tailored to be practicable for businesses of all sizes. The MCRA authorizes FDA to inspect records necessary to determine compliance with GMPs. This flexibility may open the door for FDA to adopt (or modify) ISO 22716, which is already recognized in many jurisdictions.

Facility Registration (FDCA § 607(a) and (b))

The MCRA requires cosmetic manufacturers or processors (both domestic and foreign) to register all existing facilities within one year of the Act’s enactment and renew registrations biennially. New facilities must register within the later of (1) 60 days of engaging in the manufacture or processing of cosmetic products, or (2) one year plus 60 days after the enactment of the MCRA. The Act defines a “facility” as any establishment that manufactures or processes cosmetic products distributed in the United States and lists several exclusions from the definition. (FDCA § 604(3)). Contract manufacturers will require only one registration, even if the facility manufactures or processes cosmetics on behalf of multiple responsible persons. (FDCA § 607(a)(3)). The registration may be submitted by the facility itself or any responsible person whose products are manufactured in the facility. Required registration information includes details about the facility’s location, contact information, cosmetic product brand names, and cosmetic product categories. (FDCA § 706(b)(2)).

Product Listing (FDCA § 607(c))

The MCRA requires that responsible persons submit a “cosmetic product listing.” For products currently on the market, the listing information is to be submitted within one year of the date of enactment of the MCRA. For cosmetic products first marketed after the date of enactment, the listing is due within 120 of marketing the cosmetic product in interstate commerce. (FDCA § 607(c)(2)).  It is not clear why the time frames for cosmetic facility registration and product listing are not aligned, or whether FDA will have a system in place to receive cosmetic product listing information as soon as May 2023. In any event, cosmetic product listing information is to be updated annually. A listing must include, among other things, a list of ingredients, including any fragrances, flavors, or colors, and the facility registration number where the cosmetic product is manufactured. (FDCA § 607(c)(4)). A single product listing may include multiple cosmetic products with identical formulations or formulations that differ only with respect to colors, fragrances or flavors, or quantity of contents.

Suspension of Registration (FDCA § 607(f))

FDA is authorized to suspend the registration of a facility if the Agency determines that a cosmetic product manufactured or processed by the facility has a “reasonable probability of causing serious adverse health consequences or death to humans” (the same standard for a Class I recall, and similar to the existing authority with respect to food facilities), and FDA has a “reasonable belief” that other products manufactured by the facility may be similarly affected. Before issuing a suspension, FDA must provide notice to the facility registrant of the cosmetic product or other responsible persons specifying the basis for the suspension and providing five days for the registrant to present a plan to address the issue(s). Within five days of ordering the suspension, FDA must provide an opportunity for an informal hearing on the actions required for the registrant to reinstate the registration and why the registration should be reinstated. While a registration is suspended, no person may introduce into U.S. commerce a product from such facility, essentially shutting down the business until the suspension is resolved. 

Safety Substantiation (FDCA § 608)

A responsible person must maintain records supporting that there is adequate substantiation of safety for each cosmetic product. This refers to tests or studies, research, analyses, or other evidence and information that is considered by qualified experts to evaluate the safety of cosmetic products and their ingredients, sufficient to support to a “reasonable certainty” that a cosmetic product is safe. 

The term “safe” means that the cosmetic product or ingredient is not injurious to users under conditions of use prescribed in the labeling. In considering safety, FDA may consider cumulative and other relevant exposure to the product or ingredient. Minor or transient skin irritation in some users is not enough for FDA to consider a product injurious. (FDCA § 608(c)(2)).

This statutory provision, combined with the new adulteration provision discussed below, appear to supersede an existing FDA regulation. Under current 21 CFR § 740.10(a), “each ingredient used in a cosmetic product and each finished cosmetic product” must be “adequately substantiated for safety.” However, any product without such adequate substantiation can still be marketed but is required to bear the statement “Warning – The safety of this product has not been determined.” With the new MCRA provisions, it appears that this option to label inadequately-substantiated cosmetic products will no longer be available (once the adulteration provision goes into effect).

Labeling (FDCA § 609)

Cosmetic product labels must (1) include a domestic address, domestic phone number, or electronic contact information (e.g., website) for the responsible person to receive adverse event reports; (2) identify “fragrance allergens” as established through rulemaking; and (3) clearly and prominently indicate if the product is for use by licensed professionals only. FDA is to consider international, state, and local requirements when determining fragrance allergens to be disclosed and may establish threshold levels of amounts of such substances subject to disclosure. The requirement for the cosmetic product label to include contact information for receiving adverse event information takes effect two years after the date of enactment of the MCRA. (MCRA § 3503(b)(2)).

Records Access (FDCA § 610)

FDA is entitled to have access to and copy all records related to any cosmetic product (including an ingredient contained in the product) and any other cosmetic product that FDA “reasonably believes” is likely to be affected in a similar manner if the Agency has a “reasonable belief” that the cosmetic product (1) is likely to be adulterated such that (2) use of or exposure to the cosmetic product presents a threat of serious adverse health consequences or death to humans (i.e., the Class I recall standard). This authority is similar to an existing provision for food manufacturers. This record access authority does not apply to recipes or formulas, financial data, pricing data, personnel data (other than technical and professional qualifications), research data (other than safety substantiation), and sales data (other than shipment data regarding sales). Although no specific time frame is provided for a response, the responsible person and/or facility shall permit FDA to have access to the requested information “at reasonable times and within reasonable limits and in a reasonable manner.”

Separately, FDA’s general records inspection authority under FDCA § 704(a)(1) is amended to include records and other information related to adverse event reporting (FDCA § 605), GMPs (FDCA § 606), and the records covered by FDCA § 610. (MCRA § 3504).

Mandatory Recall (FDCA § 611)  

The MCRA authorizes FDA to issue a mandatory “cease distribution” order if (1) the Agency determines there is a “reasonable probability” that a cosmetic is adulterated or misbranded under the FDCA; (2) FDA determines that the use of or exposure to the cosmetic will cause “serious adverse health consequences or death”; and (3) the responsible person refuses to voluntarily cease distribution or recall the cosmetic upon request. This authority is similar to an existing provision covering conventional foods and dietary supplements. Within ten days of issuing the cease distribution order, FDA must provide the responsible person with an informal hearing to determine whether adequate evidence exists to justify the order. The outcome of the hearing will either (a) vacate the order, (2) continue the “cease distribution” requirement until a date to be determined, or (3) amend the order to require a recall of the cosmetic product. (FDCA § 611(c)). In conducting a recall, FDA must ensure a press release is published to notify consumers and retailers to whom the cosmetic product was distributed of the recall.

Small Business Exemption (FDCA § 612)

“Small businesses” are defined as entities (1) whose gross annual sales in the U.S. for cosmetic products for the prior three years are less than $1 million (adjusted for inflation) and (2) who do not engage in the manufacture or processing of cosmetics that: (a) come into contact with the mucus membrane of the eye; (b) are injected; (c) are intended for internal use; or (d) alter the appearance for more than 24 hours under normal use. Such small businesses are not subject to the GMP requirements, facility registration, or product listing expectations.

Preemption (FDCA § 614)

The preemption provision precludes states and local governments from implementing or enforcing any other requirement for cosmetics with respect to registration and product listing, GMP, records, recalls, adverse event reporting, or safety substantiation. Additional cosmetic labeling requirements are not preempted. The provision does not prevent states from prohibiting the use or limiting the amount of an ingredient in a cosmetic product or from continuing to enforce an ingredient reporting requirement that was in effect when the MCRA was enacted (such as California’s Proposition 65).

Enforcement Provisions (MCRA § 3503)

New prohibited acts include: (1) the failure to register or submit listing information under FDCA § 607 and (2) the refusal or failure to follow a cease distribution and/or recall order under FDCA § 611.

A cosmetic is now adulterated under FDCA § 601 if (a) it is manufactured or processed under conditions that do not meet the GMP requirements of FDCA § 606 or (b) the cosmetic product and each ingredient do not have adequate substantiation for safety under FDCA § 608.

A cosmetic is now misbranded under FDCA § 602(b) if the label does not include the information specified in FDCA § 609. 

These enforcement provisions take effect one year after the date of enactment of the MCRA.

Talc-containing Cosmetics (MCRA § 3505)

Within one year, FDA must publish a proposed rule to establish and require standardized testing methods for detecting and identifying asbestos in talc-containing products. The final regulation is to be published not more than 180 days after the close of the comment period on the proposed regulations.

PFAS in Cosmetics (MCRA § 3506) 

Within three years, FDA must assess the use of PFAS substances in cosmetic products and the scientific evidence regarding the safety of such use, including any associated risks, and publish a report summarizing the results.

Animal Testing (MCRA § 3507) 

Congress suggests that animal testing should not be used to test the safety of cosmetic products and that it should be phased out with certain unlisted exceptions.