On December 29, 2022, President Biden signed the Consolidated Appropriations Act, 2023. Among the Act’s many provisions is the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), which significantly expands the U.S. Food and Drug Administration’s (FDA) regulation of cosmetic products1 in the United States. The MoCRA amends the Federal Food, Drug, and Cosmetic Act (FDCA) and imposes extensive new requirements related to cosmetic products, as described below.

Notably, FDA will spend the next two years developing certain implementing regulations as required by the MoCRA. This will offer stakeholders multiple chances to influence the nature of these rules, both before and after a proposed rule is published.

Establishment Registration (Compliance required as of December 29, 2023)

• Submission of Registration
  • Initial Registration
    • Every person that, on December 29, 2022, owns or operates a facility2 that engages in the manufacturing or processing of a cosmetic product for distribution in the United States must register each facility with FDA no later than December 29, 2023.
    • Every person that owns or operates a facility that first engages, after December 29, 2022, in manufacturing or processing of a cosmetic product for distribution in the United States, must register the facility with FDA within 60 days of first engaging in such activity or 60 days after December 29, 2023, whichever is later.
  • Biennial Renewal of Registration
    • A person required to register a facility must renew such registrations biennially.
  • Contract Manufacturers
    • If a facility manufactures or processes cosmetic products on behalf of a responsible person, 3 FDA requires only a single registration for such facility even if such facility is manufacturing or processing its own cosmetic products or cosmetic products on behalf of more than one responsible person.
    • This single registration may be submitted to FDA by such facility or any responsible person whose products are manufactured or processed at such facility.
  • Updates to Content
    • A person that is required to register must notify FDA within 60 days of any changes to content required by the MoCRA (as described below).
  • Abbreviated Renewal Registrations
    • FDA will provide for an abbreviated registration renewal process for any person that owns or operates a facility that has not been required to submit updates for a registered facility since submission of the most recent registration of such facility (via either the initial registration or biennial renewal of registration).
• Format and Contents of Registration
  • Registration information may be submitted at such time and in such manner as FDA may prescribe.
  • The registration must contain:
    • The facility’s name, physical address, email address, and telephone number;  
    • For any foreign facility: the contact for the United States agent of the facility, and, if available, the electronic contact information;
    • The facility registration number, if any, previously assigned by FDA (as described below);
    • All brand names under which cosmetic products manufactured or processed in the facility are sold; and
    • The product category or categories and responsible person for each cosmetic product manufactured or processed at the facility.
• Facility Registration Suspension
  • FDA may suspend the registration of a facility if:
    • FDA determines that a cosmetic product manufactured or processed by a registered facility and distributed in the United States has a reasonable probability of causing serious adverse health consequences or death to humans; and
    • FDA has a reasonable belief that other products manufactured or processed by the facility may be similarly affected because of a failure that cannot be isolated to a product or products, or is sufficiently pervasive to raise concerns about other products manufactured in the facility.
  • Before suspending a facility registration, FDA will provide:
    • Notice specifying the basis of the determination that the facility registration should be suspended; and
    • The opportunity to provide a plan for addressing the reasons for possible suspension of the facility registration within 5 business days of the notice.
  • FDA will provide registrants subject to a suspension order with the opportunity for an informal hearing on the actions required for reinstatement of registration and why the registration that is subject to the suspension should be reinstated.
    • FDA will reinstate a registration if the Agency determines, based on evidence presented, that adequate grounds do not exist to continue the suspension of the registration.
    • If FDA determines that the suspension remains necessary, the registrant must submit a corrective action plan to demonstrate how the registrant plans to correct the conditions found by the Agency. FDA will review the plan no later than 14 business days after the submission of the corrective action plan or such other time period determined by FDA in consultation with the registrant.
  • If FDA determines that adequate grounds do not exist to continue the suspension actions, the Agency will promptly vacate the suspension and reinstate the registration of the facility.
  • It is prohibited to deliver for introduction into commerce in the United States cosmetic products from a facility with a suspended registration.
• Confidentiality
  • In response to a request under 5 U.S.C. § 552 (commonly referred to as the Freedom of Information Act), information derived from a facility registration required by the MoCRA that pertains to the brand names under which cosmetic products manufactured or processed in a facility are sold will be withheld pursuant to 5 U.S.C. § 552(b)(3).

Cosmetic Product Listing (Compliance required as of December 29, 2023)

• For each cosmetic product, the responsible person must submit to FDA a cosmetic product listing, or ensure that such submission is made, at such time and in such manner as FDA may prescribe.
• The responsible person of a cosmetic product that is marketed on December 29, 2022 must submit to FDA a cosmetic product listing no later than December 29, 2023, or for a cosmetic product that is first marketed after December 29, 2022, within 120 days of marketing such product in interstate commerce. Thereafter, any updates to the listing must be made annually.
• FDA will provide for an abbreviated process for the renewal of any cosmetic product listing with respect to which there has been no change since the responsible person submitted the previous listing.
• Contents of Listing
  • Each such cosmetic product listing must include:
    • The facility registration number of each facility where the cosmetic product is manufactured or processed;
    • The name and contact number of the responsible person and the name for the cosmetic product, as such name appears on the label;
    • The applicable cosmetic category or categories for the cosmetic product;
    • A list of ingredients in the cosmetic product, including any fragrances, flavors, or colors, with each ingredient identified by the name, as required under 21 C.F.R. § 701.3 (or any successor regulations), or by the common or usual name of the ingredient; and
    • The product listing number, if any previously assigned by FDA (as described below).
• A single listing submission for a cosmetic product may include multiple cosmetic products with identical formulations, or formulations that differ only with respect to colors, fragrances or flavors, or quantity of contents.
• A responsible person that is required to submit a cosmetic product listing must submit any updates to such cosmetic product listing annually.
• A responsible person may submit product listing information as part of a facility registration or separately.
• Confidentiality
  • In response to a request under 5 U.S.C. § 552 (commonly referred to as the Freedom of Information Act), information derived from a cosmetic product listing required by the MoCRA that pertains to the facility registration number of a facility where cosmetic products are manufactured or processed will be withheld pursuant to 5 U.S.C. § 552(b)(3).

Facility Registration and Product Listing Numbers

• At the time of the initial registration of any facility or initial listing of any cosmetic product, FDA will assign a facility registration number to the facility and a product listing number to each cosmetic product. FDA will not make such product listing number publicly available.

Labeling (Effective dates as noted below)

• General Requirement (Effective date: December 29, 2024)
  • Each cosmetic product must bear a label that includes a domestic address, domestic phone number, or electronic contact information, which may include a website, through which the responsible person can receive adverse event reports with respect to such cosmetic product.
• Fragrance Allergens (Rulemaking is mandated and provisions will go into effect when FDA has undergone formal rulemaking process)
  • Cosmetic product labels must identify each fragrance allergen included in the product.
  • FDA will determine which substances are fragrance allergens for purposes of the above requirement by regulation.
    • FDA will issue a notice of proposed rulemaking promulgating the regulation implementing this requirement no later than 18 months after December 29, 2022.
    • No later than 180 days after the date on which the public comment period on the proposed rulemaking closes, FDA will issue a final rulemaking.
    • In promulgating regulations implementing this requirement, FDA will consider international, State, and local requirements for allergen disclosure, including the substance and format of requirements in the European Union, and may establish threshold levels of amounts of substances subject to disclosure pursuant to such regulations.
• Cosmetic Products for Professional4 Use (Effective date: December 29, 2023)
  • A cosmetic product introduced into interstate commerce and intended to be used only by a professional must bear a label that:
    • Contains a clear and prominent statement that the product shall be administered or used only by licensed professionals; and
    • Is in conformity with FDA requirements for cosmetics labeling and section 4(a) of the Fair Packaging and Labeling Act (15 U.S.C. § 1453(a)).

Records and FDA Access to Them (Effective date: December 29, 2023)

• If FDA has a reasonable belief that a cosmetic product or ingredient in a cosmetic product is likely to be adulterated such that the use or exposure to such product presents a threat of serious adverse health consequences or death to humans, each responsible person and facility must, at the agency’s request, permit FDA to have access to and copy all records relating to such cosmetic product and to any other cosmetic product that FDA reasonably believes is likely to be affected in a similar manner, that are needed to assist FDA in determining whether the cosmetic product is adulterated and presents a threat of serious adverse health consequences or death to humans.
  • This requirement does not extend to recipes or formulas for cosmetics, financial data, pricing data, personnel data (other than data as to qualification of technical and professional personnel performing functions subject to the MoCRA), research data (other than safety substantiation data for cosmetic products and their ingredients), or sales data (other than shipment data regarding sales).
  • This requirement does not limit FDA’s authority to inspect records or require establishment and maintenance of records under any other provision of the MoCRA.

Safety Substantiation (Effective date: December 29, 2023)

• A responsible person for a cosmetic product must ensure, and maintain records supporting, that there is adequate substantiation of safety5, 6 of the cosmetic product.
  • This requirement does not apply to coal-tar hair dye that otherwise complies with the requirements of 21 U.S.C. § 361 (adulterated cosmetics). A responsible person for a coal tar hair dye must maintain records related to the safety of the product.

Good Manufacturing Practices (Rulemaking is mandated and provisions will go into effect when FDA has undergone formal rulemaking process)

• FDA will establish good manufacturing practices for facilities that are consistent, to the extent practicable, and appropriate, with national and international standards.
• These regulations are intended to protect the public health and ensure that cosmetic products are not adulterated. Furthermore, the regulations may allow FDA to inspect records necessary to demonstrate compliance with these newly established good manufacturing practices during an inspection conducted under 21 U.S.C. §§ 374, 374a.
• In establishing these regulations, FDA will take into account the size and scope of the businesses engaged in the manufacture of cosmetics, and the risks to public health posed by such cosmetics, and provide sufficient flexibility to be practicable for all sizes and types of facilities to which such regulations will apply. The regulations will include simplified good manufacturing practice requirements for smaller businesses, as appropriate, and may include longer compliance times for smaller businesses.
• Before issuing these regulations, FDA will consult with cosmetics manufacturers, including smaller businesses, consumer organizations, and other experts.
• FDA will publish a notice of proposed rulemaking no later than December 29, 2024, and will publish a final rule no later than December 29, 2025.

Mandatory Recall Authority (Effective date: December 29, 2023)

• If FDA determines that there is a reasonable probability that a cosmetic is adulterated under 21 U.S.C. § 361 or misbranded under 21 U.S.C. § 362 and the use of or exposure to the cosmetic will cause serious adverse health consequences or death, the agency will provide the responsible person with an opportunity to voluntarily cease distribution and recall the product.
  • If the responsible person refuses to or does not voluntarily cease distribution or recall the cosmetic within the time and manner prescribed by FDA (if so prescribed), the agency may require such person to immediately cease distribution of the product.
• FDA will provide the responsible person who is subject to an order under this section with an opportunity for an informal hearing, to be held no later than 10 days after the date of issuance of the order, on whether adequate evidence exists to justify the order.
• Following the issuance of a recall order or order to cease distribution, FDA will:
  • Vacate the order if FDA determines that inadequate grounds exist to support the actions required by the order;
  • Continue the order ceasing distribution of the cosmetic until a date specified in such order; or
  • Amend the order to require a recall of the cosmetic, including any requirements to notify appropriate persons, a timetable for the recall to occur, and a schedule for updates to be provided to FDA regarding the recall.
• Any person who is subject to a recall order shall immediately cease distribution of or recall, as applicable, the cosmetic and provide notification as required by such order.
• If determined necessary, FDA may require the person subject to a recall order or order to cease distribution to provide notice to appropriate persons, including (1) persons who manufacture, distribute, import, or offer for sale the cosmetic product that is the subject of the order and (2) the public.
• In conducting a recall under this section, FDA will:
  • Ensure that a press release is published regarding the recall, and that alerts and public notices are issued, as appropriate, in order to provide notification:
    • Of the recall to consumers and retailers to whom the cosmetic was, or may have been, distributed; and
    • That includes, at a minimum:
      • The name of the cosmetic subject to the recall;
      • A description of the risk associated with such article; and
      • To the extent practicable, information for consumers about similar cosmetics that are not affected by the recall; and
  • Ensure publication of an image of the relevant cosmetic on FDA’s website, as appropriate and if an image is available.
• Reporting
  • The responsible person must submit to FDA any report received of a serious adverse event8 associated with the use, in the United States, of a cosmetic product manufactured, packed, or distributed by such person.
    • Serious adverse event reports must be:
      • Accompanied by a copy of the label on or within the retail packaging; and
      • Submitted no later than 15 business days after the report is received.
    • The responsible person must submit any new and material medical information related to a serious adverse event report that is received:
      • Within one year of the initial report; and
      • No later than 15 business days after such information is received.
    • FDA will develop systems to enable responsible persons to submit a single report that includes duplicate reports of, or new medical information related to, a serious adverse event.
    • The responsible person shall receive reports of adverse events through the domestic address, domestic telephone number, or electronic contact information included on the label in accordance with the MoCRA (as described below).
  • A serious adverse event report submitted to FDA pursuant to these requirements, including new medical information submitted as described above, or an adverse event report or any new information voluntarily submitted to FDA is considered to be:
    • A safety report under 21 U.S.C. § 379v and may be accompanied by a statement, which shall be a part of any report that is released for public disclosure, that denies that the report or the records constitute an admission that the product involved caused or contributed to the adverse event; and
    • A record about an individual under 5 U.S.C. § 552a (commonly referred to as the Privacy Act of 1974) and a medical or similar file the disclosure of which would constitute a violation of 5 U.S.C. § 552 (commonly referred to as the Freedom of Information Act), and will not be publicly disclosed unless all personally identifiable information is redacted.
  • If FDA has reasonable grounds to believe that an ingredient or combination of ingredients in a fragrance or flavor has caused or contributed to a serious adverse event required to be reported, FDA may request in writing a list of the ingredients or categories of ingredients in the specific fragrances or flavors in the cosmetic product from the responsible person. The responsible person must ensure that the requested information is submitted to FDA within 30 days of the request.
• Recordkeeping
  • Records related to each adverse event report must be maintained for a period of:
    • Six years; or
    • Three years, if the responsible person (1) is considered a small business; and (2) does not engage in the manufacturing or processing of certain cosmetic products (as described below).
  • The responsible person must permit an authorized person9 to have access to records required to be maintained under this section during an inspection pursuant to 21 U.S.C. §§ 374, 374a.

Small Businesses (Effective date: December 29, 2022)

• Responsible persons, and owners and operators of facilities, whose average gross annual sales in the United States of cosmetic products for the previous three-year period is less than $1,000,000, adjusted for inflation, and who do not engage in the manufacturing or processing of the cosmetic products described below, shall be considered small businesses and not subject to the MoCRA requirements regarding good manufacturing practices, facility registration, and product listing.
• The above exemption does not apply to any responsible person or facility engaged in manufacturing or processing any of the following products:
  • Cosmetic products that regularly come into contact with mucus membrane of the eye under conditions of use that are customary or usual.
  • Cosmetic products that are injected.
  • Cosmetic products that are intended for internal use.
  • Cosmetic products that are intended to alter appearance for more than 24 hours under conditions of use that are customary or usual and removal by the consumer is not part of such conditions of use that are customary or usual.

Exemption for Certain Products and Facilities (Effective date: December 29, 2022)

• Except as described below, a cosmetic product or facility that is also subject to the requirements of 21 U.S.C. § 351-360fff-7 (drugs and devices) is exempt from the MoCRA requirements regarding adverse events, good manufacturing practices, facility registration, product listing, safety substantiation, general labeling, records, and recalls.
• A facility described above that also manufactures or processes cosmetic products that are not subject to the requirements of 21 U.S.C. § 351-360fff-7 (drugs and devices) is not exempt from the MoCRA requirements regarding adverse events, good manufacturing practices, facility registration, product listing, safety substantiation, general labeling, records, and recalls with respect to such cosmetic products.

Preemption (Effective date: December 29, 2022)

• No state or political subdivision of a state may establish requirements regarding cosmetic product establishment registration and product listing, good manufacturing practices, records, recalls, adverse event reporting, or safety substantiation that differ from the MoCRA.
• This preemption clause does not prevent states from:
  • Prohibiting the use or limiting the amount of an ingredient in a cosmetic product; or
  • Continuing in effect a requirement of any state that was in effect on December 29, 2022, for the reporting to the state of an ingredient in a cosmetic product.
• Nothing in the MoCRA nor any standard, rule, requirement, regulation, or adverse event report shall be construed to modify, preempt, or displace any action for damages or the liability of any person under the law of any state, whether statutory or based in common law.

Talc-Containing Cosmetics (Rulemaking is mandated and provisions will go into effect when FDA has undergone formal rulemaking process)

• No later than December 29, 2023, FDA will promulgate proposed regulations to establish and require standardized testing methods for detecting and identifying asbestos in talc containing cosmetic products.
• No later than 180 days after the date on which the public comment period on the proposed regulations closes, FDA will issue final regulations.

Perfluoroalkyl and Polyfluoroalkyl Substances (PFAS) in Cosmetics (Effective date: December 29, 2022)

• FDA will assess the use of PFAS in cosmetic products and the scientific evidence regarding the safety of such use in cosmetic products, including any risks associated with such use.
  • In conducting this assessment, FDA may, as appropriate, consult with the National Center for Toxicological Research.
• No later than December 29, 2025, FDA will publish a report summarizing the results of this assessment on the Agency’s website.

Animal Testing

• While the MoCRA contains no actual requirement on the following issue, it provides that “[i]t is the sense of the Congress that animal testing should not be used for the purposes of safety testing on cosmetic products and should be phased out with the exception of appropriate allowances.”

Enforcement (Effective date: December 29, 2023)

• It is a violation of the FDCA to:
  • Fail to register a facility or submit product listing information as required by the MoCRA.
  • Refuse or fail to follow a recall order or order to cease distribution issued under the MoCRA.
  • Introduce or deliver into interstate commerce any article in violation of the MoCRA requirements regarding facility registration and product listing.
  • Refuse to permit access to or copying of any record as required under the adverse event provisions of the MoCRA.
  • Fail to establish or maintain any record, or make any report, required under the adverse event provisions of the MoCRA or refuse to permit access to or verification or copying of any such required record.
  • Falsify a serious adverse event report submitted to a responsible person or FDA as required by the MoCRA.
• A cosmetic product will be deemed to be adulterated:
  • If it has been manufactured or processed under conditions that do not meet the good manufacturing practice requirements of the MoCRA.
  • If the product, including each ingredient in the product, does not have adequate substantiation for safety as required by the MoCRA.
• A cosmetic product will be deemed to be misbranded if in package form unless it bears a label containing:
  • The name and place of business of the manufacturer, packer, or distributor;
  • An accurate statement of the quantity of the contents in terms of weight, measure, or numerical count (noting that reasonable variations are permitted and there are exemptions as to small packages); and
  • The labeling information required by the MoCRA, as described above.
• Among the other requirements of 21 U.S.C. § 381 (imports and exports), if FDA has credible evidence that a cosmetic product has not complied with the adverse event provisions of the MoCRA, the product will be refused admission into the United States and may be destroyed.

1 “Cosmetic product” means “a preparation of cosmetic ingredients with a qualitatively and quantitatively set composition for use in a finished product.” FDCA § 604.

2 The term “facility” includes “any establishment (including an establishment of an importer) that manufactures or processes cosmetic products distributed in the United States.” FDCA § 604. The term does not include:

• Beauty shops and salons, unless such establishment manufactures or processes cosmetic products at that location.
• Cosmetic product retailers, including individual sales representatives, direct sellers (as defined in section 3508(b)(2) of the Internal Revenue Code of 1986 (26 U.S.C. § 3508)), retail distribution facilities, and pharmacies, unless such establishment manufactures or processes cosmetic products that are not sold directly to consumers at that location.
• Hospitals, physicians’ offices, and health care clinics.
• Public health agencies and other nonprofit entities that provide cosmetic products directly to the consumer.
• Entities (such as hotels and airlines) that provide complimentary cosmetic products to customers incidental to other services.
• Trade shows and other venues where cosmetic product samples are provided free of charge.
• An establishment that manufactures or processes cosmetic products that are solely for use in research or evaluation, including for production testing and not offered for retail sale.
• An establishment that solely performs one or more of the following with respect to cosmetic products:
  • Labeling
  • Relabeling
  • Packaging
  • Repackaging
  • Holding
  • Distributing

3 “Responsible person” means “the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product in accordance with [the MoCRA general labeling requirement] . . . or section 4(a) of the Fair Packaging and Labeling Act [(15 U.S.C. § 1453(a)].” FDCA § 604.

4 “Professional” means “an individual who is licensed by an official state authority to practice in the field of cosmetology, nail care, barbering, or esthetics.” FDCA § 609.

5 “Adequate substantiation of safety” means “tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe.” FDCA § 608.

6 “Safe” means “that the cosmetic product, including any ingredient thereof, is not injurious to users under the conditions of use prescribed in the labeling thereof, or under such conditions of use as are customary or usual. [FDA will] not consider a cosmetic ingredient or cosmetic product injurious to users solely because it can cause minor and transient reactions or minor and transient skin irritations in some users. In determining for purposes of this section whether a cosmetic product is safe, [FDA] may consider, as appropriate and available, the cumulative or other relevant exposure to the cosmetic product, including any ingredient thereof.” FDCA § 608.

7 “Adverse event” means “any health-related event associated with the use of a cosmetic product that is adverse.” FDCA § 604.

8 “Serious adverse event” means an adverse event that:

A. Results in:

i. death;

ii. a life-threatening experience;

iii. inpatient hospitalization;

iv. a persistent or significant disability or incapacity;

v. a congenital anomaly or birth defect;

vi. an infection; or

vii. significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), other than as intended, under conditions of use that are customary or usual; or

B. Requires, based on reasonable medical judgment, a medical or surgical intervention to prevent an outcome described in subparagraph (A).

FDCA § 604.

9 “Authorized person” means “an officer or employee of the [US] Department of Health and Human Services who has [(1)] appropriate credentials, as determined by the Secretary; and [(2)] been duly designated by the Secretary to have access to the records required under this section.” FDCA § 605.