In the first major reform of cosmetics regulations since the Federal Food, Drug & Cosmetics Act (FDCA) became law in 1938, the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) significantly expands the authority of the U.S. Food and Drug Administration (FDA) to oversee and regulate cosmetics.

Enacted on December 29, 2022, as part of the 2023 omnibus bill, MoCRA amends Chapter VI of the FDCA to include new provisions and requirements for cosmetic products similar to those already in place for other FDA-regulated products.

New Obligations for Cosmetics Companies

Under the FDA’s new cosmetics regulatory framework, manufacturers and processers of cosmetics will be subject to a number of new regulatory responsibilities, including the following:

• Facility Registration. Owners and operators of both domestic and foreign facilities that manufacture or process cosmetic products will be required to register with the FDA. (Notably, facilities whose activities solely relate to the labeling, relabeling, packaging, repackaging, holding, and/or distributing of cosmetic products will not be required to register with the FDA.) Owners/operators will have one year from December 29, 2022, to register existing facilities, while new facilities must be registered either 60 days after they start manufacturing cosmetics or 60 days after the existing facility deadline, whichever is later. Registrations must be renewed biennially.
• Product Listing. “Responsible persons”—meaning manufacturers, packers, or distributors of a cosmetic product whose name appears on the label—will have one year from December 29, 2022, to list their cosmetic products with the FDA. (As with medical devices, listings for cosmetics will likely occur at the time of the facility registration.) Such listings must include the product’s ingredients and information about where the cosmetic product is manufactured.
• Mandatory Reporting of Adverse Events. Serious adverse events must be submitted to the FDA by the responsible person no later than 15 days after receiving the report, and responsible persons must maintain all records related to serious adverse events for a minimum of six years. “Serious adverse events” include death, a life-threatening experience, hospitalization, a persistent or significant disability, a congenital anomaly or birth defect, infections, or “significant disfigurement,” such as serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance, other than as intended. (Currently, the FDA uses MedWatch for voluntary cosmetics adverse event reporting, and presumably will continue to do so for the new mandatory serious adverse event reporting.)
• Substantiation of Safety. Under MoCRA, businesses must now maintain records, including tests, analyses, research, and other evidence sufficient to demonstrate to a “reasonable certainty” that a cosmetic product is safe. MoCRA clarifies that a cosmetic is deemed to be “safe” if it “is not injurious to users under the conditions of use prescribed in the [product’s] labeling” or under conditions of customary or usual use.
• Cosmetics Labeling Changes: Professional Use Only; Allergens; Contact Information.  Cosmetic product labels will now be required to identify all fragrance allergens. The FDA will issue a list of such allergens no later than July 1, 2024. Manufacturers, packers, or distributors must also update their cosmetic product labels to include contact information in order to receive adverse event reports from consumers. Finally, cosmetic products intended for use solely by licensed professionals such as estheticians, cosmetologists, or hair/nail salons must be clearly labeled “For Professional Use Only.” As noted above, such products will also be required to include additional contact information and identify any fragrance allergens.

Enhanced FDA Oversight

MoCRA also provides the FDA with new enforcement tools that authorize the agency to take timely action to help protect the public.

• Access to Records. MoCRA permits the FDA to access a company’s records related to a cosmetic product if the agency reasonably believes the product and/or its ingredients are adulterated, such that they present a risk of serious adverse health consequences or death. The FDA may also request a list of ingredients in a product’s fragrance or flavor if it believes these components contributed to a consumer’s serious adverse event, and access records as needed to enforce the good manufacturing practice (GMP) rules, adverse event reporting rules, and other new requirements detailed above. The FDA will not have access to a company’s records related to formulas/recipes, financial data, or research data unrelated to safety substantiation.
• Mandatory Recalls. Effective December 29, 2023, the FDA will have the authority to issue cosmetic product recalls. The FDA must provide the responsible person the opportunity to voluntarily recall and halt distribution of the product before issuing a mandatory recall.
• Suspension of Registration. MoCRA gives the FDA the authority to suspend a facility’s registration if it determines that a cosmetic product manufactured by that facility has a reasonable probability of causing serious adverse health consequences and other products manufactured by the facility may be similarly affected. Once suspended, a facility may not introduce any cosmetic products into commerce until its registration is reinstated. This authority is similar to the FDA’s authority to suspend food facility registrations for safety violations.

Forthcoming FDA Action

As summarized below, MoCRA requires the FDA to issue three new rules subject to notice-and-comment rulemaking. Although Congress set forth various dates by which the FDA must issue proposed and final rules with respect to these topics, industry should continue to monitor these developments, as the public will have an opportunity to review and provide comments on these proposed rules.

• Current Good Manufacturing Practices. MoCRA directs the FDA to establish GMP regulations consistent with national and international standards. FDA must issue a proposed rule within two years after the December 29, 2022, enactment and a final rule no later than three years after MoCRA’s enactment. If a cosmetic product has been manufactured or processed under conditions that do not meet these regulations, it will be deemed adulterated under the FDCA.
• Talc-Containing Products. By December 29, 2023, the FDA must issue a proposed rule to establish and require standardized testing methods for detecting and identifying asbestos in talc-containing cosmetic products and must finalize the rule 180 days thereafter.
• PFAS in Cosmetic Products. MoCRA directs the FDA to assess the scientific evidence regarding the safety of, and risks associated with, the use of perfluoroalkyl and polyfluoroalkyl substances (PFAS) in cosmetic products. The FDA is also required to issue a report within three years of MoCRA’s enactment summarizing the results of its assessment.

Exemptions and Limitations of Application

We note that MoCRA exempts cosmetic/drug and cosmetic/device combination products from certain requirements related to adverse event reporting, GMPs, registration/listing, safety substantiation, recordkeeping, and mandatory recall authority. FDA’s oversight for such combination products will presumably be handled under the agency’s drug or device authorities. However, the foregoing exemptions are not applicable to facilities that manufacture both combination products and cosmetics.

In addition, owners/operators of “small businesses,” which are defined as those whose average gross annual sales of cosmetic products in the United States for the previous three-year period is less than $1,000,000, and who do not engage in the manufacturing or processing of cosmetic products, are exempt from the GMP and registration/listing requirements.

Looking Forward

Although many of the new MoCRA requirements do not become effective until later this year (i.e., one year after the law was enacted), it is important for cosmetics manufacturers and processers to proactively think about these requirements to ensure they have robust compliance programs in place to comply with these new obligations. We expect that the FDA will issue guidance for industry concerning the new requirements, and state laws may also change in response once the full extent of the FDA requirements become known. Such changes may also spur manufacturers to rethink their contracts with raw material/ingredient suppliers in order to comply with the new requirements and shift the burden for such compliance to suppliers where possible.  

[View source.]