MoCRA Compliance: The Complete Guide for Cosmetics Manufacturers

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is the most significant expansion of FDA's authority over cosmetics since the Federal Food, Drug, and Cosmetic Act was first written. For the first time, FDA has mandatory recall authority, mandatory facility registration and product listing requirements, and a formal adverse event reporting clock for cosmetics manufacturers. This guide walks through what MoCRA actually requires, where the current enforcement posture stands, and what records you need to keep.

Who This Guide Is For

This guide is written for cosmetics manufacturers, brand owners, and contract manufacturers (co-packers) who need to understand MoCRA's substantive requirements, not just the headline that "cosmetics are now regulated." It assumes no prior familiarity with FDA cosmetics regulation and walks from the statute's basic structure through the specific records and deadlines that determine whether a facility is actually compliant today.

Why MoCRA Matters for Manufacturers, Not Just Brand Owners

Cosmetics manufacturing has historically operated with far less direct FDA oversight than dietary supplements or food. Before MoCRA, FDA had no mandatory recall authority over cosmetics, no mandatory facility registration requirement, and no formal adverse event reporting timeline. Manufacturers who built their quality systems assuming a light-touch regulatory environment now need to retrofit registration, listing, safety substantiation, and adverse event response processes onto operations that, in some cases, have never had to document any of it formally before. This is a meaningfully different starting point than supplement manufacturers, who have operated under Part 111's CGMP framework since 2007 and generally already have a quality unit, batch documentation, and specification review built into daily operations. Cosmetics-only manufacturers reading this guide should expect the documentation lift to feel larger, precisely because there was less structural expectation to build from.

MoCRA Overview and Current Enforcement Posture

MoCRA amended the FD&C Act (codified across FDCA Chapter VI) and was signed into law in December 2022, with core provisions phasing in through 2024 and beyond. Facility registration and product listing requirements took effect with a compliance deadline of July 2024 (after FDA extended enforcement discretion from the original December 2023 date to allow the industry time to use FDA's electronic registration system). Serious adverse event reporting and recordkeeping obligations are in effect now.

The provision furthest from finalized is cosmetic Good Manufacturing Practice (GMP) rulemaking. MoCRA directed FDA to issue GMP regulations for cosmetics, but as of this guide's last review date, FDA has not finalized that rule. Manufacturers should verify the current status directly at FDA's MoCRA guidance page before relying on any specific deadline, because rulemaking timelines are exactly the kind of detail that shifts. In the interim, ISO 22716 is the reference standard FDA has pointed to as representative of current good manufacturing practice for cosmetics, and it is the standard most compliance-forward manufacturers are already building toward.

Facility Registration and Product Listing Walkthrough

Under MoCRA, every facility that manufactures or processes cosmetic products for U.S. distribution must register with FDA, and every cosmetic product must be listed, identifying its ingredients and the responsible facility. Registration and listing are submitted through FDA's Cosmetics Direct electronic portal. Key points manufacturers get wrong:

• Registration is facility-level; listing is product-level. You register each manufacturing or processing facility once (with renewal every two years) and separately list each product marketed under that facility.
• Contract manufacturers and brand owners both have obligations. Similar to the Part 111 dynamic in supplements, MoCRA does not let a brand owner treat facility registration as solely their contract manufacturer's problem. The responsible person (see below) has listing obligations regardless of who physically manufactures the product.
• Small business exemption exists, but it is narrower than most people assume. MoCRA exempts certain small businesses from registration and listing requirements based on average gross annual sales, but the exemption does not apply to manufacturers of specific higher-risk product categories (products that contact the eye area, are injected, or are intended for internal use, among others) regardless of company size. Do not assume small-business status exempts you without checking the specific product-category carve-outs.

Responsible Person Duties and Safety Substantiation

MoCRA formally defines the "Responsible Person" for a cosmetic product, generally the manufacturer, packer, or distributor whose name appears on the product label. The Responsible Person has specific, non-delegable duties:

• Safety substantiation. The Responsible Person must maintain adequate substantiation that the cosmetic product is safe, based on the ingredients, formulation, and product testing, or other appropriate substantiating evidence. This substantiation must be documented and retained, not just asserted.
• Reporting serious adverse events to FDA (covered in detail below).
• Maintaining records to support both of the above and making them available for FDA inspection.

Safety substantiation is not the same thing as a product having no known issues; it means the Responsible Person can produce documentation, ingredient safety data, formulation rationale, relevant testing, that supports the safety conclusion before the product ever reaches a consumer. This is a proactive documentation obligation, not a reactive one.

Serious Adverse Event Reporting: The 15-Day Clock

MoCRA requires the Responsible Person to report serious adverse events associated with the use of a cosmetic product to FDA within 15 business days of receiving the report, with a follow-up report requirement if new material information becomes available within one year. A "serious adverse event" under MoCRA includes death, a life-threatening experience, inpatient hospitalization, a persistent or significant disfigurement, a congenital anomaly, or an event requiring medical or surgical intervention to prevent one of the above outcomes.

The 15-business-day clock is unforgiving, and it starts the moment the Responsible Person receives the report, not when someone gets around to reviewing it. This means your intake process, however a consumer or retailer complaint reaches you, needs a documented triage step that flags anything meeting the serious adverse event definition immediately, not at the next scheduled quality meeting. Our detailed walkthrough, MoCRA Adverse Event Reporting: Building a 15-Day Response System That Won't Break Under Pressure, covers the intake-to-report timeline hour by hour and the specific records you need in place before an event ever occurs.

Records and the Coming GMP Rule

Until FDA finalizes its cosmetic GMP regulation, ISO 22716 remains the internationally recognized reference standard for cosmetic manufacturing practice, and FDA has signaled it as directionally consistent with where U.S. cosmetic GMP requirements are headed. ISO 22716 covers personnel, premises, equipment, raw materials and packaging materials, production, quality control, storage and shipping, and deviation and non-conformity handling, structural categories that will look immediately familiar to any supplement manufacturer already operating under 21 CFR Part 111.

That overlap is not incidental. Manufacturers who already run a Part 111-compliant supplement operation, master formula records, batch production records with lot traceability, a quality unit reviewing and releasing batches, are most of the way to an ISO 22716-aligned cosmetics operation structurally, even though the two regulations are legally distinct. Our guide, GMP for Cosmetics: What Supplement Manufacturers Already Know, maps the specific overlap and the specific gaps for dual-category manufacturers.

MoCRA's own recordkeeping mandate requires the Responsible Person to keep records supporting safety substantiation and adverse event reporting, and to make them available to FDA upon request. Combined with the anticipated GMP rule, cosmetics manufacturers should expect batch-level production and lot traceability documentation, formalized under ISO 22716 today, to become a formal regulatory expectation once FDA's rule is final, not just a best practice.

Two practical resources worth building into your quality system now, ahead of the final GMP rule, are a structured self-assessment and a documented survival-guide-style readiness review. Our 2026 MoCRA Compliance Checklist walks through 21 yes/no benchmarks across five compliance phases, facility registration, safety substantiation, adverse event reporting, GMP readiness, and post-market vigilance, and our 2026 MoCRA & GMP Compliance Survival Guide breaks down the four failure points that most often trigger FDA enforcement action. Neither resource substitutes for legal or regulatory counsel, but both are useful starting points for benchmarking where your facility's documentation currently stands against what MoCRA and the anticipated GMP rule will expect.

State-Law Overlay

MoCRA does not exist in a regulatory vacuum. Several states, most notably California, maintain their own cosmetic ingredient disclosure and safety statutes (such as California's Safe Cosmetics Program and evolving state-level restricted-substance lists) that can impose additional obligations beyond MoCRA's federal floor. State requirements can also change on a different timeline than federal rulemaking. This overlay is not something we can walk through comprehensively here, state cosmetic law varies and changes, and we are not offering legal advice. If you distribute in multiple states, or in California specifically, confirm current state-level obligations with qualified counsel in addition to your federal MoCRA compliance work.

Fragrance and Flavor Ingredient Disclosure

MoCRA requires the Responsible Person to have a process for identifying and disclosing fragrance allergens once FDA finalizes its list of allergens requiring disclosure on the product label. This is distinct from the general ingredient list requirement, which cosmetics have long been subject to under existing FD&C Act and FPLA rules; the fragrance allergen provision specifically targets the "fragrance" or "parfum" catch-all listing that has historically let individual allergenic components go undisclosed to consumers. As of this guide's last review, FDA had not yet published the final list of allergens subject to mandatory disclosure. Manufacturers using fragrance blends from third-party suppliers should be tracking the full allergen composition of those blends now, through supplier disclosure agreements, rather than waiting for the final rule to start that documentation work from zero.

Recall Authority and Records That Support a Recall Decision

MoCRA gave FDA mandatory recall authority over cosmetics for the first time. If FDA determines there is a reasonable probability that a cosmetic is adulterated or misbranded in a way that could cause serious adverse health consequences, and voluntary recall is refused, FDA can order a mandatory recall. This is a meaningful shift from the pre-MoCRA landscape, where FDA had to rely entirely on voluntary manufacturer or distributor cooperation.

The records that support a fast, defensible recall decision, lot-level production and distribution traceability, are largely the same records a well-run batch and lot tracking system already produces for other purposes. A manufacturer that can identify, within hours rather than days, exactly which finished goods lots contain a specific raw material lot, and exactly which customers received those finished goods lots, is positioned to execute either a voluntary or FDA-directed recall far faster and with a narrower, more defensible scope than one relying on manual cross-referencing across purchase orders and shipping logs. Our recall simulation content covers how to pressure-test this traceability chain before you need it in an actual recall.

MoCRA Compliance Timeline at a Glance

The following reflects MoCRA's phased rollout as of this guide's last review; verify current deadlines directly with FDA before relying on any specific date, since some deadlines (particularly cosmetic GMP rulemaking) have already shifted once:

• December 2022: MoCRA signed into law.
• December 2023 (original) / July 2024 (enforcement discretion extension): Facility registration and product listing compliance deadline.
• Ongoing: Serious adverse event reporting (15-business-day clock) and safety substantiation recordkeeping obligations are in effect now.
• Pending: Cosmetic GMP rulemaking, and the final fragrance allergen disclosure list, have not been finalized.

Frequently Asked Questions

(See the FAQ section below the article for answers to common questions about the Responsible Person, small business exemptions, GMP rule status, recordkeeping, and adverse event reporting triggers.)

Import and Contract Manufacturing Under MoCRA

MoCRA's registration and listing requirements apply to facilities that manufacture or process cosmetics for U.S. distribution regardless of whether that facility is domestic or foreign, mirroring the same structural approach Part 111 takes for supplements. A U.S. brand importing a finished cosmetic product from an overseas contract manufacturer does not get to treat MoCRA compliance as the foreign facility's sole responsibility; the brand owner, as the Responsible Person in most cases, still holds safety substantiation and adverse event reporting duties regardless of where physical manufacturing occurs, and should confirm the manufacturing facility itself is properly registered with FDA before relying on its output for U.S. distribution. Given that foreign facility registration and communication with FDA can move on a different timeline than domestic registration, brand owners working with overseas co-packers should build registration verification into their supplier qualification process, not treat it as an assumption.

Common MoCRA Compliance Mistakes

• Treating registration as a one-time task. Facility registration must be renewed every two years, and product listings need updates when formulations or responsible-party information changes. A registration filed in 2024 and never revisited is a compliance gap waiting to surface at the next FDA inquiry.
• Assuming a co-packer's registration covers the brand owner. A contract manufacturer's facility registration does not substitute for the brand owner's own product listing and Responsible Person obligations. Both parties have distinct, non-overlapping duties under MoCRA.
• Confusing "no known complaints" with "safety substantiation on file." Safety substantiation is a proactive documentation requirement, ingredient safety data, formulation rationale, relevant testing, that must exist before a product ships, not a retrospective claim based on the absence of reported problems.
• Missing the adverse event reporting clock because complaint intake is informal. If consumer complaints arrive through multiple untracked channels (email, social media, retailer relay), a serious adverse event report can sit unnoticed well past the 15-business-day window before anyone realizes the clock has already run. A single, documented intake and triage process, whatever channel the complaint originally arrived through, is the only reliable defense against this.
• Building a cosmetics quality system from scratch when a supplement quality system already exists. As covered above, the structural overlap between Part 111 and ISO 22716 is substantial. Manufacturers with both product categories should extend their existing quality unit review and batch documentation practices to cosmetics rather than building an entirely separate, disconnected system.

A Note on Scope

This guide covers MoCRA's substantive federal requirements as they stand today. It does not cover the anticipated cosmetic GMP rule's final text (not yet published), state-specific cosmetic statutes in full, or product-category-specific rules (such as talc testing requirements or PFAS restrictions some states have separately enacted). Treat this as a starting framework for understanding your federal obligations, and confirm category-specific and state-specific requirements separately as they apply to your product line.

How BatchBuddy Handles This

BatchBuddy supports cosmetics manufacturers running an ISO 22716-aligned production system today: master formula records with version control, batch production records that capture lot-level ingredient traceability from raw material receipt through finished goods, and a quality-unit release gate before a batch can ship. Deviation and non-conformity capture, one of ISO 22716's core structural requirements, is built into the production workflow rather than left to a separate document. What BatchBuddy does not do is manage your MoCRA facility registration, product listing submission, or safety substantiation dossier directly, those are Responsible Person obligations that live outside a manufacturing execution platform, and we do not claim otherwise. What the platform gives you is the underlying batch and lot documentation that a Responsible Person needs on hand to support both safety substantiation and any FDA request for records, tied to the same audit trail every other manufacturing record on the platform uses.

Frequently Asked Questions

Who is the MoCRA Responsible Person?

The Responsible Person is generally the manufacturer, packer, or distributor whose name appears on the cosmetic product's label. They hold non-delegable duties for safety substantiation, serious adverse event reporting, and recordkeeping, even if a different company physically manufactures the product.

Are small cosmetics businesses exempt from MoCRA facility registration?

MoCRA provides a small business exemption based on average gross annual sales, but it does not apply to manufacturers of certain higher-risk product categories, such as products contacting the eye area, injected products, or products intended for internal use, regardless of company size. Check the specific product-category carve-outs before assuming exemption.

Has FDA finalized a cosmetic GMP rule under MoCRA?

Not as of this guide's last review. MoCRA directed FDA to issue cosmetic GMP regulations, but the rule has not been finalized. Confirm current status at FDA's MoCRA guidance page, since rulemaking timelines shift. ISO 22716 is the reference standard most manufacturers use in the interim.

How fast do I have to report a serious adverse event under MoCRA?

Within 15 business days of the Responsible Person receiving the report, with a follow-up report required if new material information becomes available within one year. The clock starts at receipt of the report, not at the next scheduled review.

What counts as a serious adverse event under MoCRA?

Death, a life-threatening experience, inpatient hospitalization, a persistent or significant disfigurement, a congenital anomaly, or an event requiring medical or surgical intervention to prevent one of those outcomes.

Does MoCRA replace state cosmetic safety laws?

No. MoCRA sets a federal floor, but states such as California maintain their own cosmetic ingredient disclosure and safety statutes that can impose additional obligations. Multi-state distributors should confirm state-level requirements with qualified counsel in addition to MoCRA compliance.