MoCRA: The Biggest US Cosmetics Overhaul Since 1938

Before MoCRA, cosmetics were essentially self-regulated. Brands didn't need to register facilities, didn't need to substantiate safety before selling, couldn't be recalled by FDA, and had no adverse event reporting requirements. MoCRA changed all of that. The law adds six new sections to the FD&C Act covering facility registration, product listing, safety substantiation, adverse event reporting, mandatory recall authority, and eventually Good Manufacturing Practices.

The most immediate operational impact: any facility that manufactures or processes cosmetics for US distribution must register with FDA via Cosmetics Direct using SPL format. That registration was required by December 29, 2023 (or within 60 days of starting operations), with biennial renewal. FDA began enforcement of registration requirements in July 2024. Brands who don't manufacture, who use a contract manufacturer, still must ensure their CMO is registered, and must submit product listings under their own name.

MoCRA's small business exemption applies to brands averaging under $1 million in annual US cosmetic sales over the preceding three years. Below that threshold, you are exempt from the facility registration and product listing requirements, and from the eventual GMP rule. That's all the exemption covers.

You are still fully subject to: safety substantiation (your products must be adequately safe before selling), adverse event reporting (serious AEs must be reported within 15 business days), all existing cosmetic labeling requirements, mandatory recall authority, and recordkeeping. The small-business exemption is narrower than most guides suggest, and it is voided entirely for brands making eye-mucous-membrane products (mascara, liquid eyeliner), injectables, internal-use cosmetics, or other categories FDA designates by rule.

Section 608 requires that cosmetics be "adequately substantiated for safety" before marketing. FDA defines this as documentation that the product "meets the safety requirement when used as directed or in the customary or expected manner." The operative phrase is "experts qualified by scientific training." Three years post-enactment, FDA has not issued specific substantiation guidance, but the working consensus across the industry is a documented evidence stack.

A serious adverse event (SAE) under MoCRA is any event associated with use of a cosmetic product that results in: death, life-threatening injury, inpatient hospitalization, persistent or significant disability/incapacity, significant disfigurement, a congenital anomaly, or requires medical or surgical intervention to prevent one of the above. This includes persistent scalp rashes, second-degree burns from a product reaction, and significant hair loss. Brands must submit SAE reports using MedWatch Form 3500A within 15 business days of becoming aware of the event.

All adverse events, not just serious ones, must be recorded and retained for 6 years (3 years for small businesses). FDA issued draft guidance on records access authority in January 2026. The FAERS dashboard launched September 12, 2025 makes these records, once reported, searchable by product, ingredient, and event type without a FOIA request.