On December 29, 2022, U.S. President Biden officially enacted the “Consolidated Appropriations Act, 2023,” which incorporates the groundbreaking Modernization of Cosmetics Regulation Act of 2022 (MOCRA). This pivotal legislation represents the most substantial enhancement of the authority granted to the United States Food and Drug Administration (FDA) for regulating cosmetics since 1938. For decades, the FDA has sought greater regulatory powers from Congress to address the evolving cosmetic industry landscape; numerous legislative efforts were made, but it wasn’t until the passage of MOCRA—resulting from extensive collaboration between the FDA, industry stakeholders, and Congress over a decade—that these ambitions were realized.

Under the new framework established by MOCRA, cosmetics will be subject to a range of new compliance requirements, including adherence to Good Manufacturing Practices (GMP), safety substantiation, adverse event reporting, and mandatory registration with the FDA. Additionally, the FDA is now empowered with mandatory recall authority, enhanced labeling protocols, and detailed recordkeeping responsibilities. The act mandates the FDA to formulate regulations that will define GMP, as well as guidelines for fragrance allergen labeling and testing methods for detecting asbestos in talc-based cosmetic products. While MOCRA preempts certain state-level cosmetic regulations, it does not eliminate the possibility of product liability litigation under existing state laws regarding cosmetics.

In our professional assessment, implementing and enforcing the provisions of MOCRA will likely take the FDA several years due to several critical factors. Firstly, the initiation of the necessary regulations to enforce the new requirements will not commence for at least one year, with certain labeling mandates being deferred for two years. Secondly, establishing and enforcing the GMP requirements will likely be a protracted process, requiring a complex rulemaking procedure subjected to numerous limitations on the FDA’s authority. Furthermore, the legislation does not allocate additional user fee funding, which will significantly hinder the FDA’s capacity to develop the necessary regulations and guidance documents for effective enforcement. Although MOCRA authorizes appropriations for the cosmetic sector, actual funding must be secured through the annual appropriations process, which may prove challenging in a politically divided Congress.

Below is an extensive overview and preliminary analysis of the new authorities and compliance requirements that Congress has instituted for cosmetic products:

Establishing Good Manufacturing Practices for Cosmetics

MOCRA mandates that the FDA develop new regulations aimed at defining Good Manufacturing Practices (GMP) applicable to facilities engaged in the manufacturing or processing of cosmetic products distributed within the United States. This provision explicitly empowers the FDA to inspect records deemed necessary for demonstrating compliance with GMP standards. However, it is crucial to note that certain establishments, such as those that exclusively handle labeling, relabeling, packaging, holding, and distribution, are excluded from this definition of “facility.” These exclusions imply that some entities may continue to manufacture and process cosmetics without adhering to GMP regulations, potentially raising concerns about product safety and quality. Unlike GMP requirements for other regulated products like dietary supplements and drugs, this legislation does not reference “current” GMP, which may restrict the FDA’s ability to apply updated interpretations through guidance in the future.

Moreover, MOCRA outlines specific and comprehensive limitations on the FDA’s interpretation and application of GMP through its rulemaking process, which includes the following stipulations:

• GMP requirements must align with international standards wherever feasible and appropriate;
• Regulations must prioritize public health and ensure that cosmetic products are free from adulteration;
• When establishing GMP requirements, the rulemaking process must consider the size and scope of businesses involved in cosmetic manufacturing, as well as the public health risks presented by such products;
• Flexibility must be incorporated to ensure that regulations are “practicable for all sizes and types of facilities,” potentially including simplified GMP requirements for smaller businesses to mitigate undue financial hardship;
• Prior to finalizing regulations, the FDA is required to consult with cosmetics manufacturers, small businesses, consumer advocacy groups, and relevant experts.

Furthermore, MOCRA introduces a small business exemption from the GMP mandates for owners and operators of facilities with average gross annual sales of less than $1 million (adjusted for inflation) over the past three years, except for those engaged in the manufacturing or processing of specific high-risk products, such as:

• Cosmetics that come into contact with the eye’s mucous membrane under usual usage conditions.
• Injectable cosmetic products.
• Cosmetics intended for internal use.
• Cosmetics designed to alter appearance for over 24 hours under customary conditions, where consumer removal is not part of the intended usage.

The extensive nature of these restrictions and exemptions may complicate the rulemaking process and potentially lead to legal challenges against the GMP regulations once finalized. The statute stipulates that the FDA must publish proposed rules within two years of enactment and finalize the rules no later than three years post-enactment. Given the intricate nature of this rulemaking and the probable controversies it will incite, we predict that the FDA will not start enforcing the new cosmetics GMP requirements for several years.

Ensuring Safety through Substantiation and Recordkeeping

Under MOCRA, a designated “responsible person” is mandated to ensure that each cosmetic product has adequate safety substantiation and to maintain the requisite records to support this claim. The term “responsible person” refers to the manufacturer, packer, or distributor whose name appears on the product label as mandated by MOCRA and the Fair Packaging and Labeling Act. The safety standard outlined in the statute requires that the cosmetic product (along with its ingredients) must not be “injurious” to users under the labeled conditions of use or those that are customary. Minor reactions and transient irritations are excluded from this safety standard. Adequate safety substantiation will necessitate “tests or studies, research, analyses, or other evidence or information” deemed sufficient by qualified experts in safety evaluation, ensuring a reasonable certainty that the cosmetic product is safe for consumer use.

From one year after enactment, the lack of adequate safety substantiation will categorize the cosmetic as adulterated, making it subject to enforcement actions by the FDA. It remains uncertain whether the FDA will provide guidance allowing for enforcement discretion to extend the time frame for cosmetics to meet safety substantiation requirements. Furthermore, the FDA appears to possess very limited authority to access the essential records necessary for evaluating safety substantiation, which will pose significant enforcement challenges. The amendment to the FDA’s records inspection authority under Section 704 of the Federal Food, Drug, and Cosmetic Act (FDCA) does not explicitly extend to these safety substantiation records, leaving the FDA reliant on a narrow interpretation under Section 610, introduced by MOCRA. To gain access to safety substantiation documentation, the FDA must have reasonable grounds to believe that a cosmetic product poses a risk of being adulterated, potentially leading to serious adverse health effects or even death.

Mandatory Adverse Event Reporting and Recordkeeping Protocols

The responsible person is tasked with receiving reports of adverse events through a domestic address or other contact information, which must be included on the product label as mandated by MOCRA. Within 15 business days of receiving a report regarding a “serious adverse event” associated with the domestic use of their cosmetic product, the responsible person must submit this information to the FDA. This report must also include a copy of the label found on or within the retail packaging of the product. A “serious adverse event” is broadly defined to encompass significant disfigurement or persistent alteration of appearance that was not intended under the typical usage conditions. Additionally, for one year following the initial report of a serious adverse event, the responsible person must submit any new and significant medical information related to the original report to the FDA within 15 business days of receipt.

Responsible persons must maintain records related to each reported adverse event for six years for cosmetics sold in the U.S.; however, qualifying small businesses, as described in the GMP section above, are only required to keep these records for three years. In contrast to safety substantiation records, MOCRA grants the FDA broad authority to access adverse event records during inspections under Section 704, facilitating the enforcement of these reporting requirements.

Although the FDA will have the authority to enforce the adverse event reporting requirements starting one year after enactment, the requirement for including the domestic address or other contact information on product labels to facilitate adverse event reporting will not take effect until two years after enactment.

Mandatory Registration and Listing of Cosmetic Products

Within one year following the enactment, all individuals or entities owning or operating a facility engaged in the manufacturing or processing of cosmetic products for distribution in the U.S. must register with the FDA. The registration process requires the submission of contact information for the facility, along with all brand names under which the cosmetic products manufactured or processed at the facility are marketed. If a new facility begins manufacturing or processing after the enactment of MOCRA, the owner or operator must register with the FDA within 60 days of commencing such activities. However, as previously noted in the GMP section, specific establishments are excluded from the definition of “facility” and therefore are not required to register. For instance, establishments solely involved in the labeling or packaging of cosmetics are exempt from this requirement. Additionally, registered owners or operators must renew their registrations biennially and notify the FDA within 60 days of any changes to the required information.

MOCRA grants the FDA the authority to suspend a facility’s registration with prior notice and the opportunity for an informal hearing. If a registration is suspended, no cosmetic product may be introduced or delivered for introduction into interstate commerce. The authority to suspend registration cannot be delegated below the Commissioner level. If the FDA suspends a facility registration, the agency will require the registrant to submit a corrective action plan, which the FDA must review within 14 business days or within a timeframe determined in consultation with the registrant.

Within one year after enactment, the responsible person must submit listing information to the FDA for each cosmetic product. For products first marketed after the enactment date of MOCRA, listing information must be submitted within 120 days of marketing. This listing information must be updated annually and includes details about the responsible person, the facility where the product is manufactured or processed, and a complete list of ingredients. Fragrance, flavor, and color components may be disclosed as “fragrance” or “flavor” without revealing the specific chemical names or details, as permitted under 21 CFR 701.3.

The FDA’s authority to enforce registration and listing requirements will not come into effect until one year after the enactment.

Mandatory Recall and Cease Distribution Authority for Cosmetics

If the FDA determines that a cosmetic product is adulterated or misbranded and poses a reasonable probability of causing serious adverse health consequences or death, the agency must provide the responsible person with the opportunity to voluntarily cease distribution and recall the product. Should the responsible person fail to comply within the prescribed timeframe, the FDA may order them to immediately halt distribution. The responsible person must then be afforded an informal hearing within 10 days. Following the hearing, the FDA may mandate a recall and require timely notifications and updates to the agency. The authority to order or vacate a recall is exclusive to the Commissioner level, but the statutory framework does not prevent delegating authority for ceasing distribution. For any recall initiated under this provision, MOCRA mandates that the FDA must publish a press release and display an image of the recalled product on its website.

The FDA’s authority to enforce orders related to ceasing distribution or recalling a product will take effect one year following the enactment.

Expanded Records Inspection Authority for the FDA

MOCRA amends Section 704, enhancing the FDA’s authority to inspect records for cosmetic facilities concerning adverse event reports, GMP documentation, and various other records. This legislation empowers the FDA to define the specific scope of records necessary for demonstrating GMP compliance, which may be subject to inspection under Section 704. However, as previously mentioned, to access records related to safety substantiation and other cosmetic records (excluding GMP or adverse event reports), the FDA must satisfy a much higher standard. The agency can only obtain access to these records if there is a reasonable belief that a cosmetic product is likely to be adulterated, posing a serious risk of adverse health consequences or death. This restricted records inspection authority starkly contrasts with the broader access the FDA holds for most other regulated products.

Regulatory Guidelines for Combination Cosmetic-Drug and Cosmetic-Device Products

A cosmetic product or facility also regulated under drug or device authorities, such as a cosmetic-drug combination product, is exempt from the cosmetic-specific requirements surrounding adverse event reporting, GMP, registration/listing, safety substantiation, label statements for receiving adverse event reports, records inspection, and mandatory recall authority. This exemption is likely due to the fact that the FDA oversees these combination products under separate drug or device regulations. However, these exemptions do not apply to facilities that manufacture or process single-entity cosmetic products in addition to combination products. For instance, a facility that produces both a cosmetic-drug combination product and standalone cosmetic items would still be subject to the cosmetic GMP, records inspection, and registration requirements.

Labeling Requirements for Fragrances and Fragrance Allergens

MOCRA does not significantly alter existing laws governing cosmetic labeling, which currently permits the identification of an ingredient intended to provide or mask a fragrance simply as “fragrance,” without the necessity to disclose its specific chemical identity. Similarly, the cosmetic product listing requirements established by MOCRA do not mandate that the chemical identity of fragrances be disclosed to the FDA. However, MOCRA introduces a new requirement for responsible persons to disclose any “fragrance allergens” mandated by FDA regulation on cosmetic labels. The FDA is required to propose a rule concerning fragrance allergens within 18 months of enactment and to finalize it within 180 days following the public comment period. Additionally, MOCRA grants the FDA the authority to request, within 30 days, a list of any fragrance or flavor ingredients that the FDA reasonably believes contributed to a serious adverse event that requires reporting.

Understanding Preemption Under MOCRA

In relation to registration/listing, GMP, records, recalls, adverse event reporting, and safety substantiation, MOCRA incorporates a clear preemption provision that prohibits state or local governments from implementing or maintaining any cosmetic requirements that do not align with federal regulations. Nevertheless, MOCRA clarifies that states retain the authority to impose restrictions on the amount of certain cosmetic ingredients. Furthermore, states may continue to enforce existing reporting requirements for ingredients in cosmetic products if such mandates were in place prior to the enactment of MOCRA. Importantly, the preemption provisions do not modify or displace any actions for damages or liability under state law or common law, such as in product liability cases, regarding any standard, rule, requirement, regulation, or adverse event report. It’s essential to note that the preexisting preemption provisions for cosmetic labeling and packaging under Section 752 remain unchanged.

Additional Provisions and Mandates Under MOCRA

• Within one year following the enactment, the FDA must propose a rule establishing standardized testing methods for detecting and identifying asbestos in talc-containing cosmetic products, with a final rule to be issued no later than 180 days after the close of the comment period.
• MOCRA mandates that the FDA assess the use of perfluoroalkyl and polyfluoroalkyl substances (PFAS) in cosmetic products, along with the scientific evidence regarding their safety and associated risks. The FDA is required to produce a report summarizing the findings of this assessment within three years of the enactment.
• MOCRA includes a statement reflecting Congress’s stance that “animal testing should not be utilized for safety testing on cosmetic products and should be phased out, with appropriate allowances.” This provision does not grant new authority to the FDA and is not enforceable.

MOCRA authorizes appropriations for fiscal years 2023 through 2027 to support both new and existing provisions pertaining to cosmetics. The authorized amount for 2023 exceeds $14 million, increasing to nearly $42 million by 2025. However, it is crucial to recognize that these authorizations do not translate into actual appropriations that can be utilized to fund a comprehensive cosmetics program or implement the provisions of MOCRA. In the absence of user fees, the new cosmetics program will need to compete for annual appropriations against other FDA funding priorities.