MoCRA, the Modernization of Cosmetics Regulation Act of 2022, gives US cosmetic duties to specific parties. Safety substantiation, serious adverse-event reporting and product listing sit with the responsible person. Facility registration sits with the facilities that manufacture or process the product. Before launch, a brand needs to know which entity holds each duty, who does the work and where the records live. Registration and listing are not FDA approval. Use the cosmetic product development roadmap to schedule these tasks alongside development and launch.
Scope and rule status
This guide covers the duties described on FDA’s MoCRA pages and in the statute, checked on 23 October 2026. It does not settle a product’s classification, a particular business’s exemption eligibility or state-law requirements. Check the current status and compliance dates of the cosmetics GMP and fragrance-allergen labeling rules against official sources before relying on them (see rulemaking status). For EU work, use the separate EU cosmetic launch checklist. The two markets define roles and dossiers differently.
Who is responsible for which MoCRA tasks?
Is the brand automatically the responsible person?
Not necessarily. The FDA’s MoCRA overview defines the responsible person as the manufacturer, packer or distributor whose name appears on the cosmetic label under the specified labeling provisions. The label decides the role, not the commercial title “brand owner.” Check the actual label rather than assuming the development lab or the brand holds it.
Establish three things: which legal entity appears on the label, who maintains the safety records and who receives safety information from customers. Then list, separately, every facility that manufactures or processes the product.
Can a supplier or service provider do the administrative work?
Yes, but the agreement should name the legally responsible party separately from whoever prepares the paperwork. Record who supplies information, who reviews it, who submits it and who keeps access to the record. “We handle MoCRA” is not a responsibility statement.
The matrix summarizes the allocation described in the FDA’s overview and registration and listing page. Exemptions still need to be assessed case by case.
What safety and claims records should a brand keep apart?
Does MoCRA require adequate safety substantiation?
Yes. The FDA’s MoCRA overview, Safety Substantiation section says the responsible person must ensure, and maintain records supporting, adequate substantiation of the product’s safety. Neither the law nor FDA regulations prescribe specific tests for individual products or ingredients, and FDA says the supporting data should come from scientifically robust methods.
No prescribed test list does not mean no evidence. Ask the specialist what evidence supports this formula, pack and intended use, and where the gaps are. A practical record register lists the product version, each evidence reference, what it covers, who reviewed it, its limitations and who updates it. FDA does not mandate that form, but it makes the records easy to produce.
Are safety substantiation and marketing-claim evidence the same?
No. Whether a product is safe is a different question from whether an advertised benefit is substantiated, and a safety file does not prove every marketing statement. Track proposed claims and their evidence separately using the cosmetic claims substantiation guide.
An EU dossier is also not a ready-made US file. Its evidence may be relevant, but someone has to check that it applies. The Product Information File guide explains the EU dossier, which does not replace US duties.
How should serious adverse events reach the responsible person?
What is the reporting deadline?
Under 21 USC §364a(a)–(b) (official 2024 US Code edition), the responsible person must submit a serious adverse-event report to FDA no later than 15 business days after receiving it, with a copy of the label on or within the retail packaging. The clock starts when the report is received, not when it is next reviewed.
A second clock applies to new and material medical information about a submitted report. If the responsible person receives it within one year of the initial report, it must be submitted no later than 15 business days after receipt. The FDA’s industry-reporting page describes the submission routes.
Set up intake and escalation that records the receipt date and routes possible serious events to the responsible party straight away. A monthly complaints meeting cannot be the only route.
Is every complaint a serious adverse event?
No. FDA distinguishes adverse events from serious adverse events by specified outcomes in its MoCRA overview. Customer service should escalate, not make medical judgements, and a “refund or report” shortcut has no basis in that guidance.
Name an escalation contact and a backup, the route for passing information on and where each decision is recorded. Agree with the relevant specialist how uncertain cases are evaluated. If the manufacturer is investigating a batch issue at the same time, the two parties need a shared communication route. One investigation does not complete the other’s duty.
How do facility registration and product listing differ?
Who registers facilities and who lists products?
Manufacturers and processors register facilities. The responsible person lists products. Both are subject to applicable exemptions. The Registration & Listing of Cosmetic Product Facilities and Products page describes facility renewal every two years from initial registration and annual product-listing updates.
Work out dates from the actual records rather than using one renewal deadline for every facility. A product listing does not complete the facility’s registration. Record which entity owns each submission, who checks for changes and how the brand gets confirmation.
Does a registration or listing number mean FDA approval?
No. The FDA’s registration and listing page states that these are not approval programs and that assigned numbers do not indicate approval of facilities or products. FDA does not issue certificates or verification documents confirming registration or listing compliance.
If a supplier offers an “FDA certificate,” ask who issued it and what it covers. It is not a safety conclusion, it does not replace required records and it should not appear in marketing as an endorsement.
Which small-business exemptions can be considered?
Does being a small business remove all MoCRA duties?
No. Under 21 USC §364h, a qualifying small business is exempt from the GMP and registration-and-listing provisions only. The statute sets the test at average gross annual US cosmetic sales over the previous three years of less than $1,000,000, “adjusted for inflation”. The $1,000,000 figure is the base written into the 2022 statute. It is not a current 2026 cutoff, and this guide does not state the adjusted figure. The FDA’s MoCRA overview, Exemptions section describes the same scope. Safety substantiation and serious adverse-event reporting still apply. Get the applicable inflation-adjusted threshold from FDA before relying on the exemption.
The exemption does not apply to businesses that manufacture or process products that regularly contact the mucous membrane of the eye under customary or usual conditions of use, products that are injected, products intended for internal use, or products intended to alter appearance for more than 24 hours where consumer removal is not part of customary or usual use. Read these categories as written. “Near the eye” is not the same as contact with the eye’s mucous membrane, and the last category depends on removal as well as duration.
Record each exemption decision with its basis and the specific requirements it covers. “MoCRA exempt” as a general label hides the duties that still apply.
What is the status of the GMP and fragrance-allergen rules?
Are GMP and fragrance-allergen rules in force?
Check before relying on either. The FDA overview confirms that MoCRA directs FDA to issue GMP and fragrance-allergen labeling regulations. That mandate does not tell you whether a final rule exists or when it takes effect.
The cosmetic GMP page is draft guidance. FDA states that guidance does not itself establish legally enforceable responsibilities. It is not a final GMP rule and does not create an ISO certification requirement.
Release check: have the regulatory owner identify the current rule texts, their status, effective and compliance dates, and any transitions or exemptions, and record the sources and check date. Hold any commitment that depends on an unresolved answer.
What happened to the talc-testing proposal?
FDA withdrew its December 2024 proposal on 28 November 2025. The withdrawal notice, document 2025-21407 gives that date and says FDA will issue a proposal to meet its statutory obligations. The FDA’s Talc page confirms the withdrawal.
That date marks a withdrawal, not a testing deadline, and the withdrawn testing and record provisions are not in force. For a talc-containing product, check whether FDA has published a replacement proposal since.
Turn the duties into a readiness record
Keep role allocation, evidence and open decisions in one record. This example is fictional and shows the level of detail, not an actual compliance assessment.
Project: product M01, formula F02, US label draft L03; record U01 dated 23 October 2026.
Role question: label entity identified in the draft; regulatory owner must confirm the responsible-person arrangement.
Evidence handoff: manufacturer provides the product evidence register; brand technical coordinator arranges its review and documents gaps. No safety conclusion yet.
Administrative work: manufacturer confirms facility-registration status; designated listing preparer confirms product-listing applicability and inputs.
Post-launch preparation: responsible-party contact agrees complaint escalation, reporting workflow and backup access.
Current-rule check: regulatory owner resolves current GMP and fragrance-allergen requirements and dates, plus any talc action or exemption.
Decision: launch on hold until role, evidence, administrative and current-rule questions are closed.
A useful record shows what is still unknown and who will resolve it. A folder, a submission number or a supplier statement is not a release decision. The development roadmap keeps these decisions separate from sensory and manufacturing approvals.
Next step: assign the open duties
Identify the responsible person and the facilities, then assign evidence, reporting and submission tasks from the matrix. Confirm any exemption and current-rule questions against official sources before relying on them. For a multi-market project, run the EU launch workflow and PIF responsibilities alongside the US work, not in place of it.
