The Modernization of Cosmetics Regulation Act (MoCRA), signed into law on December 29, 2022, ended more than eight decades of minimal federal oversight by giving the FDA real authority over cosmetic products — and companies that have not yet mapped their obligations are running out of runway.

MoCRA is the most significant expansion of the FDA's cosmetics powers since the Federal Food, Drug, and Cosmetic Act of 1938. Under the old regime, the agency could not require recalls, inspect safety records or even know which facilities made the products on US shelves. MoCRA changes that baseline.

What does MoCRA actually require?

The law introduces several mandatory duties for brands, contract manufacturers and importers operating in the US market:

• Facility registration. Manufacturing and processing facilities must register with the FDA and renew every two years.
• Product listing. Responsible persons must list each marketed cosmetic product, including ingredients, and update annually.
• Safety substantiation. Companies must maintain records supporting the safety of every product — evidence that the product and its ingredients are safe under labeled or customary use.
• Adverse event reporting. Serious adverse events must be reported to the FDA, and related records retained for six years (three years for certain small businesses).
• Mandatory recall authority. If the FDA determines a cosmetic is adulterated or misbranded and exposure will cause serious harm, the agency can compel a recall after giving the company a chance to act voluntarily.

Who counts as the "responsible person"?

The law places the core compliance burden on the "responsible person" — the manufacturer, packer or distributor whose name appears on the label. This entity owns the safety substantiation, the product listing and the adverse event workflow.

For private-label and contract-manufactured brands, that allocation shifts substantial work to the brand owner, not the factory. Formulators and procurement teams should verify that supplier agreements now spell out who holds safety data, who reports adverse events and who files the listing.

What should formulators and compliance teams do now?

Practical steps follow directly from the statute:

• Build a facility register across the entire supply chain, including contract manufacturers and overseas sites exporting to the US.
• Assemble ingredient-level safety dossiers for each SKU, not just finished-product claims.
• Stand up a documented adverse event intake process with escalation criteria for "serious" events.
• Review labeling to confirm the responsible person is correctly identified.

Small businesses receive some relief from registration and listing deadlines, but the safety substantiation and adverse event obligations apply across the board — and no exemption covers safety.

MoCRA also directs the FDA to develop standards for detecting and identifying asbestos in talc-containing products, a rulemaking with direct consequences for powder-based formulations and their raw material suppliers.

What comes next?

The FDA has been issuing guidance and opening enforcement expectations in stages since the statute passed, and companies should treat facility registration, product listing and safety substantiation as live obligations rather than future ones. The next data point to watch: each new FDA guidance document and proposed rule under MoCRA, including the talc testing standard, which will define the compliance workload for powder categories first.