Modernization of U.S. cosmetics regulation will be phased in over time

MOCRA will require cosmetics to comply with various new requirements, including: Good Manufacturing Practice (GMP), safety substantiation, adverse event reporting, registration and listing with FDA, mandatory recall authority for FDA, additional labeling, and various recordkeeping requirements. MOCRA requires FDA to establish through regulations requirements for GMP, fragrance allergen labeling, and methods to test for asbestos in talc-containing cosmetic products. The new legislation also provides for preemption of certain State requirements for cosmetics but will generally not preempt product liability litigation under State causes of action pertaining to cosmetics with regard to any standard, rule, requirement, regulation or adverse event report. However, the law includes exemptions from GMP and registration/listing requirements for qualifying small businesses,

In our view, it will likely take FDA several years to implement and enforce the new law, for several reasons. First, the effective date for the provisions necessary to enforce the new requirements is deferred for one year (two years for certain labeling requirements). Second, the GMP requirements will likely not come into effect for several years because they will require a rulemaking proceeding that will be technical and complicated by numerous constraints on the authority granted to FDA. And third, the legislation does not come with any additional user fee funding, which will limit FDA’s ability to develop the regulations and guidance documents that will be necessary for implementation. Although MOCRA includes authorization of appropriations for cosmetic regulation, MOCRA does not include any actual appropriations, which FDA will need to obtain through the annual appropriations process to expand FDA’s cosmetic program and fund MOCRA implementation. Obtaining new funds for FDA regulation in a divided Congress will not be easy.

The following is a detailed overview and preliminary analysis of the new authorities and requirements that Congress has established for cosmetic products:

Good Manufacturing Practice

MOCRA requires FDA to publish new regulations to establish GMP requirements for “facilities” that manufacture or process cosmetic products distributed in the US. In addition, this provision expressly grants FDA the authority to inspect records “necessary to demonstrate compliance with GMP.” However, among the exclusions from the definition of “facility” are establishments that solely perform labeling, relabeling, packaging, holding, and distribution. These and other exclusions from the definition of “facility” indicate that certain entities will be able to manufacture and process cosmetics without complying with GMP regulations. It is also noteworthy that unlike GMP requirements for dietary supplements, drugs, and even foods, this provision does not refer to “current” GMP, which might hinder FDA’s ability in the future to apply dynamic interpretations through guidance.

In addition, MOCRA includes numerous and detailed restrictions on FDA’s interpretation and application of GMP through rulemaking, including the following:

• To the extent practicable and appropriate, the GMP requirements must be consistent with international standards;
• The regulations must be intended to protect the public health and ensure that cosmetic products are not adulterated;
• In establishing GMP requirements, the rulemaking must take into account the size and scope of businesses engaged in the manufacture of cosmetics and the risks to public health posed by such cosmetics;
• FDA must provide sufficient flexibility to be “practicable for all sizes and types of facilities” to which such regulations will apply and, as appropriate, include “simplified” GMP requirements for smaller businesses, which may include longer compliance times to ensure that the regulations do not impose undue economic hardship;
• Before issuing the regulations, FDA must consult with cosmetics manufacturers, including smaller businesses, consumer organizations, and other experts.

Furthermore, MOCRA establishes a small business exemption from cosmetic GMP requirements for owners and operators of facilities with average gross annual sales of less than $1 million (inflation adjusted) for the previous three-year period, except if they are engaged in manufacturing or processing certain higher risk products, such as:

• Cosmetic products that regularly come into contact with mucus membrane of the eye under conditions of use that are customary or usual.
• Cosmetic products that are injected.
• Cosmetic products that are intended for internal use.
• Cosmetic products that are intended to alter appearance for more than 24 hours under conditions of use that are customary or usual and removal by the consumer is not part of such conditions of use that are customary or usual.

These extensive restrictions and exemptions are likely to complicate the rulemaking and may provide a basis for legal challenges to the GMP rule through litigation after it is finalized. The statute requires FDA to publish the proposed rules within 2 years of enactment and issue the final rule no more than three years after enactment. Given the complexity of this rulemaking and the controversy it is likely to engender, we do not anticipate that FDA will begin enforcing cosmetics GMP requirements for several years.

Safety substantiation and recordkeeping

A “responsible person” must ensure that there is adequate substantiation of the safety of each cosmetic product and maintain the necessary records to support that substantiation. A “responsible person” is defined as the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label, as required by MOCRA and the Fair Packaging and Labeling Act. The statutory standard for safety requires that the cosmetic product (including its ingredients) is not “injurious” to users under the labeled conditions of use or those that are customary or usual; minor or transient reactions and irritations are excluded from this safety standard. Adequate substantiation of safety will require “tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients,” and the substantiation must be “sufficient to support a reasonable certainty that a cosmetic product is safe.”

Beginning one year after enactment, the failure to have adequate substantiation of safety will render the cosmetic adulterated and subject to FDA enforcement action. It remains to be seen whether FDA will issue through guidance an enforcement policy that will allow for enforcement discretion to grant more time for cosmetics to obtain the necessary safety substantiation. However, it appears that FDA has very limited authority to obtain access to the necessary records to assess safety substantiation, which will make enforcement very challenging for FDA. The MOCRA amendment to FDA’s records inspection authority under Section 704 of the Federal Food, Drug and Cosmetic Act (FDCA)[1] does not expressly extend to these safety substantiation records. Instead, it appears that FDA will be limited to the very narrow records access afforded by Section 610, added by MOCRA. To obtain access to safety substantiation documentation under this records provision, FDA will need to have a reasonable belief that the cosmetic product (including any ingredient) is likely to be adulterated such that product presents a threat of “serious adverse health consequences or death.” As a result, FDA will be precluded from routinely reviewing cosmetic safety substantiation documentation.

Adverse event reporting and recordkeeping

The responsible person must receive adverse event reports through the domestic address or other contact information, which is required under MOCRA to be included on the label. A responsible person must submit to FDA, within 15 business days after it is received, any report of a “serious adverse event” associated with the domestic use of a cosmetic product manufactured, packed or distributed by the responsible person. The report must also include a copy of the label on or within the retail packaging of the cosmetic. A “serious adverse event” is defined broadly to include significant disfigurement, including persistent or significant alteration of appearance, not intended for the cosmetic product under customary or usual conditions of use. In addition, for one year after the initial report of serious adverse event, the responsible person must submit to FDA within 15 business days of receipt any new and material medical information related to the initial report.

The responsible person must maintain records for six years related to each report of an adverse even that it received for a cosmetic used in the US that was manufactured or distributed by the responsible person. Qualifying small businesses described in the GMP section, above, need only maintain such records for three years.

In contrast to records for safety substantiation described above, MOCRA grants broad authority to FDA during an inspection under Section 704, allowing access to adverse event records required to be maintained.

Although FDA will have the authority to begin enforcing the adverse event reporting requirements in one year after enactment, the requirement to include the domestic address or other contact information on the product label to receive adverse event reports does not become effective for two years from the date of enactment.

Registration and listing

Within one year of enactment, any person that owns or operates a facility that engages in manufacturing or processing of a cosmetic product for US distribution must register with FDA. The information that must be submitted to FDA for registration includes contact information relating to the facility and all brand names under which cosmetic products manufactured or processed in the facility are sold. If a new facility first engages in such manufacturing or processing after enactment of MOCRA, the owner or operator of such a facility must register with FDA within 60 days of initiating such manufacturing or processing. However, as described above in the GMP section, certain establishments are exempt from the definition of “facility” and would therefore not be required to register. For example, establishments that solely engage in labeling or packaging of cosmetic products are not required to register with FDA. The owner or operator required to register must renew such registration on a biennial basis and notify FDA within 60 days of any changes to the required information.

MOCRA grants to FDA the authority to suspend a facility registration with notice and the opportunity for an informal hearing; upon suspension of registration, no cosmetic product may be introduced or delivered for introduction into interstate commerce. The exercise of the authority to suspend a facility registration cannot be delegated below the level of the Commissioner. If FDA suspends a facility registration the agency must require the registrant to submit a corrective action plan, which FDA must review within 14 business days or another time period determined by FDA in consultation with the registrant.

Within one year of enactment, the responsible person must submit to FDA for each cosmetic product certain listing information. For a product first marketed after the date of enactment of MOCRA, listing information must be submitted to FDA within 120 days of marketing such product in interstate commerce. Listing information must be updated annually. The listing information that must be submitted for each product includes information about the responsible person and the facility where the product is manufactured or processed and a list of ingredients in the cosmetic product. Fragrances, flavors and colors, however, may be identified as required under 21 CFR 701.3, which allows for disclosure of a fragrance as “fragrance” and a flavor as “flavor,” without disclosing the chemical name or other details.

FDA’s authority to enforce registration and listing requirements does not come into effect until one year after enactment.

Mandatory recall & cease distribution authority

If FDA determines that there is a reasonable probability that a cosmetic is adulterated or misbranded and it will cause serious adverse health consequences or death, FDA must provide the responsible person with an opportunity to voluntarily cease distribution and recall the cosmetic. If the responsible person does not voluntarily cease distribution or recall a cosmetic within the time and manner prescribed by FDA, FDA may order the responsible person to immediately cease distribution of such article. The responsible person to whom such an order is issued must be provided an opportunity for an informal hearing within 10 days. After the hearing, FDA may order a recall and require appropriate notifications and updates to FDA. FDA’s authority to order or vacate a recall may not be delegated below the Commissioner level, but the statutory language does not prevent FDA from delegating the authority for a cease-distribution order under this section. For any recall conducted under this provision, MOCRA requires FDA to ensure that a press release is published, as well as an image of the recalled cosmetic product on FDA’s website.

FDA’s authority to take enforcement action against a responsible person’s failure to follow an FDA order to cease distribution or recall under MOCRA takes effect one year from the date of enactment.

Records inspection

MOCRA amends Section 704 to grant FDA records inspection authority for a cosmetic facility with respect to adverse event reports, GMP records, and certain other records. MOCRA grants FDA the authority to establish, as part of the rulemaking establishing GMPs for cosmetic products, the scope of records necessary to demonstrate compliance with GMP that may be inspected under Section 704. However, as described above, to obtain or inspect records required for safety substantiation and other cosmetic records (not including GMPs or adverse event reports), FDA would need to meet a much higher standard: FDA can only obtain access and copy these records if FDA has a reasonable belief that a cosmetic product is likely to be adulterated such that the use or exposure to such product presents a threat of serious adverse health consequences or death. This limited records inspection authority stands in stark contrast to the broader records inspection authority that FDA has most other regulated products.

Combination cosmetic drug and cosmetic device products

A cosmetic product or facility that is also regulated under drug or device authorities, such as a cosmetic-drug combination product, is exempt from the cosmetic requirements for adverse event reporting, GMP, registration/listing, safety substantiation, label statement for receiving adverse event reports, records inspection, and mandatory recall authority. Presumably this is because FDA’s oversight for these cosmetic combination products will be handled under the drug or device authorities. But the foregoing exemptions are not applicable to a facility that in addition to such combination products also manufacturers or processes single entity cosmetic products that are not cosmetic combination products. For example, a facility that manufactures a cosmetic-drug combination product and one or more cosmetic products would be subject to cosmetic GMP requirements, cosmetic records inspection, and cosmetic facility registration requirements.

Fragrances and fragrance allergens

MOCRA generally does not alter current law for cosmetic labeling, which allows the label to identify as “fragrance” an ingredient intended to provide or mask a fragrance, without disclosing the specific chemical identity of the fragrance. Similarly, the cosmetic product listing requirements established by MOCRA do not require that the specific chemical identity of fragrances are provided to FDA in the listing submission. However, MOCRA adds a new requirement for the responsible person to identify on the label each “fragrance allergen” that FDA has required by regulation for such label disclosure. FDA must issue the proposed rule for such fragrance allergens within 18 months of enactment and finalize the rule within 180 days after the comment period ends on the proposed rule. In addition, MOCRA gives FDA new authority to request from a responsible person, within 30 days, a list of any fragrance or flavor ingredients, or categories of such ingredients, that FDA has reasonable grounds to believe caused or contributed to a serious adverse event for which reporting to FDA is required.

Preemption

With respect to registration/listing, GMP, records, recalls, adverse event reporting and safety substantiation, MOCRA includes an express preemption provision that prohibits any State or local government from establishing or continuing any requirement for cosmetics that is not identical to those under Federal law. However, MOCRA clarifies that the statute does not prohibit a State from prohibiting or limiting the amount of a cosmetic ingredient. In addition, MOCRA does not prevent a State from continuing in effect a requirement for reporting an ingredient in a cosmetic product if such requirement was in effect when MOCRA was enacted. In addition, the preemption provision does not modify, preempt, or displace any action for damages or liability under State law or common law, such as under product liability litigation, with regard to any standard, rule requirement, regulation or adverse event report. Note that the MOCRA’s preemption language does not alter the preexisting preemption provision for cosmetic labeling and packaging under Section 752.

Other provisions

• Within one year of the date of enactment, FDA must publish a proposed rule establishing and requiring standardized testing methods for detecting and identifying asbestos in talc-containing cosmetic products, and FDA must issue the final rule not later than 180 days after the comment period closes on the proposed rule.
• MOCRA directs FDA to assess the use of perfluoroalkyl and polyfluoroalkyl substances (PFAS) in cosmetic products and the scientific evidence regarding the safety of, and risks associated with, their use in cosmetics products. FDA is also required to issues a report within three years of enactment summarizing the results of this assessment.
• MOCRA includes a provision stating the “sense of the Congress” that “animal testing should

not be used for the purposes of safety testing on cosmetic products and should be phased out with the exception of appropriate allowances.” This provision creates no new authority for FDA and is not enforceable.

• MOCRA includes authorization of appropriations for fiscal years 2023 through 2027 for carrying out the new and existing provisions relating to cosmetics. The amount authorized for 2023 is in excess of $14 Million, increasing to almost $42 Million beginning in 2025. However, these authorizations are not actual appropriations that can be used to fund an expanded cosmetics program or implement MOCRA. Without any user fees, the new cosmetics program will need to compete for annual appropriations with other FDA funding priorities.

Authored by David Horowitz, Heidi Gertner, and Sally Gu