The Complete Guide to MoCRA Compliance in 2026

The Modernization of Cosmetics Regulation Act (MoCRA), signed into law on December 29, 2022, represents the most significant overhaul of US cosmetics regulation since the Federal Food, Drug, and Cosmetic Act of 1938. For the first time in nearly a century, FDA has real authority over cosmetics — and every brand selling in the US needs to comply.

This guide covers everything you need to know: what MoCRA requires, who it applies to, key deadlines, and how to automate compliance.

What is MoCRA?

MoCRA amends the FD&C Act to give FDA new authorities over cosmetics, including:

Mandatory facility registration — every facility that manufactures or processes cosmetics for US distribution must register with FDA
Mandatory product listing — every cosmetic product marketed in the US must be listed with FDA
Safety substantiation — manufacturers must ensure and maintain adequate substantiation of safety for each product
Adverse event reporting — serious adverse events must be reported to FDA within 15 business days
Good Manufacturing Practices (GMP) — FDA will establish GMP requirements for cosmetics
Labeling requirements — new requirements including fragrance allergen disclosure
Records access — FDA can access safety records during inspections
Recall authority — FDA can order mandatory recalls of cosmetics

Who Needs to Comply?

MoCRA applies broadly to anyone in the cosmetics supply chain:

Manufacturers and Processors

If you manufacture, process, pack, or hold cosmetics for US distribution, you must register your facility. This includes contract manufacturers — the brand AND the manufacturer both have obligations.

Brands and Marketers

The "responsible person" — typically the brand whose name appears on the label — must list all products with FDA and is responsible for adverse event reporting and safety substantiation.

Small Business Exemption

Businesses with average annual gross sales under $1,000,000 over the past 3 years are exempt from facility registration, product listing, and GMP requirements. However, they are NOT exempt from:

Adverse event reporting (15-day deadline still applies)
Safety substantiation requirements
Labeling requirements
Products for the eye area, injected products, or products intended for internal use

Facility Registration

Every facility involved in manufacturing or processing cosmetics for US distribution must register with FDA. Key details:

Deadline: Within 60 days of beginning manufacturing or processing
Renewal: Biennial (every 2 years), between October 1 and December 31 of each even-numbered year
Method: Through FDA's Cosmetics Direct portal, or via SPL XML through the Electronic Submissions Gateway (ESG NextGen)
FEI Number: You'll need an FDA Establishment Identifier (FEI) number. If you don't have one, request it from FDA before registering.
Cost: Free through FDA directly. Third-party services charge $495–$1,449.

Product Listing

Every cosmetic product marketed in the US must be listed with FDA. Product listing includes:

Product name and category
Complete ingredient list
Facility where the product is manufactured
Responsible person name and contact information

Deadline: Within 120 days of marketing the product. Updates required within 60 days of any changes.

Method: Same as facility registration — Cosmetics Direct or ESG NextGen. Cosmetica automates this with direct ESG API integration, generating the required SPL XML and submitting automatically.

Safety Substantiation

Perhaps the most significant new requirement: manufacturers must "ensure, and maintain records supporting, adequate substantiation of safety" for each cosmetic product. This means:

You must have evidence that your product is safe under labeled conditions of use
FDA can request to see your safety data during an inspection
Tests, studies, and other relevant data must demonstrate safety
There is no pre-market approval — but you must have the data to back up safety

Cosmetica's AI formulation analysis helps with safety substantiation by checking every ingredient against known regulatory limits, identifying restricted concentrations, and linking to peer-reviewed safety studies and SCCS opinions.

Adverse Event Reporting

Serious adverse events must be reported to FDA within 15 business days of receiving the initial report. A "serious adverse event" is one that results in:

Death
A life-threatening experience
Inpatient hospitalization
A persistent or significant disability or incapacity
A congenital anomaly or birth defect
An infection
Significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance)

Reports are submitted using FDA Form 3500A (MedWatch). Cosmetica generates this form automatically and tracks the 15-business-day deadline for each event.

Good Manufacturing Practices (GMP)

MoCRA requires FDA to establish GMP regulations for cosmetics. The FDA has indicated these will be based on existing industry standards, likely aligned with ISO 22716:2007 (Cosmetics — Good Manufacturing Practices).

While the final GMP rule is still in development, companies should begin preparing by implementing ISO 22716 practices now.

Key Deadlines

Requirement	Deadline	Status
Facility Registration	July 1, 2024	Active — register now
Product Listing	July 1, 2024	Active — list now
Adverse Event Reporting	Ongoing	15 business days from receipt
Small Business Exemptions	December 29, 2025	Most exemptions expired
GMP Compliance	2026 (expected)	Final rule pending
Fragrance Allergen Labeling	TBD	FDA rulemaking in progress

How Cosmetica Automates MoCRA Compliance

Cosmetica replaces the manual, error-prone compliance process with software:

AI Formulation Analysis: Upload your ingredient list and get instant compliance results across the US and 14 other markets, with verified citations from FDA CFR sections, SCCS opinions, and CIR safety assessments.
Automated FDA ESG Submissions: Direct API integration with FDA's ESG NextGen. Generate SPL XML, submit facility registrations and product listings, and track submission status — no manual portal work.
Adverse Event Management: Track events from receipt through FDA submission. Auto-generate MedWatch 3500A forms. Monitor the 15-business-day deadline with email alerts at 7, 3, and 1 day.
Safety Substantiation Support: Every compliance finding is linked to the actual regulatory source — FDA CFR, SCCS opinion, CIR report, or PubMed study. Build your safety evidence file with verified citations.

See pricing → | Learn more about MoCRA automation →