MoCRA Explained: What the Regulation Requires, Who It Affects, and the Key Dates
MoCRA is the largest expansion of FDA authority over cosmetics since 1938, and it has quietly changed what a cosmetics business is expected to be able to prove.
Several years on, we're still seeing brands wrestling with it, and not because the requirements are unusually complicated. It's that this is the first regulation of its kind the sector has faced. Pharmaceutical and medical device companies spent decades building the recordkeeping infrastructure MoCRA now assumes, prompted by regulators who arrived far earlier. Cosmetics teams are being asked to develop the same discipline from a standing start, while still launching at the pace the market expects. That's a tooling problem far more than a knowledge one.
If you're working out where you're struggling with MoCRA, this blog is for you.
What is MoCRA?
The Modernization of Cosmetics Regulation Act of 2022 was signed into law on December 29, 2022 as part of the Consolidated Appropriations Act. Before it, cosmetics were regulated under a framework that required no facility registration, no product listing, no safety records, and gave the FDA no power to order a recall.
MoCRA introduced all of those. In practical terms it moves cosmetics much closer to the way pharmaceutical and medical device products are handled: registered facilities, listed products, documented safety, traceable records, and a regulator with the authority to ask for any of it.
Who does MoCRA apply to?
The obligations fall on the responsible person, which MoCRA defines as the manufacturer, packer, or distributor whose name appears on the product label. If your name is on the pack, the responsibility is yours regardless of who actually made it. Contract manufacturers and facilities that process cosmetics for the US market also need to register, including facilities located outside the United States.
A small business exemption applies to companies with average gross annual US cosmetic sales below $1 million over the previous three years. Those businesses are exempt from facility registration, product listing, and GMP requirements, but not from safety substantiation or adverse event reporting. The exemption does not apply at all to products that are injected, intended for internal use, used in the eye area, applied to mucous membranes, or designed to alter appearance for more than 24 hours where removal isn't part of normal use.
Products regulated as drugs, including many sunscreens, continue to be handled under drug rules rather than MoCRA.
| Date | What it covers |
|---|---|
| December 29, 2022 | MoCRA signed into law |
| December 29, 2023 | Safety substantiation, serious adverse event reporting within 15 business days, record retention, FDA records access, and mandatory recall authority all take effect |
| July 1, 2024 | End of FDA enforcement discretion for facility registration and product listing (the original statutory deadline was December 29, 2023) |
| December 29, 2024 | Labels must carry a domestic address, phone number, or electronic contact for adverse event reporting. Professional-use products must carry their required professional labeling |
| Ongoing | Facility registration renewed every two years, product listings updated annually |
| Still pending | Final rules on Good Manufacturing Practice, fragrance allergen disclosure, and standardized talc testing methods, plus the FDA's assessment of PFAS in cosmetics |
The pending items are the ones most likely to create labeling work, particularly fragrance allergen disclosure, so it's worth tracking their status rather than waiting to be told.
What companies should be doing now
Confirm your registrations and listings are current and accurate. Product listings need annual updates and facility registrations every two years. What you filed and what you're actually selling drift apart quickly, especially across regional variants.
Make sure safety substantiation is documented, not assumed. The requirement is adequate substantiation you can produce on request, which means the records need to exist somewhere findable rather than with a supplier or a former employee.
Check your adverse event process actually meets 15 business days. That clock is short, and it depends on the reports reaching the right person quickly.
Audit your labels against the December 2024 requirements. Every affected pack needs the adverse event contact detail. This is the point where most teams discover how long it takes to find every label carrying a given element.
Get your label content structured before the pending rules land. Fragrance allergen disclosure in particular will mean changing an ingredient statement across a large number of SKUs at once.
How labeling and artwork management helps with MoCRA
Most of the work above comes down to three things: knowing what's on the market, being able to change approved content quickly, and being able to show what changed and why.
Kallik's Veraciti handles label content as reusable components rather than text locked inside artwork files, so a single approved change flows through to every product that uses it. Where-used search returns the list of affected SKUs, markets, and artwork versions on demand. Approval routes with full version history mean the audit trail is created as people work, rather than reconstructed from email when the FDA asks.
The brands still finding MoCRA difficult several years in tend to have one thing in common, which is that they're managing it by hand: label content living inside artwork files, approvals tracked through email, and impact assessments run as one-off projects each time something changes. That holds together until the volume of change increases, and MoCRA has guaranteed it will.
MoCRA isn't finished, and the pending rules will add to the list. The systems that make the current requirements manageable are the same ones that will absorb the next set, which is why the brands who moved this into managed software mostly stopped experiencing regulatory updates as events.
Speak to one of our experts for MoCRA guidance
If you want a straight read on where your labeling operation sits against MoCRA and what the pending rules are likely to mean for your product range, we work with regulated brands on exactly this and are happy to have the conversation. Call us on +44 (0) 1827 318100, email enquiries@kallik.com, or fill in a form here.
What is MoCRA?
MoCRA is the Modernization of Cosmetics Regulation Act of 2022, the biggest expansion of FDA authority over cosmetics since 1938. It introduced mandatory facility registration, product listing, safety substantiation, adverse event reporting, and FDA recall authority for cosmetic products sold in the United States.
Who has to comply with MoCRA?
The obligations fall on the responsible person, meaning the manufacturer, packer, or distributor whose name appears on the product label. Facilities that manufacture or process cosmetics for the US market must also register, including those located outside the United States.
Are small businesses exempt from MoCRA?
Businesses with average annual US cosmetic sales below $1 million over the previous three years are exempt from facility registration, product listing, and GMP requirements. They must still meet safety substantiation and adverse event reporting obligations, and the exemption does not apply to certain higher-risk products such as eye area, injected, and internal-use cosmetics.
What are the current MoCRA deadlines?
Facility registration, product listing, safety substantiation, and adverse event reporting are all in effect now, with labeling for adverse event contact details required since December 29, 2024. Facility registrations renew every two years and product listings must be updated annually.
What MoCRA rules are still to come?
Final rules on Good Manufacturing Practice, fragrance allergen disclosure, and standardized talc testing methods are still outstanding, along with the FDA's assessment of PFAS in cosmetics. Fragrance allergen disclosure is the one most likely to require widespread label changes.
How long do you have to report a serious adverse event under MoCRA?
Serious adverse events must be reported to the FDA within 15 business days of receipt. Supporting records must be retained for six years, or three years for qualifying small businesses.
What records does MoCRA require you to keep?
You need adequate safety substantiation records for each product and records of any adverse events reported to you. The FDA can request access to these during an inspection, so they need to be retrievable rather than scattered across suppliers and shared drives.