MoCRA in 2026: Where Things Stand and What You Should Have Done Yesterday
When the Consolidated Appropriations Act of 2023 was signed into law on December 29, 2022, it ushered in the most significant overhaul of cosmetic regulation in the United States since 1938. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) gave the FDA authority it never had before, and it created compliance obligations that the industry is still working toward.
The Law Is Active. Are You?
MoCRA became operative on December 29, 2023. Facility registration and product listing deadlines ran through mid-2024. If your facility manufactures or processes cosmetic products distributed in the U.S., you are required to register. If you haven’t, that’s a problem that needs to be fixed immediately.
It’s worth noting what “facility” means under MoCRA, and what it doesn’t. Beauty salons, retail pharmacies, hospitals, and hotels providing complimentary amenities are excluded. Establishments that only label, relabel, package, repackage, hold, or distribute products are also carved out. But if you’re filling a product container, you’re manufacturing, and the carve-out doesn’t apply to you.
Adverse Event Reporting: This One Has Teeth
One of MoCRA’s more consequential provisions is its mandatory adverse event reporting requirement. Serious adverse events must be reported to the FDA within 15 days via the FDA MedWatch portal, and the responsible person (e.g., the manufacturer, packer, or distributor whose name appears on the label) must follow up for one year with any new medical information.
What counts as a serious adverse event? Death, life-threatening experience, inpatient hospitalization, persistent disability, congenital anomaly, infection, or significant disfigurement (including severe burns, significant hair loss, or serious persistent rashes). The bar is meaningfully higher than ordinary consumer complaints, but the obligation is real and enforceable.
The record retention requirements in MoCRA apply to all adverse events, not just serious ones. Standard businesses must maintain records for six years. Smaller businesses with average annual revenue under $1 million over a three-year period get a reduced three-year window. If you don’t have a formal SOP covering complaints and adverse events, now is the time to write one.
One provision that deserves attention: FDA can share adverse event reports with state health and food authorities under memoranda of understanding. This creates a direct pathway from federal reporting to state regulatory and enforcement activities and, potentially, to plaintiffs’ attorneys’ discovery requests in class-action litigation. These reports are not private documents.
GMPs: Delayed, But Coming
Good Manufacturing Practices were supposed to be finalized by December 2025. However, both the proposed rule and the final rule publication have been postponed. An Advance Notice of Proposed Rulemaking (ANPRM) was required within two years of enactment.
When the GMP rule materializes, it will likely draw on existing frameworks, such as ISO 22716, pharmaceutical GMPs, food GMPs, or dietary supplement regulations, with some adaptation for cosmetics. The statute requires consistency with national and international standards “to the extent practicable.” Smaller businesses are entitled to simplified requirements and extended compliance timelines.
The delay doesn’t mean you should wait. If your operations aren’t already aligned with ISO 22716 or an equivalent framework, now is the time to close those gaps. Once the rule is final, FDA’s records access and inspection authority under MoCRA kicks in, including the right to review manufacturing records, raw material receipt records, distribution records, finished product analytical results, complaint records, and safety substantiation data during an inspection.
What FDA cannot access: your formulas and recipes, financial and pricing data, personnel records beyond technical qualifications, and general research data. Safety substantiation data is a different matter. That they can see.
The PFAS Report: Uncertainty Acknowledged, but States Are Moving Anyway
In December 2025, FDA issued its Report on the Use of PFAS in Cosmetic Products and Associated Risks. The findings are instructive and illustrate why the regulatory picture around PFAS remains genuinely complicated.
FDA identified 51 PFAS intentionally added as ingredients across 1,744 cosmetic formulations. PTFE (polytetrafluoroethylene, commonly known as Teflon) is the most frequently used. These ingredients are most commonly found in eye shadows, face and neck products, eyeliners, face powders, and foundations.
The safety assessment results were mixed. Five PFAS, including PTFE and perfluorodecalin, were assessed as posing low safety concerns. One, perfluorohexylethyl triethoxysilane, raised a potential concern specifically when used at high concentrations in body lotion. Nineteen others could not be definitively evaluated due to insufficient toxicological data.
FDA’s own report acknowledges significant uncertainty: limited data on use levels, gaps in dermal and oral absorption data, and absence of dermal toxicity data for many compounds.
None of this has slowed the states. Eleven states, including California, Colorado, Connecticut, Maine, Minnesota, New Hampshire, New Mexico, Oregon, Rhode Island, Vermont, and Washington, have passed legislation prohibiting intentionally added PFAS in cosmetics, with effective dates ranging from 2025 through 2028. And there’s a complication: state testing requirements typically rely on combustion ion chromatography for organic fluorine, while FDA uses a more specific LC-MS/MS method capable of identifying and quantifying 30 discrete PFAS compounds. A product that passes FDA’s analytical framework might still present compliance issues under state requirements, or vice versa.
There is currently no consensus federal definition of PFAS in the U.S., and no federal regulation specifically prohibiting their use in cosmetics. The OECD definition covers fluorinated substances containing at least one fully fluorinated methyl or methylene carbon atom without H/Cl/Br/I attached, but U.S. federal law hasn’t adopted this definition.
FDA’s Draft Guidance on Records Access
In January 2026, FDA released draft guidance on its authority to access and copy cosmetic product records. The trigger is a reasonable belief that a cosmetic product is adulterated in a way that poses a threat of serious adverse health consequences or death (SAHCOD).
Adulteration under MoCRA covers the expected categories: poisonous or deleterious substances, filthy or decomposed conditions, and, once GMP regulations are finalized, conditions that fail to meet those standards. SAHCOD includes microbial contamination with pathogenic organisms, chemical or toxicological hazards arising from unsafe ingredients or impurities, design or application vulnerabilities that lead to unintended systemic exposure, and improper storage, labeling, or distribution conditions.
The records access authority isn’t limited to the product that triggered concern. It extends to products sharing similar suspect ingredients. If a problem with one SKU raises questions about your formulation practices or ingredient sourcing, FDA can pull records across your portfolio.
The Talc Situation: Ongoing
Test methods for talc were issued in December 2024 and withdrawn in November 2025. The methodological questions around talc and asbestos contamination remain unresolved at the federal level, which is something to watch closely.
Bottom Line
MoCRA is not a compliance exercise to be completed once and filed away. It’s a shift in the FDA’s relationship with the cosmetics industry. One that implements ongoing obligations on adverse event surveillance, recordkeeping, GMP alignment, and ingredient safety substantiation.
The timelines have slipped in several places, and there’s still genuine regulatory uncertainty around PFAS, GMPs, and testing methodologies. But the core of the law is in effect. Companies that treat registration, adverse event reporting, and recordkeeping as operational infrastructure, rather than one-time checkboxes, will be better positioned when inspections begin in earnest.
If you have questions about MoCRA compliance, testing, or how these requirements apply to your specific product portfolio, contact our Consulting team today.