MoCRA is no longer a registration-and-listing project. FDA’s January 2026 draft guidance on its records-access authority signals that the safety substantiation, adverse-event, and supplier records you create today may be reviewed tomorrow. Build product-specific files, a real serious-adverse-event system, and updated supplier contracts now.

Many cosmetic companies approached the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) as a facility-registration and product-listing exercise. That was the first wave. The current phase is about records and readiness. MoCRA created obligations spanning adverse-event reporting, registration and listing, safety substantiation, good manufacturing practices, fragrance-allergen labeling, and standardized asbestos testing for talc-containing cosmetics — and it expanded FDA’s authority to access company records.

When MoCRA first passed, the industry’s panic was almost entirely focused on the mechanics of facility registration and product listing. However, as I’ve counseled private-label cosmetics manufacturers and brand owners over the last year, those initial filings were truly just the tip of the iceberg. The real regulatory exposure lies in the operational requirements that follow. I am currently working with several cosmetic brands to build out their internal compliance infrastructure—drafting rigorous Quality Agreements with their contract manufacturers, establishing protocols for Serious Adverse Event (SAE) reporting, and auditing their ingredient profiles for safety substantiation. The FDA’s new mandatory recall authority and records-access powers mean that if a safety issue arises, having a listed product won’t save you if you don’t have the underlying safety data and GMP procedures to back it up

The 2026 Development That Should Reframe Your Program

In January 2026, FDA issued draft guidance addressing its records-access authority for cosmetic products (docket FDA-2025-D-2243). The practical signal is straightforward: assume that the records you create today may later be reviewed by FDA. Two access pathways are worth distinguishing. Under Section 605, FDA can reach adverse-event records in connection with inspections. Under Section 610, FDA can access broader manufacturing and safety records when it has a reasonable belief that a product presents a threat of serious adverse health consequences or death. Safety files, adverse-event files, complaint investigations, supplier records, and formulation decisions should therefore be written with regulatory scrutiny in mind — poor documentation can simultaneously weaken FDA compliance and increase litigation exposure.

Safety Substantiation Is a Core Obligation — Make the File Coherent

Under MoCRA, the responsible person must maintain records supporting adequate substantiation of safety. This is not a drug-style approval dossier — cosmetics are still not FDA-approved before marketing — but the company must have a reasonable basis to support product safety, and the file should be product-specific, current, and coherent. A scattering of disconnected supplier documents may not answer the question FDA (or a litigation opponent) will eventually ask: how did you conclude this product was safe?

Serious Adverse-Event Reporting Requires Systems, Not Just Forms

The responsible person must report serious adverse events associated with cosmetic products used in the United States to FDA within 15 business days, and must submit new medical or other information received within one year of the initial report within 15 business days. MoCRA also requires retaining adverse-event records for a defined period — generally six years (three years for certain small businesses). Meeting these obligations takes a process: receiving complaints, identifying potential adverse events, escalating serious ones, obtaining medical information, preserving product and lot information, determining reportability, submitting timely reports, and trending events over time. Companies selling through retailers, Amazon, distributors, spas, salons, or dermatology offices must also ensure complaints actually flow back to the responsible person.

Contract Manufacturers and Private Labelers Need Clear Responsibility

Compliance gets complicated when a brand relies on a contract manufacturer, or a foreign company relies on a U.S. responsible person. The practical question is: who maintains which records, and who can produce them quickly? Many agreements predate MoCRA and do not allocate these duties.

Agreements should expressly address listing and registration duties, safety substantiation, complaint-forwarding timelines, serious-adverse-event escalation, formulation changes, supplier substitutions, batch records, recall coordination, FDA inspection support, and document retention.

Practical Steps for Cosmetic Companies

Build product-specific safety substantiation files. Review adverse-event procedures so you can identify and report serious events within the 15-business-day window. Update manufacturing, distribution, and private-label agreements to reflect MoCRA responsibilities. Organize records for rapid retrieval in anticipation of FDA access. Prioritize higher-risk categories — talc, eye-area use, children, leave-on exposure, exfoliation, strong actives, allergens, and sensitive-skin claims. And train customer-service teams, who often receive the first signal of an adverse event, on when to escalate.

Key Takeaway

MoCRA compliance is no longer just registering a facility or listing a product. FDA’s cosmetics framework now emphasizes safety substantiation, adverse-event reporting, records, and accountability — and the January 2026 records-access draft guidance makes clear those records can be reviewed. Treat MoCRA as a full compliance system; companies with strong safety files, complaint procedures, supplier controls, and inspection-ready records will be far better positioned if FDA asks questions or a safety issue arises.

Frequently Asked Questions

What did FDA’s January 2026 MoCRA guidance change?

It is draft guidance describing FDA’s authority to access certain cosmetic records (docket FDA-2025-D-2243). It signals that safety, adverse-event, and supplier records should be created with FDA review in mind.

How fast must serious adverse events be reported?

Within 15 business days, with follow-up information received within one year reported within another 15 business days.

How long must cosmetic records be kept?

Generally six years, with a shorter period for certain small businesses.

Who is responsible when a contract manufacturer is involved?

The responsible person generally owns substantiation and adverse-event reporting; the manufacturer typically holds registration and batch records. Allocate duties clearly by contract.

This article is attorney advertising and is provided for general informational purposes only. It is not legal advice and does not create an attorney-client relationship. MoCRA guidance and timelines continue to evolve; consult qualified FDA regulatory counsel about your products and recordkeeping.