What is MoCRA?
The US cosmetics law seen from the EU side: what it requires, who must comply, and how it departs from Regulation (EC) No 1223/2009.
MoCRA is the Modernization of Cosmetics Regulation Act of 2022, the US law that gave the FDA substantially greater oversight of cosmetics. It requires companies to register their facilities, list their products, hold records that adequately substantiate each product's safety, and report serious adverse events. The US requires no Product Information File, and no signed assessment by a qualified safety assessor, but several MoCRA duties occupy the same territory as the EU file.
What MoCRA changed, and to whom it applies
MoCRA was signed into law in December 2022 and inserted a new chapter into the Federal Food, Drug, and Cosmetic Act. It is the first substantial revision of the FDA's cosmetics powers in decades. Before it, the FDA held no inventory of cosmetic facilities or products and had limited means of intervening when a product caused harm. Companies must now identify themselves and their products to the FDA, hold records the FDA may inspect, and report serious harm. The FDA may suspend a facility's registration where there is a reasonable probability that its products will cause serious adverse health consequences, and may order a mandatory recall.
It applies to businesses that manufacture, pack or distribute cosmetics for the US market, including brands and facilities established outside the US. The FDA's MoCRA page is the authoritative source for the current position.
From an EU standpoint, the structural difference is worth stating plainly: the EU requires a defined dossier of defined content, assessed by a defined professional, held at a defined address. MoCRA requires outcomes — adequate substantiation, accurate filings, timely reporting — without prescribing the form the evidence takes. That latitude is not a lower bar; it simply shifts the burden onto the company to show that what it holds is sufficient.
The obligations MoCRA imposes
| Obligation | What it means | How often |
|---|---|---|
| Facility registration | Manufacturers and processors register each facility with the FDA | Renewed every two years |
| Product listing | The responsible person lists each marketed product, including its ingredients | Updated annually |
| Safety substantiation | The responsible person holds records constituting adequate substantiation of safety — tests, studies, research, analyses or other evidence that a reasonably prudent person would rely on. No specific tests are prescribed, existing data may be used where scientifically sound, and animal testing is not required | Held and available to the FDA |
| Adverse event reporting | Serious adverse events are reported to the FDA with a copy of the label within 15 business days, and new and material medical information received within one year is reported on the same timeline | On each occurrence |
| Label contact details | The label carries a domestic address, telephone number or electronic contact for reporting adverse events | On every product |
MoCRA also directs the FDA to issue further rules, including on fragrance allergen labelling and on good manufacturing practice, and contains provisions addressing talc and PFAS. The list will therefore grow; verify the current position on the FDA's page before filing.
Who must comply
MoCRA places most duties on the responsible person: the manufacturer, packer or distributor whose name appears on the product label. For many brands that is the brand owner, even where a third party manufactures the product. The parallel with the EU Responsible Person is close in principle but not identical in scope, and the two should not be assumed interchangeable in internal procedures.
Two further points matter in practice:
- Foreign brands are covered.If the product is marketed in the US the duties apply, and facilities outside the US fall within the registration requirement. Unlike the EU, MoCRA does not require the responsible person to be established in the territory, although a domestic contact must appear on the label.
- Small businesses are partly exempt.Certain small businesses are relieved of facility registration and product listing. The exemption does not extend to products that regularly come into contact with the mucous membrane of the eye under customary use, are injected, are intended for internal use, or are intended to alter appearance for more than 24 hours where removal by the consumer is not part of customary use. Adverse event reporting applies regardless.
MoCRA and the EU regime compared
Brands selling in both territories routinely ask whether a single file can serve both. The underlying evidence overlaps substantially; the instruments differ.
| Question | EU | US (MoCRA) |
|---|---|---|
| Core document | Product Information File under Article 11, with an Annex I safety report | No PIF; a set of records and filings |
| Safety evidence | A CPSR whose Part B is assessed and signed by an assessor qualified under Article 10(2) | Records adequately substantiating safety, with no prescribed format and no qualification requirement for the author |
| Filing with authorities | CPNP notification of each product before placing on the market | Facility registration and product listing with the FDA |
| Establishment requirement | Responsible Person must be established in the Union | No establishment requirement; a domestic contact on the label |
| Animal testing | Prohibited for finished cosmetics and for ingredients under Article 18 | Not required in order to substantiate safety |
| Post-market reporting | Serious undesirable effects notified under Article 23 | Serious adverse events reported within 15 business days |
In practice a well-constructed CPSR will carry most of the weight of US safety substantiation, since the Annex I dataset is more demanding than anything MoCRA specifies. The reverse does not hold: a MoCRA substantiation file will rarely satisfy Annex I without additional toxicological profiling, exposure modelling and a signed Part B.
See What is a Product Information File? and What is CPNP? for the EU side.
Common findings
- Assuming the contract manufacturer has dealt with it.The responsible person named on the label carries most of the duties, whoever operates the plant.
- Registering the facility but omitting the product listing.These are separate obligations on separate renewal cycles.
- Treating safety substantiation as a filing exercise.The records must actually support the safety of the product, and the FDA may require access to them.
- No adverse event procedure.A 15-business-day clock cannot reliably be met without a defined intake, triage and reporting process.
- Stale listings.A reformulation, a new shade or a new product requires the listing to be updated.
- Assuming the EU file transfers unchanged.The evidence largely does; the filings, the labelling requirements and the reporting mechanics do not.
Frequently asked questions
- What does MoCRA stand for?
- The Modernization of Cosmetics Regulation Act of 2022.
- Does MoCRA require a PIF?
- No. The US uses no such instrument. It requires safety substantiation records, facility registration and product listing.
- Who is the responsible person under MoCRA?
- The manufacturer, packer or distributor whose name appears on the product label. The role resembles the EU Responsible Person but carries different obligations and no establishment requirement.
- Do I need to register my facility?
- Manufacturers and processors must register and renew every two years, unless they qualify for the small-business exemption, which does not extend to the higher-risk product categories listed above.
- Must I test my products on animals?
- No. MoCRA requires adequate substantiation of safety but prescribes no specific tests, and animal testing is not required. Note that the EU prohibits it outright, so testing performed for another market can itself create an EU compliance problem.
- How quickly must serious adverse events be reported?
- Within 15 business days of receipt, with a copy of the label, and the same timeline applies to new and material medical information received within one year of the initial report.