The Modernization of Cosmetics Regulation Act of 2022 (“MoCRA”) contains several provisions that will go into effect on December 29, 2023. We have previously explained some of the main provisions of MoCRA in Amendments to Section VI of the Federal Food and Drug and Cosmetic Act in the Omnibus Bill (February 23, 2023). While the industry waits for FDA to finalize instructions and guidance, there are a host of activities that can be undertaken to make sure you do not find yourself out-of-compliance when that date arrives.
Facilities and Product Registration
The facilities registration provisions of MoCRA require that all cosmetic manufacturers and processors register their facilities in advance of the December 2023 deadline. Likewise, responsible persons must register all of their cosmetic products by that same date. Failing to register a facility or a product risks FDA determining that a marketed cosmetic product is adulterated or misbranded, which could lead to: (1) a mandatory recall instituted by FDA under MoCRA; (2) criminal action against a company or facility for marketing adulterated or misbranded products; (3) rejection or suspension of a facility registration resulting in a shutdown of that facility; and/or (4) a fine or other penalty associated with noncompliance.
These registrations will necessarily need to include the following information:
1. The facility’s name, physical address, email address, and telephone number.
2. The contact (including electronic contact information) for the United States Agent for any foreign facility.
3. The facility registration number assigned by the Secretary of HHS (if any).
4. All brand names under which cosmetic products manufactured or processed in the facility are sold.
5. The product category or categories and responsible person for each cosmetic product manufactured or processed at the facility.
1. The facility registration number of each facility where the cosmetic product is manufactured or processed.
2. The name and contact of the responsible person and the name for the cosmetic product as such name appears on the label.
3. The applicable cosmetic category or categories for the product.
4. A list of ingredients in the cosmetic product, including any fragrances, flavors, or colors, with each ingredient identified by name set forth in the Code of Federal Regulations or by the common or usual name of the ingredient.
5. The product listing number assigned by the Secretary of HHS (if any).
FDA has yet to release an electronic system for filing these registrations and has already decommissioned the previous voluntary registration platform. FDA has promised to have a system ready in time for the December 2023 MoCRA deadline, and we expect that FDA will provide guidance on its new registration system in the next 2-3 months.
What you should do now
A company that fails to prepare while waiting for the registration system to be finalized and open risks significant delays that could place it out of compliance in December 2023.
To mitigate potential risks, “responsible persons” (i.e., the manufacturer, packager, or distributor of a cosmetic product whose name appears on the product label) should be working diligently to assemble all of the information required above. This process should include communication between any distributors, packagers, labelers, repackagers, or relabelers and their contract manufacturers to exchange the information necessary to file the registrations and decide what entity or entities should and will be filing the registrations.
Companies should also set up a regular system for exchanging information on new products and new facilities to ensure that any future registrations or amended registrations are filed in a timely manner that meets MoCRA’s deadlines for updates.
Adequate Safety Substantiation
Under MoCRA, a “responsible person” must ensure and maintain records supporting that there is adequate substantiation of safety for each cosmetic product for which it is responsible by the December 2023 deadline. These records include determining the safety of a cosmetic product and its ingredients under customary and usual use, as well as potential effects from cumulative or other relevant exposures. FDA will expect these records to sit with contract manufacturers and any listed “responsible persons.”
The statute defines “adequate safety substantiation” as “tests or studies, research, analyses, or other evidence of information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe.”
FDA has published no guidance about how to substantiate whether a product or its ingredients is safe at this time. It is unclear whether any guidance will be provided by the deadline.
What you should do now
All “responsible persons” should gather what information they have on the safety of their products and ingredients to assess what gaps, if any, exist with respect to safety data. This information may include CIR and other reviews accepted by experts in the field, published scientific literature, and public and private testing data.
Since safety testing often takes significant planning, time, and investment, it is imperative that companies immediately assess whether any gaps exist in their safety data. After determining what information and data you possess, it is advisable to consult with your scientific, regulatory, and legal teams to determine what next steps, if any, may be necessary to prepare a dossier for review upon any FDA request or inspection.
Adverse Event Recordkeeping and Reporting
MoCRA requires all “responsible persons” to maintain records of any “adverse event” reported for a cosmetic product they have manufactured, processed, or distributed for six (6) years (or three (3) years for qualifying small businesses). MoCRA further establishes that a responsible person must report any “serious adverse event” to FDA within fifteen (15) days, and provide FDA with any updates concerning “new or material medical information” associated with such serious adverse events within fifteen (15) days for a period of one (1) year.
MoCRA provides for inspection of any registered facility of a “responsible person.” During such an inspection, FDA may request copies of all adverse event records, which may then be provided to State or Federal health agencies or personnel. Failure to provide such records renders a product or facility noncompliant.
FDA has not yet provided guidance on the exact forms or systems that will be utilized when making “serious adverse event” reports to the Agency. FDA, however, has set up independent systems for drugs, devices, food, vaccines, and animal drugs that likely will be adapted for the nuances of the cosmetics industry.
What you should do now
FDA recently advised that it believes companies should already have systems in place to identify adverse events in complaints they have received. In other words, “responsible persons” and their facilities cannot wait until December 29, 2023 to implement systems for identifying, tracking, recording, and reporting adverse event complaints, as needed. We have written separately in more detail about how companies can prepare for the adverse event requirements of MoCRA here.
ConclusionMoCRA places significant responsibilities on companies in the cosmetics industry that come with substantial risks if a company or product fails to comply by December 29, 2023, including withdrawal of a product from the market or complete shutdown of a manufacturing facility. It is incumbent upon “responsible persons” and other manufacturers and processors to take the steps necessary to ensure no product or facility gets left behind. Locke Lord’s FDA Regulatory and Cosmetics teams can assist you and your company in assessing what your company needs to meet these new obligations.
Sign up for our newsletter and get the latest to your inbox.