The Modernization of Cosmetics Regulation Act of 2022 (MOCRA)

 The first major change to cosmetic regulatory law since 1938 has been enacted by Congress and signed by President Biden. The FDA has been given new authority under the FD&C Act which sets significant new requirements for cosmetics manufacturers and brand owners. FDA is mandated to promulgate multiple new regulations over the next couple of years that will create sweeping requirements across the cosmetic industry. The regulations will be enforceable in either 1 or 2 years, depending on the specific requirement. The following is a synopsis of the new requirements.

“Responsible Person” and “Facility”

MOCRA has clarified the roles of brand owner and manufacturer. A “responsible person” is defined as the “manufacturer, packer, or distributor of a cosmetic whose name appears on the label of that product,” while a facility is any establishment (including that of an importer) that manufactures or processes cosmetic products that are distributed in the United States. These definitions make it clear that brand owners are responsible for complying with the law, not just manufacturers. This has always been the case under the FD&C Act, but the role of “responsible person” has been overlooked since there was no requirement for brand owners to register. The responsibility for compliance with adulteration and misbranding requirements was often left to the contract manufacturer to figure out. Now all the requirements are the responsibility of the firm whose name is on the label. To be clear, the contract manufacturer is also responsible for what they do, but only if they actually manufacture or process. MOCRA defines a “facility” as any establishment that manufactures or processes cosmetics distributed in the United States, but specifically excludes establishments that “solely perform” labeling, relabeling, packaging, repackaging, holding, and/or distributing cosmetic products. Several other types of entities are also expressly excluded from the definition of a facility, such as cosmetic retailers and beauty shops/salons and tattoo parlors and permanent makeup facilities (unless they’re engaged in manufacturing).

Definition of “Cosmetic”

The definition of “cosmetic” has not changed. The FD&C Act defines a “cosmetic” broadly and includes all “articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body...for cleansing, beautifying, promoting attractiveness, or altering the appearance.” Traditional beauty make-up items, perfumes, shampoos, conditioners, and other hair care products, deodorants, mouthwash, body creams, moisturizers are all included. FDA considers tattoo ink used for traditional tattooing and permanent cosmetic tattooing to be cosmetics as well. For some firms that have not previously been directly impacted by FDA oversight the new law will have a big impact.

Registration and Listing

FDA has had a Voluntary Cosmetic Registration Program (VCRP) in place for decades. However, it will now be mandatory. By the end of 2023 all manufacturers and brands will be required to register their

facilities. Two years after enactment all cosmetic products offered for sale on the enactment date of the law (December 29, 2023) are required to be listed. All products newly marketed after the enactment date are required to be listed within 120 days of going on the market. It is not clear if VCRP will become MCRP (mandatory) or if cosmetics will be added to FDA’s FURLS program, which is currently used for a number of purposes including but not limited to food facility and medical device registration. Cosmetics are under the Center for Food Safety and Applied Nutrition (CFSAN) so this is a possibility. Notably, similar to food, there are no registration or listing fees required under the new law.

Facility Registration (With biennial renewal)

Each facility must be registered with FDA using the official FDA form, indicating the facility name; address; email; telephone; all “brand” names under which cosmetic products manufactured at the facility are sold; product category and “responsible person” for each cosmetic product manufactured or processed at the facility.

Cosmetic Product Listing (With annual update)

Each cosmetic product must be listed with FDA using the official FDA form, indicating the registration # of the facility in which the product is manufactured; name and contact information of the “responsible person” and the name of the product as it appears on the product label; the applicable cosmetic category to which the product belongs; list of ingredients in the product including any fragrances, flavors or colors, with each ingredient being identified by its common or usual name.

Adverse Events

Adverse event recordkeeping and reporting is already required for drugs, devices and dietary supplements, so it is likely FDA will expect compliance along the lines of what is already required for these products. The “responsible person” has a responsibility to perform these duties. MOCRA also requires labeling (see below) providing direction to customers on how to report an adverse event. The “responsible person” must collect and analyze all data reported by customers. Any reports of a serious adverse event must be reported to to FDA within 15 days. This is a totally new concept for the cosmetic industry which has never been required to track adverse events. Many combination drug and cosmetic firms already collect adverse event data through 3rd party specialists.

Adverse Event Recordkeeping

Accurate records must be maintained of all Adverse Events. Such records must be made available to FDA upon their request or during a facility inspection. As mentioned, some firms already perform this function, especially if they also sell drugs, where it has been required for decades. For independent brands this will be a resource intensive activity requiring constant oversight. Records are required to be kept for 6 years (or 3 years for qualifying small firms – see GMP requirements).

Serious Adverse Event Reporting to FDA

The “responsible person” is required to submit a report of each Serious Adverse Event to FDA within 15 days of becoming aware of the event. A Serious Adverse Event is: Any event that results in death, life-threatening experience; inpatient hospitalization; persistent or significant disability or incapacity; a congenital anomaly or birth defect; and infection or significant disfigurement OR requires, based on reasonable medical judgment, a medical or surgical

intervention to prevent an outcome described in the first definition of serious adverse event. For one year following the submission of such a report to FDA, the responsible person must submit all new and material medical information it receives regarding the serious adverse event.

This definition is in line with current FDA guidelines, with one exception. “Significant Disfigurement” is a new definition in the law. It includes serious and persistent rashes, second- degree burns, third-degree burns, hair loss, or alteration of appearance. These types of skin reactions will require reporting to FDA. This definition can be found in FDA guidance which came about as a result of reports of hair loss and scalp disfigurement caused by nationally distributed hair products.

Safety Substantiation and Recordkeeping for Each Product

The “responsible person” must ensure and maintain records supporting that there is adequate substantiation of safety for each cosmetic product. Such records must be made available to FDA upon their request or during a facility inspection. Adequate substantiation means tests, studies, or other evidence to support a reasonable certainty that the product is safe. This is a new requirement for cosmetics. Current law only requires safety substantiation after FDA discovers a problem.

Composition of Fragrance and Flavor Ingredients

If FDA has reasonable grounds to believe that an ingredient or combination of ingredients within a fragrance or flavor has caused or contributed to a Serious Adverse Event, FDA has the authority to request a listing of the ingredients and/or category of ingredients that are present in the fragrance and/or flavor that is used in such cosmetic product. Thus, the “responsible person” must maintain accurate information regarding the contents of each fragrance and/or flavor used in each cosmetic product.

Labeling Requirements

In addition to already-existing cosmetic labeling requirements, MOCRA requires that each label indicate: a domestic address; domestic telephone number or electronic contact information through which the “responsible person” may receive Adverse Event reports from consumers; and the name of each fragrance allergen which may be present in the product. FDA is required to publish a list of cosmetic allergens (similar to the European Union). If any of these allergens are in a cosmetic formula they will require labeling. The labeling requirements take effect 2 years after the enactment date.

Mandatory Recall Authority

If FDA determines there is reasonable probability that a cosmetic is adulterated or misbranded and the use or exposure to such cosmetic will cause serious adverse health consequences, FDA will provide the “responsible person” the opportunity to cease distribution and recall the product. If the responsible person refuses, FDA may, by order, require the “responsible person” to immediately cease distribution and recall the product. This is a big change from the current law which only allows FDA to ask a firm to “voluntarily” recall a product. How FDA interprets the term “reasonable probability” will be important, since current law requires FDA to demonstrate adulteration and misbranding before sending Warning Letters.

FDA Facility Inspections and Review of Records

Cosmetic facilities are expected to allow FDA to inspect their facility and review any records that FDA deems necessary to verify compliance with MOCRA. It is already common practice for FDA to ask for records. The difference is that MOCRA specifically requires record keeping so written SOPs and documentation of all GMP activities are now required and can be used to establish “reasonable probability” for a mandated recall.

Records are to be available to authorized personnel (FDA inspector) to examine products if there is reason to believe a cosmetic product is adulterated, an ingredient could cause harm or is out of compliance with other standards. The authorized personnel must provide written notice to have access to records at a reasonable time to determine whether the product poses a threat. The records to be reviewed do not include recipes or formulas for cosmetics, financial data, pricing data, personnel data (except qualifications) research data (other than safety substantiation) or sales data (other than shipment data regarding sales). This is not drastically different from what can occur now, except that if FDA asks in writing the records must be provided. During an inspection, if they ask, a written response can be requested. This language may result in misunderstanding unless FDA clarifies its intent in the new regulations.

FDA Non-compliance Enforcement

MOCRA adds several enforcement tools to FDA’s toolbox. Failure to register a Cosmetic facility could result in a mandatory recall of all cosmetic products manufactured or processed by that facility. Failure to submit a Cosmetic Product Listing could result in a mandatory recall of each product which is not listed and a possible revocation of the responsible person’s registration. Failure to comply with other MOCRA requirements could result in (depending upon the critical nature of the non-conformance) the issuance of Observations of Non-Compliance; Issuance of Warning Letters; Mandatory Product Recalls; and Revocation of a Facility’s Registration.

Good Manufacturing Practices (GMPs)

FDA has published guidance on GMPs that are closely aligned with ISO 22716. In two years FDA will publish mandatory regulations that will become final at the end of 2025. MOCRA requires FDA to establish Good Manufacturing Practices (GMPs) that are intended to protect the public health and ensure that cosmetic products are not adulterated. Such regulation will allow FDA to inspect facilities and review all records that it deems necessary to verify compliance with GMP as prescribed by FDA. MOCRA also includes provisions for a “simplified” (less stringent) GMP for smaller businesses having annual gross sales of less than $1M for each year of the previous 3-year period EXCEPT for cosmetic products that are applied near the eyes; injected; intended for internal use; or intended to alter appearance for more than 24 hours. For such products, the Cosmetic GMP regulation will apply in full force regardless of the size of the business. For the tattoo ink industry this may result in specific regulations since FDA views these products as “injected” and they are intended to alter the appearance for more than 24 hours.

Preemption

Preemption is a legal term that refers to language in the Federal law which forbids states from passing their own laws that supercede Federal law. Under MOCRA no state or political subdivision of a state

may establish any law, regulation, order, or other requirement for cosmetics that is different for registration and product listing, good manufacturing practice, records, recalls, adverse event reporting or safety substantiation. The preemption clause does not prohibit a state from prohibiting the use of an ingredient in a cosmetic product, or continuing a requirement that was in effect at time of enactment. This requirement limits the state’s ability to regulate cosmetics. The cutout for limiting ingredients is a concession that allows states to ban or control specific ingredients (example, California Prop. 65).

Additional Changes

Talc-containing cosmetics: The HHS secretary shall propose regulations one year after December 29, 2022 and finalize the rules 180 days after the comment period to establish testing for detecting asbestos in talc products. The purpose here is to establish a standardized test.

PFAS in Cosmetic. The HHS secretary shall assess the use of perfluoroalkyl and polyfluoroalkyl substances (PFAS) in cosmetic products and the scientific evidence regarding the safety in cosmetic products, including risks. The secretary may consult with the National Center for Toxicological Research. Report must be issued not later than three years after enactment summarizing the results of the assessment conducted.

Sense of the Congress on animal testing: It is the sense of the Congress that animal testing should not be used for the purposes of safety testing on cosmetic products and should be phased out except for appropriate allowances. There is no outright ban on animal testing, but FDA is requested not to require animal testing. How this will impact requirements for animal testing of colors is unclear.

For additional information or assistance deciphering how the new law will impact the cosmetic industry, please contact Ceutical laboratories at info@ceuticallabs.com.