Thanks to the Food and Drug Omnibus Reform Act (FDORA), cosmetic companies will soon be subject to new requirements for registration, product listing, disclosure of ingredients, adverse event reporting, safety substantiation, and compliance with good manufacturing practices (GMPs). FDORA was a part of the Consolidated Appropriations Act, 2023 (the omnibus spending package that Congress passed late last year), and amended the Federal Food, Drug, and Cosmetics Act (FDCA) to, among other things, provide the Food and Drug Administration (FDA) with additional oversight tools over cosmetics. The FDORA subtitle expanding FDA's cosmetics regulatory authority is the "Modernization of Cosmetics Regulation Act of 2022" (MoCRA).
MoCRA is the most significant expansion of FDA's authority to regulate cosmetics since the FDCA was passed in 1938. Under the new regulatory regime, cosmetic companies will be subject not only to more requirements but also to greater scrutiny, both from regulators and the private bar. These are changes that companies should begin to prepare for as soon as possible.
Facility Registration and Product Listing Requirements
Facility Registration: An owner or operator of an existing facility that manufactures or processes cosmetic products for U.S. distribution must now register with FDA, whether the facility is located in the United States or abroad. Registration will involve providing certain prescribed information to FDA, such as all brand names under which the cosmetic products manufactured or processed in the facility are sold, the product category or categories, and the identity of the "responsible person" (the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label) for each cosmetic product manufactured or processed at the facility.
A facility only needs to submit one registration regardless of whether that facility manufactures or produces cosmetic products on the behalf of multiple responsible persons.
This requirement excludes certain beauty shops, salons, and retailers. In addition, establishments that only perform one or more of the following with respect to cosmetic products are excluded: labeling, relabeling, packaging, repackaging, holding, and distributing (the terms "packaging" and "repackaging" do not include filling a product container with a cosmetic product).
When? Different deadlines apply depending on whether the facility is an existing facility or a new facility. Facilities that were in existence on December 29, 2022 must register no later than December 29, 2023. New facilities must register within 60 days after first manufacturing or processing cosmetic products, or 60 days after December 29, 2023, whichever is later. Furthermore, registration information must be updated within 60 days of any change, including a change in brand name. Registration must be renewed every two years.
How? FDA is creating a new system to receive these mandatory submissions. Venable will be monitoring FDA's progress in this regard and will keep you informed. FDA has stopped accepting submissions to its Voluntary Cosmetic Registration Program ("VCRP"). Information previously submitted to VCRP will not transfer over for registration and listing purposes under MoCRA.
Product Listing: Separate from the facility registration requirement, a responsible person must list each marketed cosmetic product intended for sale in the United States with FDA and provide updates to this information.
The listing will require a great deal of information about the product, such as a list of ingredients, including any fragrances, flavors, or colors, identified by name. FDA is also now tasked with finalizing a rule for the disclosure of fragrance allergens (discussed below). This could raise trade secret questions because companies could be required to disclose fragrance ingredients that FDA considers to be allergens.
The product listing requirement pertains to formulas, not brand names. In other words, one formula sold under various brand names needs only to be listed once, along with a disclosure of all of the brand names assigned to it. If the formula from product-to-product varies only by color, fragrance, flavor, or quantity, these variations may be covered in a single listing.
When? Different deadlines apply depending on when the product was marketed. If the product was marketed on December 29, 2022, the listing is due by no later than December 29, 2023. If the product was first marketed after December 29, 2022, the listing is due within 120 days of marketing the product in interstate commerce. Thereafter, updates must be submitted annually.
How? FDA is creating a new system to receive the mandated listing information. We will keep you abreast of developments in this area.
Serious Adverse Event Reporting and Recordkeeping
MoCRA imposes greater recordkeeping obligations regarding product safety and reporting, documenting, and following up on serious adverse events – with an expanded definition of what constitutes a serious adverse event – and imposes new labeling requirements related to providing contact information for adverse event reporting (see below). A responsible person must report serious adverse events associated with the use of its cosmetic products in the United States to FDA no later than 15 business days after receiving a report of such an event. The responsible person for the company must also provide FDA with certain additional information, such as new medical information, within one year of the initial report.
FDA will also have access to all adverse event reports during an inspection. An "adverse event" is "any health-related event associated with the use of a cosmetic product that is adverse."
Companies should be aware that the definition of "serious adverse event" in MoCRA is broader than the existing definition of "serious adverse event" applied in the context of dietary supplements and other products. Specifically, the new definition adds infections and significant disfigurement (including "serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance") to the list of events that would need to be reported to FDA. In other words, a serious adverse event is an adverse event that:
- (A) results in:
- death;
- a life-threatening experience;
- inpatient hospitalization;
- a persistent or significant disability or incapacity;
- a congenital anomaly or birth defect;
- an infection; or
- significant disfigurement (including serious and persistent rashes, second- or third-degree burns, significant hair loss, or persistent or significant alteration of appearance), other than as intended under conditions of use that are customary or usual; or
- (B) requires, based on reasonable medical judgment, a medical or surgical intervention to prevent an outcome described in (A) above.
Responsible persons must have processes in place allowing them to receive adverse event reports from consumers. In addition, responsible persons must report serious adverse events to FDA no later than 15 business days after the responsible person receives the report, and all adverse event records must be made available to FDA for inspection.
Regulations Establishing Good Manufacturing Practice (GMP)
FDA must establish GMP regulations for manufacturers and processors. Once FDA enacts the new regulations required by MoCRA, they will be the first federal regulations to mandate the implementation of GMP by cosmetic companies. To the extent practicable and appropriate, these regulations must be consistent with national and international standards and are intended to ensure that cosmetic products are not adulterated. MoCRA gives FDA express authority to inspect records necessary to demonstrate compliance with the GMPs. Manufacturing a cosmetic product that fails to meet these GMPs would render the product adulterated.
When: FDA is to publish the proposed rule by December 29, 2024, and the final rule by December 29, 2025.
Exemptions
MoCRA exempts certain small businesses from GMP, registration, and product listing requirements. However, such exemptions do not apply to manufacturers or facilities that manufacture or process the following cosmetic products:
- Products that regularly come into contact with mucus membrane of the eye under customary or usual conditions of use;
- Products that are injected;
- Products that are for internal use;
- Products that are intended to alter appearance for more than 24 hours under customary or usual conditions of use and removal by the consumer is not part of such conditions of use.
Exemptions also exist for certain products and facilities that are subject to requirements for drugs and devices.
Adequate Substantiation of Safety
Responsible persons for a cosmetic product are required by December 29, 2023, to ensure and maintain records supporting adequate safety substantiation for their products. To be adequately substantiated, a company must have "tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe." A cosmetic product is "safe" if the product, including any ingredient thereof, is not injurious to users under the conditions of use prescribed in the labeling thereof or under such conditions of use as are customary or usual.
The statute explains that a cosmetic product or ingredient would not be considered injurious to users solely on the basis of the potential to "cause minor and transient" reactions or skin irritations in some users. Still, each cosmetic product, "including each ingredient in the cosmetic product," must have adequate substantiation for safety or will otherwise be considered adulterated. Overall, this provision raises significant questions. We strongly recommend that cosmetic companies reach out to counsel for questions about developing adequate safety substantiation for their products.
Talc and PFAS: MoCRA requires FDA to develop regulations to establish and require standardized testing methods for detecting and identifying asbestos in talc-containing cosmetic products. The proposed rule is to be published by December 29, 2023. In addition, FDA will be issuing a report that will summarize an assessment of the safety of the use of per- and polyfluoroalkyl substances (PFAS) in cosmetics by December 29, 2025.
What Do I Need to Consider?
Label Changes
MoCRA introduces three new cosmetic labeling requirements. The timing for these requirements varies.
- Contact Information. By December 29, 2024, cosmetic product labels must include certain contact information (domestic address, phone number, or electronic contact information, which may include a website) through which the responsible person for the product can receive adverse event reports.
- Fragrance Allergen Information. Each fragrance allergen included in the product must be identified on the label. Substances that are fragrance allergens for purposes of this requirement will be identified in rulemaking, and the proposed rulemaking for allergen identification is to be issued by FDA no later than June 29, 2024. The final rulemaking is to be issued 180 days after the proposed rulemaking's public comment period closes. In other words, companies will have time before they need to disclose fragrance allergens, as FDA first must publish regulations identifying which substances count as fragrance allergens.
- For Use by Licensed Professionals Only. By December 29, 2023, professional cosmetics product labels must state that they are for use only by licensed professionals and comply with FDA and other federal requirements.
Mandatory Recall or Registration Suspension
If FDA determines that (1) there is a reasonable probability that a cosmetic is adulterated or misbranded and (2) the use of, or exposure to, the cosmetic will cause serious adverse health consequences or death, FDA has the authority to order a mandatory recall if the responsible person refuses to do so voluntarily.
FDA also may suspend a facility's registration if FDA: (1) determines that a product manufactured or processed at that facility has a "reasonable probability of causing serious adverse health consequences" to humans; and (2) reasonably believes that other products manufactured or processed by the facility may be similarly affected. Once suspended, a facility is prohibited from introducing any new cosmetic products into commerce until its registration is reinstated.
Preemption
MoCRA includes an express clause that precludes a state from establishing or continuing in effect any different requirements for cosmetics related to registration and listing, GMP, records, recalls, adverse events reporting, or safety substantiation.
However, MoCRA does not bar states from continuing to prohibit the use of or limit the amount of ingredients in cosmetic products or from continuing to require compliance with preexisting state cosmetic product ingredient reporting requirements, such as California's Proposition 65.
What Should Your Company Do Now?
The facility registration and product listing deadlines are among the earliest compliance requirements to take effect. Therefore, cosmetic companies should take the time now to determine whether they need to register any facilities with the FDA. With regard to the listing requirement, we recommend that companies now closely consider which products require individual listings and which products may be covered by a single listing and consider engaging legal counsel in connection with these determinations.
Companies also should start to develop reporting and compliance policies for updating the FDA annually as to product listing and for notifying FDA within 60 days of product changes or within 120 days of marketing new products.
This also is a useful time to review your adverse event reporting procedures, current GMP practices, and recall insurance coverage. Companies also should review their safety documentation to ensure that they support a reasonable certainty of safety under product use/typical use conditions, including for fragrances. Furthermore, this is a good time to review your safety and toxicity claims and the support therefore.
Please contact the authors if you would like to learn more about MoCRA and to discuss your regulatory compliance obligations and considerations.