backThe Modernization of Cosmetics Regulation Act of 2022 (“MOCRA”) was signed into law alongside other reforms to the Federal Food, Drug, and Cosmetic Act (“FD&C Act”) on December 29, 2022,1Consolidated Appropriations Act of 2023, Pub. L. No. 117-328, 117th Cong. § 3501 et seq. (2022) (Modernization of Cosmetics Regulation Act of 2022 (“MOCRA”)). as part of a broader consolidated appropriations bill to fund the Federal government through fiscal year 2023. MOCRA marks the first significant expansion to the U.S. Food & Drug Administration’s (“FDA” or the “Agency”) authority over cosmetics since the original enactment of the FD&C Act in 1938.2See 21 U.S.C. §§ 361–363. MOCRA was originally introduced in the Senate’s FDA user fee bill last fall,3See Food and Drug Administration Safety and Landmark Advancements Act of 2022, S. 4348, 117th Cong. § 801 et seq. (2022). which we reported on here, and emerged in the wake of heightened FDA and consumer attention toward the safety of cosmetic products, including serious health effects linked to cosmetic products containing talc and per- and polyfluoroalkyl substances (“PFAS”).4See U.S. Food & Drug Admin., Talc (updated Dec. 7, 2022), https://www.fda.gov/cosmetics/cosmetic-ingredients/talc; U.S. Food & Drug Admin., Per and Polyfluoroalkyl Substances (PFAS) in Cosmetics (updated Feb. 25, 2022), https://www.fda.gov/cosmetics/cosmetic-ingredients/and-polyfluoroalkyl-substances-pfas-cosmetics.
MOCRA’s reforms, when taken together, bring the cosmetics regulatory paradigm closer to medical products in a number of important ways, but they stop short of imposing a premarket government review and approval process, and they do not align the U.S. regulatory regime for cosmetics with that of the European Union (“EU”). MOCRA adds, among other things: (1) new requirements related to facility registration and product listing, adequate substantiation of safety, product labeling, adverse event reporting, recordkeeping, and good manufacturing practices5MOCRA § 3502 (to be codified at FD&C Act §§ 605 (adverse event reporting and recordkeeping), 606 (good manufacturing practices), 607 (facility registration and product listing), 608 (adequate substantiation), and 609 (label)). for most manufacturers, packers, and distributors of cosmetic products whose name appears on the product label (“responsible persons”) and certain requirements for establishments that manufacture, process, or import cosmetic products distributed in the U.S. (“facilities”);6Id. § 3502 (to be codified at FD&C Act § 604(3) and (4)). and (2) increased FDA enforcement powers to suspend facilities and order the recall of cosmetic products that may pose a risk to public health.7Id. (to be codified at FD&C Act §§ 607(f) (suspensions) and 611 (mandatory recalls)). MOCRA also directs FDA to take certain actions related to establishing asbestos testing methods for talc-containing cosmetic products and studying the safety of PFAS.8Id. §§ 3505 (talc) and 3506 (PFAS). Importantly, MOCRA also contains an express preemption provision.
Responsible persons and facilities should prepare to comply with the majority of the MOCRA provisions, which are set to take effect in one year (i.e., on December 29, 2023), with the exception of: (1) the labeling requirements, which will take effect in two years; and (2) the requirement that FDA issue regulations governing Good Manufacturing Practices (“GMPs”), for which MOCRA gives FDA three years to issue final regulations.9Id. §§ 3503(b)(1)–(b)(2) and 3502 (to be codified at FD&C Act § 606(c)). Responsible persons and facilities, unless deemed to be exempt, should also closely monitor FDA’s rulemaking and guidance activity with respect to the new obligations and the regulation of cosmetic products containing talc and PFAS. FDA will treat the failure to adhere to any of MOCRA’s requirements as violating the adulteration or misbranding provisions in the FD&C Act or as a separate prohibited act under the Act.10Id. § 3503(a).
The start dates for complying with MOCRA’s regulatory obligations (and discussed throughout this client alert) fundamentally assume that FDA will have developed and implemented all the necessary regulatory infrastructure and regulations by such dates. In some cases, we anticipate it may take more time than allotted for FDA to do so, which will effectively delay the timeline for compliance.
A summary of MOCRA’s significant provisions and take-aways is below, followed by a brief comparison with the cosmetics regime in the European Union. For a discussion of the Food and Drug Omnibus Reform Act of 2022, which was contained in the consolidated appropriations bill along with MOCRA, we issued a concurrent Client Alert available here.
1. Facility Registration and Product Listing
Under MOCRA, each manufacturing facility for cosmetic products must maintain a valid facility registration with FDA. A facility in operation at the time of MOCRA’s enactment must register by December 29, 2023.11Id. § 3502 (to be codified at FD&C Act § 607(a)(1)). Going forward, new facilities must register within 60 days of first engaging in the manufacturing or processing of a cosmetic product for distribution in the U.S.12Id. (to be codified at FD&C Act § 607(a)(1)). For contract manufacturers, MOCRA clarifies that either the facility or any responsible person whose products are manufactured or processed at such facility may submit the registration for that facility.13Id. (to be codified at FD&C Act § 607(a)(3)).
Responsible persons must also maintain listings of their cosmetic products with FDA, including each product’s name, type, ingredients (including fragrances, flavors, or colors), and facility of manufacture or processing.14Id. (to be codified at FD&C Act § 607(c)(2)–(c)(4)). A responsible person must submit its product listing for currently marketed products by December 29, 2023, and for any new cosmetic product within 120 days of marketing such product.15Id. (to be codified at FD&C Act § 607(c)(2)).
Registration must occur on a per-facility basis whereas listing must occur on a per-responsible person basis. Further, the processes are to operate on separate timelines, with registration renewals occurring every two years and listing updates occurring every year.16Id. (to be codified at FD&C Act § 607(a)(2) and (c)(2)).
2. Adequate Substantiation of Safety
Responsible persons must ensure that their cosmetic products are safe and must maintain records of adequate substantiation of safety for each.17Id. (to be codified at FD&C Act § 608(a)). MOCRA defines adequate substantiation of safety to mean tests, studies, research, analyses, or other data considered by experts qualified by scientific training and experience as sufficient to support that the product and its ingredients are “safe” (i.e., are not injurious when used in accordance with the labeling or customary use).18Id. (to be codified at FD&C Act § 608(c)).
3. Labeling
FDA regulations currently require cosmetic products to be labeled with a listing of ingredients,1921 C.F.R. § 701.3. statement of identity,20Id. § 701.11. net quantity of contents,21Id. § 701.13. and name and place of business of manufacturer, packer, or distributor (i.e., the principal place of business or the actual place where the cosmetic was manufactured, packed, or is to be distributed).22Id. § 701.12. MOCRA expands this list by requiring a responsible person to identify on each product label: (i) its domestic address, phone number, or electronic contact information through which it may receive adverse event reports;23MOCRA § 3502 (to be codified at FD&C Act § 609(a)). (ii) any “fragrance allergens” included in the cosmetic product;24MOCRA tasks FDA to issue a proposed rule identifying “fragrance allergens” by June 2024 and finalize such rule within 180 days after the end of the public comment period. Id. (to be codified at FD&C Act § 609(b)). and (iii) if intended for “professional use” by a licensed professional cosmetologist, nail technician, barber, or esthetician, a clear and prominent statement that the product shall be administered or used only by licensed professionals.25Id. (to be codified at FD&C Act § 609(c)).
4. Adverse Event Reporting and Recordkeeping
MOCRA requires cosmetic companies to report serious adverse events for the first time. Within 15 business days of receiving relevant information, a responsible person must report to FDA: (i) any known serious adverse event (“SAE”) (i.e., an adverse event that results in death, a life-threatening experience, hospitalization, a significant disability or incapacity, a congenital anomaly or birth defect, an infection, significant disfigurement, or medical or surgical intervention to prevent such outcomes)26Id. (to be codified at FD&C Act § 604(5)). associated with the use of its cosmetic product(s) in the U.S.;27Id. (to be codified at FD&C Act § 605(b)(1)). and (ii) any new and material medical information related to such SAE report that is received within one year after filing the initial report.28Id. (to be codified at FD&C Act § 605(b)(2)).
Responsible persons must receive, maintain, and make accessible for FDA inspection reports of adverse events associated with use of its cosmetic product(s) in the United States.29Id. (to be codified at FD&C Act § 605(d)–(e)). If FDA has a reasonable belief that an ingredient or combination of ingredients in a fragrance or flavor has caused or contributed to an SAE and requests a list of the ingredients or categories of ingredients in that fragrance or flavor, then the responsible person must submit the requested information to FDA within 30 days of the request.30Id. (to be codified at FD&C Act § 605(f)).
5. Good Manufacturing Practices
The FD&C Act and FDA regulations did not historically contain GMP requirements for cosmetics. However, FDA has maintained that compliance with GMPs is important to minimize the risk of adulteration or misbranding of cosmetic products.31See U.S. Food & Drug Admin., Draft Guidance for Industry: Cosmetic Good Manufacturing Practices, at 4 (revised June 2013), https://www.fda.gov/media/86366/download; U.S. Food & Drug Admin., Good Manufacturing Practice (GMP) Guidelines/Inspection Checklist for Cosmetics (updated Feb. 25, 2022), https://www.fda.gov/cosmetics/cosmetics-guidance-documents/good-manufacturing-practice-gmp-guidelinesinspection-checklist-cosmetics. FDA and industry have traditionally looked to the international standard for cosmetics GMPs, ISO 22716.32Draft Guidance for Industry: Cosmetic Good Manufacturing Practices, at 3.
For the first time, MOCRA creates a legal requirement for manufacturing facilities to comply with FDA-issued GMPs.33MOCRA § 3502 (to be codified at FD&C Act § 606(a)). MOCRA directs FDA to develop GMPs that: (i) are consistent and appropriate with both national and international standards to ensure cosmetic products are not adulterated;34Id. (to be codified at FD&C Act § 606(a)). (ii) consider the size and scope of the facilities, as well as the risks to public health posed by the cosmetics they manufacture;35Id. (to be codified at FD&C Act § 606(b)). and (iii) are informed by cosmetic manufacturers (including smaller businesses), consumer organizations, and selected experts.36Id. (to be codified at FD&C Act § 606(b)). FDA must issue a proposed rule for these GMP regulations by December 29, 2024 and a final rule by December 29, 2025.37Id. (to be codified at FD&C Act § 606(b)).
We anticipate that the GMP regulations to be issued by FDA will follow a framework very similar to ISO 22716 given that: (i) FDA has previously recommended that manufacturers adopt requirements of ISO 22716 in guidance; (ii) industry has voluntarily adopted compliance with ISO 22716; (iii) the Agency recognizes the importance of international harmonization of regulatory requirements (see, for example, our discussion on FDA’s proposed replacement of the device GMPs in the Quality System Regulation with the international GMP standard, ISO 13485, here); and (iv) Congress’s direction for FDA to develop GMPs that are consistent with international standards.
6. Suspensions and Mandatory Recalls
MOCRA grants FDA the authority to suspend the registration of a facility if FDA: (i) determines that the facility manufactures or processes a cosmetic product for distribution in the U.S. that raises a reasonable probability of causing serious adverse health consequences or death; and (ii) has a reasonable belief that other products manufactured or processed by the facility may be similarly affected because the failure is non-isolated or sufficiently pervasive.38Id. (to be codified at FD&C Act § 607(f)(1)). Consequently, FDA will bar the facility from introducing or delivering for introduction into interstate commerce any cosmetic products in the U.S. until FDA determines that the facility corrects the violative conditions, vacates the suspension, and reinstates the registration.39Id. (to be codified at FD&C Act § 607(f)(4)–(f)(6)). An effect of this provision is to give FDA the ability to prevent distribution of domestically produced cosmetic products about which it has safety concerns. FDA already has similar enforcement powers over internationally produced cosmetic products under its ability to place foreign facilities on Import Alerts and prevent the importation of cosmetics if FDA has reason to believe the products are adulterated or misbranded.
Further, under MOCRA, FDA may order a responsible person to cease distribution or recall a cosmetic product if: (i) FDA determines there is a reasonable probability the cosmetic product is adulterated or misbranded and the use of or exposure to such product will cause serious adverse health consequences or death; and (ii) given the opportunity, the responsible person refuses to voluntarily recall or cease distribution of such product in accordance with the time and manner prescribed by FDA (if any).40Id. (to be codified at FD&C Act § 611(a) and (d)). FDA will itself notify the public that it has initiated a mandatory recall,41Id. (to be codified at FD&C Act § 611(f)). and may correspondingly order the responsible person to notify the public and affected persons (including persons who manufacture, distribute, import, or offer for sale the product).42Id. (to be codified at FD&C Act § 611(a)–(e)).
7. Exemptions
MOCRA carves out various groups of responsible persons and facilities from its requirements. MOCRA excludes certain establishments from the definition of “facility” and, by extension, does not hold them to the facility requirements. Among others, MOCRA excludes cosmetic product retailers that sell directly to consumers, hospitals, physicians’ offices, and any establishment that only performs one of the following functions with respect to cosmetic products: (i) labeling; (ii) relabeling; (iii) packaging; (iv) repackaging; (v) holding; and (vi) distributing.43Id. (to be codified at FD&C Act § 604(3)). Further, MOCRA exempts “small businesses” from the GMP, facility registration, and product listing requirements.44Id. (to be codified at FD&C Act § 612(a)–(b)). MOCRA defines “small businesses” as responsible persons and owners/operators of facilities that: (i) generated an average of $1,000,000 (adjusted for inflation) in gross annual sales during the last three years; and (ii) do not manufacture or process cosmetic products that regularly come into contact with the mucus membrane of the eye under typical conditions of use, are injected, are intended for internal use, or are intended to alter the consumer’s appearance for more than 24 hours under typical conditions of use.45Id. (to be codified at FD&C Act § 612(a)–(b)).
8. Talc and PFAS
MOCRA instructs FDA to issue regulations that establish and require standardized testing methods for detecting and identifying asbestos in talc-containing cosmetics.46Id. § 3505. FDA has until December 29, 2023 to issue a proposed rule and then 180 days after the end of the public comment period to issue a final rule.47Id.
This direction departs from and goes further than the Agency’s body of work and recently announced plans. The Agency previously commissioned the limited sampling and analysis of talc-containing cosmetic products in 2009–2010, 2019, 2021, and 2022 to detect the presence of asbestos, a known carcinogen when inhaled.48See U.S. Food & Drug Admin., Talc (updated Dec. 7, 2022), https://www.fda.gov/cosmetics/cosmetic-ingredients/talc. In December 2022, the Agency stated that it intends to issue a draft guidance (i.e., nonbinding recommendations, but that reflect FDA’s current positions) to industry for testing asbestos in talc-containing cosmetic products sometime in 2023.49U.S. Food & Drug Admin., Press Release, FDA Releases Data from the Agency’s 2022 Testing of Talc-Containing Cosmetic Products for Asbestos (updated Dec. 7, 2022), https://www.fda.gov/food/cfsan-constituent-updates/fda-releases-data-agencys-2022-testing-talc-containing-cosmetic-products-asbestos.
MOCRA also directs FDA to assess the use and safety of PFAS in cosmetic products, including any risks, and to publicly publish its findings by December 29, 2025.50MOCRA § 3506(a)–(b).
9. Animal Testing
Absent from its requirements are provisions that regulate the use of animal testing in cosmetics. Rather, MOCRA includes a “sense of Congress” statement, a formal opinion without teeth, that recommends animal testing not be used for purposes of safety testing of cosmetics and should be phased out.51Id. § 3507.
10. Preemption
In return for this extensive new set of regulations, MOCRA provides an express preemption provision that precludes states from establishing or continuing in effect any law or regulation that “is different from or in addition to, or otherwise not identical with” any MOCRA requirement with respect to “registration and product listing, good manufacturing practice, records, recalls, adverse event reporting, or safety substantiation.”52Id. (to be codified at FD&C Act § 614). Notably, however, the provision only preempts states laws with respect to these categories of regulation. It contains a “limitation” instruction directing that states can continue to regulate cosmetic ingredients (including prohibiting the use of or limiting quantities of ingredients) and require reporting of certain cosmetic ingredients.53Id. (to be codified at FD&C Act § 614). The limitation also protects Proposition 65 in California.54See Cal. Health & Safety Code § 25249.5 et seq. The savings clause specifies that MOCRA is not preempting product liability and damages claims under state law, whether statutory or based in common law.55MOCRA § 3507 (to be codified at FD&C Act § 614(c)).
European Union
The EU Cosmetics Regulation,56Regulation (EC) No 1223/2009 of the European Parliament and of the Council of 30 November 2009 on cosmetic products. which was adopted almost 15 years ago, strictly regulates cosmetic products by imposing various obligations on the so-called “responsible person” (i.e., the EU manufacturer or EU importer unless it expressly delegates this status to a third party). Those obligations include compliance with GMPs, labeling, reporting of “serious undesirable effects” as well as, before marketing, the creation of a “product information file” (“PIF”), and a notification to a central, European database. When compared to MOCRA, the EU:
i. Requires the PIF to include, among other documentation, a safety report and proof of the claimed effect(s). Ideally, manufacturers who meet the PIF requirements will also satisfy MOCRA’s adequate substantiation of safety requirement, and ultimately avoid the need to conduct additional tests to market their products in both regions.
ii. Requires GMP compliance. As discussed above, we hope and anticipate that FDA’s forthcoming cosmetics GMP regulations will resemble the international GMP standard used in the EU (i.e., ISO 22716) such that manufacturers can easily comply with both sets of requirements.
iii. Does not yet require labels to include allergen information. While labeling requirements are more extensive in the EU than in the U.S., the EU is still discussing whether to indicate allergens.
iv. Does not require manufacturing facilities to register. However, some countries (e.g., France) impose separate registration obligations.
v. Includes lists of ingredients either prohibited or restricted in cosmetics or authorized for specific uses. These lists are more extensive than the lists kept by FDA.
vi. Expressly bans the testing of cosmetic products and ingredients on animals, as well as the marketing of cosmetic products and ingredients that are tested on animals.
Overall, manufacturers who comply with the EU Cosmetics Regulation, particularly ISO 22716, may find the transition to comply with MOCRA easier than manufacturers who only produce cosmetic products for the U.S. market.
***
King & Spalding LLP regularly counsels cosmetics companies on FDA and EU regulatory compliance matters. Please let us know if you have any questions regarding MOCRA or if we can be of any assistance in navigating the forthcoming requirements.
