MoCRA 2026: What the Modernization of Cosmetics Regulation Act Means for Indie Brands

For the first time in over 80 years, the FDA has comprehensive regulatory authority over cosmetics and personal care products. The Modernization of Cosmetics Regulation Act (MoCRA), signed into law in December 2022, represents the most significant overhaul of cosmetics regulation since the Federal Food, Drug, and Cosmetic Act of 1938.

If you're building skincare, haircare, or personal care products, MoCRA 2026 compliance deadlines are approaching fast. The law introduces mandatory facility registration, product listing, adverse event reporting, and good manufacturing practice requirements that will fundamentally change how indie brands approach product development and manufacturing.

This isn't just about paperwork. MoCRA compliance affects your formulation decisions, manufacturing partner selection, record-keeping systems, and go-to-market timeline. Here's what you need to know.

What Is MoCRA and Why Does It Matter?

MoCRA gives the FDA new enforcement powers over cosmetics and personal care products sold in the United States. Before MoCRA, cosmetics were largely self-regulated. Brands didn't need to register with the FDA, list their products, or report safety issues. The FDA could only take action after products reached the market and caused harm.

Now, the FDA has proactive authority to:

Require facility registration and product listing
Mandate adverse event reporting
Order recalls of unsafe products
Inspect manufacturing facilities
Enforce good manufacturing practices
Request safety substantiation records

The law applies to all cosmetics sold in the U.S., regardless of where they're manufactured. If you're making products in your garage or working with a contract manufacturer overseas, you're subject to the same requirements as major CPG companies.

Key MoCRA Compliance Deadlines for 2026

MoCRA implementation happens in phases. Here are the critical deadlines:

December 29, 2023 (already passed):

Adverse event reporting became mandatory
Brands must report serious adverse events within 15 business days

July 1, 2024 (already passed):

Facility registration opened
Product listing became required

December 29, 2024:

Full compliance required for facility registration
Full compliance required for product listing
Records retention requirements take effect

July 1, 2025:

Small businesses (fewer than $1M in annual sales) must register facilities

December 29, 2025:

Good Manufacturing Practice (GMP) requirements take effect
Safety substantiation records must be available for FDA inspection

2026 and Beyond:

Ongoing compliance with all MoCRA requirements
FDA inspections and enforcement actions increase

If you're launching new products in 2026, you need compliant systems in place before your first production run.

MoCRA Facility Registration: What You Need to Know

Every facility that manufactures or processes cosmetics for U.S. distribution must register with the FDA. This includes:

Contract manufacturers and co-packers
Private label manufacturers
In-house production facilities
Repackaging and relabeling facilities

Registration is facility-specific, not company-specific. If you manufacture at multiple locations, each facility needs separate registration.

Who Registers the Facility?

The "responsible person" registers the facility. For most indie brands working with contract manufacturers, the manufacturer handles facility registration. But you're still responsible for verifying that your manufacturing partner is registered and compliant.

Before selecting a contract manufacturer, ask:

Have you registered your facility with the FDA under MoCRA?
What is your FDA facility registration number?
Do you have documented GMPs in place?
How do you handle adverse event reporting for products you manufacture?

If a manufacturer can't answer these questions clearly, they're not ready for MoCRA compliance.

Registration Requirements

Facility registration includes:

Business name and contact information
Physical address of the facility
Email address for electronic correspondence
Product categories manufactured at the facility
Certification that the facility follows good manufacturing practices

Registration must be renewed every two years. The FDA may inspect registered facilities at any time.

Product Listing Under MoCRA

Every cosmetic product sold in the U.S. must be listed with the FDA. Product listing is separate from facility registration and includes detailed information about each SKU.

What Information Is Required?

For each product, you must provide:

Product name and brand
Product category (moisturizer, serum, shampoo, etc.)
Responsible person's name and contact information
Facility where the product is manufactured
Complete list of ingredients (in descending order of predominance)
Product images (if available)

You don't need to disclose proprietary formulation details, percentages, or supplier information. But you must list every ingredient by its standard name (typically INCI name for cosmetics).

When to List Products

Products must be listed within 120 days of being marketed in the U.S. If you discontinue a product, you must update the listing within 180 days.

For brands with large product catalogs, this creates ongoing administrative work. You need systems to track SKU launches, reformulations, and discontinuations.

Small Business Exemption

Businesses with less than $1 million in annual gross sales have an extended deadline (July 1, 2025) for product listing. But this exemption doesn't apply to facility registration or adverse event reporting.

Even if you qualify for the small business exemption, getting compliant early reduces risk. The FDA can still take enforcement action against non-compliant products, regardless of company size.

Adverse Event Reporting Requirements

Brands must report serious adverse events to the FDA within 15 business days. This requirement took effect in December 2023 and applies to all cosmetics companies.

What Counts as a Serious Adverse Event?

A serious adverse event is a health-related reaction that:

Results in death
Causes or contributes to serious injury or illness
Requires medical intervention to prevent permanent impairment
Causes significant disfigurement

Common examples include severe allergic reactions, chemical burns, infections, or eye injuries. Minor skin irritation or temporary redness typically doesn't meet the threshold for reporting.

How to Report Adverse Events

The FDA provides an electronic reporting system for adverse events. Reports must include:

Description of the adverse event
Product information (name, ingredients, lot number)
Consumer information (age, medical history if relevant)
Timeline of product use and reaction
Medical records or documentation (if available)

You must also maintain records of all adverse events (serious and non-serious) for at least six years.

Building an Adverse Event System

Even if you've never received a complaint, you need a system to:

Collect and document customer complaints
Evaluate whether complaints meet the threshold for reporting
Submit reports to the FDA within the 15-day window
Maintain records for FDA inspection

This isn't something you can handle manually at scale. Most brands use customer service software with tagging and escalation workflows to identify potential adverse events.

Good Manufacturing Practices (GMPs) Under MoCRA

Starting December 29, 2025, all cosmetics facilities must follow good manufacturing practices. This is the most operationally significant requirement for indie brands.

What Are GMPs?

GMPs are documented procedures that ensure products are consistently manufactured to quality standards. They cover:

Facility sanitation and maintenance
Equipment calibration and cleaning
Personnel training and hygiene
Raw material testing and storage
Production batch records
Quality control testing
Contamination prevention
Record retention

The FDA hasn't published final GMP regulations for cosmetics yet, but they're expected to align with international standards (ISO 22716) and existing FDA guidance.

How GMPs Affect Indie Brands

If you manufacture in-house, you need to:

Document your manufacturing procedures
Implement quality control testing
Train staff on sanitation and safety protocols
Maintain batch production records
Establish contamination prevention procedures

This level of documentation and control is challenging for small-scale operations. Many indie brands will shift to contract manufacturers that already have GMP systems in place.

If you work with a contract manufacturer, verify that they:

Have documented GMPs that comply with FDA requirements
Conduct regular internal audits
Maintain batch records and testing documentation
Have contamination control procedures
Provide certificates of analysis for finished products

A manufacturer that can't demonstrate GMP compliance puts your brand at regulatory risk.

Safety Substantiation and Record Keeping

MoCRA requires brands to maintain records that substantiate product safety. While the FDA hasn't issued specific guidance on what constitutes adequate safety substantiation, the law gives the FDA authority to request these records during inspections.

What Records Should You Maintain?

At minimum, maintain:

Formulation records (ingredients, percentages, suppliers)
Ingredient safety data sheets (SDS)
Stability testing results
Microbial testing results
Challenge testing (preservative efficacy) data
Patch testing or clinical trial results (if conducted)
Literature supporting ingredient safety at used concentrations
Records of any safety assessments conducted

You don't need to submit these records to the FDA proactively, but they must be available if requested. Records must be retained for at least three years.

Working with Formulators and Chemists

Most indie brands don't have in-house chemists to conduct safety assessments. You have several options:

Work with a cosmetic chemist who provides safety documentation
Use a contract manufacturer that includes safety substantiation in their services
Hire a third-party lab to conduct stability and safety testing
Use a product development platform that structures safety documentation workflows

The key is documentation. Anecdotal evidence or founder intuition doesn't constitute safety substantiation under MoCRA.

How MoCRA Changes Product Development Workflows

MoCRA compliance affects every stage of product development, from concept to commercialization.

Formulation Decisions

You need to consider:

Ingredient safety data: Can you substantiate the safety of every ingredient at the concentration you're using?
Preservative systems: Do you have challenge testing data showing your preservative system works?
Stability: Do you have data showing your product remains safe and effective through its shelf life?
Supplier documentation: Can your ingredient suppliers provide certificates of analysis and safety data?

These questions should be answered during formulation, not after production.

Manufacturing Partner Selection

When evaluating contract manufacturers, MoCRA compliance is now a critical factor. Ask:

Is your facility registered with the FDA?
Do you have documented GMPs?
What testing do you conduct on raw materials and finished products?
How do you handle batch records and documentation?
What safety substantiation do you provide?

The cheapest manufacturer isn't the best choice if they can't demonstrate compliance.

Launch Timeline

MoCRA adds time to your launch timeline:

Facility registration and product listing (if not already complete)
Stability testing (typically 3-6 months minimum)
Challenge testing (2-4 weeks)
Safety documentation review
GMP documentation and batch record setup

Plan for at least 4-6 months from final formulation to compliant production, assuming your manufacturer is already GMP-compliant.

MoCRA Compliance for Brands Using Genie

Genie structures product development workflows around compliance and manufacturing readiness. Here's how the platform supports MoCRA compliance:

Formulation Documentation

Genie's formulation workspace automatically generates:

Complete ingredient lists (INCI names)
Ingredient concentration ranges
Supplier information and lot tracking
Safety data sheet organization

This documentation feeds directly into product listing requirements and safety substantiation records.

Manufacturing Brief Generation

Genie generates production briefs that include:

Full formulation specifications
Quality control parameters
Testing requirements
Packaging specifications

These briefs help contract manufacturers understand your compliance requirements and set up proper batch records.

Manufacturer Vetting

Genie's manufacturer directory includes compliance information for contract manufacturers, including:

FDA facility registration status
GMP certifications
Testing capabilities
Minimum order quantities

This helps you select manufacturing partners that meet MoCRA requirements.

Record Organization

Genie maintains version-controlled records of:

Formulation changes and iterations
Ingredient specifications
COGS calculations
Production specifications

These records support safety substantiation and provide an audit trail for FDA inspections.

Common MoCRA Compliance Mistakes to Avoid

As brands scramble to meet MoCRA deadlines, several common mistakes are emerging:

Mistake 1: Assuming Your Manufacturer Handles Everything

Your contract manufacturer may register their facility and follow GMPs, but you're still the "responsible person" for your brand. You must:

List your products with the FDA
Report adverse events
Maintain safety substantiation records
Verify your manufacturer's compliance

Don't assume compliance is someone else's problem.

Mistake 2: Waiting Until the Last Minute

MoCRA compliance takes time. Stability testing, challenge testing, and GMP implementation can't be rushed. Start compliance work at least 6 months before your next production run.

Mistake 3: Treating Compliance as a One-Time Event

MoCRA compliance is ongoing. Every new product, reformulation, or manufacturing change requires updated documentation. Build compliance into your regular product development workflow.

Mistake 4: Cutting Corners on Testing

Stability testing and challenge testing cost money, but they're essential for safety substantiation. Skipping testing leaves you vulnerable to FDA enforcement and product recalls.

Mistake 5: Poor Record Keeping

The FDA can request safety substantiation records at any time. If you can't produce documentation, you're non-compliant. Invest in organized record-keeping systems from day one.

The Business Case for MoCRA Compliance

MoCRA compliance requires investment, but it also creates competitive advantages:

Retailer Requirements

Major retailers increasingly require MoCRA compliance documentation before accepting new brands. Sephora, Ulta, and Target are all updating vendor requirements to include:

FDA facility registration numbers
Product listing confirmation
GMP certifications
Safety substantiation documentation

Non-compliant brands will be locked out of retail distribution.

Consumer Trust

Consumers are increasingly aware of cosmetics regulation. Brands that proactively communicate their MoCRA compliance build trust and differentiation.

Reduced Liability

Proper safety substantiation and adverse event reporting reduce your liability exposure. If a safety issue arises, documented compliance demonstrates due diligence.

Operational Efficiency

MoCRA compliance forces you to build better product development systems. Structured formulation workflows, organized documentation, and vetted manufacturing partners make your operations more efficient and scalable.

What Happens If You're Not Compliant?

The FDA has significant enforcement authority under MoCRA:

Warning letters: Public notices of non-compliance that damage brand reputation
Product seizures: The FDA can physically seize non-compliant products
Mandatory recalls: The FDA can order recalls of unsafe products
Facility inspections: The FDA can inspect manufacturing facilities without notice
Civil penalties: Fines for non-compliance
Criminal prosecution: In cases of intentional violations or serious harm

The FDA is still ramping up enforcement, but early warning letters have already been issued. Don't assume you'll fly under the radar.

Getting Started with MoCRA Compliance

If you're not yet compliant, here's your action plan:

Step 1: Verify Facility Registration (Immediately)

Confirm that every facility manufacturing your products is registered with the FDA. If you manufacture in-house, register your facility immediately.

Step 2: List Your Products (By December 29, 2024)

Gather ingredient lists (INCI names) for every SKU and submit product listings through the FDA's electronic system.

Step 3: Implement Adverse Event Reporting (Immediately)

Set up a system to track customer complaints and identify serious adverse events. Train your customer service team on reporting requirements.

Step 4: Assess Your Manufacturing Partners (Q1 2025)

Review your contract manufacturers' GMP compliance. Request documentation of their GMP procedures and testing protocols.

Step 5: Organize Safety Substantiation Records (Q1-Q2 2025)

Gather formulation records, ingredient safety data, and testing results for all products. Identify gaps and conduct additional testing as needed.

Step 6: Update Product Development Workflows (Q2 2025)

Integrate MoCRA compliance into your standard product development process. Build compliance checkpoints into formulation, testing, and manufacturing workflows.

Frequently Asked Questions

Does MoCRA apply to small indie brands?

Yes, MoCRA applies to all cosmetics sold in the U.S., regardless of company size. Small businesses (under $1M in annual sales) have extended deadlines for some requirements, but they must still comply with facility registration, product listing, adverse event reporting, and GMPs.

Do I need to register my products with the FDA before selling them?

You must list products with the FDA within 120 days of marketing them in the U.S. There's no pre-market approval process for cosmetics (unlike drugs), but you must list products and maintain safety substantiation records.

What happens if I reformulate a product?

You must update your product listing with the new ingredient list within 120 days. You should also update your safety substantiation records and conduct new stability testing if the reformulation significantly changes the product's composition.

Can I use the same facility registration for multiple brands?

Facility registration is location-specific, not brand-specific. If you manufacture multiple brands at the same facility, you only need one facility registration. But each brand must list its own products separately.

How do I know if my contract manufacturer is MoCRA compliant?

Ask for their FDA facility registration number and request documentation of their GMP procedures. A compliant manufacturer should readily provide this information. If they can't or won't, consider that a red flag.

What's the difference between a cosmetic and a drug under FDA regulations?

Cosmetics are products intended to cleanse, beautify, or alter appearance. Drugs are products intended to treat, prevent, or cure disease. If your product makes therapeutic claims ("reduces acne," "treats eczema"), it may be regulated as a drug, which has much stricter requirements than MoCRA.

Key Takeaways

MoCRA 2026 fundamentally changes cosmetics product development:

All facilities manufacturing cosmetics for U.S. sale must register with the FDA
All products must be listed with the FDA, including complete ingredient lists
Serious adverse events must be reported within 15 business days
Good Manufacturing Practices become mandatory December 29, 2025
Safety substantiation records must be maintained and available for FDA inspection
Non-compliance risks warning letters, product seizures, recalls, and legal penalties

MoCRA compliance isn't optional, and it's not something you can defer. The deadlines are firm, and the FDA's enforcement authority is real.

The good news: compliance is achievable with the right systems and partners. Structure your product development workflows around documentation, testing, and manufacturing readiness. Work with contract manufacturers that have robust GMP systems. Maintain organized records from day one.

MoCRA raises the bar for cosmetics product development, but it also creates opportunities for brands that take compliance seriously. Better systems, stronger manufacturing partnerships, and documented safety substantiation make your brand more credible, more scalable, and more attractive to retailers and investors.

Ready to build MoCRA-compliant products? Get started free on Genie to structure your formulation workflows, organize safety documentation, and connect with GMP-compliant contract manufacturers.