Cosmetics: MoCRA, the EU Regulation and GMP
Cosmetics are lighter-touch than medicines but no longer lightly regulated. In the US, the Modernization of Cosmetics Regulation Act of 2022 gave FDA its largest expansion of cosmetics authority since 1938: facility registration, product listing, serious adverse event reporting, safety substantiation, records access and mandatory recall, with GMP regulations to follow. In the EU, Regulation (EC) No 1223/2009 has long required a responsible person, a safety report, a product information file, notification and GMP, which ISO 22716 is used to demonstrate.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
MoCRA: What Industry Must Now Do
MoCRA defines the responsible person as the manufacturer, packer or distributor whose name appears on the label. That person must report serious adverse events associated with use of a cosmetic in the US to FDA within 15 business days, with a copy of the label, and submit any new medical or other information received within a year of the initial report within 15 business days. FDA can see adverse event records during an inspection.
Manufacturers and processors register their facilities and renew every two years, and FDA may suspend a registration where a product has a reasonable probability of causing serious adverse health consequences or death and the failure is not isolated. The responsible person lists each marketed product, including ingredients, and updates the listing annually. It must also ensure, and keep records supporting, adequate safety substantiation; no specific tests are required, and animal testing is not a requirement.
MoCRA: FDA’s New Powers and Pending Rules
FDA can now access and copy certain records, including safety records, when conditions are met, and can order a mandatory recall if a responsible person refuses to recall voluntarily a cosmetic with a reasonable probability of being adulterated or misbranded and of causing serious adverse health consequences or death.
MoCRA requires FDA to issue regulations on GMP for cosmetic facilities, on fragrance allergen labelling, and on testing methods for asbestos in talc-containing cosmetics. FDA withdrew its December 2024 proposed rule on asbestos testing in November 2025. Certain small businesses are exempt from GMP, registration and listing, but not if they make products that contact the eye’s mucous membranes, are injected, are for internal use, or alter appearance for more than 24 hours.
The EU: Regulation (EC) No 1223/2009
Only a cosmetic with a responsible person designated in the EU may be placed on the market (Article 4). For a product made in the EU it is the manufacturer, for an import each importer, and a distributor that sells under its own name or modifies a product becomes the responsible person; others can be designated by written mandate.
Before placing a product on the market, the responsible person ensures it has had a safety assessment and that a cosmetic product safety report exists under Annex I (Article 10). The assessment in Part B of the report is carried out by a person qualified in pharmacy, toxicology, medicine or a similar discipline. The responsible person keeps a product information file — description, safety report, manufacturing method and GMP statement, proof of claimed effects and animal-testing data — for ten years after the last batch is placed on the market (Article 11), and notifies the product electronically to the Commission beforehand (Article 13).
Serious undesirable effects are notified without delay to the competent authority of the Member State where they occurred, with the product name and any corrective measures (Article 23).
GMP and ISO 22716
Article 8 of the EU Regulation requires manufacture in accordance with GMP and presumes compliance where manufacture follows the relevant harmonised standards published in the Official Journal. ISO 22716 is the GMP standard for cosmetics used for that purpose. It covers personnel, premises, equipment, raw and packaging materials, production, finished products, the quality-control laboratory, out-of-specification product, waste, subcontracting, deviations, complaints and recalls, change control, internal audit and documentation.
In the US, MoCRA requires FDA to set GMP regulations, and FDA lists a draft guidance on cosmetic GMP. Until a rule is final, ISO 22716 is the practical reference for a company that sells in both markets.
FREQUENTLY ASKED
How quickly must a serious adverse event for a cosmetic be reported to FDA?
Within 15 business days, by the responsible person, with a copy of the label. New medical or other information received within a year of the initial report is submitted within 15 business days of receipt.
Does MoCRA require animal testing for safety substantiation?
No. FDA states that neither the law nor its regulations require specific tests to demonstrate safety, that relevant existing data may be used, and that animal testing is not a requirement for marketing a cosmetic.
How long must an EU product information file be kept?
For ten years after the date on which the last batch of the cosmetic was placed on the market (Regulation (EC) No 1223/2009, Article 11(1)).
Is there a US GMP regulation for cosmetics yet?
MoCRA requires FDA to issue one. FDA’s MoCRA page lists a public meeting and a draft guidance on cosmetic GMP; until a final rule exists, ISO 22716 is the widely used reference.
The inspection-readiness playbook for this topic
PUT THIS PLAYBOOK TO WORK
- HOW-TO GUIDEHow to Place a Cosmetic on the US and EU Markets →Meet the responsible-person obligations under MoCRA and the EU Cosmetics Regulation before the first unit ships.
- TEMPLATECosmetic Market Compliance File (US and EU) →
A free account keeps what you save, remembers where you are across devices, and can send you the weekly regulatory briefing. Create a free account