[Note, this is Part 3 in an ongoing series of posts exploring substantive aspects of the Consolidated Appropriations Act, 2023 (P.L. 117-328) (referred to hereafter as 2023 CAA). Earlier parts covered Medicare Payments and the PIE Act]

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is Subtitle E of the Food and Drug Administration Title of the 2023 CAA. The subtitle itself is a major change for the cosmetics industry, bringing almost all manufacturers and distributors into a regulatory and reporting structure similar to that currently used by the FDA to govern drugs and medical devices.

The Senate and House committee markups for both versions of the FDA User Fee legislation included a version of this law. However, the final version of that legislation had almost all policy riders stripped from it. But, it reappeared in the 2023 CAA and is now law.

So, what is MoCRA and what does it do? As with the previous posts on the 2023 CAA, we will go a little deeper on this than a regular blog post. That approach is particularly warranted here since this is an entirely new regulatory structure.

Effective Dates and Preemption

As a bit of housekeeping, one of the more important aspects of the law is the differing effective dates for each section. Most of the substantive provisions of the law take effect on December 29, 2023. At that point, the cosmetics industry will have to register facilities and list products manufactured at those facilities, deliver product and ingredient lists to FDA and begin compiling and submitting to FDA any serious adverse event reports.

The only exceptions to this date are the labeling provisions, which take effect on December 29, 2024. Additionally, the Department of Health and Human Services isn’t required to issue proposed rules for good manufacturing practices until December 29, 2024 at the latest, with the final rule due by December 29, 2025 at the latest.

In addition, the law specifically preempts any state laws with respect to registration and product listing, good manufacturing practices, records, recalls, adverse event reporting and safety substantiation. However, the law does NOT preempt state laws prohibiting, limiting or reporting the use of an ingredient in a cosmetic product. It also does not preempt personal liability actions under existing state law.

Facility Registration

One of the primary changes in the law is the requirement for all cosmetic manufacturing or processing facilities to register with the FDA by December 29, 2023 (currently, registration is voluntary). All existing facilities on the enactment date (December 29, 2022) will need to register by the registration date (December 29, 2023). All new facilities that come online between the enactment date and the registration date will have to register either by the registration date or 60 days after the facility comes online, whichever is later. After that point a new facility will have to register within 60 days of beginning manufacture.

The registrations will be good for two years and, while facility operators will be required to notify the FDA of any changes to the content of a registration, the FDA will also provide an abbreviated renewal process for facilities that haven’t required updates since their most recent registration.

The registration must include information about the name and physical location of the facility as well as the contact information for the facility, including for the U.S. based agent for any foreign facility that is registering. In addition to that information, the registration must include the brand names under which the cosmetic products manufactured or processed in the facility are sold. Finally, the registration must include the product categories and “responsible person” for each cosmetic manufactured or processed at the facility.

It is this last category of information that is useful for the tracking of adverse events, covered later, and worth emphasizing that the registration is for the facility, not for the cosmetic brand. So, if a facility is contract-processing cosmetics on behalf of more than one brand or third party, the facility needs to submit only one registration.

“Responsible person” here means the corporation that is responsible for the cosmetic either as the manufacturer, packager or distributor. The key distinction is that the “responsible person” is the one whose name appears on the label, not necessarily the owner or operator of the facility that manufactures them.

Product Listing

The new law requires the responsible person for each cosmetic to provide FDA with a product listing by December 29, 2023, one year after the enactment date of MoCRA. For any cosmetic that is first marketed after the enactment date, the product listing is due to FDA within 120 days of the cosmetic’s first marketing date.

Unlike the facility registration requirement, which needs only to be completed on a facility-by-facility basis, the product listing burden falls on the “responsible person” for the cosmetic regardless of whether that corporation is the one that directly manufactures the product. However, a single listing can be completed for multiple products that represent identical formulations or formulations that differ only with respect to colors, fragrances, flavors or quantity of products. Additionally, in cases where the responsible person is also the corporation that operates the manufacturing facility, the product listing can be submitted as part of the facility registration.

That product listing submission itself should include: the facility registration number for the facility in which the cosmetic is manufactured; information about the responsible person for the cosmetic, including contact information; the applicable cosmetic category or categories for the product and a list of ingredients in the product.

Product listings must be renewed annually and FDA is tasked with developing an abbreviated submission process for listings that have had no changes over the course of a year.

Labeling and Records

Cosmetics must now bear labels that include the contact information for the responsible person for the purposes of reporting serious adverse events. The labels must also identify if the cosmetics are intended exclusively for professional use. This means that the cosmetics are designed to be exclusively used by licensed professionals in the fields of cosmetology, nail care, barbering, or esthetics, and not for personal or consumer use at home.

The labels should also include each fragrance allergen that is included in the product. HHS will issue proposed regulations at some time before June 29, 2024 defining what substances are considered fragrance allergens. As a result of this delay in regulations, the labeling provisions of the law don’t take effect until December 29, 2024.

Additionally, the law requires a responsible person or facility to keep on hand records relating to the safety and distribution of the cosmetics. For a responsible person, those records are required to include information supporting that there is adequate substantiation of the safety of the product. This substantiation can include tests, studies or research of the type that is considered by experts qualified to evaluate the safety of cosmetic products or their ingredients.

All of these records will be accessible to inspection by FDA upon request.

Adverse Event Reporting

The law requires a responsible person to report to FDA any serious adverse events that have resulted from use of a cosmetic that was manufactured, packaged or distributed by that person. The adverse event reports are received by the responsible person through the contact information that it has placed on its labeling. The reports are then forwarded to FDA within 15 days of the responsible person receiving them and must be accompanied by a copy of the label.

The responsible person must keep records related to each report for six years and permit inspection of those records upon demand from FDA.

A serious adverse event is defined in the law as one that results in death, a life threatening experience, inpatient hospitalization, persistent or significant disability or incapacity, congenital anomaly, infection or significant disfigurement, or an event that would require medical or surgical intervention to avoid such effects.

The responsible person is required to update these reports within 15 days of learning any new and material medical information for one year after the initial report to FDA. To help with that reporting and to assist in the reporting of adverse events that have generated multiple reports, the FDA is tasked with developing a system that will allow a responsible person to submit a single report that includes either duplicate reports or new medical information relating to a serious adverse event.

Also, in an effort to encourage compliance with this provision, the law protects all personally identifiable information contained in the reports from release. The law also allows for a statement to be included with the report or records disclosed to the public that denies that the report is an admission that the product caused or contributed to the adverse event. In fact, the law specifically states that the submission of a report is not to be construed as an admission of such.

FDA investigation of a serious adverse event that leads to a determination that the product contributed to the event could result in the agency suspending the registration for the facility that produced the product. Such a suspension will be implemented only after notice to the facility, opportunity for an informal hearing and review of a proposed corrective action plan. Suspensions can be lifted after completion of a corrective action plan or if sufficient grounds no longer exist for the suspension.

Good Manufacturing Practice Regulations

The law attempts to protect public health from the manufacturing of “adulterated” cosmetics by requiring FDA to issue regulations that will establish “good manufacturing practices” for cosmetic manufacturers.

Under the law, the regulations should take into account the size and the scope of businesses regulated. For smaller businesses that could suffer undue economic hardship, the regulations will include simplified requirements.

Under the law, FDA must issue its proposed rule by December 29, 2024 and finalize the rule by December 29, 2025.

Mandatory Recalls

Finally, the law places cosmetics under a recall regime that results from a finding that the cosmetics are “adulterated” or “misbranded” in a similar fashion as is currently used for drugs.

If the cosmetics are determined to be misbranded or adulterated, FDA will give the responsible person the opportunity to stop distribution and voluntarily recall the products. If the responsible person fails to do so, FDA can issue an order requiring such a recall.

A recall order will generate an informal hearing process and, if continued, could result in a full recall and public notification.

What Does This Mean?

So in short, what does this mean for the cosmetic industry?

  1. Be ready for increased investment of time, effort, and financial resources. As noted above, the law provides FDA greater authority to regulate cosmetic products through inspections and recalls, similar to drug and devices. Although provisions such as GMP compliance are not effective immediately, manufacturers and brand owners should begin the review immediately because it takes some time to bring a facility into compliance and to train the employees if the facility is not GMP-compliant. This will require greater attention and investment on regulatory compliance.
  2. Assess whether the products are likely to be FDA’s priority for scrutiny and enforcement. Historically, there have been certain products that FDA considers to pose greater risks to consumers, and such products and their manufacturers will be high on FDA’s priority list for enforcement. Additional caution should be taken to ensure such products’ and their manufacturers’ regulatory compliance. Be sure to review and track FDA’s prior and current enforcement actions to assess the risk of FDA scrutiny and/or enforcement. We can help with this also.
  3. Review the supply chain and assess your suppliers’ compliance. In particular, brand owners that engage a contract manufacturer to manufacture the products should conduct sufficient due diligence on the suppliers’ practices to ensure that the products being received comply with FDA’s requirements. FDA’s enforcement actions against such products will invariably affect the brand owners. For example, if cosmetic products are refused by FDA during importation, the brand owners may pay the price for reputational damage or not meeting the deadlines.

Reed Smith will continue to follow legislative and regulatory developments affecting MoCRA and its implementing regulations. If you have any questions about how this law affects you, please reach out to the health care lawyers at Reed Smith, LLP.