Enacted on 29 December 2022 and set to come into force from 29 December 2023, as part of the 2023 Omnibus Bill, MoCRA provides a major overhaul of the Food and Drug Administration’s regulatory framework for cosmetics. The new regulation amends Chapter VI of the Federal Food, Drug, and Cosmetic Act (FDCA) and represents the first update to US cosmetics law since 1938. In essence, it provides a harmonized legal framework that empowers the FDA to protect consumers against safety issues with cosmetic products.
To find out more about what this long-awaited legal reform means for industry, CosmeticsDesign-USA spoke to Joanne Hawana, FDA regulatory and compliance strategist at law firm Mintz.
“At a federal level, cosmetics laws haven’t changed since 1938 although in the interim the cosmetics industry has become far more globalized, relying on foreign-imported products and ingredients, and has seen the introduction of new technologies such as nano-technology, and ingredients like botanicals and CBD,” Hawana said.
Limited power to act
Under the old law, there was no protection for consumers from safety and cross contamination issues arising as a result of increasingly globalized supply chains, she said. This was because, under the existing framework, the FDA had no authority to demand a product recall and adverse event reporting; Good Manufacturing Practice (GMP) and facility registration were entirely voluntary.
“The only mandatory requirement was that products were not ‘adulterated’ or ‘misbranded’, but the FDA’s ability to enforce that was very limited,” Hawana said. “They could invoke a seizure or an injunction or some other extreme enforcement but that was a huge burden that involved going to the Department of Justice.”
In the absence of stronger federal rules, individual states were taking matters into their own hands, said Hawana. California, for example, implemented the California Safe Cosmetics Act in 2005. The problem with this situation, however, was that companies were having to comply with different rules in different states, she said.
Harmonizing a fragmented legal landscape
MoCRA aimed to harmonize the regulatory framework for cosmetics by preventing any states from enforcing or establishing any laws relating to registration and product listing, GMP, records, recalls, adverse event reporting, or safety substantiation for cosmetics that were different from MoCRA’s requirements. However, states remained free to implement additional requirements for cosmetics, such as prohibiting the use of specific ingredients.
“Individual states can still ban ingredients, so they are not a completely losing the ability to regulate in their own jurisdiction,” noted Hawana.
However, she said creating a federal baseline was important to industry as companies could use their compliance with these rules to protect themselves against state law suits, such as personal injury claims. “Some of the earlier versions of the Bill did not have any pre-emption language which was why they didn’t get support from the industry in the same way this version has.”
MoCRA was also designed to make provisions that would empower the FDA to act quickly to protect consumers in the event of a safety incident, she said. “Consumer safety is a huge part of it because in the last few years there have been some fairly large national events where I suspect that the FDA felt if they had had more power they could have protected consumers more quickly,” said Hawana.
What are the provisions within MoCRA?
There were various provisions in MoCRA designed to remedy this situation:
. Mandatory recall authority: MoCRA granted the FDA the authority to order a mandatory recall of a cosmetic product if it determined that the cosmetic product was likely to cause serious adverse health consequences or death.
. Mandatory allergen labeling: MoCRA required the FDA to determine by regulation fragrance allergens that must be disclosed on a cosmetics label.
. First GMP regulations: the FDA must issue mandatory current good manufacturing practice (GMP) regulations for cosmetics that were consistent with national and international standards.
. Facility registration: operators of facilities that manufactured or processed cosmetic products must register with the FDA and renew such registrations every two years.
. Product listing: the ‘responsible persons’ (manufacturers, packers or distributors whose name appeared on the label of a cosmetic product) were required to list with the FDA each cosmetic product, including its ingredients and information about where the cosmetic product was manufactured, and update cosmetic product labels to include contact information through which the responsible person could receive adverse event reports.
. Adverse event reporting: where a consumer had been harmed by a product, manufacturers were required to report this to the FDA.
. Safety substantiation: manufacturers would be required to maintain records supporting “adequate substantiation” that the cosmetic product was safe. Cosmetic products that did not have adequate safety substantiation would be considered adulterated under a newly created adulteration provision within the FDCA.
What do cosmetics companies need to do right now?
According to Hawana, the two main actions that businesses should be taking right now were to review their procedures for adverse event reporting and for safety substantiation, as both of these requirements come into effect at the end of 2023.
With regard to adverse event reporting, she said: “Many companies will already have policies, procedures and training in place for analyzing and reviewing those types of complaints. But they will still need to review and refresh them to reflect those new regulations.
She continued: “Companies need to have very clear policies and procedures in place: who is responsible for reviewing complaints? Who decides when events go to the FDA?”
The other priority, said Hawana, should be working towards having the necessary systems in place to substantiate the safety of products. MoCRA included new affirmative obligations for the ‘responsible person’ to ensure and maintain records supporting that there was adequate substantiation of safety for each product on the market.
“Although under existing federal law, manufacturers are of course expected to ensure the safety of their products before distributing them, otherwise those products would technically be adulterated and could become subject to enforcement action, this is the first affirmative federal statute requiring safety substantiation and defining what “adequate substantiation” is in this context,” said Hawana.
MoCRA defined ‘adequate substantiation of safety’ – for both the finished cosmetic product and its ingredients – to mean ‘tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience, to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe’.
When the majority of MoCRA became effective at the end of 2023, Hawana said a failure to demonstrate adequate substantiation of safety would render the product ‘adulterated’ pursuant to the law.
Start working on safety substantiation now
And businesses should begin to work on this now, rather than waiting for any FDA guidance, advised Hawana.
“We would expect this new section on safety substantiation to be interpreted by the courts as part of future product liability lawsuits, likely well before we see any potential FDA interpretation via guidance or any enforcement action involving a failure to maintain the necessary records,” she said.
“Therefore, from a liability defense standpoint, manufacturers should work not only to ensure those records exist and meet the articulated standard, but also to evaluate whether there are newer test methods or other technologies that could be used to make their safety substantiation even stronger.”
All provisions in MoCRA come into force at the end of 2023 apart from the labeling requirements, which would come into effect at the end of 2024.
The reason that adverse event reporting and safety substantiation should be prioritized, Hawana said, was because they did not require the FDA to promulgate any regulations first. Before mandatory allergen labeling could be implemented, for example, the FDA had to establish which allergens need to be identified.
Similarly, product listings and facility listings could not be registered until the FDA had set up an online system, and companies couldn’t comply with GMP regulations until they had been established, said Hawana.
“The registration requirements are for inspection purposes once the GMP regulations are in place, but it will be some years before we reach that point. Although GMP guidance currently exists it can’t just be turned into a rule, it will involve a very complex technical rule making process. The expectation is that GMP regulations will be finalized three years from this law’s signing date, but I don’t know whether that will happen. So, it will be a while before operations can set up their facilities around GMP regulation,” she said.
