Locke Lord QuickStudy: Preparing for the December 2023 ‎MoCRA Deadlines: What You Should Do Now

The Modernization of Cosmetics Regulation Act of 2022 (“MoCRA”) contains several provisions that will go into effect on December 29, 2023. We have previously explained some of the main provisions of MoCRA in Amendments to Section VI of the Federal Food and Drug and Cosmetic Act in the Omnibus Bill (February 23, 2023). While the industry waits for FDA to finalize instructions and guidance, there are a host of activities that can be undertaken to make sure you do not find yourself out-of-compliance when that date arrives.

Facilities and Product Registration

The facilities registration provisions of MoCRA require that all cosmetic manufacturers and processors register their facilities in advance of the December 2023 deadline. Likewise, responsible persons must register all of their cosmetic products by that same date. Failing to register a facility or a product risks FDA determining that a marketed cosmetic product is adulterated or misbranded, which could lead to: (1) a mandatory recall instituted by FDA under MoCRA; (2) criminal action against a company or facility for marketing adulterated or misbranded products; (3) rejection or suspension of a facility registration resulting in a shutdown of that facility; and/or (4) a fine or other penalty associated with noncompliance.

These registrations will necessarily need to include the following information:

FDA has yet to release an electronic system for filing these registrations and has already decommissioned the previous voluntary registration platform. FDA has promised to have a system ready in time for the December 2023 MoCRA deadline, and we expect that FDA will provide guidance on its new registration system in the next 2-3 months.

What you should do now

A company that fails to prepare while waiting for the registration system to be finalized and open risks significant delays that could place it out of compliance in December 2023.

To mitigate potential risks, “responsible persons” (i.e., the manufacturer, packager, or distributor of a cosmetic product whose name appears on the product label) should be working diligently to assemble all of the information required above. This process should include communication between any distributors, packagers, labelers, repackagers, or relabelers and their contract manufacturers to exchange the information necessary to file the registrations and decide what entity or entities should and will be filing the registrations.

Companies should also set up a regular system for exchanging information on new products and new facilities to ensure that any future registrations or amended registrations are filed in a timely manner that meets MoCRA’s deadlines for updates.

Adequate Safety Substantiation

Under MoCRA, a “responsible person” must ensure and maintain records supporting that there is adequate substantiation of safety for each cosmetic product for which it is responsible by the December 2023 deadline. These records include determining the safety of a cosmetic product and its ingredients under customary and usual use, as well as potential effects from cumulative or other relevant exposures. FDA will expect these records to sit with contract manufacturers and any listed “responsible persons.”

The statute defines “adequate safety substantiation” as “tests or studies, research, analyses, or other evidence of information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe.”

FDA has published no guidance about how to substantiate whether a product or its ingredients is safe at this time. It is unclear whether any guidance will be provided by the deadline.

What you should do now

All “responsible persons” should gather what information they have on the safety of their products and ingredients to assess what gaps, if any, exist with respect to safety data. This information may include CIR and other reviews accepted by experts in the field, published scientific literature, and public and private testing data.

Since safety testing often takes significant planning, time, and investment, it is imperative that companies immediately assess whether any gaps exist in their safety data. After determining what information and data you possess, it is advisable to consult with your scientific, regulatory, and legal teams to determine what next steps, if any, may be necessary to prepare a dossier for review upon any FDA request or inspection.   

Adverse Event Recordkeeping and Reporting

MoCRA requires all “responsible persons” to maintain records of any “adverse event” reported for a cosmetic product they have manufactured, processed, or distributed for six (6) years (or three (3) years for qualifying small businesses). MoCRA further establishes that a responsible person must report any “serious adverse event” to FDA within fifteen (15) days, and provide FDA with any updates concerning “new or material medical information” associated with such serious adverse events within fifteen (15) days for a period of one (1) year.

MoCRA provides for inspection of any registered facility of a “responsible person.” During such an inspection, FDA may request copies of all adverse event records, which may then be provided to State or Federal health agencies or personnel. Failure to provide such records renders a product or facility noncompliant.

FDA has not yet provided guidance on the exact forms or systems that will be utilized when making “serious adverse event” reports to the Agency. FDA, however, has set up independent systems for drugs, devices, food, vaccines, and animal drugs that likely will be adapted for the nuances of the cosmetics industry.

What you should do now

FDA recently advised that it believes companies should already have systems in place to identify adverse events in complaints they have received. In other words, “responsible persons” and their facilities cannot wait until December 29, 2023 to implement systems for identifying, tracking, recording, and reporting adverse event complaints, as needed. We have written separately in more detail about how companies can prepare for the adverse event requirements of MoCRA here.

Conclusion