Cosmetic Good Manufacturing Practices: FDA Registration and Recalls

Cosmetic good manufacturing practices under FDA requirements are no longer voluntary. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) directed the FDA to establish binding GMP regulations for cosmetics and imposed a set of obligations that are already in force: facility registration, product listing, safety substantiation, labeling accuracy, adverse event reporting, and recordkeeping. The FDA can now order mandatory recalls, suspend a facility’s registration, and pursue seizures and injunctions when those obligations are ignored.¹

What Is in Force Now, and What Is Still Draft

For decades, cosmetics were the least regulated product category the FDA oversaw. The Federal Food, Drug, and Cosmetic Act has always prohibited introducing adulterated or misbranded cosmetics into commerce, but GMP compliance sat on the honor system.² MoCRA directed the FDA to write binding GMP regulations aligned with national and international standards.³

The FDA’s draft GMP guidance draws heavily on ISO 22716 and covers personnel, facilities, equipment, raw materials, production, quality control, and documentation.⁴ The binding GMP rule has not been finalized. The other MoCRA duties, listed below, are already in effect, and cosmetics made under poor manufacturing conditions can already be treated as adulterated under existing law. Waiting for the final GMP rule before upgrading operations is a real risk.

Facility Registration and Biennial Renewal

Every facility that manufactures or processes cosmetics for the U.S. market must register with the FDA. Registration is not one-and-done. Facilities must renew every two years from the date of initial registration, and the FDA allows an abbreviated renewal when nothing has changed since the last submission.⁵

The consequences of losing your registration are serious. The FDA can suspend a facility’s registration when it determines that a cosmetic from that facility has a reasonable probability of causing serious adverse health consequences or death, and reasonably believes other products from the same facility may be similarly affected. Once registration is suspended, distributing or selling any cosmetic from that facility becomes a prohibited act under federal law.⁵

Product Listing Is Separate From Registering the Facility

Product listing is a distinct obligation. The “responsible person” for each product (the manufacturer, packer, or distributor named on the label) must list every cosmetic with the FDA using Form 5067. The listing must include the product name as it appears on the label, the FDA product category code, each ingredient by its labeling-regulation name or common name, the FDA establishment identifier for every facility where the product is made or processed, and whether the product contains fragrance or flavor.⁵

Product listings must be updated annually.⁶ Any formula change triggers an update. Registering the facility does not cover the products inside it.

Safety Substantiation

MoCRA introduced a duty that had no real predecessor in cosmetics law: the responsible person for each product must ensure and maintain records supporting adequate safety substantiation. The statute defines “adequate substantiation of safety” as tests, studies, research, analyses, or other evidence that qualified experts would consider sufficient to support a reasonable certainty that the product is safe.⁷

The FDA does not prescribe specific tests. Existing safety data, published literature, ingredient safety assessments, or in-house testing can all qualify, provided the methods are scientifically sound. Animal testing is not required.¹ Coal-tar hair dyes that comply with existing statutory requirements are exempt from the safety substantiation mandate itself, though responsible persons must still maintain safety-related records for those products.⁷

A long sales history without complaints is not substantiation. The obligation is documented evidence.

Labeling

Cosmetic labels must carry an ingredient declaration listing each ingredient in descending order of predominance, an accurate statement of the net quantity of contents, and the name and place of business (street address, city, state, and zip code) of the manufacturer, packer, or distributor.⁸

Fragrance and flavor ingredients do not have to be individually named; they can appear as “fragrance” or “flavor.”⁹ An ingredient that functions as both fragrance and flavor must be identified by both functions unless it is listed by its individual name.

Labels that omit required information or carry inaccurate claims render the product misbranded. A misbranded cosmetic can be seized, and the FDA can seek injunctions in federal court.²

Adverse Event Reporting Deadlines

When the responsible person receives a report of a serious adverse event linked to a cosmetic used in the United States, the report must go to the FDA within 15 business days, with a copy of the product label attached. If additional medical or other information about the event arrives within one year of the initial report, the responsible person has another 15 business days to forward it.¹⁰

A “serious adverse event” is broad. It covers death, life-threatening experiences, hospitalization, persistent disability, congenital anomalies, infections, and significant disfigurement, including serious rashes, second- or third-degree burns, significant hair loss, and persistent unintended changes in appearance.¹¹ A customer who develops a persistent rash or significant hair loss after using your product has experienced a reportable event.

Records the FDA Can Access

Batch production records should track lot numbers of raw materials used, the personnel involved, processing parameters, and results of in-process and final quality checks. Adverse event records must be retained for six years after creation. Qualifying small businesses that do not manufacture certain higher-risk products may retain those records for three years instead.¹²

During a routine inspection, the FDA can review records related to adverse event reports received by the responsible person. If the agency has a reasonable belief that a product presents a threat of serious adverse health consequences or death, its access broadens to manufacturing logs, raw material receipt records, distribution records, analytical results, complaint files, and safety substantiation data.¹³

The access authority has limits. Even at its broadest, the FDA cannot demand recipes or formulas, financial data, pricing data, most personnel records, research data beyond safety substantiation, or sales data beyond shipment records. Proprietary formulas stay protected. Refusing to hand over records the FDA is entitled to access is itself a prohibited act and can lead to injunctions, criminal prosecution, or refusal of admission at the border for imported products.¹³

Enforcement: Recalls, Suspension, and Penalties

MoCRA gave the FDA mandatory recall authority over cosmetics for the first time. The agency can order the responsible person to stop distributing a cosmetic and recall it when two conditions are met: a reasonable probability the product is adulterated or misbranded, and a reasonable probability that use or exposure will cause serious adverse health consequences or death.¹¹

Before issuing a mandatory recall order, the FDA gives the responsible person a written opportunity to voluntarily stop distribution and initiate a recall. If the responsible person refuses or fails to act, a formal order follows, and the responsible person then gets an informal hearing no later than 10 days after the order is issued.¹¹ The voluntary stage is where a responsible person still has the most control over scope and cost.

Beyond recalls, the FDA can suspend facility registrations, seek court injunctions to stop sales, seize adulterated or misbranded inventory, and pursue criminal prosecution. Criminal penalties for introducing adulterated or misbranded cosmetics into interstate commerce can include fines and imprisonment.¹⁴

Operational GMP Expectations

The draft GMP guidance sets expectations across the operation. Personnel need the education or hands-on experience to do their jobs without introducing contamination risks, and training records should show that standards are actually maintained. Hygiene protocols keep hair, skin cells, and other particles out of product, and workers with signs of illness or open wounds stay away from direct contact with ingredients or finished batches.

The physical layout should minimize cross-contamination between product lines and raw materials, with adequate space to separate manufacturing stages, proper lighting for visual inspections, ventilation that maintains air quality, and functional plumbing and waste systems. A written sanitation program should specify how often floors, walls, ceilings, and equipment surfaces get cleaned. These structural requirements have legal weight: a cosmetic manufactured under unsanitary conditions where it may have become contaminated with filth or rendered injurious to health is considered adulterated.²

Equipment that touches product or ingredients should be non-reactive and non-absorbent, cleaned on schedule, and calibrated to keep measurements accurate. Raw materials should be inspected and identified on arrival, with supplier certificates of analysis and internal sampling before ingredients reach the production floor. Written standard operating procedures should define every phase of the production cycle for each product, with in-process checks (pH, viscosity, temperature, weight) at key intervals. Microbial contamination testing and stability testing on finished goods verify safety and shelf life, and each batch should stay quarantined until quality control reviews and approves the results.

Small Business Exemption and Its Limits

MoCRA exempts certain small businesses from GMP requirements, facility registration, and product listing. To qualify, a business generally must have average annual gross sales below $1,000,000 over the preceding three-year period.¹

The exemption disappears entirely if the business manufactures or processes any of these higher-risk categories:

Products that regularly contact the mucous membrane of the eye under normal use
Products that are injected
Products intended for internal use
Products intended to alter appearance for more than 24 hours where removal by the consumer is not part of normal use

Even one product in those categories pulls the whole business back into the full regime.¹ And the exemption is partial even when it applies: qualifying small businesses still must comply with adverse event reporting and safety substantiation. The paperwork is lighter. The obligation to make a safe product is not.

1
U.S. Food and Drug Administration. Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
2
Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts
3
Office of the Law Revision Counsel. 21 USC 364b – Good Manufacturing Practice
4
U.S. Food and Drug Administration. Guidance for Industry – Cosmetic Good Manufacturing Practices
5
U.S. Food and Drug Administration. Registration and Listing of Cosmetic Product Facilities and Products
6
U.S. Food and Drug Administration. Deadline for Registration and Listing of Cosmetic Product Facilities and Products
7
Office of the Law Revision Counsel. 21 USC 364d – Safety Substantiation
8
U.S. Food and Drug Administration. Summary of Cosmetics Labeling Requirements
9
eCFR. 21 CFR Part 701 – Cosmetic Labeling
10
U.S. Food and Drug Administration. Serious Adverse Event Reporting for Cosmetic Products
11
Food and Drug Administration. Questions and Answers Regarding Mandatory Cosmetics Recalls – Guidance for Industry
12
U.S. Food and Drug Administration. FDA Records Access Authority for Cosmetics Products
13
U.S. Food and Drug Administration. FDA Records Access Authority for Cosmetic Products – Guidance for Industry
14
Office of the Law Revision Counsel. 21 USC 333 – Penalties