Cosmetic Good Manufacturing Practices (GMP) Requirements

Cosmetic good manufacturing practices requirements are the federal rules that govern how a cosmetic product must be made, handled, documented, and tracked before it can be sold in the United States. They come from the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), which directed the FDA under 21 U.S.C. § 364b to issue binding good manufacturing practice (GMP) regulations for every facility producing cosmetics for U.S. distribution.¹ In practice, that means facility conditions, personnel practices, ingredient controls, production procedures, and recordkeeping all have to meet a standard the FDA can inspect against, and a product made outside that standard is treated as adulterated whether or not it actually harms anyone.²

The statute required the FDA to publish a proposed rule within two years of MoCRA’s enactment and a final rule within three years, putting the final GMP rule’s due date at December 29, 2025. As of early 2026, the FDA has not yet published that final rule. The underlying statutory obligations, however, already carry legal weight, and the agency has signaled through warning letters that it expects strict compliance once the rule takes effect. Section 704 of the FD&C Act separately allows FDA inspectors to enter cosmetic facilities at reasonable times without prior notice.³

Facility Conditions

GMP compliance starts with the physical space. Facilities need enough room to separate equipment, raw materials, and finished products so different product lines don’t contaminate each other. Walls, floors, and ceilings should be built from smooth, easily cleaned surfaces that hold up under regular sanitization. Ventilation and air filtration systems help keep dust and airborne contaminants from settling into open products during production.

Plumbing has to deliver water of adequate quality for manufacturing use, and floor drains need to be designed and maintained so they don’t become reservoirs for bacteria. Pest control programs are expected to keep insects and rodents out of production areas. Documented cleaning schedules for all surfaces and equipment form the baseline proof that a facility is taking sanitation seriously, and regular building maintenance is necessary to catch leaks or structural problems before they compromise a product.

Personnel Practices

Workers need training specific to their roles, covering proper handwashing technique, the correct use of protective clothing like hairnets and gloves, and how to spot potential contamination risks. Employees who are visibly ill or have open wounds should be kept away from exposed products and ingredients. The statute specifically requires the FDA to account for the size and scope of different businesses when setting GMP standards, so smaller operations won’t necessarily face identical requirements to large-scale manufacturers.¹

Raw Material Handling

Every ingredient that enters a facility must be clearly labeled and stored to prevent deterioration, pest exposure, or moisture damage. Incoming shipments go through a testing or verification step to confirm they meet the purity and identity specifications the formula requires. Most facilities quarantine raw materials until the quality department clears them for production, which prevents substandard ingredients from being accidentally used in a batch.

Production Controls

Manufacturing runs on precise batching. Each ingredient is weighed and added according to a validated master formula, and equipment must be calibrated regularly to keep measurements accurate. Cross-contamination between product runs is one of the more common risks in shared-equipment facilities. Standardized cleaning procedures dictate how machinery is broken down and scrubbed between batches, and those procedures are documented to prove they were followed.

Temperature, pressure, and mixing times are monitored throughout production to maintain the chemical stability and physical properties of the finished cosmetic. Water used in manufacturing must meet potability standards to avoid introducing microorganisms or heavy metals. Every step follows a predetermined sequence so batches remain consistent and the final product reliably matches its intended design.

Documentation and the Quality Control Unit

Documentation is the proof that everything described above actually happened. Standard Operating Procedures provide written instructions for every task in the facility, so the work stays consistent regardless of which employee performs it. Batch production records track the history of each lot from the raw materials used through final distribution, and those records are the first thing investigators reach for when something goes wrong.

A dedicated quality control unit, operating independently from production staff, reviews these documents and approves or rejects both materials and finished goods. That independence matters, because letting the same people who made a product decide whether it passes quality checks creates an obvious conflict. Regular internal audits help catch weaknesses before they turn into product failures or unfavorable inspection results.

Safety Substantiation

MoCRA added a duty that didn’t exist under the old voluntary framework: the responsible person for a cosmetic product must ensure there is adequate substantiation of the product’s safety and must maintain records supporting that conclusion.⁴ “Adequate substantiation” means tests, studies, research, analyses, or other evidence sufficient to support a reasonable certainty that the product is safe, and “safe” means not injurious to users under the conditions described on the label or under customary use conditions.

The FDA can consider cumulative exposure to a product or ingredient when evaluating safety, but it cannot deem an ingredient unsafe solely because it causes minor and transient reactions or skin irritation in some users.⁴ Coal-tar hair dyes that comply with 21 U.S.C. § 361(a) are exempt from the substantiation requirement, though their responsible persons must still keep safety-related records. If the FDA asks to see your safety data during an inspection, you need to have it on hand.

Adverse Event Records

Adverse event records sit alongside the GMP paperwork in an inspection. When a responsible person receives a report of a serious adverse event associated with a cosmetic used in the United States, they must submit it to the FDA within 15 business days, including a copy of the label from the product’s retail packaging.⁵ A serious adverse event includes death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability, a congenital anomaly, an infection, or significant disfigurement. If new and material medical information about a previously reported serious adverse event surfaces within one year, that update also has to reach the FDA within 15 business days.

Retention is longer than many companies expect. Responsible persons must keep records related to each adverse event report, not just serious ones, for six years. Qualifying small businesses that don’t manufacture certain higher-risk cosmetic categories can keep those records for three years instead.⁵

What the FDA Can See During an Inspection

MoCRA’s records access authority is broader than many manufacturers realize. During a facility inspection, FDA staff can access adverse event records, safety substantiation data, and facility registration and product listing information.⁶ If the FDA has a reasonable belief that a cosmetic product poses a threat of serious health consequences or death, that authority expands to records related to manufacturing, processing, packing, distribution, receipt, or importation of the affected product.⁷ Refusing to allow access is itself a prohibited act under the FD&C Act and can trigger enforcement. The agency cannot, however, reach recipes, formulas, financial data, pricing data, or most personnel records under this authority.

Separately from GMP, MoCRA requires facilities to register with the FDA and responsible persons to list each marketed product with its ingredients. Those obligations are additional to the GMP requirements, not part of them.

Flexibility for Small Businesses

MoCRA doesn’t apply equally to everyone. A “small business” is a responsible person or facility owner whose average gross annual U.S. cosmetic sales over the previous three years are less than $1,000,000, adjusted for inflation.⁸ Small businesses that qualify can be exempt from facility registration and product listing and get the shorter three-year adverse event record retention period.

The exemption from registration and listing does not apply to a business that manufactures or processes any of the following higher-risk products:

Cosmetics that regularly contact the mucous membrane of the eye under normal use
Cosmetics that are injected
Cosmetics intended for internal use
Cosmetics intended to alter appearance for more than 24 hours where consumer removal is not part of normal use conditions⁸

The GMP statute itself also directs the FDA to provide simplified requirements and potentially longer compliance timelines for smaller businesses, so the final GMP regulations are expected to build in some flexibility for smaller operations.¹

What Non-Compliance Costs

A cosmetic produced under conditions that fail to meet GMP requirements is legally adulterated under 21 U.S.C. § 361, even if the product itself contains no harmful substance.² A product can also be deemed misbranded under 21 U.S.C. § 362 if its labeling is false or misleading, if the package fails to list the manufacturer’s name and address along with an accurate quantity statement, or if required information isn’t displayed prominently enough for an ordinary consumer to notice and understand.⁹

Introducing an adulterated or misbranded cosmetic into interstate commerce is a prohibited act under 21 U.S.C. § 331, as is manufacturing such a product or refusing FDA access to required records.¹⁰ Adulterated products are subject to seizure by federal authorities and can be blocked at the border if offered for import. Where the FDA determines there is a reasonable probability that a cosmetic is adulterated or misbranded and that using or being exposed to it will cause serious health consequences or death, the agency can now order a mandatory recall under 21 U.S.C. § 364g, an authority it did not have before MoCRA.¹¹

Criminal penalties for a first violation include up to one year of imprisonment, a fine of up to $1,000, or both. For a second violation after a prior conviction has become final, or for a violation involving intent to defraud or mislead, the penalties rise to up to three years of imprisonment, a fine of up to $10,000, or both.¹² The FDA can also seek an injunction in federal court to shut down a non-compliant operation entirely.

1
Office of the Law Revision Counsel. 21 USC 364b – Good Manufacturing Practice
2
Office of the Law Revision Counsel. 21 USC 361 – Adulterated Cosmetics
3
U.S. Food and Drug Administration. Inspection of Cosmetics
4
Office of the Law Revision Counsel. 21 USC 364d – Safety Substantiation
5
Office of the Law Revision Counsel. 21 USC 364a – Adverse Events
6
U.S. Food and Drug Administration. FDA Records Access Authority for Cosmetic Products: Guidance for Industry
7
Office of the Law Revision Counsel. 21 USC 364f – Records
8
Food and Drug Administration. Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products
9
Office of the Law Revision Counsel. 21 USC 362 – Misbranded Cosmetics
10
Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts
11
Office of the Law Revision Counsel. 21 USC 364g – Mandatory Recall Authority
12
Office of the Law Revision Counsel. 21 USC 333 – Penalties