MoCRA wrote safety substantiation into the statute. Section 608 of the Federal Food, Drug, and Cosmetic Act (FD&C Act) requires the responsible person for a cosmetic product to ensure, and maintain records supporting, that there is adequate substantiation of safety for that product. The records are not filed with FDA, and FDA does not approve cosmetics or their ingredients, other than color additives, before marketing, so a weak file may go unnoticed until an inspection, an adverse event investigation or a recall. For which MoCRA requirements are already in force, see MoCRA at the end of 2026.
Who carries the duty
Section 604 defines the responsible person as the manufacturer, packer or distributor whose name appears on the label. If a foreign brand's name is on the label, the brand holds the duty, even when a contract manufacturer makes the product and a US company imports it.
Gaps have legal consequences. Since December 29, 2023, section 601(g) has deemed a cosmetic product adulterated if the product, including each ingredient, lacks adequate substantiation for safety. Introducing an adulterated cosmetic into interstate commerce is a prohibited act under section 301(a), and an imported cosmetic that appears adulterated is subject to refusal of admission under section 801(a).
What ‘adequate substantiation of safety’ means
Section 608(c) defines it as tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe. Safe means not injurious to users under labeled or customary conditions of use, and FDA may not consider a product injurious solely because it can cause minor and transient reactions or skin irritations in some users.
FDA states that neither the law nor its regulations require specific tests, that relevant existing safety data can be used, and that animal testing is not a requirement for marketing a cosmetic, while all supporting data should come from scientifically robust methods. In an October 2026 Paperwork Reduction Act notice, FDA added that responsible persons have discretion in determining which records satisfy section 608(a).
What can go into the file
FDA's product testing page points to these building blocks:
- safety data from ingredient suppliers;
- published scientific literature on the ingredients and on products with similar formulations;
- Cosmetic Ingredient Review (CIR) assessments, which FDA takes into consideration but may disagree with (see how the CIR panel evaluates cosmetic ingredient safety);
- toxicological or other testing to fill gaps in the available information;
- microbiological evidence: cosmetics need not be sterile, but they must not contain harmful microorganisms, and aerobic microorganism counts per gram must be low.
FDA notes that testing may be needed for each ingredient and for the finished product, so a usable file links ingredient data to concentration, product type, area of application and intended users, with the expert reasoning written down. FDA also cautions that ‘natural’ or ‘organic’ sourcing is no guarantee of safety.
Limits and exceptions
- Coal-tar hair dyes that meet the caution statement and patch-test conditions of section 601(a) are outside section 608(a), but the responsible person must still keep records related to their safety (section 608(b)).
- Cosmetics that are also subject to drug or device requirements are exempt from section 608 under section 613; see cosmetic or drug: why FDA classification matters.
- The small business exemption in section 612 covers only good manufacturing practice and registration and listing, not safety substantiation; see who qualifies for the MoCRA small business exemption.
- Warning statements: under 21 CFR 740.10, a 1975 regulation, an unsubstantiated cosmetic is misbranded unless its principal display panel states ‘Warning—The safety of this product has not been determined.’ Section 601(g) contains no exception for products that carry that warning.
Where substantiation meets the other MoCRA duties
- Product listing: listings include the product's ingredients, including fragrances, flavors and colors (section 607(c)(4)), and should describe the same formula as the safety file.
- Adverse events: serious events must be reported within 15 business days and records kept for six years, or three for qualifying small businesses (section 605); new reports should inform the safety assessment. See MoCRA adverse event reporting for foreign cosmetic brands.
- Fragrances and flavors: if FDA has reasonable grounds to believe fragrance or flavor ingredients caused or contributed to a reportable serious adverse event, it may request in writing a list of those ingredients or their categories, due within 30 days (section 605(f)). Confirm that your fragrance supplier can provide it.
- Records access: section 610 excludes recipes and formulas but not safety substantiation data, and FDA's January 2026 draft guidance lists safety substantiation records among the records FDA may access and copy; see FDA records access and mandatory recalls under MoCRA.
Keeping the file usable
- Keep one file per formulation, linked to the US product name and listing number, with the US formula and data for each ingredient at its use level.
- Date the expert assessment and review it after changes to the formula, suppliers, manufacturer or intended use, and after new adverse event reports.
- Where data sit with a contract manufacturer, formulator or fragrance supplier, agree in writing that the responsible person can obtain them.
How FDABridge helps
FDABridge handles the filings and records next to the safety file: product listings with product name, category and ingredient list, including review of changes for annual updates (cosmetic product listing); facility registration for covered manufacturers and processors (cosmetic facility registration); and adverse event intake, seriousness assessment, MedWatch Form 3500A filings and six-year record retention (adverse event management). Label review checks ingredient declarations, warnings, net quantity, the responsible person's name and address and restricted substances (cosmetic label review). As that page states, it does not include a safety assessment of ingredients, which remains the responsible person's responsibility. Registration and listing are not FDA approval.
Sources: 21 U.S.C. 361 to 364i, FD&C Act sections 601 to 613 (https://www.govinfo.gov/content/pkg/USCODE-2024-title21/html/USCODE-2024-title21-chap9-subchapVI.htm); 21 U.S.C. 331 and 381, sections 301 and 801 (https://www.govinfo.gov/content/pkg/USCODE-2024-title21/html/USCODE-2024-title21-chap9-subchapIII.htm, https://www.govinfo.gov/content/pkg/USCODE-2024-title21/html/USCODE-2024-title21-chap9-subchapVIII.htm); 21 CFR 740.10 (https://www.ecfr.gov/current/title-21/chapter-I/subchapter-G/part-740/subpart-B/section-740.10); FDA, MoCRA (https://www.fda.gov/cosmetics/cosmetics-laws-regulations/modernization-cosmetics-regulation-act-2022-mocra); FDA, Product Testing of Cosmetics (https://www.fda.gov/cosmetics/cosmetics-science-research/product-testing-cosmetics); 91 FR 65219, October 14, 2026 (https://www.federalregister.gov/documents/2026/10/14/2026-20990/agency-information-collection-activities-submission-for-office-of-management-and-budget-review); FDA, draft guidance on records access, January 2026 (https://www.fda.gov/regulatory-information/search-fda-guidance-documents/fda-records-access-authority-cosmetic-products).