MoCRA in 2026: What the FDA's New Cosmetic Rules Mean for Your Shelf

For most of the last century, the FDA’s authority over cosmetics was thin enough to see through. Brands could launch a product, make claims, and sell it — without proving a single thing to any regulatory body first. That era is officially ending.

The Modernization of Cosmetics Regulation Act (MoCRA), signed in December 2022, is the most significant overhaul of U.S. cosmetics law since 1938. The law itself wasn’t the hard part. Implementation is. And 2026 is the year the FDA moves from collecting registrations to actually using them.

If you buy skincare — especially from smaller brands, indie labels, or newer international companies trying to crack the U.S. market — here’s what’s changing and what it means in practice.

What MoCRA Actually Does

MoCRA doesn’t turn cosmetics into drugs. Products without drug claims are still regulated separately from pharmaceuticals, and the FDA still doesn’t require pre-market approval for cosmetics. But the law does four things that matter:

Requires facility registration and product listing with the FDA
Mandates adverse-event reporting for serious health problems
Requires companies to substantiate product safety before selling
Directs the FDA to establish Good Manufacturing Practice (GMP) regulations

Each of these sounds simple. The enforcement details are where things get complicated.

Facility Registration: The Foundation Is Already Built

Cosmetics manufacturers and processors were required to register with the FDA by December 2023 (smaller companies had until July 2024). By now, that phase is largely done — or brands that skipped it are already operating outside compliance.

Registration means the FDA knows where products are made. That’s not trivial. Before MoCRA, a brand could exist entirely as a paper entity with no traceable supply chain. Now there’s a record.

What this means for consumers: The registration database is publicly searchable. If you want to know whether the new serum from a brand you’re not sure about is listed with the FDA, you can check the Voluntary Cosmetic Registration Program database, which is now supplemented by mandatory submissions. Brands that aren’t listed are a yellow flag.

The bigger shift in 2026 is that the FDA is now actively cross-referencing registrations against products in the market. Unregistered facilities are subject to enforcement action — not just a warning letter.

Adverse-Event Reporting: The Part Most People Don’t Know About

This provision is underreported and genuinely useful. Under MoCRA, responsible parties (the company whose name is on the label) must report serious adverse events to the FDA within 15 business days. Serious means hospitalization, significant disfigurement, disability, or death — not a rash or breakout.

Retailers with $1 billion or more in annual sales also have their own reporting obligations if they receive adverse-event reports from consumers.

The FDA has to maintain these records for six years. And for the first time, the agency has clear authority to request the safety records behind a specific product.

What this means for consumers: We now have a mechanism for systemic signal detection. If a specific product generates multiple serious adverse events, the FDA can spot the pattern and act. Before MoCRA, there was no centralized way to connect those dots.

It’s worth being realistic about the limits here. “Serious” is a high bar. Irritation, contact dermatitis, and most allergic reactions won’t trigger a mandatory report. The FDA’s voluntary reporting system — MedWatch — is still the place for those. But the baseline accountability is new.

Safety Substantiation: The Rule With the Most Teeth

This is the provision that will matter most to ingredient-curious readers.

MoCRA requires that cosmetic products be “adequately substantiated for safety” before they go to market. The responsible party must maintain records supporting that claim and provide them to the FDA upon request.

The law doesn’t define exactly what adequate substantiation looks like — and the FDA hasn’t finalized specific guidance on this yet. That ambiguity is intentional in one sense (flexibility) and problematic in another (inconsistency). A large brand with an in-house toxicologist interprets “adequate” very differently than a small indie brand relying on a contract manufacturer’s safety data sheet.

What we do know: the safety assessment must cover all ingredients, including contaminants the FDA identifies as safety concerns. It must account for likely conditions of use — so a product meant to be applied daily to the full face gets more scrutiny than a rinse-off foot scrub.

What this means for consumers: This is a backstop, not a screen. The FDA doesn’t approve the safety dossier before a product hits shelves. But if a product causes harm and the FDA asks for the substantiation record and it doesn’t exist — or is inadequate — that company has a real legal problem. That threat is a real deterrent.

For deeper context on how ingredient safety is actually evaluated (versus how it’s marketed), the piece on how to read skincare ingredient labels is worth your time. And if you’ve ever wondered why “chemical-free” is a claim with no regulatory meaning, that article covers it too.

GMP Rules: Still Pending, Genuinely Important

The FDA was directed by MoCRA to issue Good Manufacturing Practice regulations for cosmetics — and as of this writing, those rules are still in proposed form. The FDA released a proposed GMP rule in late 2023, and finalization has moved slower than the law envisioned.

Once finalized, GMP rules will set minimum standards for:

Facility cleanliness and equipment maintenance
Personnel training
Quality control testing
Batch record documentation
Complaint handling

This matters because cosmetics manufacturing currently operates under informal standards that vary enormously by company size. A large pharmaceutical-adjacent skincare company probably already meets what the FDA will require. A small-batch indie brand making serums in a commercial kitchen may not.

What this means for consumers: Watch for the final GMP rule — it will have a compliance timeline attached, probably with phased deadlines for small businesses. When it’s finalized, it will functionally raise the floor for what a legally compliant cosmetic product requires to produce.

Who Gets Hit Hardest

Not every brand is equally exposed. A few categories face the most friction:

Small and indie brands. The compliance infrastructure MoCRA requires — safety dossiers, adverse-event tracking, registration maintenance — costs time and money. A one-person operation selling through Etsy or a DTC website has the same legal obligations as Estée Lauder. The practical burden is not proportional to size.

International brands entering the U.S. market. If a Korean or European brand is selling in the U.S. through Amazon or a U.S. retailer, MoCRA applies. Many smaller international brands weren’t set up for this. Some have quietly exited the U.S. market rather than deal with the compliance overhead.

Private-label and white-label products. A lot of influencer-brand skincare is manufactured at a contract facility and relabeled. Under MoCRA, the brand whose name is on the label is the responsible party — even if they didn’t formulate or manufacture the product. That’s new liability.

What this means for consumers: If you buy from small indie brands, don’t expect immediate change. Most won’t reformulate or close overnight. But over the next few years, the brands that can’t or won’t maintain compliance will face enforcement pressure. The market will get somewhat more legible.

This connects to a broader pattern worth understanding: the gap between what’s on a label and what’s actually regulated. The piece on why “100/100 on Yuka” isn’t the whole story covers how third-party scoring apps fill a gap that regulation has historically left open. MoCRA is starting to close that gap — but slowly.

What the FDA Can Now Do That It Couldn’t Before

This section is the one brands were most nervous about when MoCRA passed.

Mandatory recalls. Before MoCRA, the FDA could ask a brand to voluntarily recall a product but had no authority to order it. Now it does. If a product is adulterated or misbranded and poses a risk of serious adverse health consequences, the FDA can mandate a recall. This authority existed for food and drugs. Cosmetics now join that list.

Access to safety records. The FDA can now formally request a company’s safety substantiation records and must receive them. Previously, getting this information required litigation or a voluntary disclosure.

Facility inspections. MoCRA expanded the FDA’s ability to inspect cosmetics facilities — domestic and foreign. For U.S. facilities, the FDA can inspect during reasonable times without advance notice.

The enforcement picture is still taking shape. The FDA’s Office of Cosmetics and Colors is a relatively small operation relative to the scope of what it’s now responsible for. Prioritization will matter. Expect the FDA to focus on products with a track record of complaints, products making drug-adjacent claims, and brands that simply haven’t registered.

The Fragrance and Flavor Loophole: Still There, Partially

One thing MoCRA did not fully fix: fragrance and flavor ingredient disclosure. Cosmetics companies still aren’t required to list individual fragrance components on the label — fragrance can remain listed as a single ingredient. This is particularly relevant for contact allergens.

MoCRA did require the FDA to study fragrance allergen disclosure and make recommendations. That study is underway. A future rulemaking could change this, but it hasn’t happened yet.

If you’re navigating fragrance sensitivity, the practical situation hasn’t changed: look for “fragrance-free” claims on products and treat “unscented” (which can still contain masking fragrances) with more skepticism. The guide on damaged skin barrier repair covers fragrance in the context of reactive skin.

Putting It All Together

MoCRA is real regulatory change, not window dressing. But it’s being implemented incrementally, and the gap between the law on paper and consistent enforcement in practice is still large.

Here’s the short version of what’s actually different in 2026:

Facility registration and product listing are now mandatory and being actively cross-checked. Brands that skipped this are legally exposed.
Adverse-event reporting for serious harms is required within 15 days. This gives the FDA a signal system it didn’t have before.
Safety substantiation must exist before a product is sold. The FDA can demand it. Brands without documentation face meaningful legal risk.
GMP rules are still pending finalization — watch for a final rule and its compliance timeline.
Mandatory recall authority is real. The FDA can now force a recall, not just request one.

For shoppers, the practical advice is simple: MoCRA doesn’t mean every product on the shelf is now certified safe. It means companies that cut corners have more exposure than they used to. The brands most likely to benefit from the scrutiny are those already doing the work — the ones who had safety dossiers before the law required them.

That’s most of the major players. It’s not all of the small ones. And the difference, over the next few years, will probably start to show.