MoCRA Compliance in 2026: What Cosmetics Brands Still Get Wrong

6 min read

MoCRA Isn't New Anymore — But the Mistakes Keep Coming

The Modernization of Cosmetics Regulation Act was signed into law in December 2022, giving brands a structured runway to get compliant. Key deadlines have now passed. FDA enforcement posture has sharpened. And yet, when I review the compliance posture of cosmetics and personal care brands — which I do regularly, both in legal advisory contexts and through the AI-driven compliance workflows we've built at HedgeNova — the same gaps appear with remarkable consistency.

This isn't an indictment of the industry. Most of the founders and operators I work with are acting in good faith. But MoCRA introduced a level of regulatory infrastructure that the cosmetics industry simply wasn't used to carrying. Unlike pharmaceuticals or medical devices, cosmetics operated for decades under a light-touch FDA framework. MoCRA changed the rules of the game, and many brands are still playing by the old ones.

Here's what I actually see in the field — and what you need to do about it now, not next quarter.

The Most Persistent Compliance Gaps in 2026

1. Facility Registration Treated as a One-Time Event

MoCRA requires cosmetic product facilities to register with the FDA — but the requirement isn't static. Any time a brand changes co-manufacturers, adds a new co-packer, shifts production overseas, or meaningfully alters its product line, registration records must be updated. Biennial renewal is also mandatory, and brands frequently miss that cycle entirely.

What I see most often: a brand registered correctly in 2023, onboarded a new contract manufacturer in 2024, and never updated the facility record. From a legal exposure standpoint, that's not a technicality — it's a material compliance failure. FDA has the authority to issue mandatory recalls and injunctions under MoCRA, and facility registration status is one of the clearest paper trails regulators will pull first.

2. Adverse Event Reporting With No Actual Process Behind It

MoCRA requires responsible persons to report serious adverse events to the FDA within 15 business days of receiving information about them. That sounds manageable until you realize most smaller brands have no defined intake process for customer complaints, no criteria for distinguishing a "serious" adverse event from general feedback, and no documentation trail showing how they evaluated a complaint that didn't get reported.

The risk here is compounded. It's not just about the event itself — it's about demonstrating to FDA that you had a system, applied it consistently, and made a reasoned determination. If a regulator asks why you didn't report a consumer's complaint about a skin reaction, "we didn't know we had to" is not an acceptable answer in 2026. The law has been in effect. The obligation is known.

The absence of a process is itself the compliance failure — not just the outcome it produces.

3. Safety Substantiation Files That Don't Survive Scrutiny

This is the gap I see most frequently, and it's the one that carries the most long-term risk. MoCRA requires that cosmetic products be safe for their intended use and that safety information be maintained in a substantiation file. What brands actually have, in many cases, is a collection of supplier safety data sheets, a certificate of analysis or two, and marketing copy that has drifted well beyond what the documentation can support.

If your product is labeled "clinically proven," "dermatologist tested," or "hypoallergenic," you need documentation that can withstand a real audit. That means controlled study data, testing protocols, and clear chain of custody for the claims you're making. Marketing teams move fast. Legal and compliance infrastructure frequently doesn't move with them. That gap is where liability lives.

4. Fragrance and Allergen Disclosure Still Catching Brands Off Guard

MoCRA requires disclosure of fragrance allergens on product labels — a meaningful departure from the prior framework where "fragrance" as a blanket ingredient declaration was largely sufficient. Brands manufacturing internationally, or sourcing fragrant raw materials from global suppliers, are particularly exposed here because disclosure standards vary by jurisdiction and internal supply chain documentation is often inconsistent.

I've reviewed labels from sophisticated brands — companies with real revenue and legal counsel — that still carry allergen disclosure gaps because no one audited the formulation records against the new requirements when they went into effect. By 2026, that's not an oversight that regulators or class action plaintiffs' attorneys are likely to treat charitably.

Why AI-Driven Compliance Tooling Is No Longer Optional at Scale

I spent years working through compliance processes manually — in law, on Wall Street, across healthcare and fintech — and I can tell you with confidence that manual tracking doesn't scale once complexity sets in. A cosmetics brand with 40 SKUs, three co-manufacturers, quarterly formulation iterations, and a DTC customer base generating hundreds of complaints per month cannot manage MoCRA compliance on a shared spreadsheet.

This is exactly the problem space we're building into at HedgeNova. The operational reality of MoCRA compliance maps well to AI-driven workflow automation: registration status monitoring with change triggers, safety substantiation tracking by SKU and formulation version, adverse event intake triage with reportability flags, and labeling compliance checks against current FDA guidance. These aren't futuristic capabilities — they're architecturally straightforward when you design compliance as a system rather than a legal opinion delivered once a year.

The brands that are going to win in a post-MoCRA environment are the ones that treat compliance infrastructure the same way they treat inventory management or customer acquisition: as an operational capability that requires ownership, tooling, and continuous improvement.

What You Should Do Right Now

If you're running or advising a cosmetics brand, here's where to start — not as an abstract legal checklist, but as a practical operational reset:

Conduct a registration audit. Pull every facility currently involved in manufacturing, packaging, or labeling your products. Confirm registration status and verify the records match your current supply chain reality. If they don't, update immediately.
Map your adverse event process end-to-end. Who receives a consumer complaint? Who evaluates it for reportability? What's the documentation standard? If you can't answer these questions without hesitation, you don't have a process — you have a liability.
Audit your safety substantiation files against your current claims. Have someone with regulatory knowledge — not just marketing — review each product claim against the underlying documentation. Flag anything that can't be substantiated. Fix it before FDA asks about it.
Review your labeling for allergen compliance. Pull your formulation records and cross-reference them against current FDA allergen disclosure requirements. Pay particular attention to products with fragrance components sourced internationally.
Assign clear ownership. The most dangerous compliance posture I encounter isn't one with known gaps — it's one where no one owns the process at all. Assign a responsible person internally, or ensure your outside counsel or compliance partner has explicit, documented accountability.

The Bottom Line

MoCRA compliance in 2026 is not a new challenge — it's a known obligation that brands have had years to address. The brands still getting it wrong are largely doing so not out of negligence, but out of organizational inertia: compliance was set up once, no one re-examined it, and the operational reality of the business moved faster than the compliance infrastructure supporting it.

That gap closes one of two ways: proactively, through disciplined audit and operational investment, or reactively, through an FDA inspection, a mandatory recall, or plaintiff litigation. In my experience across three decades of regulated industries, the proactive path is always cheaper — in time, money, and reputational capital — than the alternative.

Build the system. Own the process. Don't wait for enforcement to tell you what you already should have known.