The revolution of cosmetics regulation in the US

December 2023 | EXPERT BRIEFING | SECTOR ANALYSIS

financierworldwide.com

The 29 December 2023 will mark the one-year anniversary since the US began to revolutionise how cosmetic products are regulated by the US Food and Drug Administration (FDA). The Modernization of Cosmetics Regulation Act (MoCRA) significantly expands the FDA’s authority to regulate cosmetics for the first time since the 1938 enactment of the Federal Food, Drug, and Cosmetic Act (FDCA). As 29 December approaches, so too does the first wave of new requirements take effect for ‘responsible persons’ and ‘facilities’ throughout the cosmetics industry.

The first set of requirements to go into effect under MoCRA’s terms concern facility registration and product listing, substantiation of safety and adverse event reporting. Requirements pertaining to product labelling and good manufacturing practices will begin to phase in after two or three years, respectively. Taken together, these requirements will provide assurance of the safety of cosmetic products on the US market.

The FDA has signalled to responsible persons and facilities that they should be prepared to comply with MoCRA’s provisions by the assigned dates unless they qualify for an exemption. Responsible persons and facilities that fail to comply with any of MoCRA’s requirements will be in violation of the adulteration or misbranding provisions of (or another separate prohibited act under) the FDCA.

While the new requirements bring the US and European Union (EU) regulation of cosmetics closer, they do not squarely align with the EU Cosmetics Regulation. Key differences remain, such as the obligation to hold a product information file for each cosmetic product, and the prohibition of and restrictions on certain ingredients. Yet, compliance with EU cosmetic law could ease a manufacturer’s transition toward MoCRA’s requirements.

Responsible persons and facilities

MoCRA applies to ‘responsible persons’ and ‘facilities’. ‘Responsible persons’ are the manufacturers, packers and distributors of cosmetic products whose name appear on the product label. By comparison, ‘facilities’ are the establishments that manufacture, process or import cosmetic products distributed in the US. Identifying the responsible persons and facilities is key to determining the applicable regulatory obligations.

Facility registration and product listing

Each manufacturing facility for cosmetic products must maintain a valid facility registration with the FDA. If a facility was in operation on 29 December 2022, then it must register with the FDA by 29 December 2023. Other facilities must register within 60 days of first engaging in the manufacturing or processing of a cosmetic product for distribution in the US or by 27 February 2024 (whichever is later.) Facilities must renew their registrations every two years.

Responsible persons must maintain and annually update their cosmetic product listings with the FDA. These listings must identify each product’s name, type, ingredients (including fragrances, flavours or colours), and the facility where the product was manufactured or processed. A responsible person must submit its product listing for currently marketed products by 29 December 2023, and for any new cosmetic product within 120 days of marketing such product.

The FDA has published draft guidance describing instructions and recommendations for submitting facility registrations and product listings.

The EU does not impose a facility registration requirement – some EU countries do at the national level (e.g., France) – but requires a similar product listing in the form of the Cosmetic Products Notification Portal (CPNP). The CPNP is an online platform to which the responsible person must submit certain information about a cosmetic product before placing it on the EU market.

Adequate substantiation of safety

Responsible persons must ensure that their cosmetic products are safe (i.e., are not injurious when used in accordance with the labelling or customary use) and maintain records to adequately substantiate product safety. These records may include tests, studies, research, analyses or other data considered by experts qualified by scientific training and experience.

This part of MoCRA is very different from the EU Cosmetics Regulation, which requires the responsible person to maintain a product information file (PIF) for each cosmetic product placed on the EU market containing technical documentation (e.g., a product safety report, description of the manufacturing process and evidence of efficacy claims).

Labelling

The FDA already requires the label of cosmetic products to bear a listing of ingredients, statement of identity (e.g., the common name or an appropriate descriptive name of the cosmetic), net quantity of content, and the name and place of business of the manufacturer, packer or distributor. MoCRA expands this list by requiring products to be labelled with the responsible person’s contact information, any fragrance allergens in the cosmetic product, and, if the product is intended for ‘professional use’ by a licensed professional cosmetologist, nail technician, barber or esthetician, a clear and prominent statement that the product must be administered or used only by licensed professionals. The labelling requirements will take effect on 29 December 2024.

Of note, the mandatory labelling information differs from the EU mandatory labelling information. In particular, the labelling of allergens is still under discussion in the EU due to the number of allergens and the practical difficulties with providing such information on the packaging.

Adverse event reporting and record-keeping

Responsible persons must receive, maintain and allow the FDA to inspect records relating to adverse events associated with the use of their cosmetic products in the US. Moreover, responsible persons must report to the FDA any known serious adverse event in connection with the use of their products within 15 business days of receiving such information. A serious adverse event is one that results in death, a life-threatening experience, hospitalisation, a significant disability or incapacity, a congenital anomaly or birth defect, an infection, significant disfigurement or medical or surgical intervention to prevent such outcomes. The responsible person must also supplement its initial report with any new and material medical information that it receives within one year after filing the initial report.

Contrary to the EU, under MoCRA’s terms responsible persons are not expressly required to set up a vigilance system to enable reporting of adverse events.

Good manufacturing practices

Manufacturing facilities will need to comply with good manufacturing practice (GMP) standards in the manufacture of their cosmetic products. The FDA must propose GMP regulations by 29 December 2024 and finalise those rules by 29 December 2025.

The FDA may issue GMP regulations that align with ISO 22716, the international standard for cosmetics GMPs. Indeed, the FDA has previously recommended that manufacturers adopt requirements of ISO 22716 in guidance, industry has voluntarily adopted compliance with ISO 22716, the FDA recognises the importance of international harmonisation of regulatory requirements, and Congress directed the FDA to develop GMPs that are consistent with international standards. If the FDA does, facilities will be able to commercialise their products in other markets where ISO 22716 applies (assuming they meet all other applicable requirements).

Suspensions and mandatory recalls

Beyond all the new requirements for industry, MoCRA grants the FDA new powers to suspend facilities and order mandatory recalls of cosmetics products. The FDA can suspend a facility registration if it determines that the facility manufactures or processes a cosmetic product for distribution in the US that has a reasonable probability of causing serious adverse health consequences or death, and it has a reasonable belief that other products manufactured or processed by the facility could be similarly affected because the failure is not isolated or sufficiently pervasive. A facility with a suspended registration cannot put any cosmetic products into US commerce until it corrects the violative conditions, and the FDA vacates the suspension and reinstates the registration.

The FDA can also order a responsible person to cease distribution or recall a cosmetic product. The FDA may mandate a recall if it determines there is a reasonable probability the cosmetic product is adulterated or misbranded and the use of or exposure to such product will cause serious adverse health consequences or death, and when given the opportunity the responsible person refuses to voluntarily recall or cease distribution of such product by the time and manner prescribed by the FDA (if any). The FDA will notify the public that it has initiated a mandatory recall and can also order the responsible person to notify the public and affected persons (including persons who manufacture, distribute, import or offer for sale the product).

Preemption and prohibited ingredients

MoCRA expressly preempts states from establishing or continuing in effect any law or regulation that “is different from or in addition to, or otherwise not identical with” any MOCRA requirement with respect to “registration and product listing, good manufacturing practice, records, recalls, adverse event reporting, or safety substantiation”. However, states may regulate cosmetic ingredients (including prohibiting the use of or limiting quantities of ingredients) and require reporting of certain cosmetic ingredients.

The FDA generally prohibits a cosmetic product from containing any ingredients that make the product harmful when used as directed or in the customary or expected way. The FDA otherwise expressly restricts or prohibits a handful of cosmetic ingredients (e.g., colour additives, bithionol, mercury compounds, vinyl chloride, halogenated salicylanilides, zirconium complexes in aerosol cosmetics, chloroform, methylene chloride, chlorofluorocarbon propellants and hexachlorophene). The EU, on the other hand, prohibits or restricts more than 1300 ingredients at the EU level.

Jessica Ringel and Geneviève Michaux are partners and Jonathan Trinh is an associate at King & Spalding. Ms Ringel can be contacted on +1 (202) 626 9259 or by email: jringel@kslaw.com. Ms Michaux can be contacted on +32 2 898 0202 or by email: gmichaux@kslaw.com. Mr Trinh can be contacted on +1 (202) 626 8994 or by email: jtrinh@kslaw.com.

Jessica Ringel, Geneviève Michaux and Jonathan Trinh

King & Spalding