LAW: Cosmetics Manufacturing and Safety Regulation
Toxicology sits at the intersection of cosmetics science and regulatory compliance. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) imposed the first substantial update to US cosmetics regulation in decades, introducing new requirements for facility registration, product listing, safety substantiation, and adverse event reporting. For cosmetics manufacturers, understanding the toxicological principles that underpin safety assessment and the regulatory framework that governs how safety must be demonstrated is foundational to MoCRA compliance.
2022
MoCRA: First Major US Cosmetics Law Update in 85 Years
The Modernization of Cosmetics Regulation Act of 2022 was the first substantial federal update to cosmetics regulation since the Federal Food, Drug, and Cosmetic Act was enacted in 1938. MoCRA added facility registration, product listing, safety substantiation, Good Manufacturing Practice requirements, and adverse event reporting obligations for cosmetics manufacturers.
FDA, MoCRA Overview
NOAEL
No Observed Adverse Effect Level: Core Safety Assessment Concept
The No Observed Adverse Effect Level (NOAEL) is the foundation of quantitative risk assessment for cosmetic ingredients. It represents the highest tested dose at which no adverse effect was observed in a study, and is used to calculate a Margin of Safety or Acceptable Daily Intake for ingredient safety determination.
FDA, Cosmetic Ingredient Safety
SCCS
EU Reference Standard for Cosmetic Safety Assessment
The Scientific Committee on Consumer Safety (SCCS) Notes of Guidance for the Testing of Cosmetic Ingredients and their Safety Evaluation (SCCS/1641/22) is the globally recognised reference standard for cosmetic ingredient safety assessment, widely referenced in US safety substantiation even though its primary mandate is EU Cosmetics Regulation compliance.
EU SCCS, Notes of Guidance
Why Toxicology Is Now a Legal Requirement in US Cosmetics
Before MoCRA, US cosmetics manufacturers operated under a largely self-regulatory framework for safety. The FD&C Act required that cosmetics not be adulterated or misbranded, but it did not require pre-market safety testing, facility registration, or documented safety substantiation. MoCRA fundamentally changed this by requiring that cosmetic products have adequate substantiation of safety, which must be based on the relevant safety assessment methodology appropriate for the type of product.
For most cosmetics, adequate safety substantiation is grounded in toxicology: the scientific discipline that studies the adverse effects of chemicals on biological systems and quantifies the dose-response relationship that determines whether a given exposure is safe. This guide explains the toxicological concepts cosmetics manufacturers need to understand, the MoCRA framework that governs how safety must be substantiated, and how EU and US requirements interact for manufacturers operating in multiple markets.
Key Toxicology and Regulatory Concepts for Cosmetics Compliance
Dose Makes the Poison (Paracelsus Principle)
Every substance is toxic at sufficient dose; the question is always whether the exposure level associated with product use is below the threshold of adverse effect. Cosmetics safety assessment quantifies this relationship through the Margin of Safety calculation.
Systemic Exposure Is the Safety Assessment Target
For most cosmetic ingredients, the safety-relevant question is not what concentration is applied to the skin but what systemic exposure results from that application. Dermal absorption, inhalation (for sprays and powders), and oral ingestion (for lip products) determine the systemic dose that must be compared to the NOAEL.
MoCRA Requires Documented Safety Substantiation
MoCRA’s safety substantiation requirement means manufacturers must maintain documented evidence that each product is safe under reasonably foreseeable conditions of use. Vague statements that the product uses “safe ingredients” are not adequate substantiation. A structured safety assessment is required.
1. Core Toxicology Concepts for Cosmetics Safety Assessment
Cosmetics safety assessment applies the quantitative methods of toxicology to determine whether ingredient concentrations in finished products create unacceptable systemic or local exposure. The following concepts form the scientific foundation of every cosmetics safety assessment.
Margin of Safety (MoS)
The Margin of Safety is calculated by dividing the NOAEL (from toxicological studies) by the Systemic Exposure Dose (SED, derived from the product usage pattern, ingredient concentration, and dermal absorption data). An MoS of 100 or greater is generally considered acceptable for most cosmetic ingredients. The MoS is the single most important number in a cosmetics safety assessment and the primary metric regulatory assessors evaluate.
Formula: MoS = NOAEL (mg/kg bw/day) / SED (mg/kg bw/day)
Systemic Exposure Dose (SED)
The Systemic Exposure Dose represents the amount of an ingredient that reaches systemic circulation per unit body weight per day, accounting for the product’s usage pattern (how much is applied, how often, to what body surface area), the ingredient’s concentration in the product, and its dermal absorption rate. Accurate SED calculation requires validated dermal absorption data or the use of default assumptions where data are absent, with conservative assumptions applied when data are limited.
Formula: SED = DA (g/day) x Conc (%) x Abs (%) / BW (kg)
NOAEL and LOAEL
The No Observed Adverse Effect Level (NOAEL) is the highest dose in a study at which no adverse effects are observed. The Lowest Observed Adverse Effect Level (LOAEL) is the lowest dose at which adverse effects are observed. When only a LOAEL is available, an additional uncertainty factor is applied before calculating the MoS. NOAEL data from repeated-dose toxicity studies in the most relevant animal species, or from human epidemiological data where available, form the basis of the safety assessment denominator.
Local Tolerability Assessment
In addition to systemic safety, cosmetics safety assessments must address local tolerability: the potential for skin irritation, sensitisation, phototoxicity, photosensitisation, and eye irritation from product contact. Local tolerability is evaluated through in vitro test methods validated by OECD (such as OECD TG 439 for skin irritation) or through human repeat insult patch test (HRIPT) data, particularly for sensitisation risk characterisation in finished products.
2. MoCRA: The New US Legal Framework for Cosmetics Safety
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA), signed into law on December 29, 2022, created new legal obligations for cosmetics manufacturers that did not exist under the prior FD&C Act framework.
FDA, MoCRA Requirements and Implementation
3. EU Cosmetics Regulation and the SCCS Framework
The European Union’s Cosmetics Regulation (EC No 1223/2009) requires a formal Product Safety Report (PSR) for every cosmetic product placed on the EU market, and that PSR must include a Cosmetic Product Safety Assessment completed by a qualified safety assessor. The assessment methodology is governed by the SCCS Notes of Guidance (most recently SCCS/1641/22), which describes the framework for ingredient toxicological profiling, hazard assessment, exposure assessment, risk characterisation, and local tolerability evaluation.
Part A: Cosmetic Product Safety Information
Part A of the EU Product Safety Report requires: quantitative composition of the product; physical and chemical specifications of ingredients and the finished product; microbiological quality; impurity levels; packaging specifications; normal and reasonably foreseeable use description; exposure assessment; ingredient toxicological profiles; and undesirable effects data. The toxicological profile for each ingredient must address all relevant endpoints including acute toxicity, repeated-dose toxicity, reproductive toxicity, sensitisation, genotoxicity, phototoxicity, and human data.
SCCS Notes of Guidance (SCCS/1641/22)
Part B: Cosmetic Product Safety Assessment
Part B must be signed by a qualified safety assessor and includes: the safety conclusion for each ingredient and the finished product; warnings and conditions of use; scientific reasoning behind the assessment; the assessor’s qualifications and a declaration of responsibility. The safety assessor must be qualified in pharmacology, toxicology, dermatology, medicine, or a related discipline. A cosmetics formulator or chemist without specific safety assessment qualifications cannot sign off a Part B under EU requirements.
EU Cosmetics Regulation EC 1223/2009, Annex I
4. The Safety Assessor’s Role and Qualifications
Under both EU Cosmetics Regulation and the emerging MoCRA safety substantiation framework, the safety assessment is not a document that the quality or regulatory department produces independently. It requires the involvement of a qualified safety assessor who can interpret toxicological data, apply risk characterisation methodology, and take professional responsibility for the safety conclusions.
- EU requirement: The EU Cosmetics Regulation requires that the safety assessor hold a diploma or evidence of formal qualifications in pharmacy, toxicology, medicine, dermatology, or an equivalent discipline as awarded by an EU member state or a country with equivalent educational standards. This is a formal professional qualification requirement, not simply experience in the field.
- US requirement under MoCRA: MoCRA does not specify safety assessor qualifications with the same precision as the EU regulation. However, because MoCRA requires safety substantiation to be “adequate,” FDA guidance and industry practice indicate that safety assessment methodology consistent with the SCCS framework, conducted by a qualified toxicologist or safety assessor, represents the expected standard.
- Contract safety assessor engagement: Most small to mid-size cosmetics companies do not employ a qualified safety assessor in-house. Engaging a contract safety assessor or a contract research organisation with cosmetics safety assessment capability is both common and acceptable, provided the assessor’s qualifications are verified and documented in the safety file.
5. Prohibited and Restricted Ingredients: The Regulatory Constraint on Formulation
Toxicology underpins the regulatory decisions that determine which ingredients may be used in cosmetics, at what concentrations, and with what labelling requirements. Both the US and EU maintain lists of prohibited or restricted cosmetic ingredients that represent the regulatory output of historical toxicological assessments.
US: FDA Prohibited/Restricted Ingredients
The US maintains a relatively short list of cosmetic ingredient prohibitions under the FD&C Act: chlorofluorocarbons (propellants), vinyl chloride (aerosols), and certain colour additives not approved under 21 CFR Parts 73 and 74. MoCRA authorised FDA to issue additional ingredient safety rules. In practice, the FDA cosmetics prohibited list is far shorter than the EU list, reflecting historically different regulatory approaches.
FDA, Authority Over Cosmetics
EU: Annexes to EC 1223/2009
The EU Cosmetics Regulation contains extensive annexes listing prohibited substances (Annex II: over 1,300 substances), restricted substances with specified maximum concentrations and conditions of use (Annex III), approved UV filters (Annex VI), approved preservatives (Annex V), and approved colorants (Annex IV). EU formulation compliance requires verification against all applicable annexes before finalising a formulation intended for the EU market.
EU Cosmetics Regulation Annex II (Prohibited Substances)
Key Takeaways
MoCRA Created the First US Cosmetics Safety Substantiation Requirement
Before MoCRA, US cosmetics manufacturers were not required to document safety substantiation. MoCRA changed this, requiring that all cosmetics marketed in the US have adequate substantiation of safety. Products without documented substantiation are deemed adulterated under MoCRA.
Margin of Safety Is the Core Safety Assessment Metric
The Margin of Safety (NOAEL divided by the Systemic Exposure Dose) is the primary quantitative output of a cosmetics ingredient safety assessment. An MoS of 100 or greater is generally required for most cosmetic ingredients. Ingredients with an MoS below 100 require additional justification or reformulation.
EU Requirements Are More Prescriptive Than US Requirements
The EU Cosmetics Regulation requires a formal Product Safety Report, a qualified safety assessor signature, extensive ingredient toxicological profiling, and compliance with detailed ingredient annexes. MoCRA’s safety substantiation requirement is less prescriptive about methodology, but the SCCS framework is the recognised industry standard for demonstrating adequacy.
Adverse Event Reporting Is Now a US Legal Obligation Under MoCRA
MoCRA requires responsible persons to report serious adverse events to FDA within 15 business days. This is a new obligation with no direct parallel in pre-MoCRA law. Manufacturers must establish adverse event receiving, triage, and reporting systems to comply.
Safety Assessors Must Be Qualified
Both EU and US frameworks expect that cosmetic product safety assessments are conducted by individuals with relevant professional qualifications in toxicology, pharmacology, medicine, or related disciplines. Cosmetics safety assessment is a professional service, not an administrative function.
EU and US Markets Require Separate Compliance but Share a Common Science Base
A cosmetics manufacturer operating in both markets cannot use a single safety file for both jurisdictions, as EU and US requirements differ in specificity, format, and assessor qualification. However, the underlying toxicological science is shared: NOAEL-based risk characterisation, dermal absorption methodology, and local tolerability assessment are common to both frameworks.
Frequently Asked Questions
What is MoCRA and who does it apply to?
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is the first major update to US cosmetics regulation since 1938. It applies to facilities that manufacture or process cosmetics marketed in the United States, including foreign facilities. Key obligations include facility registration, product listing, safety substantiation of all marketed cosmetics, adverse event reporting, and compliance with FDA Good Manufacturing Practice regulations. Responsible persons (typically the US manufacturer, distributor, or importer whose name appears on the product label) bear the primary compliance obligations.
What constitutes “adequate substantiation of safety” under MoCRA?
MoCRA states that a cosmetic is adulterated if its safety has not been adequately substantiated. FDA has not yet issued final guidance specifying exactly what adequate substantiation requires methodologically, but the agency has indicated that safety substantiation should be based on the relevant safety assessment methodology, which for most products means a risk-based assessment using toxicological data for each ingredient. Industry practice, informed by the EU SCCS framework, typically includes a safety assessment file covering ingredient toxicological profiles, product exposure analysis, Margin of Safety calculations, and local tolerability data.
What is dermal absorption and why does it matter for cosmetics safety?
Dermal absorption is the rate and extent to which a cosmetic ingredient penetrates the skin barrier and enters systemic circulation. It is a critical parameter in the Systemic Exposure Dose calculation because even high concentrations of an ingredient applied to the skin may result in very low systemic exposure if dermal absorption is poor. Conversely, a low concentration of a highly absorbed ingredient may produce significant systemic exposure. Dermal absorption data should ideally come from in vitro or in vivo studies using validated OECD test methods; default absorption values (typically 50% or 100%) are applied conservatively when no data are available.
What is a “serious adverse event” that must be reported to FDA under MoCRA?
Under MoCRA, a serious adverse event is an adverse event that results in: death; a life-threatening experience; inpatient hospitalisation; a persistent or significant disability or incapacity; a congenital anomaly or birth defect; or that requires, based on a reasonable medical judgment, a medical or surgical intervention to prevent one of the preceding outcomes. Responsible persons must report serious adverse events to FDA within 15 business days of receiving information about the event. Manufacturers should establish systems for receiving, triaging, and documenting consumer and healthcare professional reports to ensure timely identification and reporting of qualifying events.
How does the EU Cosmetics Regulation differ from US MoCRA?
The EU Cosmetics Regulation (EC No 1223/2009) is considerably more prescriptive than MoCRA. Key differences: EU requires a formal Product Safety Report with a qualified safety assessor signature; US MoCRA requires adequate substantiation without specifying the format or assessor qualification. EU contains over 1,300 prohibited substances in Annex II; US prohibitions are much narrower. EU requires a Responsible Person established in the EU and product notification to the EU Cosmetics Product Notification Portal (CPNP); US requires facility registration and product listing with FDA. Both frameworks require safety substantiation and Good Manufacturing Practice compliance, but the EU standard is more detailed and more prescriptive.
What is ISO 22716 and how does it relate to cosmetics GMP?
ISO 22716:2007 (Cosmetics: Good Manufacturing Practices) is the internationally recognised GMP standard for cosmetics manufacturing. It covers personnel, premises, equipment, raw materials, production, finished products, quality control, waste management, outsourcing, auditing, and documentation. ISO 22716 compliance is required for EU Cosmetics Regulation compliance and is the anticipated basis for FDA’s MoCRA GMP regulations, which FDA is required to develop. Cosmetics manufacturers preparing for both US and EU market compliance should align their quality management systems with ISO 22716, as it represents the common foundation for both regulatory frameworks.
Can a cosmetic product also be regulated as a drug?
Yes. Products intended to affect the structure or function of the body, treat or prevent a disease, or that are marketed with drug claims may be regulated as both cosmetics and drugs, or as drugs only, under the FD&C Act. This “cosmetic-drug interface” applies to products such as sunscreens, fluoride toothpastes, anti-dandruff shampoos, antiperspirants, and skin protectants. Products at the cosmetic-drug interface must comply with both cosmetics and drug regulatory requirements, including applicable Over-the-Counter (OTC) drug monographs or New Drug Application (NDA) requirements. Manufacturers must carefully review their product claims to determine the applicable regulatory pathway.
Government and Regulatory Sources
Government and Regulatory Sources
- FDA. Modernization of Cosmetics Regulation Act of 2022 (MoCRA): requirements overview, implementation timeline, and FDA guidance on facility registration, product listing, and safety substantiation.
- FDA. Cosmetic Ingredient Safety: how FDA evaluates cosmetic ingredient safety and the regulatory framework for ingredient restrictions.
- EU SCCS. Notes of Guidance for the Testing of Cosmetic Ingredients (SCCS/1641/22): the authoritative framework for cosmetic product safety assessment methodology.
- EU Cosmetics Regulation EC No 1223/2009: full regulation text including Annexes II through VI on prohibited and restricted ingredients.
- ISO 22716:2007. Cosmetics: Good Manufacturing Practices: the international GMP standard for cosmetics manufacturing, aligned with EU and anticipated US MoCRA GMP requirements.
Related VelSafe Articles
Related VelSafe Articles
VelSafe Cosmetics Compliance Law
MoCRA Changed the Rules. Safety Substantiation Is Now a Legal Requirement, Not a Best Practice.
Cosmetics manufacturers marketing in the US are now subject to facility registration, product listing, adverse event reporting, and documented safety substantiation requirements that did not exist before MoCRA. Understanding the toxicological framework that underpins safety assessment is the first step to compliance. VelSafe covers cosmetics regulation, MoCRA implementation, and EU-US comparative compliance for cosmetics and personal care manufacturers.
Browse Regulatory Law Articles
