After MoCRA: The FDA Compliance Gaps European Cosmetics Exporters Cannot Afford to Miss

European cosmetics companies have spent years mastering EU Regulation 1223/2009. The Product Information File is meticulous. The CPSR is signed by a qualified safety assessor. Every label follows Annex requirements to the letter. And then someone decides to expand into the United States — and discovers that none of that documentation transfers cleanly across the Atlantic.

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) — signed into law on December 29, 2022 as part of the US Consolidated Appropriations Act — fundamentally rewrote the FDA’s authority over cosmetics. For European brands watching from a distance, it may have looked like the US was simply catching up to EU standards. In practice, MoCRA created a parallel compliance framework with its own logic, its own deadlines, and its own failure modes that EU-trained regulatory teams regularly stumble into.

This isn’t a matter of one system being more stringent than the other. It’s a matter of two systems with different structures, different assumptions about what constitutes safety evidence, and different enforcement mechanisms. Getting EU compliance right doesn’t make US compliance easier unless you understand exactly where the frameworks diverge — and why.

What MoCRA Actually Changed for Foreign Manufacturers

Before MoCRA, the FDA’s authority over cosmetics was remarkably thin — essentially unchanged since the Federal Food, Drug, and Cosmetic Act of 1938. The agency couldn’t inspect cosmetics facilities without consent, couldn’t mandate recalls, and had no systematic visibility into what products were being sold under its jurisdiction. European brands with no physical US presence often assumed they weren’t subject to meaningful FDA oversight.

That assumption is no longer viable.

MoCRA applies to any facility that manufactures or processes cosmetics distributed in the United States — regardless of where that facility is located. A French skincare manufacturer shipping finished goods to a US distributor now has direct obligations to FDA. The law requires facility registration, product listing, safety substantiation documentation, serious adverse event reporting, and GMP compliance under standards that FDA is still in the process of finalising.

And enforcement has real teeth. FDA can now conduct facility inspections, issue warning letters for non-compliance, and order mandatory recalls for products it determines pose a reasonable probability of causing serious adverse health consequences. The era of de facto light-touch cosmetics oversight in the US is over.

Three Compliance Gaps That Catch European Brands Off Guard

Gap 1: Your CPSR Is Not FDA Safety Substantiation

Under EU 1223/2009, cosmetic safety is documented in a Cosmetic Product Safety Report prepared by a qualified person — typically a toxicologist holding a degree in pharmacy, medicine, or a related discipline. The CPSR follows the structured format set out in Annex I: Part A covering safety information and Part B covering the safety assessment, with specific content obligations for each section.

MoCRA’s safety substantiation requirement is structurally different. It doesn’t mandate a specific document format or a credentialed assessor. It requires that adequate substantiation of safety exists “before the cosmetic product is marketed” — and FDA has accepted a range of evidence types, including ingredient safety data sheets, stability testing results, published SCCS opinions, and historical use data.

This flexibility sounds reassuring. But it creates a trap. European brands routinely arrive at the US market with an Annex I-compliant CPSR and assume it satisfies FDA’s requirements by default. It doesn’t. A CPSR written exclusively against the EU framework doesn’t necessarily address the specific concerns FDA inspectors raise during facility reviews — particularly for ingredients with a different regulatory classification in US commerce. The two documents aren’t interchangeable; they’re responsive to different regulatory questions.

Gap 2: The Ingredient Divergence Is Larger Than Most Brands Assume

The EU bans or restricts approximately 1,600 substances for cosmetic use under Regulation 1223/2009 Annexes II through VI. FDA prohibits or restricts roughly 11 ingredient categories in cosmetics. The intuitive read is that an EU-compliant formulation comfortably clears US requirements. It usually does — but specific divergences cause expensive problems.

FDA’s color additive system is entirely independent of the EU colorants regime under Annex IV. Any color additive used in a cosmetic sold in the US must be specifically approved by FDA. More critically, certain colorants used in products applied near the eye, on the lips, or that might be ingested must come from a batch that has passed FDA’s Batch Certification program. There are approximately 80 FDA-approved color additives in total, organised into D&C, FD&C, and Ext. D&C categories — and these categories don’t map neatly onto EU Annex IV entries.

A product using an EU-permitted colorant with no FDA analog isn’t just technically non-compliant — it’s legally adulterated under US federal law. We’ve seen this catch European brands whose formulations rely on pigments permitted across the EU and UK that simply don’t appear on the FDA-approved list.

Zinc pyrithione is another instructive case. Used in EU rinse-off cosmetics for anti-dandruff efficacy (and subsequently restricted in the EU in 2022 for ecotoxicity reasons), it’s classified by FDA as a drug active ingredient for anti-dandruff use. Any US product containing it isn’t a cosmetic at all under US law — it requires drug approval, not cosmetic registration. That’s a regulatory category shift with major commercial consequences, and it catches teams who are used to the EU’s more unified cosmetic/active approach off guard.

Gap 3: Serious Adverse Event Reporting Is a New and Unfamiliar Obligation

EU 1223/2009 requires the responsible person to notify competent authorities of serious undesirable effects, but the EU framework leaves significant procedural discretion to member states. Reporting timelines and formats vary across the bloc, and many European quality systems handle this through established post-market surveillance procedures that prioritise flexibility.

Under MoCRA, manufacturers and distributors of cosmetics must report serious adverse events to FDA within 15 business days of receiving notice of the event. A “serious adverse event” is defined to include any event resulting in death, a life-threatening condition, inpatient hospitalisation, a significant disability or incapacity, or one that requires medical or surgical intervention to prevent such outcomes. This is a mandatory, time-bound obligation — not a discretionary notification.

For European brands managing consumer complaints through EU-centric quality systems, the 15-business-day clock can easily be missed. If the US distributor doesn’t know they’re required to escalate certain complaints to the manufacturer, or if the manufacturer doesn’t have a written US-specific adverse event triage procedure in place, the deadline passes unnoticed. FDA considers SAER non-compliance a priority enforcement focus area.

Facility Registration and Product Listing: Are You Already Non-Compliant?

The initial MoCRA registration and listing deadlines have already passed. Large manufacturers — those with more than $1,000,000 in average gross annual sales of cosmetics in the US over the previous 3 years — were required to register their facilities and list their products by December 29, 2023. Smaller businesses had until July 1, 2024.

Both obligations are ongoing. Facility registrations must be renewed every two years. Product listings must be updated whenever any material information changes — reformulation, new product name, new responsible party contact, or change in US distribution channel.

We regularly encounter European brands that launched in the US market in 2022 or 2023 and were simply not tracking MoCRA implementation timelines. They were focused — reasonably — on their EU compliance documentation. But their manufacturing facility (or their contract manufacturer’s EU facility) needed to be registered with FDA, and many were not.

An unregistered facility with products actively on US shelves is in direct violation of MoCRA. Registration is handled through FDA’s Cosmetics Direct electronic portal. For European manufacturers without a US legal presence, the process requires appointing a US agent — a role analogous to what 21 CFR Part 807 requires for foreign device manufacturers. The agent must maintain a US address and be available during business hours to receive FDA communications on the facility’s behalf.

Building a MoCRA-Ready Compliance Package

A European brand entering the US market compliantly today needs a documentation structure that runs parallel to, not in place of, the EU PIF. Think of it as a second track:

1. Facility registration in FDA Cosmetics Direct, with a designated US agent for any manufacturer without a US legal address.
2. Product listings for every SKU entering US commerce, with a process for updating listings on any material change.
3. US safety substantiation file — distinct from the EU CPSR, but potentially drawing on the same underlying ingredient safety data — structured to address FDA’s specific framework rather than Annex I.
4. Color additive verification: a formulation-level review confirming that every colorant is FDA-approved and, where required by product type, that an FDA-certified batch certificate is available.
5. Serious adverse event reporting procedure: a written SOP in your quality system specifying how US-market consumer complaints are triaged, how the “serious” threshold is evaluated, and exactly how the 15-business-day FDA submission is executed.
6. GMP readiness assessment: FDA’s final cosmetics GMP rule has not yet been issued, but brands already operating under ISO 22716 will have a meaningful head start. Monitor FDA’s rulemaking docket at Regulations.gov for publication and effective dates.

The EU compliance infrastructure you’ve built is not wasted — the safety data, GMP documentation, and quality systems all provide a genuine foundation to build from. But the US market requires a separate layer, with different document formats, different regulatory hooks, and a different responsible party structure. Treating the EU framework as a proxy for US compliance is the single most common mistake European cosmetics teams make when entering the American market.

If your products are already on US shelves, the most urgent step is confirming your facility registration status in FDA Cosmetics Direct. Everything else — product listings, safety substantiation, SAER procedures — can be addressed systematically from there. But without a registered facility, everything else is moot.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and US FDA compliance. Contact us

Related from our network

• Cosmetic Testing and Safety Substantiation for US FDA Compliance — Qalitex Laboratories provides ISO 17025-accredited stability testing, color additive verification, and safety data packages for European cosmetics brands entering the US market.
• Health Canada Cosmetics Notification and NHP Licensing for European Brands — Androxa supports European manufacturers through Canada’s Cosmetics Notification Form (CNF) process and natural health product licensing requirements.