The short answer
Under MoCRA, the responsible person for every cosmetic must ensure, and keep records supporting, that there is adequate substantiation of safety for the product (21 U.S.C. 364d). There is no FDA form, no filing and no list of required tests — but you must be able to show the evidence if FDA asks.
This applies to small businesses too. The only exception is coal-tar hair dye that meets the caution and patch test requirements; its responsible person must still keep records related to its safety.
What the law means by “adequate substantiation” and “safe”
| Term | Meaning in MoCRA |
|---|---|
| Adequate substantiation of safety | Tests or studies, research, analyses, or other evidence or information that qualified experts consider sufficient to support a reasonable certainty that the product is safe |
| Safe | Not injurious to users under the conditions of use in the labeling, or under customary or usual conditions of use |
| Minor reactions | A product is not considered injurious just because it can cause minor and transient reactions or skin irritation in some users |
| Exposure | FDA may consider cumulative or other relevant exposure to the product and its ingredients |
What a typical safety file contains
- 1Formula and ingredient dataThe full quantitative formula, ingredient specifications, supplier safety data and published safety reviews for each ingredient at the level used.
- 2Exposure assessmentWho uses the product, where on the body, how much, how often and whether it is rinsed off or left on. Products for babies, the eye area or lips need extra thought.
- 3Impurities and contaminantsFor example heavy metals in colors, asbestos testing for talc, and residual solvents.
- 4Finished-product testsStability, preservative efficacy and microbiology — and where useful, skin compatibility or patch testing on volunteers.
- 5Expert conclusionA signed assessment by someone qualified by scientific training and experience, stating why the product is safe as used.
- 6Keep it currentUpdate the file when the formula, supplier or use changes, and review it against your adverse event records.
How it connects to the rest of MoCRA
- Product listing tells FDA what you sell; the safety file shows it is safe.
- Adverse event records are evidence — repeated reactions should trigger a review of the safety file. See adverse event reporting.
- Talc products: include asbestos test reports. See talc in cosmetics.
- Drug claims are a separate issue — a safe cosmetic with a drug claim is still a drug.
Example: a skincare brand from France
A French brand already has EU safety reports for its serum, cream and cleanser. For the U.S. it adjusts the cream formula to remove a color not permitted in the U.S., so it updates that file: new formula, new stability data and an updated signed assessment. It keeps the three files ready to send if FDA asks, lists all three products under MoCRA and adds a U.S. contact to the labels.
Cosmetic facility registration with U.S. Agent from $300 (1 year) or $450 (2 years). Product listing $150 per product. Cosmetics label review $250.
Frequently asked questions
Do I have to send safety substantiation to FDA?
No. You keep the records and make them available if FDA requests them.
Which tests does MoCRA require?
None specifically. The evidence must be enough for qualified experts to have a reasonable certainty that the product is safe.
Are small businesses exempt from safety substantiation?
No. The MoCRA small business exemption covers registration, listing and GMP, not safety substantiation.
Can I use my EU safety report?
It is a good base, but check that it matches the U.S. formula, labeling and conditions of use.
Sources
- 21 U.S.C. 364d — Safety substantiation
- Loeb & Loeb — MoCRA increases FDA oversight of the cosmetics industry
- dicentra — MoCRA in 2026
Requirements checked on November 11, 2026. This article is general information, not legal advice.