MoCRA Enforcement Is Here: What Small Beauty Brands Can't Ignore in 2026

When the Modernization of Cosmetics Regulation Act was signed into law in December 2022, the FDA spent the following year largely in what it called an “education and outreach” phase. Deadlines came and went. Many small brands assumed enforcement was still a distant possibility.

That window is closing. As of 2026, the FDA has moved firmly into enforcement mode, and “I didn’t know about it” is no longer a viable defense.

If you run a small beauty brand and are not yet fully MoCRA compliant, here is an honest picture of where things stand and exactly what you need to do.

The Deadlines Have Already Passed

This is the part that surprises most small founders: the major MoCRA compliance deadlines were in 2023 and 2024, not in the future.

Facility registration: Existing facilities were required to register with the FDA by December 29, 2023.
Product listing: Products already on the market were required to be listed by December 29, 2023. New products entering commerce must be listed within 120 days.
Adverse event reporting: The 15-day serious adverse event reporting requirement has been in effect since December 29, 2023.

If you have not completed these steps, you are not “not yet compliant.” You are currently out of compliance, and that is a meaningful legal distinction.

What Enforcement Actually Looks Like

The FDA’s enforcement toolkit under MoCRA is substantially broader than it was before the law passed. The agency can now:

Issue warning letters for registration and listing failures
Conduct facility inspections and request records
Issue mandatory recalls, not just voluntary requests
Pursue injunctions and civil penalties

The FDA has not yet published extensive enforcement action data specific to MoCRA, but the agency has been clear that it intends to use these tools. Brands that have received warning letters in related areas (labeling, safety claims) are already seeing MoCRA-related language appear in FDA correspondence.

The practical risk for small brands is not just a warning letter. It is the supply chain disruption that follows. Retailers, distributors, and marketplaces are increasingly requiring proof of MoCRA compliance before onboarding new brands or renewing agreements. Non-compliance is becoming a commercial problem, not just a legal one.

Does the Small Business Exemption Apply to You?

MoCRA includes a small business exemption from facility registration and product listing requirements. But the exemption is narrower than most founders assume.

To qualify, your business must:

Have average annual gross sales of cosmetics under $1 million (averaged over the last three years), AND
Not sell any cosmetics that regularly come into contact with the mucous membranes of the eye

That second criterion disqualifies a lot of beauty products. Eye shadow, mascara, eyeliner, lip gloss, lip balm: these are all products that come into contact with mucous membranes. If any of your products fall into this category, the exemption likely does not apply to you, regardless of your revenue level.

Even if you qualify for the exemption from registration and listing, you are still subject to:

Safety substantiation requirements
Adverse event reporting
Good manufacturing practice requirements (once FDA finalizes GMP rules)
Labeling requirements

The exemption is real, but it is not a pass on MoCRA entirely.

Safety Substantiation: The Requirement No One Talks About Enough

Of all MoCRA’s requirements, safety substantiation gets the least attention and poses the biggest long-term risk.

The law requires that cosmetic products be “adequately substantiated for safety” before they go to market. This is not a new concept, as the FDA’s pre-MoCRA guidance reflected this standard, but MoCRA formalizes it with a capital letter and enforcement authority behind it.

In practice, safety substantiation means having documented evidence that your product is safe when used as directed. This typically includes:

Ingredient safety assessments: evidence that each ingredient is safe at the concentration used
Stability testing: documentation that the product maintains its safety and integrity over its expected shelf life
Microbial/challenge testing: particularly important for water-containing products
Finished product safety review: typically conducted or reviewed by a qualified cosmetic chemist or toxicologist

If you are working with a contract manufacturer, you need to know who is holding this documentation and whether your contract addresses it explicitly. Many contract manufacturers produce the products but do not automatically provide founders with the underlying safety data. Ask for it. Get it in your records.

The GMP Rules Are Coming

MoCRA required the FDA to establish Good Manufacturing Practice regulations for cosmetics. The FDA is still finalizing these rules, but once they are in place, compliance will be mandatory.

GMP requirements will cover things like:

Facility cleanliness and maintenance standards
Personnel hygiene and training
Quality control testing
Record-keeping requirements
Handling of complaints and returns

If you manufacture your own products, even in small batches, preparing for GMP compliance now is far smarter than scrambling when the rules are finalized.

What to Do If You Are Behind

If you are not yet compliant, the path forward is straightforward. The important thing is to start now.

Determine your registration and listing status. Log in to the FDA’s Cosmetics Direct system (the portal for MoCRA registration and listing) and check whether your facility and products are listed.
Register your facility if you have not already. If you were required to register and did not, consult with regulatory counsel about how to come into compliance and document your late registration.
List your products. Each distinct product (by formulation and labeling) requires its own listing, including a full ingredient list using INCI nomenclature.
Audit your safety documentation. Pull together what you have and identify the gaps. Work with your contract manufacturer or a cosmetic chemist to address them.
Implement an adverse event tracking system. You need a documented process for receiving, evaluating, and recording customer complaints and adverse events, including escalating to the FDA within 15 days when a serious adverse event is reported.
Review your labels. Watch the FDA’s rulemaking on fragrance allergen labeling. If your products contain fragrance, packaging updates will likely be required.

MoCRA compliance is not a once-and-done exercise. Registration must be renewed every two years, product listings must be updated annually and when formulations or labels change, and adverse event records must be maintained for six years. Build this into your business operations now, while the cost of doing it is manageable.

This article is for informational purposes only and does not constitute legal advice. For guidance specific to your situation, book a consultation with Antonella Colella, Esq.