US MoCRA and EU Cosmetics Rules: What Ingredient Buyers Should Know
Regulation is where sourcing decisions become expensive if they are deferred. This is an orientation, not legal advice — but it is enough to know which questions to ask before you import.
This article is a general orientation for buyers of cosmetic ingredients. It is not legal advice. Confirm requirements for your product and market with a regulatory professional.
Two frameworks dominate for brands selling into the largest Western markets: the modernised US cosmetics regime, and the EU Cosmetics Regulation. They differ in structure, but both place responsibility on the party putting the product on the market — which is you, not your ingredient supplier.
United States: MoCRA
The Modernization of Cosmetics Regulation Act substantially expanded US federal oversight of cosmetics. Key elements that affect brands:
- Facility registration. Cosmetic manufacturing and processing facilities serving the US market are expected to register with the FDA.
- Product listing. Cosmetic products placed on the market are subject to listing requirements, including ingredient information.
- Adverse event reporting. Serious adverse event reporting obligations apply to responsible persons.
- Safety substantiation. The responsible person must be able to substantiate that a product is safe.
- Good manufacturing practice. FDA has been developing GMP expectations for cosmetics.
Enforcement has built up gradually, and smaller brands have sometimes assumed the rules do not reach them. Where you are the responsible person for a product sold in the US, they do.
European Union: Regulation (EC) No 1223/2009
The EU regime is more prescriptive and has been in force longer. Practical points for brands and buyers:
- Responsible Person. Every product needs a Responsible Person established in the EU, who carries legal responsibility for compliance.
- CosIng. The EU's cosmetic ingredient database lists permitted and restricted ingredients and their INCI names. Check your ingredient appears and is not subject to a restriction relevant to your use.
- CPNP notification. Products are notified via the Cosmetic Products Notification Portal before being placed on the market.
- Product Information File. A technical file including safety assessment must be available for inspection.
- Labelling. INCI ingredient listing, mandatory warnings and language requirements are prescribed.
Where ingredient suppliers fit — and where they don't
An ingredient supplier can and should provide: the INCI name, the specification, the COA for the batch, the MSDS, and technical guidance on handling and pH.
An ingredient supplier generally cannot take on: your product registration, your product labelling compliance, your safety substantiation, or your adverse event obligations. Those sit with you as the party placing the product on the market.
If a supplier offers to “handle compliance” for your finished product, ask precisely what that means in writing.
What to request from a supplier for your regulatory file
- INCI name exactly as it should appear on a label.
- Specification sheet with a version reference.
- COA for each batch supplied, retained and retrievable.
- MSDS in the required format and language for your market.
- Confirmation of grade — cosmetic grade, and nothing else.
- Statement on restricted substances, where your market requires one.
- Origin documentation where relevant to labelling or duty.
Build this file as you go rather than reconstructing it later. Reconstructing documentation from three years of purchases is a task nobody enjoys and some suppliers cannot support.
Common misconceptions
- “Our supplier handles compliance.” Usually they mean they supply documents, not that they carry your obligations.
- “We're too small to be covered.” Rules generally apply by activity, not by company size.
- “The ingredient is listed, so the product is fine.” Ingredient listing is one input; the finished product has its own requirements.
What is actually in force under MoCRA
MoCRA was enacted in 2022 and its provisions have been brought into effect progressively. Understanding which elements are live matters more than knowing the statute exists.
| Element | Who it applies to | Practical implication |
|---|---|---|
| Facility registration | Facilities that manufacture or process cosmetic products for the US market, with limited exceptions | Your contract manufacturer may need to be registered; ask them |
| Product listing | Responsible persons placing products on the market | Includes ingredient information; you will need accurate INCI data from your suppliers |
| Adverse event reporting | Responsible persons | You need a process, not just an intention |
| Safety substantiation | Responsible persons | You must be able to evidence that the product is safe |
| Good manufacturing practice | Facilities in scope | FDA has been developing cosmetic GMP expectations |
Because implementation has been phased, and because guidance has continued to develop, confirm the current position with a regulatory professional rather than relying on a summary — including this one.
The EU Responsible Person, explained
Under the EU Cosmetics Regulation, every cosmetic product placed on the EU market must have a Responsible Person established in the EU. That person carries legal responsibility for compliance.
- It is a legal role, not an administrative one. The Responsible Person answers for the product's compliance.
- A brand outside the EU cannot be its own Responsible Person for EU placement — an entity established in the EU is required.
- The Product Information File sits with them. Including the safety assessment, which must be available for inspection.
- Notification goes through CPNP before the product is placed on the market.
Where brands get into difficulty is treating the Responsible Person as a formality. It is a substantive appointment, and the quality of the arrangement determines how well you survive a question from a market surveillance authority.
An ingredient documentation matrix
What you should be able to produce, and from whom.
| Document | Source | When you need it |
|---|---|---|
| INCI name, exactly as declared | Ingredient supplier | Label artwork; product listing |
| Specification sheet with version | Ingredient supplier | Qualification; audits |
| COA per batch | Ingredient supplier | Every purchase; retained |
| MSDS | Ingredient supplier | Handling; transport; workplace |
| Grade confirmation | Ingredient supplier | Qualification |
| Restricted substance statements | Ingredient supplier, where required | Market-specific requirements |
| Safety assessment | Qualified assessor | EU Product Information File |
| Stability and challenge test data | You, or your manufacturer | Safety assessment; shelf-life claims |
| Product listing / notification records | You, or your Responsible Person | US and EU market placement |
The top five rows are what your ingredient supplier owes you. Everything below that is yours. Confusing the two is where most small brands get caught out.
The compliance gaps that catch small brands
- Assuming the supplier handles registration. They supply documents. The obligations attach to the party placing the product on the market.
- Artwork finalised before compliance review. Rework after printing is far more expensive than review before.
- Documentation reconstructed retrospectively. Retrieving COAs for batches bought two years ago is often impossible.
- Claims that cross the line. Ingredient description and product claim are governed differently. This is the most expensive category of error.
- No adverse event process. An obligation with no procedure behind it is not a plan.
- Treating the Responsible Person as a signature. The arrangement's quality determines how you fare under scrutiny.
The pattern across all six is the same: they are cheap to fix in advance and expensive to fix afterwards. Build the file as you go, and commission the compliance review before the artwork goes to print.
A simple self-check before you launch
Before a product goes live in either market, confirm each line has a named owner — even if that owner is you.
| Question | US | EU |
|---|---|---|
| Who is the responsible party, and are they established where required? | You | Responsible Person in the EU |
| Is the manufacturing facility registered, where applicable? | Confirm with your manufacturer | N/A |
| Has the product been listed or notified? | Product listing | CPNP notification |
| Can you produce a safety assessment on request? | Safety substantiation | Product Information File |
| Is the label compliant for mandatory elements and language? | Yes | Yes |
| Is there a documented adverse event process? | Required | Required in substance |
| Are batch COAs filed and retrievable? | Yes | Yes |
If any line has no owner, that is the next thing to fix — not the launch date.
Frequently asked questions
Does my ingredient supplier need to register under MoCRA?
Registration obligations attach to facilities that manufacture or process cosmetic products for the US market, with limited exceptions. Whether your supplier's facility is in scope — and what they have done about it — is a reasonable question to ask them directly.
Can I sell the same product in the US and the EU?
Often yes, but the labelling, notification and safety-assessment requirements differ. Plan for both sets of requirements before finalising artwork.
Where can I check an INCI name?
For the EU, CosIng is the reference database. For the US, the INCI naming convention is the industry standard for ingredient declaration.
Does MoCRA apply to small brands?
Obligations generally attach to the activity and the role, not to company size. If you are the responsible person for a product on the US market, the requirements reach you.
Do I need a Responsible Person if I only sell online?
Placement on the EU market is what triggers the requirement, regardless of the sales channel.
Can my ingredient supplier act as my Responsible Person?
Only if they are established in the EU and you appoint them to that legal role, which is a substantive arrangement rather than a documentation service. Ask precisely what they would take on.
How long must I keep compliance records?
Retention periods vary by market and document type. Confirm the requirement for your market and keep records longer than the minimum — retrieving old COAs is often impossible.
Is an ingredient listed in CosIng automatically fine to use?
Listing is one input. Concentration limits, restrictions and the finished product's own requirements also apply. Check the entry, not just its existence.
What is the most common compliance failure for small brands?
Making drug-like claims on packaging or in marketing, and finalising artwork before any compliance review. Both are far cheaper to fix before printing.