FDA MoCRA Cosmetics Recall Compliance in 2026: Adverse Event Reporting, EU Article 23, and PFAS Ingredient Monitoring

The Modernization of Cosmetics Regulation Act reshaped FDA's oversight of the beauty industry — including mandatory adverse event reporting, recall authority, and facility registration obligations that beauty brands and contract manufacturers must meet in 2026.

The Most Significant Change to U.S. Cosmetics Regulation in 85 Years

When the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) was signed into law in December 2022, it fundamentally altered the regulatory relationship between FDA and the $93 billion U.S. beauty industry. Before MoCRA, FDA had no mandatory recall authority over cosmetics, no requirement for manufacturers to register their facilities, no requirement to list their products, and no mandatory adverse event reporting obligation. Cosmetics were, in practical regulatory terms, one of the least-regulated categories of consumer products subject to FDA oversight.

MoCRA changed all of that. The Act granted FDA:

• Mandatory facility registration for facilities that manufacture or process cosmetics marketed in the United States (required since December 2023)
• Mandatory product listing for each cosmetic product, including the list of ingredients in descending order of predominance
• Mandatory serious adverse event reporting (SAER) within 15 business days of receiving a report of a serious adverse event associated with the product
• Formal recall authority — FDA can now order mandatory recalls of cosmetics it determines present an unreasonable risk of serious adverse health consequences or death
• Facility inspection authority — FDA can inspect cosmetics manufacturing facilities, including those of contract manufacturers

For beauty brands that had never filed a mandatory safety report in their existence, MoCRA's operational requirements represent a genuine infrastructure challenge. The companies that have adapted fastest are those that treated MoCRA not as a documentation exercise but as a signal to build the same type of adverse event monitoring and recall readiness infrastructure that pharmaceutical and medical device companies have maintained for decades.

MoCRA Serious Adverse Event Reporting: The 15-Business-Day Framework

The centerpiece of MoCRA's new enforcement architecture is mandatory serious adverse event reporting. Under MoCRA, a serious adverse event is an adverse event that:

• Results in death
• Is life-threatening
• Results in inpatient hospitalization
• Results in significant disability or incapacity
• Results in a congenital anomaly or birth defect
• Requires medical or surgical intervention to prevent permanent impairment or damage to a body structure or body function

When a manufacturer, packer, or distributor of a cosmetic receives information — from any source, including consumer complaints, social media, healthcare provider reports, or retailer reports — about a serious adverse event associated with a cosmetic they sell or manufacture, they have 15 business days to submit a mandatory Serious Adverse Event Report (SAER) to FDA.

What the SAER Must Include

FDA's SAER requirements specify the information that must be included in each report:

• Product identification: Name, lot number, and formulation of the cosmetic product
• Consumer/patient information: Age, gender, and relevant medical history of the person who experienced the event (without personally identifiable information in the public record)
• Adverse event description: Detailed description of the event, including the sequence of use, application site, and the clinical outcome
• Regulatory action: Whether the manufacturer has taken or proposes to take any action (e.g., voluntary recall, product withdrawal, reformulation)
• Follow-up information: If additional information becomes available after the initial 15-day report, a follow-up report may be required within 15 business days of receiving the new information

The 15-Day Clock: When It Starts and Common Mistakes

The 15-business-day deadline begins when the responsible person (the manufacturer, packer, or distributor whose name appears on the product label) receives a report of a serious adverse event. Receipt can occur through:

• A direct consumer complaint to the company's customer service line or email
• A report from a retailer or distributor who received the consumer complaint
• A social media post identifying the product and a qualifying serious adverse event
• A report from a healthcare provider treating a patient who used the product
• A return or product complaint that includes qualifying injury information

Common mistakes that cause deadline violations:

Misclassifying the severity: Companies sometimes classify adverse events as "non-serious" when the clinical description — rash requiring emergency room treatment, chemical burn requiring medical intervention, systemic reaction requiring hospitalization — would meet MoCRA's serious adverse event definition. Conservative classification (treating ambiguous events as potentially serious) is safer than optimistic classification.

Siloed complaint intake: In many beauty companies, consumer complaints arrive through multiple channels — customer service email, social media DMs, Amazon seller reviews, retailer customer service escalations — and are managed by different teams. A serious adverse event that arrives through Amazon's review system may not reach the regulatory team within the same week it was posted, let alone within 15 business days. Centralized adverse event monitoring across all channels is a structural requirement, not a best practice.

Contract manufacturer confusion: In the beauty industry's widespread contract manufacturing model, the label manufacturer (the brand) and the physical manufacturer (the CMO/CDMO) are often different entities. MoCRA's reporting obligation falls on the responsible person — the manufacturer, packer, or distributor whose name appears on the label. The brand owns the SAER obligation even if the contract manufacturer produced the batch. Quality agreements must explicitly assign adverse event reporting responsibilities and information-sharing obligations between the brand and the CMO.

FDA Recall Authority Under MoCRA: What Changed

Before MoCRA, FDA's only authority to remove a dangerous cosmetic from the market was to seek a court order for injunction or product seizure — a slow and resource-intensive process. MoCRA gave FDA direct recall authority for cosmetics that:

• Present an unreasonable risk of serious adverse health consequences or death, or
• Are adulterated or misbranded

How FDA initiates a mandatory recall: FDA may request a voluntary recall first. If the manufacturer refuses or does not act promptly, FDA can order a mandatory recall. The mandatory recall order becomes final 10 days after issuance unless the manufacturer requests a hearing.

What "voluntary" means in practice: Given FDA's new mandatory recall authority, "voluntary" recalls are conducted in the shadow of mandatory authority. A beauty brand that refuses to conduct a voluntary recall after FDA has determined that a product presents an unreasonable risk will face a mandatory recall order, adverse publicity, and potential civil penalties — a materially worse outcome than a cooperative voluntary recall. Companies that move quickly to conduct voluntary recalls when safety signals emerge consistently receive more favorable regulatory treatment.

Recall notification requirements: When a cosmetic recall is initiated — whether voluntary or mandatory — FDA's recall regulations (21 CFR Part 7) require the responsible person to:

• Notify all accounts in the distribution chain (wholesalers, retailers, distributors) of the recall
• Notify consumers directly if the product was sold direct-to-consumer
• Conduct effectiveness checks to verify that accounts have removed the product from sale
• Submit recall status reports to FDA at specified intervals
• Provide a final recall status report confirming disposition of all recalled units

EU Cosmetics Regulation Article 23: Parallel Obligations for Global Brands

Beauty brands selling in the European Union operate under a separate regulatory framework — (EC) No 1223/2009 (the EU Cosmetics Regulation) — with its own serious adverse event reporting requirements. For brands operating in both the U.S. and EU, these two frameworks run in parallel.

Article 23: Serious Undesirable Effect Notifications

Under Article 23, responsible persons (EU market term for the entity responsible for placing the cosmetic on the EU market) and distributors must notify the competent authority of the member state in which the serious undesirable effect occurred within 20 working days of becoming aware of the event.

What constitutes a serious undesirable effect (SUE) under EU law: EU Cosmetics Regulation defines a SUE as an undesirable effect that results in temporary or permanent serious functional incapacity, disability, hospitalization, congenital anomalies, an immediate vital risk, or death. The definition is broadly comparable to MoCRA's serious adverse event definition, though EU guidance documents clarify specific borderline cases.

Who receives the notification: Unlike the U.S. system where all SARs go to FDA through a central electronic gateway, EU Article 23 notifications go to the national competent authority of each member state where the event occurred. For a brand selling in 15 EU member states where a serious adverse event was reported in France, the notification goes to the French ANSM (Agence nationale de sécurité du médicament et des produits de santé). If the same product caused a separate event in Germany, a separate notification to BfArM (Bundesinstitut für Arzneimittel und Medizinprodukte) is required.

CPNP integration: Article 23 notifications reference the product's Cosmetic Products Notification Portal (CPNP) record, which must exist and be current. A missing or incomplete CPNP notification creates a compliance problem that must be remediated in parallel with the Article 23 notification.

RAPEX / EU Safety Gate

For cosmetics that present a serious risk beyond the borders of a single member state, the EU Safety Gate (formerly RAPEX) system is used to notify all EU member states simultaneously. Cosmetics that are the subject of a voluntary or mandatory market withdrawal in one member state, or that contain prohibited or restricted substances, are reported through Safety Gate to alert authorities in all 27 member states.

Beauty brands that receive a Safety Gate notification about their product must respond to inquiries from multiple national competent authorities simultaneously, providing the same underlying product safety data and risk assessment to each authority.

PFAS, Heavy Metals, and Allergen Ingredient Monitoring

MoCRA's product listing requirement creates a direct connection between a cosmetic's ingredient list and its regulatory exposure. Products containing ingredients that are subsequently restricted or prohibited — by FDA, by state law, or by EU Cosmetics Regulation — must either be reformulated or removed from the market. This is not a future risk; it is an active compliance management challenge in 2026.

PFAS in Cosmetics: A Rapidly Evolving Restriction Landscape

Per- and polyfluoroalkyl substances (PFAS) have been found in numerous beauty product categories — foundations, mascaras, lipsticks, and waterproof formulations — including products where PFAS were not intentionally added but were present as contaminants or degradation products. The regulatory and legal environment around PFAS in cosmetics is moving quickly:

• California SB 312 (effective January 2025): Prohibits the intentional addition of PFAS to cosmetics sold in California. Because California is the world's fifth-largest economy and typically dominates the U.S. market, California restrictions have practical national effect.
• Colorado HB 22-1345 (effective 2025): Contains similar PFAS restrictions for cosmetics, with testing and certification requirements.
• EU REACH PFAS restriction: A universal PFAS restriction under EU REACH is in progress and expected to apply broadly, including to cosmetics, when finalized — potentially restricting the use of PFAS-containing ingredients across the EU.
• FDA guidance: FDA has issued guidance on PFAS testing for cosmetics and has signaled regulatory action for intentionally added PFAS pending further scientific review.

For beauty brands, PFAS monitoring requires both intentional ingredient screening (reviewing formulation raw material data sheets for PFAS-listed ingredients) and finished product testing for PFAS contaminants, particularly for waterproof or long-wear formulations that historically used PFAS for performance.

Heavy Metals: FDA Action Levels and EU Annex II

Heavy metal contamination in cosmetics — lead in lipstick, mercury in skin-lightening products, arsenic and cadmium in various formulations — has been a persistent regulatory concern. FDA maintains action levels for lead in cosmetics (10 ppm for lip cosmetics, under 2 ppm proposed for external cosmetics) and has specific regulations prohibiting mercury in cosmetics (except as a preservative in trace amounts for eye area cosmetics, which itself is under review).

EU Cosmetics Regulation Annex II lists prohibited substances including specific heavy metals. Brands must ensure that each market-specific formulation complies with the applicable jurisdiction's heavy metal limits — which differ between the U.S. and EU, creating complexity for globally marketed products.

EU Fragrance Allergen Labeling: Regulation 2023/1545

The EU adopted new fragrance allergen labeling requirements under Commission Delegated Regulation (EU) 2023/1545, which expands the list of fragrance allergens that must be declared on cosmetic product labels when present above threshold concentrations. Products formulated before the regulation's effective dates must be reviewed against the expanded allergen list, and CPNP records must be updated to reflect the revised formulations or labeling changes.

For brands with large EU portfolios, the 2023/1545 allergen update requires a systematic review of formulations across the full product catalog — a significant regulatory operations undertaking that, if not completed before the applicable deadline, creates non-compliance risk across the portfolio.

Social Signal Monitoring: The Operational Reality for Beauty Brands

Beauty brands face a monitoring challenge that has no parallel in other regulated industries: social media-driven adverse event signals that escalate to viral status within hours, often before the regulatory team is even aware. This is not a theoretical risk — in recent years, beauty brands have faced large-scale consumer backlash on TikTok and Instagram over safety concerns before any formal regulatory action was taken.

The monitoring obligation under MoCRA: FDA's adverse event reporting obligation is triggered by receipt of a report through any channel. A consumer post on TikTok describing a serious adverse event associated with a named product — a chemical burn, an allergic reaction requiring hospitalization, a systemic reaction — potentially constitutes a report that starts the 15-business-day SAER clock. The brand's social media team that sees the post but fails to escalate it to the regulatory team has not relieved the company of its reporting obligation; it has simply created a record of notification that regulators will find if they look.

What effective social monitoring for adverse event purposes requires:

• Keyword and product name monitoring across TikTok, Instagram, YouTube, Reddit, and beauty-specific communities (Reddit's r/SkincareAddiction, Beautypedia, and similar communities)
• Amazon and Sephora/Ulta review monitoring for qualifying adverse event language
• Integration with consumer complaint routing, so social media adverse events reach the regulatory team on the same timeline as direct consumer complaints
• Documentation of when the social signal was identified, its content, and the regulatory assessment conducted — creating the evidentiary record that demonstrates timely review

Building a MoCRA-Ready Cosmetics Compliance Infrastructure

A beauty brand or contract manufacturer with a mature MoCRA compliance program demonstrates several capabilities that FDA expects and that internal audit functions should verify:

Adverse event intake centralization: A single intake channel — or a documented aggregation process from multiple channels — ensures that serious adverse event reports reaching any part of the organization (customer service, social media, e-commerce operations, field sales) are captured, routed to the regulatory team, and assessed against the MoCRA SAER criteria within a documented timeframe.

SAER generation and submission capability: The operational capacity to prepare, review, and submit a complete SAER to FDA via the Electronic Submissions Gateway within 15 business days of receiving a qualifying report. This requires that product lot information, formulation data, and consumer information are accessible to the regulatory team in a timely manner — not locked in manufacturing records that require multi-day retrieval.

Product listing and facility registration currency: MoCRA's facility registration and product listing requirements are not one-time exercises. When new products launch, existing products are reformulated, or facilities change, registrations and listings must be updated. A product that is sold commercially but lacks a current FDA listing is non-compliant — a risk that scales with portfolio size and launch velocity.

Ingredient risk monitoring: A systematic process for reviewing FDA guidance updates, EU Cosmetics Regulation Annex amendments, EU REACH restriction decisions, and state-level ingredient bans against the current formulation database — with a documented process for initiating reformulation or market withdrawal when a prohibited or restricted ingredient is identified.

Recall readiness documentation: A written cosmetics recall plan that covers the full distribution network — DTC channels, retailer accounts, international distributors — with pre-drafted notification templates, designated regulatory contacts at major retail accounts, and a tested process for executing effectiveness checks across all distribution tiers.

---

SuperRecall.ai helps beauty brands and contract manufacturers build FDA MoCRA-compliant recall and adverse event management programs — including automated serious adverse event report generation, EU Cosmetics Regulation Article 23 notification workflows, PFAS and allergen ingredient monitoring, and social signal detection integrated with regulatory escalation. To see how our platform supports your cosmetics compliance program, request a demonstration.