MoCRA Safety Substantiation: What Your Cosmetic Safety File Must Contain
Under MoCRA, the brand whose name is on a cosmetic's label must be able to prove, on paper, that the product is safe. The law calls this adequate substantiation of safety, and it applies to every cosmetic product sold in the US, including those made by businesses small enough to skip registration and listing.
Before MoCRA, US law prohibited selling an adulterated cosmetic but did not require a brand to keep a safety file. Many small brands relied on their contract manufacturer, a supplier's data sheet, or the fact that nobody had complained. That is no longer enough. If FDA asks, the responsible person must show the records that support the product's safety.
The law does not prescribe specific tests, which is both a relief and a trap: you choose the evidence, but you must be able to defend that choice to a qualified expert. This guide explains what the law requires, what a defensible safety file contains, and the procedure that keeps one current for every product.
What the law requires
Section 608 of the FD&C Act (21 U.S.C. 364d) says the responsible person for each cosmetic product must ensure, and maintain records supporting, that there is adequate substantiation of the product's safety. The responsible person is the manufacturer, packer or distributor whose name appears on the label.
Two definitions in the same section set the standard.
Adequate substantiation of safety means tests or studies, research, analyses, or other evidence or information that experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients would consider sufficient to support a reasonable certainty that the product is safe.
Safe means the product, including every ingredient in it, is not injurious to users under the conditions of use in its labeling, or under customary or usual conditions of use. FDA may consider cumulative or other relevant exposure to the product and its ingredients. A product is not considered injurious solely because it can cause minor and transient reactions or skin irritation in some users.
Three practical consequences follow:
The test is expert opinion. Your evidence must be the kind a qualified safety assessor (a toxicologist or similarly trained scientist) would accept. Your own belief that the product is fine does not count.
Every ingredient is in scope, at the concentration you use, and in the way consumers actually use the product: a leave-on face serum is judged differently from a rinse-off shampoo.
Misuse that is customary counts. If people commonly use your body lotion on their face, or a product on children, the safety file should address it.
FDA states that neither the law nor its regulations require specific tests, that brands may use relevant safety data that is already available, and that animal testing is not required to market a cosmetic (FDA MoCRA page). Coal-tar hair dyes that carry the required caution statement are exempt from the substantiation requirement, but the responsible person must still keep records related to their safety.
What goes in a safety file
A defensible safety file has four parts: what is in the product, how people are exposed to it, what is known about each ingredient at that exposure, and how the finished product behaves, followed by a signed conclusion. The EU's cosmetic product safety report is a useful model, and brands that already sell in Europe can reuse much of it.
1. Product description and formula
Product name, intended use, target users (adults, children, sensitive skin), application area, and whether it is leave-on or rinse-off.
Full quantitative formula, including the composition of fragrance, botanical extracts and premixes as far as the supplier will disclose.
Specifications for raw materials and the finished product, and impurity information (for example heavy metals, 1,4-dioxane, nitrosamines where relevant).
2. Exposure
Amount applied per use, frequency of use, and how much stays on the skin (retention factor).
The resulting systemic exposure dose for each ingredient, calculated per kilogram of body weight per day.
Customary misuse and vulnerable users, such as use around the eyes or on children.
3. Ingredient safety review
Prohibited and restricted ingredients: Confirmation against 21 CFR 700 (e.g. mercury, chloroform, methylene chloride, prohibited cattle materials).
Color additives: Each color approved for the intended use in 21 CFR 73, 74 or 82, and batch certified where required.
Published expert assessments: Cosmetic Ingredient Review (CIR) conclusions; EU SCCS opinions where relevant.
Supplier data: Safety data sheet, certificate of analysis, toxicology summary.
Fragrance: IFRA conformity certificate for your use category and dose; allergen breakdown.
Margin of safety: NOAEL divided by systemic exposure dose, with the conventional target of at least 100.
4. Finished product evidence
Preservative efficacy (challenge) test, for example to ISO 11930, for any water-containing product.
Microbial limits on each batch, or a justification that the product cannot support microbial growth.
Stability and packaging compatibility, which support the shelf life or period after opening on the label.
Skin tolerance, such as a human repeat insult patch test, for leave-on products or new formulas where the ingredient review leaves doubt.
Eye tolerance evidence for eye-area products, using in-vitro methods.
Post-market data: the adverse event and complaint history for the product, reviewed at least yearly.
5. The safety assessment and sign-off
The file ends with a written conclusion by a qualified safety assessor: the product is safe under its labeled and customary conditions of use, with any warnings or directions needed on the label. Record the assessor's name, qualifications and the date. Without it, the rest of the file is a pile of data rather than substantiation.
A note on scope: sunscreens, anti-dandruff shampoos, antiperspirants and acne products are drugs in the US, not just cosmetics. Their claims and active ingredients follow the OTC drug rules, which a cosmetic safety file does not replace.
Building the procedure, step by step
A safety substantiation procedure makes sure no product reaches the market, and no formula change slips through, without a current, signed safety file.
Trigger. A safety file is required before launch of every new product, and a review is required for every formula change, new supplier of a key raw material, new fragrance, new package, new claim or new target group (for example extending an adult product to children).
Collect supplier information. Request the safety data sheet, certificate of analysis, toxicology summary and, for fragrance, the IFRA certificate and allergen breakdown. Make disclosure of this information, including to FDA on request, a condition in your supplier agreements.
Screen the formula. Check every ingredient against prohibited and restricted ingredient rules and color additive approvals, and record the result.
Assess exposure and ingredient safety. Calculate exposure, find published assessments, and calculate margins of safety for ingredients where the published data does not settle the question.
Decide which finished product tests are needed. Preservative efficacy and stability for water-containing products as a minimum; skin or eye tolerance where the ingredient review or the product type calls for it. Record why any test was not done.
Have the assessment written and signed. A qualified safety assessor, in-house or a consultant, writes the conclusion, any label warnings and the conditions of use.
Link it to the label. Check that the warnings, directions and claims on the label match the safety assessment before release.
Release only with a complete file. Quality checks that a signed file exists for the exact formula and package before the first batch ships.
Review it on a schedule. At least once a year, and after any serious adverse event, compare the complaint and adverse event history to the safety conclusion and update the file if anything has changed.
Keep the records. Store the safety file under document control for as long as the product is on the market, plus a defined period after (A.P. Lyon's procedure uses at least 6 years, matching the adverse event record period).
Small businesses are not exempt
MoCRA's small business exemption covers facility registration, product listing and the coming GMP rule. It does not cover safety substantiation. A home-based brand selling a few hundred jars a year needs a safety file for each product just as a large brand does. The file can be proportionate: a simple rinse-off product made from well-assessed ingredients needs far less than a new leave-on eye cream, but it must exist and it must be signed.
Common mistakes
Relying on the contract manufacturer's word. If your brand is on the label, the safety file is your responsibility. Get a copy, and make sure it covers your exact formula.
One file for a whole range. Each shade, scent or formula variant needs to be covered, even if one assessment handles a family of near-identical products.
Fragrance as a black box. "Fragrance" on the formula with no IFRA certificate or allergen data leaves a gap an expert would not accept.
No preservative efficacy test. Contamination is one of the most common reasons cosmetics are recalled. A water-based product without a challenge test is hard to defend.
Not updating after a change. A new supplier for a botanical extract or a switch from a jar to a pump can change the safety picture.
Claims that change the product's legal status. A safety file does not make "treats acne" or "SPF 30" acceptable on a cosmetic; those are drug claims.
Put it in writing
A.P. Lyon's MoCRA Compliance Procedures ($345) include a Safety Substantiation procedure written to section 608, with a safety file checklist, an ingredient safety review record, an exposure and margin of safety worksheet, a safety assessment conclusion and an annual review form, all as editable Word documents. They are also part of the Cosmetic GMP and MoCRA Quality System ($995), which adds ISO 22716 production, laboratory and release procedures.
Browse all cosmetics documents, or contact A.P. Lyon about consulting.
The procedures need to be adapted to your products, suppliers and organization, and a qualified safety assessor should sign your safety assessments. They are documentation, not legal advice or certification.
Comments