One could almost hear a collective sigh of relief in the cosmetic industry on November 8, 2023. That day, the FDA (U.S. Food and Drug Administration) issued guidance, informing the industry that there would be a six month delay in enforcement of the requirements for cosmetic product facility registration and cosmetic product listing under MoCRA (Modernization of Cosmetics Regulation Act of 2022). Although the FDA explained that this six-month delay was reflective of their desire to “help ensure that industry has sufficient time to submit such facility registration and product listing information,” one can reasonably infer that this decision was also designed for the FDA’s benefit. Consider that the FDA has not yet completed its electronic portal for the submission of required information. Also, the FDA may be lacking the additional trained staff necessary to enforce the law – perhaps a budget or staffing issue.

This results in an intriguing issue for compliance and governance professionals, as well as the officers and corporate board members to whom they report. If a law is in effect, but enforcement will be postponed as a decision of the enforcement agency, how does this impact corporate governance and compliance? In other words, if your corporation is not compliant with the letter of the law, but is not at risk of being held accountable for its noncompliance, does the corporation have to disclose to its shareholders that it is non-compliant? Without enforcement, is compliance with law even relevant?

First, a little background on MoCRA, signed into law on December 29, 2022. It is the most significant expansion of the FDA’s authority to regulate cosmetics since 1938, when the FD&C Act (Food, Drug, and Cosmetic Act) was signed. In general, the FDA did not develop robust regulations for cosmetics, at least not in comparison to its regulatory requirements for drugs and medical devices. Nor did the FDA develop the strength of enforcement capabilities for cosmetics that the CPSC (Consumer Product Safety Commission) has been employing for decades, even though the CPSC was created in 1972.

Indeed, FDA’s enforcement role with cosmetics has been so under the radar that many, if not most, consumers would naturally default to the CPSC with any safety complaints about cosmetics. Cosmetics are consumer products, yes? No, not in the federal regulatory scheme. The definition of consumer products, drugs, and cosmetics can be quite murky for experts and more difficult for consumers. Soap, for instance, can be subject to CPSC or FDA regulations but never at the same time. What is soap? It depends! The FDA explanation and the CPSC’s guidance endeavor to make the distinction between their respective statutory responsibilities. Dove face soap = FDA. Dawn dishwashing liquid = CPSC. Yet, even Dawn informs its customers that they do not include triclosan as an ingredient in their dishwashing liquid because it is “banned by the FDA under certain conditions and uses.”

Further, under FDA regulations, soap can be a cosmetic or a drug or both. What it can’t be is a “cosmeceutical.” Previously, how the product was marketed would be more determinative than its components. MoCRA specifically amended the FD&C Act by including the definition of a “cosmetic product” as “a preparation of cosmetic ingredients with a qualitatively and quantitatively set composition for use in a finished product,” 21 U.S.C. § 364(2). Taken to its logical extension, by this definition, the inclusion of ingredients commonly recognized as having cosmetic properties may classify the product as a cosmetic even if the end-product is not intended to be marketed as a one.

In general, cosmetics have been defined by the FD&C as “articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body…for cleansing, beautifying, promoting attractiveness, or altering the appearance.” Included in this definition are products such as skin moisturizers, perfumes, lipsticks, fingernail polishes, eye and facial makeup preparations, shampoos, permanent waves, hair colors, toothpastes, and deodorants. , (https://www.fda.gov/cosmetics/cosmetics-laws-regulations/cosmetics-us-law#U.S._Law)

MoCRA requires the cosmetic industry to register with the FDA all their product facilities, and list all their cosmetic products, first marketed after December 29, 2022. Initially, this was to be accomplished within a year, by December 29, 2023, and the FDA was charged with enforcing these requirements immediately. Procrastination is endemic to meeting deadlines. Setting a late late December deadline without regard to prime holiday vacation time was a questionable scenario from the outset, negatively impacting corporate and government staff alike.

Accordingly, the delayed enforcement is a win-win for most everyone. Even if the cosmetics industry was able to comply with the new requirements in a timely fasion, it is understandable that  the FDA is not quite ready to enforce them. New staff would need to be hired and trained to perform new responsibilities. Also, based on the Guidance for Industry, it appears that, as recently as November 2023, the FDA had not completed its “Cosmetics Direct,” an electronic submissions portal for facilities registration and product listing.

For corporate compliance professionals, this raises an intriguing issue. The FDA’s guidance does not, and cannot, relieve companies from MoCRA requirements effective December 29, 2023. The FDA’s announcement addresses only one side of the equation — enforcement being delayed until July 1, 2024 (also, perilously close to prime vacation time). This is an important distinction. In essence, the law continues to require compliance, but the FDA will not enforce it until July 1, 2024.

This scenario is not too different than wondering whether a tree makes a sound in the forest if there is no one there to hear it. If your company is not in compliance with the statute, it’s not in compliance. However, the FDA’s guidance that it will delay enforcement for an additional six months is very relevant, as the company and its shareholders will not be exposed to financial penalties or reputational harm for that non-compliance. To cover all bases, compliance professionals in this industry would be well advised to report the status of compliance to the board now, especially if there is the possibility or the reality that your company will be non-compliant with MoCRA on December 29, 2023.

To avoid confusion, please note, MoCRA has many regulatory sections. This review addresses only the recent FDA guidance pertaining soley to facilities registration and product listings requirements. The FDA’s guidance delays enforcement of these sections to July 1, 2024. Specifically, the only new requirements of MoCRA that will not be enforced are:

• Facility Registration: Cosmetic product manufacturers and processors must register their facilities with FDA, update content within 60 days of any changes, and renew their registration every two years.
• Product Listing: A responsible person must list each marketed cosmetic product with FDA, including product ingredients, and provide any updates annually. 

The FDA does not intend to enforce the registration requirements owners or operators of facilities that first engaged in manufacturing or processing a cosmetic product after December 29, 2022, or the listing requirement for cosmetic products first marketed after December 29, 2022, until July 1, 2024.

Other aspects of MoCRA will take effect on December 29, 2023, per the Act and without delay, including mandatory recall authority, adverse event reporting, and records access.

“I love deadlines. I love the whooshing noise they make as they go by.”

Douglas Adams, The Salmon of Doubt – Hitchhiking the Galaxy One Last Time

Debra Rade is an attorney, adjunct professor of legal ethics, speaker on corporate governance and compliance, and business consultant. She has been a c-suite executive, as well as a board member of a publicly traded FTSE 100 global company.