FDA Cosmetics Compliance: Understanding FDA Records Access Under MoCRA

The U.S. Food and Drug Administration ("FDA") released a draft guidance document in January 2026 titled "FDA Records Access Authority for Cosmetic Products: Guidance for Industry" (the “Draft Guidance”). The Draft Guidance clarifies the agency's current position with respect to its authority to access and copy records related to cosmetic products under sections 605, 610, and 704 of the Federal Food, Drug, and Cosmetic Act ("FD&C Act") (including those sections added or amended by the Modernization of Cosmetics Regulation Act of 2022 ("MoCRA"). 

The Draft Guidance is directed towards "Responsible Persons," manufacturers, packers, and distributors whose names appear on the label of Cosmetic Products and "Facilities," those who manufacture or process Cosmetic Products distributed in the United States. "Cosmetic Products" are “preparations of cosmetic ingredients with qualitatively and quantitatively set composition for use in a finished product.” The intent of the Draft Guidance is to help Responsible Persons and Facilities understand the records maintenance requirements and records access conditions under the FD&C Act. 

FDA Access to Adverse Event Records

The Draft Guidance draws on the FD&C's definition for various terms, including for an "Adverse Event" which is "any health-related adverse event associated with cosmetic use," and a "Serious Adverse Event" which is an Adverse Event which, based on reasonable medical judgment, results in "death, a life-threatening experience, inpatient hospitalization, persistent or significant disability or incapacity, a birth defect or congenital anomaly, an infection, significant disfigurement (other than as intended)."  

The FDA has the authority to access and copy records related to Adverse Event information associated with a Cosmetic Product’s use in the United States. These records include all communications, reporting, and assessment of the Adverse Event, such as the assessment of the Adverse Event as serious or non-serious, medical information related to the Adverse Event, and any reports to the FDA. Importantly, these records must be retained in paper or electronic format as originals or true copies for 6 years (or 3 years for qualifying small businesses) after the date the record was created. 

FDA Access to Records for Products that May Result in Serious Adverse Health Consequences or Death

The FDA may access and copy records if it reasonably believes a cosmetic or ingredient is likely adulterated such that its use or exposure to the product poses a threat of serious adverse health consequences or death ("SAHCOD").  These records include records related to the “manufacture, processing, packing, distribution, receipt, or importation of the cosmetic product believed to be affected,” including records maintained by or on behalf of the Responsible Person, at any location. 

FDA may request access to these records when it becomes aware of (i) product recalls, (ii) adverse event reports, (iii) consumer complaints, or (iv) inspections or sampling that result in conditions indicating a Cosmetic Product presents a threat of SAHCOD. The types of records FDA may access and copy include, among others:

1. Manufacturing Records
2. Raw material receipt records
3. Raw ingredient and finished product analytical results
4. Safety substantiation records
5. Personnel data related to the qualifications of technical and professional personnel
6. Research data related to the safety substantiation data for the product and its ingredients

FDA may not access records related to:

1. Recipes or formulas
2. Financial data and pricing data
3. Personnel data (outside of technical and professional personnel)
4. Research data (outside of the product safety and substantiation data)
5. Sales data

The Draft Guidance includes examples of circumstances where a Cosmetic Product may increase the potential for a SAHCOD, such as microbial contamination, chemical or toxicological hazards, design-or-use related vulnerabilities, or improper labeling, storage or distribution, or in which a cosmetic product may cause a SAHCOD such as: 

• Cleansing cloths or alcohol-free mouthwash contaminated with the bacteria Burkholderia cepacia.
• Eye area Cosmetic Products contaminated with the bacteria Pseudomonas aeruginosa (which is linked to sight-threatening ocular infections).
• Tattoo ink with microbial contamination (which may result in systemic and localized infections).
• Skin care products contaminated with Staphylococcus aureus or other harmful bacteria (which may lead to skin infections or systemic illness).
• Cosmetic Products with unsafe levels of heavy metals (e.g., lead, cadmium).

The Draft Guidance clarifies that the following entities and activities are excluded from the above requirements—(i) beauty shops (unless manufacturing on-site), (ii) retailers (unless manufacturing non-retail products), (iii) hospitals, physician offices, and nonprofits providing direct-to-consumer products, (iv) complimentary providers like hotels, trade shows, and research-only entities, or (v) entities solely involved in labeling, relabeling, packaging (excluding filling), repackaging, holding, or distributing. 

Companies in the cosmetics industry, including Responsible Persons and Facilities, should review the Draft Guidance and evaluate their records systems for Adverse Event tracking and SAHCOD preparedness.