What happened

In January 2026, FDA published draft guidance spelling out a MoCRA power many foreign brands overlooked: the agency can demand access to your records — including your safety records — and copy them. This isn’t a proposal. The authority already exists in the law; the guidance just explains how FDA plans to use it.

On January 21, 2026, FDA announced a draft guidance document titled “FDA Records Access Authority for Cosmetics Products: Guidance for Industry.” It explains how the agency will use the records-access authority that MoCRA added to the Food, Drug, and Cosmetic Act — specifically section 605 (adverse event records), section 610 (records tied to products that may cause serious adverse health consequences or death), and section 704(a)(1) (inspection authority over facilities that manufacture or process cosmetics).

The guidance was issued in draft form; the public comment period has since closed, and FDA is working toward a final version. But the underlying authority is already law — so the practical message for brands is simple: assume FDA can ask, and be ready.

When FDA can demand your records

FDA doesn’t get to browse your files at will. Under section 610, the agency may access and copy records when it reasonably believes a cosmetic product is likely adulterated and the use of or exposure to the product could cause serious adverse health consequences or death (FDA calls this “SAHCOD”).

The guidance says the situations most likely to trigger a records request are:

product recalls,
adverse event reports,
consumer complaints, or
inspection or sampling findings that point to a health threat.

Under section 605, FDA also has access to adverse event report records during inspections conducted under its inspection authority.

Which records are covered

The guidance lists the records FDA may access and copy, including:

manufacturing and processing records,
raw materials receipt records (ingredients and packaging),
product distribution records and customer distribution lists,
product inventory records,
raw ingredient and finished-product analytical/test results,
recall records,
consumer complaints and adverse event reports, and
safety substantiation records.

Responsible persons must keep these records for 6 years — 3 years for qualifying small businesses — and produce them on request. Records must be kept as originals or true copies, and FDA notes they may need to be provided in English.

What FDA may NOT access

The guidance also draws a line. FDA says it may not access:

your product recipes or formulations,
personnel information,
financial, pricing, and sales data (other than shipment records), and
research data other than safety substantiation data.

Your formulas stay yours. But nearly everything around how the product is made, tested, shipped, and complained about is fair game.

Why foreign brands should care most

Here’s the part that matters for brands selling from outside the US. Refusing FDA access isn’t a paperwork dispute — the statute provides for civil or criminal penalties, and for imported products, refusal can mean import refusal: your products stopped at the US border.

And FDA doesn’t need to fly to your factory. It reaches a foreign facility through the facility’s designated U.S. agent — the same U.S.-agent designation MoCRA requires foreign facilities to maintain. This is exactly the scenario the U.S.-agent requirement exists for: a US-based contact FDA can serve with requests on your behalf. If your agent designation on file is outdated or missing, FDA’s request has nowhere to land — and the consequences land on you.

What to do now

Three practical steps:

Organize the records listed above so you can produce them quickly — not scattered across inboxes and factory hard drives.
Check your retention periods. If you’re keeping safety and complaint records for less than 6 years (3 for small businesses), extend them now.
Confirm your U.S. agent designation on file with FDA is current — and that your agent will actually pick up when FDA calls.

A records request is not the moment to discover your files are a mess or your agent changed addresses two years ago.

This is a plain-English summary of draft guidance, not legal advice.

Stay ahead of MoCRA changes — download our free 12-step MoCRA compliance checklist: https://usmocraagent.com/free-mocra-checklist/ — and check whether you need a U.S. agent: https://usmocraagent.com/mocra-eligibility-checker/