FDA doesn’t approve your cosmetic before you sell it. But MoCRA requires you to hold proof that it’s safe — before the first unit ships. No safety file, no legal product.
Here’s what “adequate safety substantiation” actually means and what belongs in your file.
What the law requires
MoCRA says every cosmetic must have adequate safety substantiation: tests, studies, research, analyses, or other information that experts consider sufficient to support a reasonable certainty the product is safe under its labeled conditions of use.
Key points: Before marketing — the substantiation must exist before you sell, not after someone complains. You define the package — FDA doesn’t prescribe an exact test battery, but “we think it’s fine” isn’t substantiation. Without it, the product is adulterated — that’s the legal consequence, and adulterated products are subject to enforcement.
What’s typically in a safety file
A defensible safety file usually includes: Ingredient safety data — toxicological profiles for each ingredient, CIR (Cosmetic Ingredient Review) findings where available, allergen and impurity information. Stability testing — typically 3 months accelerated plus 12 months real-time. Preservative challenge testing — proving the preservation system works. Microbial testing — finished-product limits met. Skin compatibility data — patch testing or HRIPT where relevant. Packaging compatibility — the formula stays safe in its actual container. Directions and warnings — the label tells consumers how to use it safely (see MoCRA labeling changes).
The file must cover this specific formula, in this specific packaging, used as directed — not just “these ingredients are generally safe.”
Who keeps the file
The responsible person — the name on the label. If you’re the brand, it’s you, even if a contract manufacturer made the product and even if a lab ran the tests. Contract manufacturers and importers should make sure the file actually exists and they can access it.
You don’t submit it — but FDA can demand it
Safety substantiation isn’t filed with FDA. You hold it. But MoCRA gave FDA records access authority: if the agency has reason to believe a product presents a threat of serious harm, it can demand your safety records. Our breakdown of that power: FDA Can Now Demand Your Records.
An empty or thin file at that moment becomes an enforcement problem.
What happens without substantiation
A product without adequate safety substantiation is adulterated under MoCRA. That exposes you to the full enforcement ladder: import refusal, warning letters, mandatory recall. The full picture: MoCRA Non-Compliance Risks.
Do small businesses get a pass?
The small-business exemption (under $1M average annual U.S. sales) covers facility registration and product listing — not safety substantiation or adverse event recordkeeping. Small brands still need their safety files.
New to MoCRA? Start with our complete MoCRA Compliance Guide for Cosmetic Brands (2026).
Frequently asked questions
Does FDA approve my safety file before I launch? No. There’s no pre-market submission for safety substantiation. You build the file, hold it, and produce it if FDA asks.
What if my contract manufacturer did the testing? Get copies. The legal obligation sits with the responsible person (you, if your name is on the label). “The manufacturer has it” isn’t a defense if you can’t produce it.
Is a CIR report on each ingredient enough? It’s a strong start, but substantiation covers the finished formula — stability, preservation, microbial limits, packaging interaction. Ingredient data alone is usually incomplete.
How does this relate to adverse event reporting? They’re connected: your safety file is your pre-market proof, and adverse event reports are your post-market surveillance. A pattern of adverse events can undermine your substantiation.
I’m importing — does my foreign factory handle this? The factory may generate the data, but the U.S. responsible person (often you, the importer) owns the obligation. Make safety-file delivery part of your supplier agreement. See our importer guide.
This article is for educational purposes only and is not legal advice. US MoCRA Agent is a private service provider and is not affiliated with or endorsed by the FDA. Regulatory details are based on FDA’s published guidance and are current as of September 2026; always verify requirements against FDA’s official sources before acting.
Pingback: MoCRA Compliance Guide for Cosmetic Brands (2026)