Last reviewed: October 22, 2026. General information, not legal advice.
If your brand name is on a cosmetic label, the Modernization of Cosmetics Regulation Act (MoCRA) most likely makes you the responsible person, even if a contract manufacturer makes and fills your product. That role carries specific duties. Separately, the facility that makes your product has its own obligations, and ISO 22716 is the clearest guide to the manufacturing practices FDA has been directed to set.
Who is the responsible person?
Under MoCRA, the responsible person is the manufacturer, packer or distributor whose name appears on the product label. For most private-label and indie brands, that's the brand owner, not the lab that fills the bottles.
What the responsible person must do
- List each product with FDA, including its ingredients, and update the listings every year.
- Keep safety substantiation records showing the product is safe under its labeled or customary use. FDA notes that the law doesn't require specific tests, and animal testing isn't required.
- Report serious adverse events to FDA within 15 business days, and send any new medical information received within a year of the first report within 15 business days too.
- Keep the label compliant, including the information consumers need to report adverse events.
What the facility must do
The owner or operator of each facility that manufactures or processes cosmetics for the U.S. market must register it with FDA and renew the registration every two years. If you use a contract manufacturer, ask for their registration number. Their registration doesn't cover your listing or safety duties.
Where ISO 22716 fits
MoCRA directs FDA to set good manufacturing practice (GMP) regulations for cosmetic facilities. As of early 2026, FDA had not issued final cosmetic GMP regulations. Until it does, ISO 22716, the international guideline for cosmetic GMP, is the most practical benchmark, and many retailers already ask suppliers for evidence of it.
For manufacturers, ISO 22716 readiness means documented procedures, trained staff, controlled materials, deviation and complaint handling, and supplier controls. For brands, it gives you a standard to measure your manufacturer against.
What about small businesses?
FDA says certain small businesses are exempt from facility registration, product listing and the coming GMP requirements. The exemption doesn't apply to some product types, including products that contact the eye's mucous membranes, injected products, products for internal use, and products meant to alter appearance for more than 24 hours. Safety, labeling and adverse-event duties still apply to everyone.
A quick self-check
- Whose name is on your label? That person or company is likely the responsible person.
- Is each product listed with FDA, and are the listings current this year?
- Can you show safety substantiation records for every product?
- Do you have a written process to receive, investigate and report serious adverse events within 15 business days?
- Do you know your manufacturer's registration status and GMP practices?
If any answer is "not sure," start there. Our MoCRA compliance consulting maps exactly which duties are yours, and our ISO 22716 GMP readiness work prepares manufacturers for the audits that follow.