MoCRA Safety Substantiation in 2026: What to Expect from Your Cosmetic Testing Laboratory

For most of the past 80-plus years, the FDA’s authority over cosmetics was surprisingly limited. The agency couldn’t require pre-market safety testing. It couldn’t mandate recalls. Access to manufacturer records was restricted. That changed on December 29, 2022, when the Modernization of Cosmetics Regulation Act (MoCRA) was signed into law as part of the Consolidated Appropriations Act—the most significant expansion of cosmetic regulation since the Federal Food, Drug, and Cosmetic Act of 1938.

By December 29, 2023, domestic manufacturing facilities were required to complete facility registration. Product listing followed on a phased timeline. And the safety substantiation requirement—the provision with the broadest, most ongoing impact on brands—carries no hard deadline. It applies to every product currently on the market, including yours.

Yet the pattern we see repeatedly is the same: the facility registration got done, the product listing is in, and the safety substantiation file is somewhere in a shared drive half-finished. That’s not a compliance posture. That’s a liability waiting for an adverse event to trigger it.

What “Safety Substantiation” Actually Requires

MoCRA states that each cosmetic product must have “adequate substantiation of safety” before it’s marketed. The statute deliberately doesn’t prescribe a specific test battery—which sounds flexible, but is in practice a harder standard to meet than a checklist would be. The burden of proof sits entirely with the brand, and that proof needs to hold up under FDA scrutiny at any point after launch.

FDA has not yet finalized its Good Manufacturing Practice regulations for cosmetics (rulemaking is still in process as of mid-2026), but the substantiation standard is operative right now. And MoCRA’s enforcement teeth are real: the agency now holds mandatory recall authority over cosmetics, a power it lacked entirely under the old framework. Brands also must report serious adverse events—consumer hospitalizations, serious illness, or disfigurement linked to a product—within 15 business days of receiving a report. That’s a tight window. It assumes your lab data is already organized and your safety file is current, not something you assemble after the call comes in.

A defensible safety dossier for a typical leave-on cosmetic should include microbial quality data, preservative efficacy data, stability testing (both accelerated and real-time), heavy metals analysis, and ingredient purity documentation. Rinse-off products have slightly different limits, but the documentation requirement is the same: you need data, not assumptions.

The Six Tests That Build a Defensible Safety File

This is where working with a qualified cosmetic testing laboratory makes a material difference. A capable lab isn’t just running routine plate counts. It’s building a data package that tells a coherent safety story—one you can hand to a retailer quality team, an insurance underwriter, or an FDA investigator without apology.

1. Microbial Limits Testing (USP <61> / USP <62>) For rinse-off cosmetics, the total aerobic count limit under USP <61> is ≤ 1,000 CFU/mL. For leave-on products and anything used near the eye, that tightens to ≤ 100 CFU/mL. Absence testing for Staphylococcus aureus, Pseudomonas aeruginosa, and Candida albicans is required across most categories. When this data comes from an ISO 17025–accredited cosmetic testing laboratory, it carries a different weight in a regulatory context than results from a non-accredited source. Accreditation doesn’t just signal quality—it signals that the methods, instruments, and analyst competencies have been independently verified.

2. Preservative Efficacy Testing (ISO 11930) This is the test most brands cut and then regret. ISO 11930 challenges your formulation with 5 specified microorganisms—Escherichia coli, Pseudomonas aeruginosa, Staphylococcus aureus, Candida albicans, and Aspergillus brasiliensis—over a 28-day period. The test answers a question that microbial limits testing can’t: does your preservative system actually resist contamination in use conditions? For “clean beauty” formulations that have replaced traditional preservatives like parabens and phenoxyethanol with alternative systems, this test is not optional. The market has moved faster than the efficacy data on many natural preservative alternatives, and some formulations that test clean at time of manufacture fail in the hands of consumers within weeks.

3. Stability Testing Accelerated stability—typically conducted at 40°C and 75% relative humidity for a minimum of 3 months—provides a compressed view of how a formula behaves over time. Real-time stability at ambient conditions adds 12–24 months of longitudinal data. For products making specific efficacy claims, tracking active ingredient concentration retention through the stability window is essential. A competent lab monitors pH drift, viscosity, color, microbial counts at intervals, and phase separation. Stability data isn’t just a regulatory requirement—it’s the evidence that your expiration date is grounded in something other than a guess.

4. Heavy Metals Analysis (ICP-MS) Lead, arsenic, cadmium, and mercury screening is non-negotiable for lip products, eye shadow, skin creams applied over large surface areas, and anything used on children. FDA has issued guidance recommending a lead limit of 10 ppm in lip cosmetics. California’s Toxic-Free Cosmetics Act separately restricts mercury in cosmetics to 1 ppm as an intentionally added ingredient. ICP-MS (inductively coupled plasma mass spectrometry) is the method of choice—it delivers parts-per-billion sensitivity that colorimetric methods and older flame AAS approaches can’t reliably match at the limits regulators care about.

5. PFAS Screening California’s Toxic-Free Cosmetics Act (AB 2762), effective January 1, 2025, prohibits intentionally added per- and polyfluoroalkyl substances (PFAS) in cosmetics sold in the state. “Intentionally added” is doing important legal work in that phrase—it doesn’t require testing for trace environmental contamination at parts-per-trillion levels. But if your formulation uses any ingredient that could carry PFAS as part of its chemistry (certain fluoropolymers, some silicone conditioning agents, specific waterproofing ingredients), you need ingredient-level documentation and, ideally, analytical verification from your raw material suppliers that you can pass along.

6. Fragrance Allergen Documentation MoCRA added a new labeling disclosure requirement: fragrance allergens present at or above 0.01% in leave-on products, or 0.1% in rinse-off products, must be disclosed individually on the label once FDA finalizes its allergen list. The final rule is expected in 2026. Getting ahead of this now—by working with your cosmetic testing laboratory and fragrance suppliers to document allergen concentrations—prevents a label redesign emergency later. It also positions you better if California pursues its own fragrance transparency requirements, which have been discussed in regulatory circles.

California’s Toxic-Free Cosmetics Act: A Second Compliance Layer Brands Can’t Ignore

If you sell into California—and if you sell anywhere in the US through major retail or e-commerce channels, you almost certainly do—AB 2762 creates compliance obligations that exist entirely independently of MoCRA and carry their own enforcement mechanisms through the California Department of Public Health.

The law bans 24 ingredients in cosmetics sold in the state, including formaldehyde and formaldehyde-releasing compounds (quaternium-15, DMDM hydantoin, imidazolidinyl urea), several phthalates (dibutyl phthalate and diethylhexyl phthalate), mercury compounds, resorcinol, toluene, triclocarban, and PFAS ingredients. Most restrictions became operative on January 1, 2025. Brands still formulating with these ingredients and shipping to California are out of compliance today.

The practical challenge is that some of these ingredients don’t announce themselves in formulations. Formaldehyde, for instance, is released over time by certain preservatives—it’s a product of ingredient chemistry, not a labeled addition. Similarly, PFAS can appear in raw materials that aren’t marketed as PFAS-containing. This is where raw material testing and supplier qualification become part of your cosmetic compliance program, not just your quality program. A cosmetic testing lab with both chemistry and microbiology capabilities can screen finished products and raw material inputs, generating documentation that stands up when a retailer’s quality team asks to see your California compliance evidence.

What to Actually Look for in a Cosmetic Testing Laboratory

Not every cosmetic testing lab is positioned to support MoCRA substantiation, and the differences matter more than most brands realize until they’re in the middle of an audit.

ISO 17025 accreditation, with scope verification. The accreditation credential matters, but so does the scope. Ask which specific methods are listed within the lab’s accreditation—USP <61>, USP <62>, ISO 11930, ICP-MS heavy metals. A lab can hold ISO 17025 for one method and run a dozen others outside its scope. For FDA-facing safety substantiation, you want data that falls within the accredited scope.

Both microbiology and chemistry capabilities in-house. A lab that handles microbial limits, challenge testing, heavy metals, and PFAS screening under one roof eliminates sample chain-of-custody gaps that create documentation vulnerabilities. When your safety dossier pulls data from three different labs, reconciling the methodology, sample handling, and reporting formats into a coherent package takes work—and introduces error opportunities.

Regulatory interpretation, not just data delivery. Your lab should be able to tell you whether your preservative efficacy result meets criterion A or criterion B under ISO 11930, what the difference means for your product category and intended consumer, and how to document the interpretation in a way that supports your substantiation narrative. Raw results without context don’t serve you in a regulatory review.

At Qalitex, we work with cosmetic brands across Southern California and nationwide at every stage—from pre-launch stability planning to safety file remediation for brands that completed MoCRA registration and then realized their testing documentation wasn’t sufficient to actually substantiate their products’ safety. The difference between a product that clears a retailer quality audit and one that triggers a voluntary recall almost always traces back to whether safety data was built proactively or assembled under pressure.

Start with the Highest-Risk Items on Your Line

If you have products currently on the market and your safety substantiation file is incomplete, start with preservative efficacy and heavy metals. Those are the areas where FDA receives the highest volume of cosmetic adverse event reports, and they’re the areas where California’s independent enforcement is most active.

Brands with launches planned in the next 90 days need to be in active testing right now. Accelerated stability takes a minimum of 3 months to generate—that’s not a lab turnaround time, that’s physics. If your Q4 launch hasn’t started stability, you’re already behind schedule for having compliant substantiation data at launch.

MoCRA didn’t create a pre-market approval process. It created an accountability standard that follows products into the market. The brands that treat that seriously—and build their testing programs accordingly—are the ones that won’t learn the hard way what FDA’s mandatory recall authority looks like in practice.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Regulatory Strategy and Audit Readiness for Cosmetic Brands — Aurora TIC helps US companies build regulatory programs that hold up under FDA review, from MoCRA compliance frameworks to CGMP readiness assessments.
• Raw Material Testing and Supplier COA Verification — Ayah Labs provides ingredient-level analytical testing and supplier qualification support for brands that need to verify what’s actually in their formulations before it becomes a finished-product problem.