New Draft Guidance Addresses FDA’s Records Access Authority for Cosmetics Under MoCRA

Among its many other provisions, MoCRA added Sections 605 and 610 and amended Section 704 of the federal Food, Drug, and Cosmetic Act (FDCA), establishing new authorities for the FDA to access and copy records related to cosmetic products. The newly issued draft guidance addresses the scope of the FDA’s authority under Sections 605, 610, and related provisions, including the entities that are subject to record access requirements, when the FDA may exercise these new authorities, record retention requirements, the protection of confidential information, and possible consequences for refusing record access to the agency.

Section 704: FDA Inspection Authority

As a reminder, though not addressed in detail in the guidance, MoCRA amended FDCA Section 704 (21 U.S.C. § 374) to extend the FDA’s inspectional authority over all records and other information described in Sections 605, 606 (21 U.S.C. § 364b) (cosmetic current good manufacturing practices), and 610, from facilities that manufacture and process cosmetic products.

Section 605: Adverse Events

FDCA Section 605 (21 U.S.C. § 364a) provides the FDA with the authority to access records related to cosmetic adverse event reports during an inspection. Under this provision, the FDA’s records access authority applies specifically to the “responsible person” for a cosmetic product, i.e., the manufacturer, packer, or distributor whose name appears on the product label.

Within the scope of an inspection under Section 704, records related to each adverse event report received by a responsible person and associated with the use of a cosmetic product in the United States must be made available to the FDA. 

In the draft guidance, the FDA notes that the types of records the agency may access under Section 605 include communications between the responsible person and individuals who provided adverse event information, records of the responsible person’s assessment of the event as serious or non-serious, and for serious adverse events, the responsible person’s serious adverse event report to the FDA along with any attachments, new material medical information, and follow-up reports. 

Records must be retained in paper or electronic format for six years after creation (or three years for small businesses that do not engage in manufacturing or processing of certain cosmetic products under Section 612(b)).

Section 610: Threat of SAHCOD

FDCA Section 610 (21 U.S.C. § 364f) provides the FDA with the authority to access and copy all needed records related to a cosmetic product if the agency believes that the product, an ingredient in the product, or any product that the agency believes is likely to be affected in a similar manner, is likely to be adulterated such that the use or exposure to the product presents a threat of serious adverse health consequences or death (SAHCOD). Unlike Section 605, the FDA’s authority under Section 610 applies to both responsible persons and cosmetic facilities. The FDA may exercise its authority under Section 610 when it has a reasonable belief that a cosmetic product, including an ingredient, is likely to be adulterated such that use or exposure presents a threat of serious adverse health consequences or death. 

Upon presentation of appropriate credentials and written notice to the responsible person or facility, and at reasonable times within reasonable limits and in a reasonable manner, records related to such cosmetic products must be made available to the FDA. Records subject to access in SAHCOD situations may include manufacturing records, raw materials receipt records, product distribution records, product inventory records, raw ingredient and finished product analytical results, recall records, customer distribution lists, complaint and adverse event records, and safety substantiation records. The FDA may request records maintained in any format and at any location, recognizing that some companies store records at locations other than the establishment where covered activities take place.

The FDA’s authority under Section 610 does not extend to certain categories of records, including recipes or formulas for cosmetics, financial data, pricing data, personnel data (other than qualifications of technical and professional personnel performing functions subject to the FDCA), research data (other than safety substantiation data for cosmetic products and their ingredients), and sales data (other than shipment data regarding sales). 

Per the draft guidance, an FDA request for records under Section 610 is most likely to occur when the agency becomes aware of product recalls, adverse event reports, consumer complaints, situations in which specific cosmetic products present a threat of SAHCOD, or inspections or sampling that reveal conditions indicating a cosmetic product presents a threat of SAHCOD. 

The draft guidance provides examples of situations that may increase the potential that a cosmetic may cause SAHCOD, including:

• Microbial contamination: presence and/or growth of pathogenic or opportunistic microorganisms that may cause infection, irritation, or other adverse reactions.

• Chemical or toxicological hazards: presence of unsafe ingredients, impurities, or contaminants that may trigger acute or severe reactions.

• Design-or-use related vulnerabilities: cosmetic forms or applications that cause unintended contact with sensitive areas of the body (such as eyes) or allow systemic exposure to potentially harmful ingredients. 

• Improper storage, distribution, or labeling: conditions that compromise the product or result in unsafe use.

The draft guidance additionally provides examples of situations in which cosmetic products may cause SAHCOD, including:

• Microbial contamination with pathogens such as Burkholderia cepacia, Pseudomonas aeruginosa, Serratia marcescens, or Staphylococcus aureus.

• Contaminated tattoo inks.

• Products containing unsafe levels of heavy metals such as lead or cadmium.

• Products containing Benzimidazole pigments that may cause allergic reactions.

• Nail products containing toxic solvents or contaminated applicators.

Finally, the draft guidance explains the FDA’s interpretation of the statutory language permitting access to records for products “likely to be affected in a similar manner,” noting that the conditions leading to adulteration often extend beyond a single batch or product. In the guidance, the FDA provides examples of situations in which a product may be considered “likely to be affected in a similar manner” to an adulterated cosmetic, including:

• Products manufactured or processed at the same time, location, or on the same equipment without adequate controls.

• Products manufactured using the same or similar ingredients, containers, or closures.

• Products manufactured in proximity without proper separation or controls.

• Products affected by systemic process deficiencies in sterilization, preservation, pH adjustment, microbial testing, or labeling controls.

• Products using raw materials, ingredients, or packaging from the same supplier that was the source of contaminated or defective inputs.

Confidentiality Protections

The FDA indicates in the draft guidance that it will comply with all applicable protections against unauthorized disclosure of non-public information obtained through records access, noting that the agency’s disclosure of information to the public is governed by several statutes, including the Trade Secrets Act, FDCA, and Freedom of Information Act, along with the FDA’s information disclosure regulations at 21 C.F.R Part 20. The guidance states that FDA personnel will only disclose non-public information as permitted by law and the FDA’s procedures, and the regulations permit agency officials to disclose certain non-public information to other federal, state, local, or foreign government officials, or to the FDA’s contractors, if certain conditions are met.

Consequences of Refusal to Permit Access

Finally, the draft guidance addresses the actions the FDA may take if an entity refuses to permit access to records under Sections 605 and 610. 

To note, a refusal to permit access to or copying of adverse event records under Section 605 or SAHCOD records under Section 610 is prohibited under FDCA Section 301(e) (21 U.S.C. § 331(e)). Additionally, it is a prohibited act to fail to establish or maintain any adverse event record, or to fail to make any adverse event report, required by Section 605. Under the FDCA, the FDA may (1) bring civil actions in federal court to enjoin persons who commit prohibited acts, and (2) bring criminal actions in federal court to prosecute persons responsible for the commission of prohibited acts. 

With respect to imported cosmetic products, the FDA may refuse admission of cosmetic products offered for import into US commerce if the agency has credible evidence or information indicating that the responsible person has not allowed access to records described in Section 605 or has not complied with other requirements of Section 605. 

Key Takeaways

Companies manufacturing, processing, packing, or distributing cosmetic products should review their existing recordkeeping policies and procedures to ensure compliance with the records access requirements described in the draft guidance. 

Responsible persons should ensure they maintain adverse event records in paper or electronic format for the required retention periods and should be prepared to make such records available to the FDA during inspections. Companies should also assess their manufacturing and supply chain documentation to ensure they can respond to FDA requests for records in SAHCOD situations. 

Finally, cosmetic companies should take note that the FDA is accepting comments on this draft guidance until March 23.

If you are interested in more information about MoCRA or are seeking guidance on any cosmetic-related requirements, please contact Shoshana Golden, Emily Cowley Leongini, or a member of our Food, Drug, Medical Device & Cosmetic team.