MoCRA Compliance in 2026: What Your Manufacturer Covers, and What Your Brand Still Owns
There is a moment that arrives for almost every beauty founder once their product starts gaining traction. A larger retailer asks for documentation. A distributor wants to confirm regulatory standing. An investor's diligence checklist includes a line item about FDA registration. And the founder, often for the first time, has to answer a question they assumed had already been handled somewhere upstream: who is actually responsible for compliance here?
The most common answer founders give themselves is also the most expensive one. They assume the manufacturer takes care of "all the FDA stuff." It is an understandable assumption, and in a pre-2023 world it was nearly true, because the regulatory bar was so low that there was very little stuff to take care of. That world no longer exists. The Modernization of Cosmetics Regulation Act, known as MoCRA, has changed what compliance means in U.S. beauty, and more importantly, it has changed who carries which part of the obligation. Understanding that division is one of the clearest markers separating a brand that is genuinely retail-ready from one that only looks ready on a pitch deck.
What MoCRA actually changed
For most of the last eighty-plus years, the FDA's authority over cosmetics was minimal. A brand could bring a product to market without pre-market review, facility registration was voluntary, and the agency could generally only respond after something had already gone wrong. MoCRA replaced that voluntary posture with an enforceable framework. It did not do this to make life harder for founders. It did it because an industry that had grown into something serious was still operating on infrastructure built for a much smaller, much slower market. The regulation is, in the most practical sense, the industry catching up to its own scale.
Several obligations now sit at the center of that framework. Facilities that manufacture or process cosmetics for U.S. distribution must register with the FDA and renew that registration on a biennial cycle. Every cosmetic product sold in the U.S. must be listed individually with the agency, including its full ingredient declaration and product category, and that listing must be updated annually. Brands must maintain adequate safety substantiation for their products. Serious adverse events must be reported within a defined window and the supporting records retained for years. Labeling requirements have expanded to include domestic contact information for adverse event reporting and clearer fragrance allergen disclosure. None of this is theoretical anymore. Enforcement is active, and a product that is not properly registered and listed can be treated as misbranded or adulterated, which is the kind of status that creates border holds, retailer pushback, and recalls.
The division most founders get wrong
Here is the distinction that matters most, and the one that quietly catches brands off guard. MoCRA splits responsibility between two parties, and they are not interchangeable.
The manufacturer is responsible for registering and maintaining the facility where products are made. That is the facility registration piece, renewed on its biennial cycle, tied to the facility's FDA Establishment Identifier. A capable contract manufacturer handles this as a matter of course, and a brand should be able to ask for confirmation of that registration without hesitation.
The brand, however, is almost always the Responsible Person under the law. The Responsible Person is the manufacturer, packer, or distributor whose name appears on the product label, and in practice that is the brand itself. The Responsible Person owns the product listing for every individual product, owns the annual update obligation when a formula changes or a new shade launches, owns the safety substantiation file, and owns the adverse event reporting process. These obligations do not transfer to the manufacturer simply because the manufacturer made the product. They sit with the brand, by name, in federal records.
This is where the comfortable assumption breaks. A founder who believes their manufacturer is handling "everything" may have a perfectly registered facility behind their product and still be personally out of compliance on the listing and substantiation side, because no one ever clarified that those pieces were theirs to carry. The gap rarely surfaces during quiet periods. It surfaces at exactly the wrong moment: during retailer onboarding, during an acquisition conversation, during a diligence review, when someone finally asks for the documentation and it is not there.
The exemption that feels like relief and isn't
MoCRA does provide a small business exemption. Brands with average gross annual U.S. cosmetic sales under one million dollars across the preceding three years are exempt from facility registration, product listing, and the forthcoming GMP requirements. On paper this reads like a reprieve for early-stage founders, and for some it genuinely is. But two things deserve a closer look before anyone treats it as a finish line.
First, the exemption does not apply at all to certain higher-risk product categories, including products that regularly contact the mucous membrane of the eye, products intended for internal use, injectables, and products that alter appearance for more than twenty-four hours under normal use. A single non-exempt product in your lineup pulls you into the full set of requirements regardless of revenue.
Second, and more strategically, exemption from a regulation is not the same as readiness for the market that regulation governs. A brand planning to stay small and direct-to-consumer may be comfortable inside the exemption for a while. A brand planning to move into national retail will cross the threshold, and retailers and investors increasingly expect to see this infrastructure in place well before the law strictly compels it. The exemption buys time. It does not build the documentation, the substantiation, or the manufacturing relationships that retail readiness actually requires. Treating the exemption as time to prepare rather than time to wait is the difference between scaling on schedule and scrambling to retrofit compliance under deadline pressure.
Why this belongs in a valuation conversation
It is tempting to file all of this under operations and move on, but compliance has quietly become a financial variable. When a brand is evaluated for acquisition, for retail placement, or for investment, the quality of its regulatory and manufacturing documentation is part of what is being priced. Clean substantiation files, current product listings, a manufacturing partner with a properly maintained facility registration, batch records that hold up to inspection — these are not back-office details to a sophisticated buyer. They are evidence of whether the brand can be scaled without inheriting hidden liability.
This is the same idea we keep returning to across everything we build at Vaulabs. Clean beauty was never meant to be a marketing aesthetic. It is a standard, and standards require structure. Transparency, testing, and documentation are not the unglamorous cost of doing business in this space; they are increasingly the competitive advantage. The brands that understand this early are the ones positioned to move when a real opportunity arrives, rather than discovering at the worst possible moment that their marketing readiness has outrun their operational readiness.
What to actually look for in a manufacturing partner
Because the brand carries the Responsible Person obligations, the right manufacturing partner is not the one that promises to make compliance disappear. No credible manufacturer can take legal responsibility off a brand's name, and any that claims to should be treated with caution. The right partner is the one that operates from a properly registered, GMP-aligned facility, maintains its own registration current, and works alongside your team so that the pieces you own are genuinely supported rather than quietly neglected.
In practice that means a partner who can confirm facility registration without friction, who builds and retains the production and quality documentation that your substantiation depends on, and who understands the product listing and labeling requirements well enough to help you prepare what you are responsible for filing. It means a relationship structured around the long arc of a brand moving toward retail, not a single transactional production run. The manufacturer cannot be the Responsible Person for you, but the manufacturer can be the reason the Responsible Person obligations are straightforward to meet instead of a source of risk.
That is the role we set out to play. Vaulabs operates as an FDA-registered, GMP-compliant clean beauty manufacturer in Clearwater, Florida, and we work with founders as a long-term infrastructure partner — building the formulation, documentation, and manufacturing backbone that retail-ready brands are eventually asked to prove they have.
If you are scaling toward retail and want to understand where your compliance infrastructure stands today, that is a conversation worth having early rather than under pressure. You can reach us at info@vaulabs.com or book a call to talk it through.
This article is intended as general education on the current MoCRA landscape and does not constitute legal or regulatory advice. For requirements specific to your brand and product categories, work with a qualified regulatory professional. Vaulabs supports brands with manufacturing and filing preparation; the Responsible Person obligations under MoCRA remain with the brand.