Records FDA Can Demand During a Cosmetic Safety Issue

Picture the phone call nobody wants: a customer's rash escalates, a dermatologist gets involved, and someone from FDA has questions. Under MoCRA, that call is not hypothetical for a US cosmetic brand anymore. The Modernization of Cosmetics Regulation Act gave FDA real tools to ask for records when there is reasonable belief a product poses a serious health threat, and the honest answer to "what will they want" is: whatever paper trail proves you knew your product was safe before you sold it.

What triggers the request

FDA does not need a full-blown recall or a confirmed pattern of injuries to start asking questions. A reasonable belief that a cosmetic is adulterated and that the adulteration presents a serious health threat is enough to open the door to a records request. That threshold is intentionally lower than what would be needed for something like a mandatory recall order, because the point of the authority is to let FDA move fast when there's smoke, not wait for a confirmed fire.

The categories of records at stake

MoCRA's broader framework rests on facility registration, product listing, a named responsible person, safety substantiation, and adverse event recordkeeping. When a safety issue triggers a records request, it typically touches several of these at once:

• Safety substantiation. The documentation that supports your claim the product is safe for its intended use. This can include stability data, challenge testing, toxicology references for individual ingredients, or a formal safety assessment.
• Adverse event records. Any reports you have received from consumers, retailers, or your own customer service channel describing a reaction or injury tied to the product, along with what you did in response.
• Product listing information. Confirmation that the formula on file matches what is actually being sold, since a mismatch between your listing and your real formula is its own separate problem.
• Responsible person identification. Records showing who is designated as the responsible person for the product and that this designation was current at the time of sale.

What "being ready" actually looks like

The businesses that handle this well are not the ones scrambling to reconstruct history after a request lands. They are the ones who already have a simple, boring habit: every time a customer reports a reaction, it gets logged, dated, and kept, whether or not the brand thinks the complaint has merit. Every time a formula changes, the safety substantiation file gets updated to match, not left pointing at an old version of the recipe.

A short list worth keeping current at all times:

1. A dated log of every adverse event report received, with enough detail to reconstruct what was reported and how it was handled.
2. Current safety substantiation tied to the exact formula being sold right now, not a prior version.
3. A clear record of who your responsible person is and since when.
4. Product listing records that match your actual current formula and label.

Record type	Why FDA asks for it	Where it usually lives
Adverse event log	Establishes pattern, timing, and your response	Customer service system or a dedicated log
Safety substantiation file	Shows you had a basis to believe the product was safe before selling it	Formulator's files, lab reports, safety assessments
Product listing	Confirms the sold formula matches what FDA has on record	Your MoCRA product listing submission
Responsible person record	Confirms accountability is assigned and current	Internal compliance records

Small businesses and the exemption question

MoCRA includes exemptions from registration and listing for some small businesses, but that exemption is narrow and does not blanket-cover every recordkeeping obligation. It is worth checking the current FDA guidance directly rather than assuming a small operation is automatically off the hook for every piece of this, since the details of who qualifies and for which requirements can be specific and are best confirmed at the source.

Keeping this from being a fire drill

The unglamorous truth is that most of what FDA would ask for in a safety issue is the same paperwork a careful brand should already be keeping for its own sake. If your adverse event log is scattered across email threads and a group chat, or if your safety substantiation file is a folder nobody has opened since the original formulation, that is the moment to fix it, not after a letter arrives.

If your main exposure right now is on the notification and ingredient-mapping side rather than the recordkeeping side, that is a different piece of the puzzle. Cosmetic Comply currently handles the Canadian Cosmetic Notification Form workflow, mapping ingredients to INCI names and CAS numbers and screening them against the Hotlist, with US support on the way. For the US side today, the practical move is simply making sure your adverse event log, your safety substantiation, and your product listing all describe the same product, updated at the same time, every time something changes.