MoCRA in 2026: A Cosmetic Testing Laboratory's Guide for Small and Indie Brands

Before December 29, 2022, FDA couldn’t order a cosmetic recall. It could issue warnings, publish safety alerts, negotiate voluntary withdrawals with manufacturers — but it had no authority to compel a product off shelves. That changed when the Modernization of Cosmetics Regulation Act (MoCRA) became law, ending 84 years of federal cosmetic oversight that most industry observers had long described as structurally inadequate.

For large cosmetic manufacturers with established quality systems, MoCRA represented extra paperwork. For indie and small brands that built their businesses in the regulatory gray zone of pre-MoCRA cosmetics, it represented something closer to a structural overhaul. The question we hear most often from emerging brands — particularly those in Southern California where we work with dozens of indie formulators — is a simple one: what do I actually need to test now?

Here’s a direct answer, built on what our cosmetic testing laboratory team sees daily across hundreds of product submissions.

What MoCRA Actually Changed — and Why Small Brands Feel It Most

The law introduced several concrete requirements that took effect December 29, 2023:

• Facility registration: Every facility that manufactures or processes cosmetics sold in the US must be registered with FDA. This applies whether you own your facility or use a contract manufacturer — the co-packer’s facility needs its own registration.
• Product listing: Each distinct cosmetic product must be listed with FDA, including a full ingredient disclosure. Different formulas count as distinct listings; different sizes or fragrance variants of the same formula do not.
• Serious adverse event (SAE) reporting: If a consumer reports a serious adverse event — disfigurement, hospitalization, death, or significant disability — your company has 15 business days to submit a report to FDA from the date it reaches you.
• Safety substantiation: Every cosmetic must be supported by “adequate substantiation” of safety. This requirement existed in principle before MoCRA, but it’s now statutory — meaning it’s enforceable, not advisory.
• Mandatory recall authority: FDA can now compel cosmetic recalls. Before MoCRA, the agency had to rely on voluntary cooperation.

There’s a small business exemption, but it’s narrower than most founders expect. To qualify, a company must average less than $1 million in gross annual cosmetics sales and must not have filed any new drug applications or pre-market approval applications with FDA. If you’re scaling past that threshold — or if you’re selling through retail or online channels that require compliance documentation regardless of size — plan your testing program as if the exemption doesn’t apply. It’s a safer assumption.

Safety Substantiation: The File You Need Before FDA Asks

The phrase “adequate substantiation of safety” does heavy regulatory lifting in MoCRA, and FDA has deliberately left it flexible while issuing ongoing guidance documents. That flexibility is useful for formulators working across very different product types. But it also means brands need to make defensible choices about what their safety file actually contains.

In practice, a cosmetic safety substantiation file that holds up to FDA review, retail partner audits, or Amazon compliance requests typically includes:

1. Microbial limits testing — Total aerobic count, total combined yeast and mold count, and pathogen absence testing for Staphylococcus aureus, Pseudomonas aeruginosa, Candida albicans, and Escherichia coli. The reference methods are USP <61> and <62>.
2. Preservative efficacy testing (PET) — Documented proof that your preservative system works through the product’s labeled shelf life, run according to USP <51>.
3. Stability testing — Evidence the product remains safe and within specification over time. Accelerated stability at 40°C / 75% relative humidity for 3 months is widely accepted as a proxy for 12-month real-time data and gets safety files moving while real-time studies run in parallel.
4. Heavy metals screening — Lead, arsenic, cadmium, and mercury at minimum, analyzed by ICP-MS. This is particularly important for color cosmetics, lip products, and anything applied near the eyes or mouth.
5. pH verification — Critical for any formula where pH affects preservative efficacy or where skin compatibility claims are made.

A safety substantiation file isn’t a formality — it’s your documented argument that the product won’t harm the person using it. FDA can request it at any time under MoCRA’s recordkeeping provisions. Increasingly, so can retail buyers, Amazon’s third-party compliance team, and product liability insurers.

Preservative Efficacy Testing: Where Clean Beauty Meets Reality

This is the test indie brands skip most often. And it’s the one that causes the most preventable, expensive post-launch problems.

USP <51> preservative efficacy testing involves inoculating a finished product with five challenge organisms: Escherichia coli, Pseudomonas aeruginosa, Staphylococcus aureus, Candida albicans, and Aspergillus brasiliensis. The test runs for 28 days. At intervals on days 7, 14, and 28, the lab measures how much the microbial population has declined. For Category 2 cosmetics — which covers most non-sterile rinse-off and leave-on products — the USP criterion requires at least a 2 log reduction in bacteria by day 14, with no increase through day 28.

Brands formulating with “clean” or “natural” preservative systems — alternatives to phenoxyethanol, fermented radish root, levulinic acid and sodium anisate blends — frequently discover during PET that their system doesn’t consistently meet those criteria under challenge conditions. That’s a formulation challenge, not an indictment of natural preservation as a concept. But it needs to be solved before launch, with data, not with marketing language about botanical protection.

Water activity (Aw) is relevant here too. Products with Aw below 0.6 — anhydrous balms, face oils, solid serums, powder formats — are inherently inhospitable to microbial growth and may be supportable without conventional preservative systems. But the moment water enters the picture during consumer use (wet hands into a jar, a spray bottle drawn back into the formula), the calculation changes. Any water-containing emulsion needs a validated preservative system with PET data behind it.

We’ve seen brands launch products that passed visual stability and looked perfect on the shelf, only to fail PET at the 14-day checkpoint when we run retrospective testing following a consumer complaint. Reformulating a product that’s already in distribution — with retail inventory, printed packaging, and active Amazon listings — is expensive. The 28-day test cost before launch isn’t.

California Brands Face a Double Compliance Layer

Qalitex serves a large number of Southern California cosmetic brands, and that geography creates a specific compliance planning consideration. California has enacted cosmetic safety requirements that layer directly on top of MoCRA — and each layer carries its own testing implications.

AB 2762, the California Toxic-Free Cosmetics Act, fully took effect January 1, 2025. It bans the manufacture or sale of cosmetics in California containing any of 24 specified ingredients as intentional additions, including dibutyl phthalate, diethylhexyl phthalate, formaldehyde, methylene glycol, mercury and mercury compounds, isobutylparaben, and isopropylparaben, among others. Most conscientious formulators have already excluded these compounds. But “excluded from formulation” and “confirmed absent by analytical testing on finished product” are two different things in a compliance file. Ingredient testing on the finished product — not just a formulator’s statement — provides the defensible documentation when a retailer or regulator asks.

Proposition 65 adds another layer still. The MADL (Maximum Allowable Dose Level) for lead under Prop 65 is 0.5 micrograms per day — an exposure-based limit that depends on both concentration in the product and realistic consumer use patterns. A lip product applied multiple times daily carries a different exposure calculation than a rinse-off body wash. Backing that calculation with ICP-MS data showing actual lead concentration in the finished formula is what keeps a Prop 65 warning label off your product.

For a California brand selling nationally, the compliance stack looks like this: MoCRA safety substantiation, plus AB 2762 ingredient bans, plus Proposition 65 exposure limits. Each layer requires testing data. None of them accept good formulation intentions as a substitute for documented results.

Build Your Testing Timeline Forward From Formulation Lock

The calendar discipline MoCRA quietly enforces is more demanding than most brands realize until they’re already behind. Work backward from this reality: preservative efficacy testing requires 28 days minimum, and a 3-month accelerated stability study requires approximately 13–14 weeks from initiation. Those studies can run concurrently, but both require a final, production-representative formula before they start. No reformulations, no late-stage ingredient swaps.

At a well-run ISO 17025 accredited cosmetic testing laboratory, standard turnaround times run roughly:

• Microbial limits testing (USP <61>/<62>): 5–10 business days
• Heavy metals panel by ICP-MS: 7–14 business days
• Preservative efficacy test (USP <51>): 28 days, non-negotiable
• Accelerated stability (3-month): 13–14 weeks

That puts your minimum pre-launch testing window at approximately 4 months from formulation lock to a complete safety file. For brands planning a holiday season launch, a major retail door opening, or an Amazon advertising push, that timeline needs to be built into the product development calendar at the beginning — not treated as a late-stage checkbox after the packaging is printed.

One detail that catches brands off guard: the ISO 17025 accreditation status on the lab’s certificate of analysis isn’t just a quality signal. Amazon’s cosmetic and supplement compliance programs, and many large retail partner qualification processes, specifically require test reports from ISO 17025 accredited facilities. A COA from an unaccredited testing provider frequently doesn’t satisfy those requirements, regardless of the underlying quality of the analytical work.

MoCRA raised the floor for everyone in the cosmetic industry. The brands that are positioned well in 2026 are the ones that stopped treating testing as a cost to minimize and started treating it as a dossier to build — one product, one safety file, one launch at a time.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Regulatory Consulting and Audit Preparation for Cosmetics — Aurora TIC helps brands navigate FDA compliance documentation, audit readiness, and pre-submission regulatory strategy.
• Raw Material and Ingredient Testing for Cosmetic Formulators — Ayah Labs provides supplier qualification, COA verification, and ingredient testing for cosmetic brands sourcing globally.