Contents

MoCRA compliance software is becoming part of the ERP conversation because the Modernization of Cosmetics Regulation Act does not stay neatly inside the regulatory team. It touches the operating system of the business: facilities, products, ingredients, labels, complaints, batch history, quality decisions, and the records a company may need to show when the FDA asks.

MoCRA does not mean an ERP can make legal judgments, write safety substantiation, or replace regulatory counsel, of course. But it does mean the gap between "we have the information somewhere" and "we can prove what happened quickly" is getting more expensive.

This article looks at what MoCRA changes at the operations level, where ERP data becomes part of compliance readiness, and what a connected system needs to carry so cosmetics manufacturers are not rebuilding evidence after the fact.

What MoCRA changed for cosmetics manufacturers

MoCRA is the largest expansion of the U.S. Food and Drug Administration's authority over cosmetics since 1938. The FDA's own MoCRA overview and summary describes new powers around records access and mandatory recalls, plus new industry requirements for adverse event reporting, facility registration, product listing, safety substantiation, good manufacturing practice (GMP) rulemaking, fragrance allergen labeling, and standardized asbestos testing methods for talc-containing products.

At a practical level, the requirements most likely to pull operations into the conversation are:

Facility registration. Manufacturers and processors must register facilities with the FDA and renew registration every two years.
Product listing. A responsible person must list each marketed cosmetic product, including ingredients, and provide annual updates.
Serious adverse event reporting. The responsible person must submit serious adverse event reports to the FDA within 15 business days, with a copy of the label on or within the retail packaging. New medical information received within one year must also be submitted within 15 business days.
Adverse event records. Responsible persons must maintain adverse event records for six years, or three years for certain small businesses, and make them available during inspection.
Safety substantiation. A responsible person must ensure and maintain records supporting adequate safety substantiation for each cosmetic product.
Label contact information. Cosmetic product labels must include a domestic address, domestic phone number, or electronic contact information through which the responsible person can receive adverse event reports.

Some small businesses are exempt from facility registration and product listing, but the exemption has limits. It does not apply to certain products, including products that regularly come into contact with the eye's mucous membrane, injected products, products intended for internal use, or products intended to alter appearance for more than 24 hours when consumer removal is not part of customary use.

The exact legal interpretation belongs with regulatory experts, but the operational impact is clear: cosmetics manufacturers need cleaner control over the data that connects a marketed product to the facility, formula, ingredients, label, batch, quality release, complaint, and shipment history behind it.

Compliance readiness is now an operating problem

An ERP will not make a cosmetic product compliant by magic. It will not decide whether a safety substantiation file is adequate, whether a claim is acceptable, or whether a label meets every legal requirement. Those decisions belong to people with the right regulatory and scientific judgment. But an ERP does dictate whether the evidence exists in a form the business can use.

Information in a usable format is critical because MoCRA creates deadlines and record expectations that do not wait for someone to reconcile five systems. A serious adverse event report has a clock attached to it, and it’s not always straightforward to reconcile. A product listing depends on the right product and ingredient data. A facility registration renewal depends on knowing which products and responsible persons are tied to which facility. A recall exercise depends on moving from the product in the market to the affected batches, lots, customers, and shipments without a week of archaeology.

The problem is not that the company has no information but that the information lives in separate places, including formula tools, spreadsheets, supplier folders, labels, customer service inboxes, warehouse records, quality files, the ERP, etc. People can bridge the gaps in those systems while the business is small, but as SKUs, channels, subcontractors, and product launches multiply, the manual bridge starts to break.

What your ERP needs to know

For cosmetics manufacturers, MoCRA readiness starts with master data that is more precise than a generic item card. The ERP needs to understand which legal entity is the responsible person for a product, which facility manufactures or processes it, which product listing data must be kept current, which formula and ingredient version is active, which label version was used, and which finished goods lots entered the market.

That does not mean the ERP has to become the regulatory dossier. In many companies, the regulatory file will still live in specialist tools or controlled document systems. The ERP's job is to connect the operational facts those files depend on, including:

Product, formula, and bill of materials versions
Ingredient and supplier references
Packaging and label versions
Facility and subcontractor links
Batch, lot, and serial history where relevant
Quality status, release, hold, rework, and scrap events
Customer, channel, and shipment history
Complaint and adverse event intake references
Document links and approval status
Change history and audit trail

If those data points are disconnected, the team still has a compliance process, but it depends on people remembering how to stitch the story together — a fragile way to run a regulated operation.

Product listing makes formula data operational

Product listing sounds administrative until you look at the data underneath it. The responsible person must list each marketed cosmetic product with ingredients and update listings annually. If product data, formula data, ingredients, packaging variants, and market status are not governed cleanly, the listing process becomes a seasonal cleanup exercise.

For operations teams, the important question is whether the ERP can show which product versions are active, which are discontinued, which are still in stock, which are being manufactured, and which ingredient or packaging changes affected them.

This is where cosmetics manufacturers often hit the same problem described in our broader post on what 50+ cosmetics manufacturers taught us about ERP in 2026: formula data may exist, but it does not always travel cleanly into production, purchasing, quality, and traceability.

Under MoCRA, that drift becomes harder to tolerate. If a formula changes, the system should help teams see what changed, when it changed, which products and batches are affected, which labels or documents need review, and whether the marketed product data still reflects reality.

Serious adverse events need a clean path back to the batch

Serious adverse event reporting is where disconnected operations become painful fast. When a report comes in, the responsible person needs to understand the product, the label, the lot or batch where available, the consumer information, the medical information received, and any follow-up information that may arrive within the next year. On top of the complexity lies thae fact that the FDA timeline is measured in business days.

That does not mean every complaint is a serious adverse event, but it does mean the intake process has to preserve enough context for the right people to decide. A connected ERP should help the team move from complaint to operational history:

Which product and label version was involved?
Which finished goods lot or batch may be affected?
Which raw material lots, packaging lots, subcontractors, or manufacturing orders fed that batch?
Which quality checks, holds, deviations, or releases exist?
Which customers, channels, and shipments received the affected stock?
Which records, files, and decisions were created after the report?

That path should not depend on one person who knows where everything is stored. The ERP should keep the operational chain close enough to the work that quality and regulatory teams can investigate from facts.

Safety substantiation depends on version control

MoCRA requires the responsible person to maintain records supporting adequate safety substantiation. The FDA also states that neither the law nor FDA regulations require specific tests to demonstrate the safety of individual products or ingredients, and that companies can use relevant available safety data if the data comes from scientifically sound methods.

That creates a clear boundary. The ERP does not decide which safety data is enough; however, it does need to preserve the operational version history around the product those records support.

If a product formula changes, a supplier changes, a fragrance variant changes, a raw material specification changes, or a label claim changes, the company needs to know whether the substantiation record still matches what is being produced and sold.

In practice, that means your ERP should help teams answer questions like which formula version is linked to the current marketed product? Which ingredient lots and supplier references were used in production? or Which batches were produced before and after the change?

GMP and recall readiness need event history

MoCRA also requires the FDA to establish GMP requirements for cosmetic product manufacturing facilities. Final obligations may continue to evolve through FDA rulemaking, so manufacturers should keep regulatory counsel close. But even before a final GMP rule changes the details, the direction is obvious: the FDA expects better manufacturing discipline and stronger access to records.

That is where event history matters. If the FDA has records access in certain conditions and mandatory recall authority when a cosmetic is likely to cause serious adverse health consequences or death, manufacturers need to know what happened inside the operation. Which lot moved where? Which batch was released? Which stock is blocked? Which customer received it? Which subcontractor handled the step? Which quality status changed after production?

Recall readiness depends on the same operational muscle as good daily production control. Teams that capture batch records, stock movements, quality status, and shipment history as work happens are not starting from zero when something goes wrong, while teams that reconstruct traceability later are gambling with time.

What does a MoCRA compliance-ready ERP look like?

A strong ERP for cosmetics manufacturing should keep the operational proof close to the work: formula-driven production, batch traceability, quality control, supplier work, launches, complaint handling, and channel complexity.

For cosmetics manufacturers looking at MoCRA, Bonx is a natural fit. The AI-native manufacturing ERP connects the operational data compliance depends on, including order management, inventory, purchasing and supplier management, planning, production, quality, traceability, and logistics. It also deploys in 1 to 3 months, which is critical when the compliance gap is already visible and the business cannot afford an 18-month ERP project.

Bonx does not replace regulatory counsel or specialist compliance tools, but it does give operations a connected system where the product, batch, quality, supplier, stock, and shipment facts can move together instead of being rebuilt across spreadsheets and inboxes.

Bottom line: MoCRA raises the cost of that gap between operations and regulations. Manufacturers that close it will not just be better prepared for audits, adverse event investigations, and recalls; they will run cleaner operations every day, because the same records that protect the business also help the factory make better decisions.