Last Updated on May 29, 2026 by Hafsa J.

How MoCRA Changed Cosmetics Forever: FDA’s New Mandatory Recall Power

On December 18, 2025, the FDA published a draft guidance explaining how it will force a cosmetic off the shelf against the manufacturer’s will. For an industry that ran on voluntary recalls since 1938, that sentence should stop you cold. The agency now holds a power it never had: if it decides your product is adulterated or misbranded and could cause serious harm, it can order the recall itself.

Most of the coverage you will read about this stops at the same place. Here is the new power, here is the notification process, update your recall plan. That is accurate, and it is also the easy half of the story. The harder question, the one I keep raising with the cosmetics manufacturers I work with, is this: the FDA can now order a recall, but the rule that defines what “good manufacturing” actually means under MoCRA has not been finalized. The enforcement teeth arrived before the rulebook. That gap is where the real risk sits in 2026, and almost nobody is talking about it.

This article walks through what MoCRA’s recall authority actually gives the FDA, why the missing GMP rule matters more than the recall power itself, and what “recall-ready” looks like in practice for the 9,528 facilities now registered to sell into the US market. ISO 22716, the international standard for cosmetics good manufacturing practice, runs underneath all of it, even though, as you will see, the law never names it once.

What MoCRA actually gave the FDA, and what it didn’t

The Modernization of Cosmetics Regulation Act of 2022 was signed on December 29, 2022, and the FDA calls it the most significant expansion of its authority over cosmetics since the Federal Food, Drug, and Cosmetic Act passed in 1938. That is not marketing language. For more than eight decades, cosmetic recalls in the US were almost entirely voluntary. The FDA could ask, could pressure, could publicize, but it could not compel.

MoCRA changed that through Section 611 of the FD&C Act, which grants mandatory recall authority. The mechanism is deliberately narrow. Before the agency can order anything, it has to determine there is a reasonable probability that a product is adulterated or misbranded, and that exposure to it will cause serious adverse health consequences or death. That last phrase has a strict definition: infections, severe burns, significant disfigurement, conditions needing medical intervention. Temporary skin irritation does not clear the bar.

Even after that determination, the FDA cannot simply seize your stock. The draft guidance lays out a sequence. First, the agency gives the responsible person, meaning the manufacturer, packer, or distributor whose name sits on the label, written notice and a chance to cease distribution and recall voluntarily. Only if the company fails or refuses does the FDA issue a cease-distribution order. The recipient can then request an informal hearing, held no fewer than ten days after the order, to argue that the evidence does not justify it. After that hearing, the agency can amend the order into a full recall with notification timetables. Refuse to comply at the end of that road and you are exposed to injunction and criminal prosecution. The “responsible person” is not a casual label here; it is a defined legal role that carries the recall obligation, and I have broken down what that role actually demands in a separate piece.

So the headline that the FDA “can now force a recall” is true, but the path runs through a voluntary off-ramp first. In practice, almost every case will still resolve as a voluntary recall, because no manufacturer wants the cease-distribution order on public record. The mandatory power is the hammer behind the negotiation, not the opening move.

Here is the part the law firms tend to skip. MoCRA never names ISO 22716. The statute directs the FDA to consider national and international standards when it writes cosmetic GMP rules, but it does not adopt the standard, does not cite it, does not make certification a requirement. ISO 22716 sits underneath the whole structure as the de facto benchmark for what “good manufacturing” actually requires, and yet legally it is invisible. That distinction matters more than it sounds, and it leads straight into the problem the next section is about: the GMP rule that would give the recall power its technical teeth has not actually arrived.

The two missed deadlines nobody is talking about

When MoCRA passed, it did not just hand the FDA a recall button. It also ordered the agency to write a binding good manufacturing practice rule for cosmetics, under Section 606 of the FD&C Act, and it set hard deadlines. The agency was required to publish a proposed GMP rule by December 29, 2024, and a final rule by December 29, 2025.

Both dates have passed. Neither rule exists.

The proposed rule missed its December 2024 deadline. The final rule missed its December 2025 deadline. And the rule has not simply slipped a few months. In the federal government’s Unified Agenda, the regulatory roadmap that tracks every pending rule, the cosmetic GMP rulemaking (RIN 0910-AJ00) was reclassified into the “Long-Term Actions” list as of the Fall 2025 agenda, with the next proposed-rule date listed as “to be determined.” In plain terms, the rule that is supposed to define what good manufacturing means for cosmetics has no scheduled arrival.

So what is the FDA actually measuring you against in the meantime? Two things. First, the general adulteration and misbranding provisions of the FD&C Act, which have always existed and do not need a new GMP rule to apply. A product manufactured under insanitary conditions is adulterated, full stop. Second, and this is where the standard quietly reasserts itself, the FDA’s own 2013 draft cosmetic GMP guidance leaned heavily on ISO 22716, and the agency has signaled that the eventual binding rule will draw from the same source. The standard is not law, but it is the closest thing to a published expectation that exists right now.

That is the practical trap. A manufacturer reading the headlines might conclude that because the GMP rule is delayed, there is breathing room, time to sort the quality system out later. The opposite is true. The recall authority does not wait for the GMP rule. If your product injures someone and the investigation finds insanitary manufacturing, the absence of a finalized Section 606 rule will not protect you. You will be judged against adulteration provisions and, informally, against the benchmark everyone in the room already knows: ISO 22716.

This is the moment to find out where you actually stand, rather than discovering it during an inspection. The self-assessment below runs through the GMP areas an FDA investigator looks at first, scored chapter by chapter against ISO 22716 and the MoCRA framework.

If that score came back lower than you expected, you are not unusual. In the consulting work I do, the facilities most exposed are the ones that built their quality systems for retail or marketing requirements rather than around drug- or food-grade manufacturing discipline. They pass a customer audit and assume that means they are ready for a regulator. Those are different bars. The next section is about what closing that gap actually costs, because “be recall-ready” is easy to say and the real number behind getting there is the question every manufacturer eventually asks.

What recall-ready means for 9,528 facilities

Here is a number that frames the scale of this. As of January 1, 2025, 9,528 cosmetic facilities were actively registered with the FDA under MoCRA. That figure is not static, and by the time you read this it has almost certainly grown, but it tells you the size of the population now living under mandatory recall authority. Every one of those facilities is a place the FDA can, in principle, order to cease distribution.

And the supply chain behind that number is mostly foreign. China alone accounts for about 44.7% of all foreign facilities registered to supply the US market, followed at a distance by South Korea, India, Italy, and France. If you are a US brand owner, this is the uncomfortable part: you are the responsible person on the label, you carry the recall obligation, but the manufacturing that determines whether you ever face a recall is often happening in a facility you do not own, on another continent. Your name is on the order; their hygiene practices are the risk.

That gap between who is accountable and who actually manufactures is based on my experience the single most common vulnerability I see. A brand builds a clean compliance file, registers properly, files its product listing, and assumes the box is ticked. Then a contract manufacturer three time zones away changes a supplier, skips a cleaning validation step, or stores finished product in a way that lets microbial counts climb after release, and the brand inherits the consequence. Recall-readiness is not a document you file once. It is a chain of control you have to be able to prove, from your contract manufacturer’s raw material handling through to the finished-product testing that catches a problem before it ships.

So what does recall-ready actually look like in concrete terms? Three things, in the order an investigator will probe them.

First, traceability. If a problem surfaces in one lot, can you identify every affected unit, every distributor who received it, and pull it back within days, not weeks? Section 611 recalls run on timetables the FDA sets. A manufacturer who cannot trace a lot cannot meet a recall order, and that failure is itself a violation.

Second, a documented recall plan that exists before you need it. Not a paragraph in a manual. A named decision-maker, a contact tree for distributors and retailers, a public-notification path, and a mock-recall you have actually run. The facilities that survive a recall with their business intact are the ones that rehearsed it.

Third, the manufacturing controls that stop you from needing a recall in the first place. This is the ISO 22716 core: personnel hygiene, premises and equipment, production and in-process controls, and the quality-control testing that confirms a batch is what it claims to be. Most recalls trace back to a failure in one of these, and the most common failures are documented and avoidable, which I have covered separately.

There is also a layer most brands underestimate: the recall obligation is market-specific. If you sell into the US, the EU, the UK, and Canada, you are not facing one recall and notification regime, you are facing four, each with its own notification system and its own definition of who must tell whom, and when. Before you can be recall-ready anywhere, you need to know exactly which obligation attaches in each market you sell into. The tool below maps that out: select your target markets and it returns the specific notification duty for each.

Knowing your obligations is step one. Meeting them is a build, and that build has a cost and a timeline, which is where most planning conversations land next. If you want to move from “I understand the risk” to “here is what fixing it takes,” the certification route lays out the path, and it is the natural next step once you have seen your Flash Audit score and your market obligations side by side.

Recall-ready is a manufacturing problem, not a paperwork problem

The instinct, when a new enforcement power lands, is to treat it as a documentation exercise. Write the recall plan, file the registration, update the label, move on. That instinct is wrong, and it is wrong in a way that costs money.

A mandatory recall does not start in your filing cabinet. It starts on your production floor, months earlier, in a decision nobody flagged at the time. A cleaning step shortened to hit a schedule. A preservative system that tested fine at batch release and then drifted. A raw material accepted without a certificate of analysis because the shipment was late and the line was waiting. By the time the FDA is at the door, the failure is already in the product, and no recall plan, however polished, un-makes it.

Two recent cases make the point better than any framework. The first is a sunscreen recall where a product passed its batch-release testing cleanly and then developed mold over the following months, a failure that batch testing alone was never designed to catch. It is a precise illustration of why ISO 22716 asks for microbiological stability over a product’s shelf life rather than a single clean result at release, and I have walked through exactly what went wrong and how the standard addresses it in the Suntegrity batch-release breakdown. The second is the FDA’s new real-time adverse-event dashboard, which now makes consumer complaints about cosmetics publicly searchable in a way they never were before. For a manufacturer, that database is an early-warning system: the complaints that show up there are often the first signal of a problem that, left alone, becomes a recall. I have explained how to read it as a quality tool rather than a threat.

Both cases share a root. Neither was a paperwork failure. Both were manufacturing-control failures that surfaced after the product was already in consumers’ hands, which is the most expensive place to discover them.

So here is the concrete action, the thing to do this quarter rather than “eventually.” Three documents decide whether a recall, if it ever comes, is a controlled event or an existential one. Make sure they exist, are current, and have been tested:

A lot-traceability record that lets you identify and locate every unit of any given batch within days. A written, rehearsed recall plan with a named owner and a live distributor contact tree, not a template you downloaded. And evidence of microbiological and stability testing that proves your product stays compliant across its claimed shelf life, not just on the day it left the line.

If those three are solid, the mandatory recall power that arrived in December 2025 is something you can manage. If any one of them is missing, the delayed GMP rule is not your reprieve. It is your blind spot. The enforcement is already here; the only open question is whether you find your weak point first, or the FDA does.

You can start with the Flash Audit above to see where your gaps are, then map your build against the certification path and its cost and timeline. The standard the law refuses to name is still the one you will be measured against.