Your Cosmetic Contract Manufacturer Is Not Your Responsible Person
A cosmetic contract manufacturer formulates, fills and labels the product, but it is not the party federal law holds to the safety file. Under 21 U.S.C. § 364d, the “responsible person” for a cosmetic product — the manufacturer, packer or distributor whose name appears on the label — must ensure, and maintain records supporting, that there is adequate substantiation of the product’s safety. For most new brands that name is the brand’s own, so the record is the brand’s obligation even though every test result in it came from somewhere else.
The distinction is easy to miss because the two roles sit in different companies. FDA’s MoCRA overview defines the facility and the responsible person separately: facilities register and renew every two years, while the responsible person lists products, reports serious adverse events and holds the substantiation records. A brand can buy from a registered facility and still have no safety file of its own.
FDA’s own estimate: one record, one hour
How much work the agency expects is on the public record. In a Paperwork Reduction Act notice published on 17 July 2026 (91 FR 44850, docket FDA-2026-N-6739), FDA put the section 608(a) safety substantiation recordkeeping burden at 22,564 respondents, one response each, at an average of one hour per response — 22,564 hours in total. The notice states plainly that the agency estimates each respondent will maintain “on average, one safety substantiation record,” and notes responsible persons have discretion over which records satisfy it.
That is a useful calibration in both directions. It is not a dossier the size of a drug submission. It is also not nothing, and more companies are expected to hold one than appear to know it.
The small-business exemptions do not reach this
This is the part that catches founders who have read the rules once. FDA’s summary says MoCRA “exempts certain small businesses from GMP, registration, and product listing requirements.” Safety substantiation is not on that list. The statute carves out only two situations: coal-tar hair dye complying with § 361(a), where records related to the product’s safety must still be kept, and products already regulated as drugs or devices.
The exemptions also stop short of several product types regardless of company size — anything that regularly contacts the mucous membrane of the eye, anything injected, anything for internal use, and anything intended to alter appearance for more than 24 hours where the consumer does not remove it.
What “adequate” means in the statute
The definition is deliberately open. Adequate substantiation of safety means tests, studies, research, analyses or other evidence that experts qualified by scientific training and experience would consider sufficient to support a reasonable certainty the product is safe. “Safe” means not injurious under the labeled or customary conditions of use — and the statute says a product is not injurious solely because it can cause minor and transient reactions or skin irritation in some users. FDA may also consider cumulative exposure.
No specific test is mandated. FDA’s product testing page says existing data can come from ingredient suppliers, published literature and Cosmetic Ingredient Review assessments, that toxicological testing may be needed to fill gaps, and that animal testing is not required — but whatever is used must come from scientifically sound methods. It also sets a floor people forget: cosmetics need not be sterile, but must not contain harmful microorganisms and must keep aerobic counts low, and contamination risk includes ordinary consumer behavior such as dipping fingers into a jar.
What to ask the factory for, in writing
A contract manufacturer holds most of the raw material for this file. It will not assemble it unless you ask, and it has no statutory duty to keep it on your behalf.
- Ask for supplier safety documentation on every raw material, not just the actives you market.
- Ask what microbiological testing was run on the finished product and in what container.
- Ask whether preservative efficacy was assessed in the final formula, and get the report, not a verbal assurance.
- Ask who signed off on the overall safety assessment and on what qualifications — the statute’s test is what qualified experts consider sufficient.
- Keep the file where you can produce it in days. FDA’s January 2026 draft guidance on records access (nonbinding, still at comment stage) lists safety substantiation records among those reachable under section 610 once the agency reasonably believes a product is likely adulterated in a way presenting a threat of serious adverse health consequences or death.
- Re-run the questions when the formula, supplier or packaging changes. The record describes a specific product, not a product name.
The file is easiest to assemble when the batch is made and hardest to reconstruct two years later from a supplier who has since reformulated. Brands ordering a ready-made white label formula at a 200-unit minimum are in the same position here as brands commissioning a custom formulation at a 1,000-unit minimum — the volume changes, the recordkeeping duty does not.
Moe’s Group formulates, fills and labels skincare, hair care and body care at its FDA-registered facility in Chatsworth, California, and documentation requests of this kind are a normal part of a project brief. If you are building a safety file for a product you are about to launch, tell us what you are making and we will tell you what documentation the build should produce.
Moe’s Group Newsroom
