On Dec. 23, 2022, Congress passed sweeping measures intended to strengthen the Food and Drug Administration’s (FDA) regulation of cosmetics. The measures were signed into law by President Biden on Dec. 29, 2022.

Titled the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), the measures were included in Congress’s $1.7 trillion year-end government spending bill and are the first major amendments to the Food, Drug and Cosmetic Act’s (FDCA) cosmetics provisions since they were enacted in 1938.¹

The law both expands FDA’s authority over cosmetics and includes new requirements for cosmetics, including safety substantiation, serious adverse event reporting, facility registration and product listing, and mandatory recall authority.

Hemp and cannabidiol (CBD) cosmetics already must comply with varied and, in some states,  detailed state regulatory regimes. They will now need to prepare for an additional layer of federal regulation. Although neither existing FDA cosmetic regulations nor MoCRA include hemp or CBD-specific provisions, manufacturers and sellers of cosmetics and personal care products containing hemp and hemp ingredients (“hemp cosmetics”) will need to reconcile MoCRA requirements with the current array of state requirements.

The vast majority of MoCRA’s provisions become effective Dec. 29, 2023, giving companies time to comply, but some provisions have earlier or later effective dates. This article provides an overview of the current regulatory status for hemp cosmetics, the impact of MoCRA, and key takeaways for companies considering the sale of hemp cosmetics as part of their product portfolio.

Current Regulatory Status of Hemp Cosmetics

FDA’s treatment of hemp or hemp-derived ingredients (including CBD) in cosmetic products aligns with its approach to cosmetic ingredients generally, and MoCRA does not inherently change the agency’s posture. Hemp ingredients, like all other cosmetic ingredients not covered by a particular statute or regulation, must comply with applicable requirements.

For example, hemp or hemp-derived ingredients cannot be used if they adulterate or misbrand the product in any way. A cosmetic is adulterated if it bears or contains any “poisonous or deleterious substance that may render it injurious to users under the conditions of use prescribed in the labeling” or under common or usual conditions of use.² A cosmetic is misbranded if, for example, the label or labeling makes false or misleading claims,³ or claims to affect the structure or function of the body (i.e., “drug” claims).

Since the federal legalization of hemp in 2018 as part of the 2018 Farm Bill,⁴ states have stepped in to regulate hemp cultivation, processing, and sale. These regulatory regimes include regulation of products containing hemp and hemp-derived ingredients such as CBD.

As of this writing, approximately 15 states have laws and/or regulations specific to hemp cosmetics.⁵ These laws include requirements for licensing,⁶ pre-approval of products,⁷ THC content,⁸ testing,⁹ and packaging and labeling.¹⁰ Companies should expect to see additional states promulgating regulations over time.

Core MoCRA Requirements Affecting the Sale of Hemp-Containing Cosmetics

MoCRA dramatically changes the regulatory landscape for cosmetic products, including a company’s pre- and post-market compliance obligations, whether or not the products contain hemp or hemp-derived ingredients.

We summarize herein core requirements that may be of particular interest to companies engaged in the manufacture and sale of hemp-containing cosmetics, and flag intersections with existing state laws governing hemp cosmetics.

Registration & Listing

Generally, firms that own or operate a facility that manufactures or processes cosmetics for distribution in the U.S. will be required to register their facility with FDA. This requirement will impose an additional registration requirement on facilities that already need to register a hemp or CBD processing facility under state law.¹¹ 

Existing facilities must register with the FDA by Dec. 29, 2023, while new facilities must register within 60 days of starting manufacturing or processing of cosmetics. Companies must submit product listings that include a list of ingredients in each product. New products must be listed with FDA within 120 days of marketing the product, while listings for existing products must be submitted by Dec. 29, 2023. 

Limited exceptions to registration and listing requirements are available for small businesses (those with average gross annual sales from the previous three years of less than $1 million).

Existing federal and state regulations governing hemp cosmetics require a list of ingredients on the label,¹² so manufacturers should already have collected this information. 

Safety Substantiation

Pre-MoCRA, cosmetic firms were restricted from introducing unsafe or adulterated products into the market, and were obligated to adequately substantiate safety for each ingredient used in the product prior to marketing. Each ingredient or product lacking substantiation would be misbranded unless labeled with “Warning – The safety of this product has not
been determined.”

MoCRA advances safety substantiation for cosmetic products and ingredients by requiring that firms both maintain records supporting that there is adequate substantiation of safety for their products and ingredients. 

This means that firms must have “tests or studies, research, analyses, or other evidence or information that is considered—among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients—sufficient to support a reasonable certainty that a cosmetic product is safe.”¹³

By “safe,” the law requires the cosmetic product and any ingredient not be injurious to users under the conditions in the labeling or customary or usual use. FDA may consider the cumulative or other relevant exposure to the product and any ingredient therein when evaluating safety. Compliance is required by Dec. 29, 2023.

Firms marketing cosmetics containing hemp or hemp-derived ingredients will need to ensure they have adequate substantiation of safety for their products and hemp ingredients. In light of FDA’s finding that the dietary supplement and foods pathway is not appropriate for CBD, it is reasonable to expect that FDA may look more carefully at firms’ safety substantiation for cannabis-containing cosmetics.

Indeed, the safety of CBD in cosmetics is an area of interest for FDA that may evolve. At the 164th meeting of the Cosmetic Ingredient Review (CIR) Expert Panel (March 2023), FDA asked that the body prioritize the review of the safety of CBD in cosmetics. Back in 2020, FDA requested that CIR review CBD in cosmetics, but at the time, there were no formulations reported to FDA’s Voluntary Cosmetic Registration Program (VCRP). Now, as CIR stated, there are 32 formulations reported to the database that use CBD, and 217 reported that use Cannabis sativa seed oil. CIR has added the review of CBD to its 2024 Draft Priority List, and has published the draft priorities for comment.¹⁴

Labeling

MoCRA does not impose significant labeling requirements over or above existing federal and state requirements. Existing state packaging and labeling requirements are the most detailed and can include, in addition to the product name, manufacturer name, and ingredients:

• Batch number;
• Date and place of manufacture;
• Total delta-9 THC by weight and/or percentage;
• Total weight or percentage of other cannabinoids;
• Expiration date;
• Link to a certificate of analysis from an independent laboratory;
• Hemp source; and
• Specific warning labels such as “contains THC.”

MoCRA focuses on providing contact information for adverse event reporting, requiring a domestic address, domestic phone number, or electronic contact information, which can include a website.¹⁵

Adverse Event Reporting

Starting on Dec. 29, 2023, cosmetics firms will be required to submit reports of serious adverse events involving their cosmetic products no more than 15 days after a report is received.

A serious adverse event is defined broadly and includes any health-related event associated with product use that results in events such as infection, significant disfigurement (e.g., serious and persistent rashes, significant hair loss), inpatient hospitalization, and more, including death. Firms must also maintain reports of adverse events, serious or non-serious. Most firms will need to retain the records for 6 years, but small businesses that do not manufacture or process the products will only need to retain the records for 3 years. 

Good Manufacturing Practices

Although FDA currently has current Good Manufacturing Practice (cGMP) guidelines for cosmetics, these are not enforceable and not uniformly adhered to across industry.

Some states, such as California, also impose manufacturing requirements, but these are generally limited to licensing and controls over hemp ingredients and can be limited to production facilities within the state.

MoCRA requires that FDA draft and finalize GMP regulations that are consistent to the extent practicable and appropriate with national and international standards. Proposed rules must be issued 2 years after MoCRA’s enactment, and final rules issued 3 years after MoCRA’s enactment. Once effective, FDA will require compliance with its GMP regulations, and FDA inspections will evaluate facilities’ compliance with law.

Impact of MoCRA on State Requirements

MoCRA does little to resolve the patchwork of varying—and sometimes conflicting—state laws governing hemp cosmetics, particularly on testing and labeling issues.¹⁶ MoCRA’s preemption provision prohibits states from establishing cosmetic laws that differ from MoCRA requirements, but only with respect to registration and product listing, GMPs, records, recalls, adverse event reporting, or safety substantiation.¹⁷

Beyond the areas expressly preempted, MoCRA does not preempt other state law. It expressly does not prevent a state from prohibiting the use or limiting the amount of an ingredient in a cosmetic or from mandating reporting to the state of an ingredient.¹⁸

Thus, state laws that require manufacturers to test for THC or other cannabinoids, and include the percentage or quantity of CBD or THC in a hemp cosmetic on the label—as well as provide a link to a certificate of analysis—will continue to apply. 

Conclusion

Hemp cosmetic manufacturers will need to continue to comply with the array of state laws governing hemp cosmetics. In addition, hemp cosmetic manufacturers—and the cosmetics industry as a whole—will need to be prepared for the implementation of MoCRA.

They should anticipate that new funding and new authorities will result in increased inspections and increased FDA advisory and enforcement actions. FDA will have more information on cosmetics facilities and products as a result of registration and product listing requirements, and information on any serious adverse events reported.

We may see FDA using that information to prioritize inspections. In particular, FDA may focus on product risk and company compliance history. To the extent that safety concerns emerge related to hemp cosmetics, the industry should expect increased FDA attention. 

Furthermore, FDA’s structural reorganization that moved cosmetics from the Center for Food Safety to the Office of the Chief Scientist, which is focused on research, science, and innovation, raises the prominence of cosmetics at FDA and hints at a more exacting and scientific approach to cosmetics regulation. This could focus more attention on hemp cosmetics, particularly those with new or emerging forms of cannabinoids such as cannabidiolic acid (CBDA) and cannabigerol (CBG).

---

About the Authors: Evelina J. Norwinski is a Partner at Arnold & Porter. Her practice focuses on litigation, white collar defense and compliance issues. She has conducted internal investigations for domestic and multi-national companies in industries such as consumer products, pharmaceutical, government contractors, financial services, and agricultural products. She also regularly counsels clients on corporate compliance programs, regulatory compliance, legislation, and ethics.

Elizabeth Trentacost is a Senior Associate at Arnold & Porter, counseling food, life sciences, and consumer products companies on a range of FDA regulatory, compliance, enforcement, and strategic matters. She routinely advises on issues related to product and claims development, and provides guidance that encompasses FDA, FTC, NAD, and litigation considerations and risks.

Ryan D. White is an Associate at Arnold & Porter whose practice encompasses an array of white collar criminal defense, internal and government investigations, and complex commercial litigation matters. He has particular experience helping clients navigate the developing regulatory frameworks governing cannabis at the state and federal levels. For more information visit www.arnoldporter.com.

References

1. Modernization of Cosmetics Regulation Act of 2022; Division FF, Title III; Consolidated Appropriations Act, 2023 Pub. L. No. 117-328, 136 Stat. 4459, 1389-1402 (hereinafter cited as MoCRA).
2. 21 U.S.C. 361.
3. 21 U.S.C. 362.
4. Agriculture Improvement Act of 2018, Public Law No: 115-334 (Dec. 20, 2018).
5. These states include Alaska, California, Hawaii, Indiana, Iowa, Kentucky, Louisiana, New Jersey, New Mexico, Ohio, Texas, Utah, Vermont, West Virginia, and Wisconsin. 
6. See, e.g., 25 Texas Admin. Code § 300.501.
7. See, e.g., Alaska Admin. Code § 40.420.
8, See, e.g., Alaska Admin. Code
9. See, e.g., Hawaii Admin. Reg. § 11-37-20; New Mexico Admin. Code §20.10.2.14;
10. See, e.g., Cal. Health and Safety Code § 111923.3; Indiana Code § 24-4-21-4; 902 KAR § 45:190; Ohio Admin. Code § 901:14-2-17; West Virginia CSR § 61-30-7.
11. See, e.g., Cal. Health and Safety Code § 111923.3(b) (requiring a hemp manufacturer who produces an industrial hemp product that is a cosmetic to register);  902 Ky. Admin. Regs. 45:190 § 2 (“A person located in Kentucky seeking to manufacture a hemp-derived ingestible or cosmetic cannabinoid product shall submit an Application for Permit to Operate a Food Plant or Cosmetic Manufacturing Plant . . .”).
12. See, e.g., Ind. Code § 24-4-21-4 (requiring that hemp product packaging contain a scannable bar or QR code linked to a document identifying ingredient name, ingredient manufacturer, and ingredient lot number). 
13. MoCRA § 608(c).
14. CIR Expert Panel Meeting, March 6-7, 2023, https://www.cir-safety.org/sites/default/files/Admin_Priorities_1.pdf
15. MoCRA has additional labeling requirements for fragrance allergens (to be determined by EPA) and cosmetic products intended for professional use.
16. Compare, e.g., Cal. Health and Safety Code § 111926.3(a)(3) (requiring hemp product labels to contain the statement: “THE FDA HAS NOT EVALUATED THIS PRODUCT FOR SAFETY OR EFFICACY.”) and Haw. Code R. § 11-37-30 (requiring that hemp product labels contain the statements: “Use this product under the guidance of a physician if you have a medical condition or are pregnant or lactating.”; “Keep out of the reach of children.”; and “This product has been tested pursuant to chapter 11-37 subchapter 2, Hawaii Administrative Rules.”).  Also compare, e.g., Alaska Admin. Code tit. 11 § 40.415 (prohibiting hemp products from containing more than 50 milligrams of THC per individual unit) and Minn. Stat. § 151.72 (mandating testing to confirm the amount of each cannabinoid in the product and that THC levels are less than 0.3 percent on a dry weight basis).
17. MoCRA § 614. 
18. MoCRA § 614(b).