TL;DR

• FDA still hasn't finalized the cosmetic-specific Good Manufacturing Practice regulations that MoCRA required it to write back in 2022 — only draft guidance exists as of early 2026 (FDA, MoCRA overview, updated 2026-03-13)
• That hasn't stopped enforcement. At least five facilities marketing themselves as cosmetics manufacturers received FDA warning letters citing existing drug CGMP rules (21 CFR Parts 210-211) between November 2025 and April 2026: CDL Services d/b/a Technichem, Cosmetic Manufacturers Pty Ltd, Patcos Cosmetics, Purolea Cosmetics Lab, and Active Cosmetics Manufacturing
• FDA's registration and listing system showed 14,299 active facility registrations and 992,907 active product listings as of January 6, 2026 — the first time the agency has had a searchable map of who makes what cosmetic products and where (Foley & Lardner, March 12, 2026)
• Three more MoCRA enforcement pieces landed in the last two weeks of December 2025 alone: a public adverse-event dashboard, draft mandatory-recall guidance, and a PFAS safety report finding "significant uncertainty" rather than a clean bill of health
• Takeaway: the missing GMP rule is not a compliance grace period. FDA already has the legal authority it needs, and it's using it now, not later.

Why is FDA sending cosmetics companies CGMP warning letters before its cosmetic GMP rule even exists?

CDL Services, Inc., doing business as Technichem, got a warning letter on November 24, 2025, over the kind of finding that reads almost mundane next to the AI-generated-document violations and insanitary-facility photos that make trade press: the firm hadn't tested its incoming components for identity and purity, hadn't verified its suppliers' own test results were reliable, and hadn't required testing for diethylene glycol, ethylene glycol, or methanol contamination in products where that testing matters most (FDA Warning Letter, CDL Services Inc. d/b/a Technichem, 713877, Nov. 24, 2025). Nothing about that letter mentions the Modernization of Cosmetics Regulation Act. It cites CGMP regulations for finished pharmaceuticals under 21 CFR Parts 210 and 211, the same rules FDA has enforced against drugmakers for decades.

That's the point. FDA doesn't need a finished cosmetic GMP rule to reach a facility that sits at the boundary between "cosmetic" and "drug." It already has one, and it's been using it on exactly that boundary all year.

What MoCRA actually requires, and what's still missing

The Modernization of Cosmetics Regulation Act of 2022 is, in FDA's own description, the most significant expansion of its cosmetics authority since the Federal Food, Drug, and Cosmetic Act passed in 1938 (FDA, MoCRA overview). It did four concrete things: it required facility registration and product listing, renewed every two years; it required responsible persons to report serious adverse events to FDA within 15 business days; it gave FDA mandatory recall authority over cosmetics for the first time; and it directed FDA to write Good Manufacturing Practice regulations specific to cosmetic facilities, something that never existed before.

Three of those four pieces are live. The fourth, the GMP rule, is not. As of January 2026, FDA states plainly that it "has not yet issued final GMP regulations for cosmetics," though draft guidance exists and a rule is expected (FDA, MoCRA overview). Compliance teams reading that sentence as "we have time" are reading it wrong. FDA's own regulatory history says it doesn't wait for a category-specific rule when an existing one already covers the conduct.

The pattern: cosmetics-labeled facilities, drug CGMP citations

Here's what's actually landed since Technichem, in order:

Five letters, five different companies with "cosmetic" in the name, five countries or states, one common thread: every single one was cited under existing drug CGMP regulations, not under anything MoCRA-specific. None of these firms were caught by a new cosmetic rule. They were caught because their products, marketed as cosmetics, met FDA's legal definition of a drug, usually because of a therapeutic claim, an active ingredient meant to treat or prevent disease, or a formulation shared with an OTC drug line on the same production equipment.

This isn't a new theory of enforcement. Industry counsel flagged the pattern as early as late 2024, when a trend analysis of FDA warning letters found the agency's clearest cosmetics-adjacent enforcement activity concentrated at "the nexus of the definition of drugs and cosmetic products," including chemical peel products FDA warned consumers about directly due to burn and infection risk. What's changed by 2026 is volume and visibility, not legal theory.

Why FDA doesn't need to wait for the GMP rule to act

The regulatory logic here is simple and worth stating plainly for any team that assumed cosmetics enforcement was paused pending rulemaking: a product's marketing label doesn't control which CGMP framework applies to it. If a facility manufactures a product that meets the FD&C Act's definition of a drug, whether it's sold in a cosmetics aisle or not, that facility is subject to 21 CFR 210 and 211 today, with or without a finished cosmetic GMP rule sitting alongside it.

The five letters above show FDA applying exactly that logic across five continents' worth of manufacturing footprints. A facility calling itself a "cosmetics lab" or "cosmetic manufacturing" company provides zero insulation from an inspection that finds untested components, insanitary conditions, or an unvalidated production process, if what's coming off that line functions as a drug.

The infrastructure FDA finished building around the warning letters

Enforcement is only half the 2026 story. The other half is the surveillance and response infrastructure MoCRA required, and most of it came online in a tight window at the end of 2025.

On September 12, 2025, FDA launched a public dashboard for cosmetic adverse events, giving anyone, consumers, competitors, plaintiffs' counsel, real-time visibility into which products are generating safety reports (FDA, Sept. 12, 2025 press announcement). On December 18, 2025, FDA issued draft guidance spelling out how it will exercise its new mandatory recall authority over cosmetics, the first time FDA has ever had that power for this product category. And on December 29, 2025, FDA published its long-required report on PFAS in cosmetic products, concluding there is "significant uncertainty" about safety rather than issuing a clean determination, which keeps the door open for future ingredient-specific restrictions (FDA, PFAS report, Dec. 29, 2025).

Layer that on top of the registration numbers. As of January 6, 2026, FDA's cosmetic facility and product listing system reflected 14,299 unique active facility registrations and 992,907 unique active product listings (Foley & Lardner, "How MoCRA Is Reshaping FDA Oversight of Cosmetics in 2026," Mar. 12, 2026). That figure matters beyond its size. It's the first time FDA has had a structured, searchable inventory of who is manufacturing which cosmetic products in the United States and where those facilities sit, data the agency and, per the same analysis, U.S. Customs and Border Protection are expected to lean on more heavily during import screening going forward.

None of this required the GMP rule to exist. Registration, adverse event reporting, recall authority, and the PFAS report are all independent MoCRA provisions FDA can and did act on without it. The GMP rule, when it lands, slots into infrastructure that's already operating.

What compliance and regulatory teams should actually do now

If your company manufactures, packs, or distributes anything that could plausibly be read as sitting between "cosmetic" and "drug," treat the missing GMP rule as background noise, not as your compliance deadline. A few concrete steps are worth taking before FDA's inspectors show up rather than after:

• Re-run the drug/cosmetic classification test on every SKU, not just the obvious ones. A product doesn't need an explicit disease claim to cross the line; shared equipment, an active ingredient with drug-like function, or a formulation adjacent to your own OTC line can be enough. The five letters above hit facilities that likely didn't see themselves primarily as drug manufacturers.
• Confirm your facility registration and product listings are current, not just filed once. Registrations require renewal every two years, and listings need annual updates. An outdated listing is now visible data FDA and CBP can both query.
• Build your adverse-event reporting clock around 15 business days, not 15 calendar days. That's a different, narrower window than the pharmacovigilance timelines quality teams may already be used to from the drug side of the house, and it's easy to misapply the wrong clock.
• Don't wait for the GMP rule to formalize supplier and component testing. Every letter in the table above involved a testing or verification gap FDA could cite under regulations that already exist. Building that discipline now means the eventual cosmetic-specific GMP rule is a paperwork exercise, not a scramble.
• Watch the PFAS and talc rulemaking dockets even without a final rule. FDA's own report language, "significant uncertainty," is not a safe harbor; it's a signal the agency is still building the record for future restrictions.

FAQ

Has FDA finalized Good Manufacturing Practice regulations for cosmetics under MoCRA?

No. As of January 2026, FDA states it has not yet issued final GMP regulations specific to cosmetics, though draft guidance exists and a rule is expected in the coming years (FDA, MoCRA overview).

If there's no final cosmetic GMP rule, how is FDA issuing warning letters to cosmetics companies?

By citing existing drug CGMP regulations, 21 CFR Parts 210 and 211, against facilities whose products meet the legal definition of a drug regardless of how they're marketed. All five 2026 letters cited in this piece use that existing framework, not a new cosmetic-specific one.

What is the deadline for reporting a serious adverse event under MoCRA?

Fifteen business days from when the responsible person receives the report, per MoCRA's adverse event reporting requirement. The responsible person must also include a copy of the product label with the report (FDA, MoCRA overview).

Does FDA have authority to force a mandatory recall of a cosmetic product?

Yes, since MoCRA's passage, if FDA determines there's a reasonable probability a cosmetic is adulterated or misbranded and poses a serious health risk, and the responsible person refuses to recall voluntarily. FDA issued draft guidance on how it will use that authority on December 18, 2025.

Does registering a facility with FDA mean the products are FDA-approved?

No. Facility registration and product listing under MoCRA are recordkeeping and transparency requirements. They don't constitute FDA approval or endorsement of any cosmetic product, and responsible persons remain independently obligated to substantiate product safety.

Founding rates end when 10 signup — lock in FDA warning-letter monitoring at $50/mo before it moves to $99 →

Sources: FDA, Modernization of Cosmetics Regulation Act of 2022 (MoCRA), Foley & Lardner, "How MoCRA Is Reshaping FDA Oversight of Cosmetics in 2026," Mar. 12, 2026, FDA Warning Letter, CDL Services Inc. d/b/a Technichem, 713877, Nov. 24, 2025, FDA Warning Letter, Cosmetic Manufacturers (Aust) Pty Ltd, 719225, Feb. 6, 2026, FDA Warning Letter, Patcos Cosmetics Pvt. Ltd., 718220, Mar. 12, 2026, FDA Warning Letter, Active Cosmetics Manufacturing Inc., 722408, Apr. 22, 2026, FDA PFAS Report, Dec. 29, 2025, FDA press announcement, cosmetics adverse event dashboard, Sept. 12, 2025. Related: FDA's first AI-related warning letter, Purolea Cosmetics Lab, What Is CGMP? FDA's Core Manufacturing Standard, Explained, The 5 most-cited FDA warning letter violations in FY2025, Why FDA warning letters are up in 2026. Byline: Andy Gaber. Published 2026-07-14.