Under MoCRA, the 2022 federal cosmetics law, a small business is one whose average US cosmetic sales over the previous three years are under $1 million, adjusted for inflation, and that doesn't make certain higher-risk products. A small business is exempt from registering its facility with FDA, listing its products, and FDA's coming manufacturing rules. It isn't exempt from the rest: it still has to report serious adverse events to FDA within 15 business days, keep records of adverse event reports for three years, keep records that support each product's safety, put a US contact for reactions on every label, and answer to FDA's new powers to see records and order a recall. Below is the test, what's exempt and what isn't, how to handle a reaction report, and the records that make it manageable.
The short version
- Small business: under $1 million average yearly US cosmetic sales over three years, adjusted for inflation.
- Only cosmetic sales count, not the rest of your business.
- Exempt: facility registration, product listing, FDA's manufacturing rules.
- Not exempt: serious adverse event reports within 15 business days, with a copy of the label.
- Keep adverse event records three years, and safety substantiation records for every product.
- A US address, phone number or website for reactions on every label.
- TaroStack takes a reaction report from the lot code to the batch, its ingredients and every customer. More below.
Are you a small business under MoCRA?
| Test | What it means |
|---|---|
| Sales | Average gross annual US sales of cosmetic products over the previous 3 years under $1,000,000, adjusted for inflation |
| What counts | Cosmetic sales only; food or candles you also sell don't count |
| Products | You don't make products that regularly touch the eye's mucous membrane, are injected, are for internal use, or alter appearance for more than 24 hours |
Windward Roots, the made-up taro business I use in these examples, sold $18,000 of body butter and soap in 2023, $26,000 in 2024 and $41,000 in 2025: a three-year average of about $28,300, well under the line. Its chips and bread don't count.
What's exempt, and what isn't
| Requirement | Small business |
|---|---|
| Register the facility with FDA, renewed every two years | Exempt |
| List each product, with updates every year | Exempt |
| Follow FDA's cosmetic good manufacturing practice rules, once final | Exempt |
| Report serious adverse events within 15 business days, with a copy of the label | Applies |
| Send new medical information about a reported event, received within a year, within 15 business days | Applies |
| Keep records of every adverse event report: 3 years for a small business, 6 for others | Applies |
| Keep records supporting the safety of each product | Applies |
| A US address, phone number or website for adverse event reports on the label | Applies |
| Name fragrance allergens on the label, once FDA's rule is final | Applies when the rule takes effect |
| Give FDA access to records, and recall if FDA orders it | Applies |
(21 U.S.C. 364a; 364d; 364e; 364g)
Safety substantiation doesn't mean a particular test; FDA says neither the law nor its rules require specific tests, but the responsible person, the business named on the label, has to keep records supporting each product's safety. This is general information, not legal advice.
Handling a reaction report
A serious adverse event is one that results in death, a life-threatening experience, hospitalization, lasting disability, a birth defect, an infection, or significant disfigurement, which includes serious and persistent rashes, second- or third-degree burns and significant hair loss, or one that needs medical or surgical intervention to prevent those. Most reactions a small maker hears about aren't serious, but every one should be recorded.
| Step | What to do |
|---|---|
| 1. Record it the day it arrives | Who, what product, the lot code, what happened, when, and any treatment |
| 2. Find the batch | From the lot code: the batch, its ingredient lots, and who else got it |
| 3. Decide whether it's serious | Against the definition above; if unsure, treat it as serious |
| 4. If serious, report to FDA | Within 15 business days of receiving it, with a copy of the label |
| 5. Look for a pattern | Other reports on the same batch or ingredient lot |
| 6. Keep the record | At least three years for a small business |
Windward Roots gets an email: a customer has a mild rash after using body butter from lot WR-BB-261008, gone in two days without treatment. It isn't serious, so there's no FDA report, but it's recorded with the lot, and the batch record and the jojoba lot are checked. A second report on the same lot would mean holding what's left of it. How to log complaints and spot a pattern by lot is in customer complaint log, and what a cosmetic batch record holds is in cosmetic batch record template.
The label
Every label carries a US address, phone number or electronic contact, which may be a website, for adverse event reports. The rest of what a cosmetic label needs is in cosmetic labeling requirements.
Where this stops working
The exemption makes MoCRA feel like it doesn't apply, until a customer reports a reaction. Then the 15-business-day clock starts, and the questions come fast: which batch was it, what went into that batch, who else bought it, and is anything from it still on a shop's shelf? With a notebook and a box of invoices, those answers take days, and the safety records for that formula are a folder from three versions ago.
How TaroStack does it
TaroStack makes the lot code on a jar lead straight to everything MoCRA's questions ask about.
From the lot to the batch. Every lot made in TaroStack carries its batch: which ingredient lots went in, from which suppliers, which recipe version it was made to, when, and who made it, with the batch record form's readings and sign-off. Recipes keep their versions, so the formula in your safety file is the one the batch used.
From the batch to every customer. One report walks the lot forward to every customer who got it, with contact details, and shows what's still on your shelves at every site. Stock on hold sits apart from what's available, so a lot you're looking into can't be shipped while you look. If FDA asks you to stop distributing, the same report is your list.
And the records keep. Every batch and every movement is a permanent record with who, when and why, searchable years later, longer than the three years a small business keeps adverse event records. TaroStack keeps the records; it doesn't file anything with FDA or decide whether an event is serious.
| The question | Notebook | In TaroStack |
|---|---|---|
| Which batch was the jar from? | Maybe a date | The lot, on its label |
| What went into that batch? | "Jojoba" | Each ingredient's lot and supplier |
| Who else got it? | A box of invoices | One report, with contacts |
| Is any still on a shelf? | Call the shops | Stock by site, held if needed |
Lots, lot labels, holds, recalls, recipes with versions, batches and batch records are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.