Connecting the Dots:  How FDA’s Record Access Authority for Cosmetics Links to FDA’s Mandatory Cosmetics Recall Authority

As FDA oversight of commodities continues to evolve, staying ahead of administrative shifts requires looking at the broader regulatory picture. Earlier this month, we examined FDA’s MoCRA Final Guidance on Mandatory Cosmetic Recalls, highlighting FDA’s current thinking on how it will exercise its mandatory recall authority. 

Building on those insights, we wanted to highlight another area related to FDA’s expanded enforcement tools for cosmetic products oversight – FDA’s January 2026 Draft Guidance, “FDA Records Access Authority for Cosmetic Products.” This addresses FDA’s authority to access and copy records related to cosmetic products under sections 605, 610, and 704 of the Federal Food, Drug, and Cosmetic Act (the FD&C Act). This draft guidance is not finalized; therefore, FDA may update its compliance guidance in the final version based on feedback received from public input.  Nevertheless, a draft guidance provides important insights into FDA’s current views on how it will implement its records access authority. Cosmetics companies should monitor these developments closely and prepare for potential records requests from the agency.

Background Information

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA), among other things, added sections 605 and 610 to, and amended section 704(a)(1) of, the FD&C Act, establishing new authorities for FDA to access and copy records related to cosmetic products.  These records can become the evidentiary basis for FDA recommending a voluntary recall or implementing a mandatory recall.  Cosmetic brands that understand FDA’s authority in this area and can produce adverse event and manufacturing records quickly will be better positioned to address potential FDA enforcement matters.

1. Section 605 of the FD&C Act

Section 605 of the FD&C Act, effective December 29, 2023, gave FDA authority to access adverse event report records during an inspection under section 704. This section requires the responsible person (RP) for a cosmetic product to maintain records related to each reported adverse event and make them available to FDA during an inspection conducted under section 704. For cosmetic products, the RP is the manufacturer, packer, or distributor whose name appears on the cosmetic product’s label (see section 604(4) of the FD&C Act). The accessible records include communications related to the adverse event and the RP’s assessment of whether the event is serious or non-serious. For serious adverse events (SAEs), these records also include SAE reports submitted to FDA and any new and material medical information about the SAE received by the RP or FDA. Generally, records related to an adverse event must be maintained in either paper or electronic format for six (6) years after the record creation date.

  2. Section 610 of the FD&C Act

Section 610 of the FD&C Act allows FDA records access authority when FDA has a reasonable belief that: (1) a cosmetic product, including any ingredient, is likely to be adulterated, including any other cosmetic product FDA reasonably believes to be similarly adulterated, and (2) that use or exposure to the product presents a threat of serious adverse health consequences or death (SAHCOD).

This authority applies to both RPs and facilities, which are defined as any establishment (including an importer) that manufactures or processes cosmetic products in the United States (see section 604(3) of the FD&C Act). When the SAHCOD standard is met, FDA can access and copy all records needed to assist in determining whether a cosmetic is adulterated and presents a threat of SAHCOD.  This may include records related to the manufacture, processing, packing, distribution, receipt, or importation of the affected cosmetic product. It applies to records maintained at any location on behalf of the RP or facility where covered activities occur. This records access authority is broad, and the scope will be dependent on the circumstances of the specific event.

FDA’s guidance provided examples of situations that increase the potential that a cosmetic may cause a SAHCOD, including:

(1) microbial contamination (e.g., presence of pathogenic microorganisms),

(2) chemical/toxicological hazards (e.g., presence of unsafe ingredients),

(3) design-related vulnerabilities (e.g., applications causing unintended contact with sensitive body parts), or

(4) improper storage, distribution, or labeling (e.g., conditions compromising the product).

FDA’s records access authority under section 610 does not apply to records of financial data, formulation information, pricing data, personnel data, sales data (apart from shipment/distribution data), or research data (apart from safety substantiation data).

  3. Section 704(a)(1) of the FD&C Act

MoCRA modified section 704(a)(1) of the FD&C Act to extend FDA’s physical inspection powers to cover cosmetic facility records, as described in sections 605, 606 (which relates to GMPs for cosmetic products), and 610 of the FD&C Act. Under this authority, FDA can inspect records “at reasonable times and within reasonable limits and in a reasonable manner” when the standards for records inspection described in these sections apply. Currently, Congress has not extended FDA’s authority in section 704(a)(4) to remotely “inspect” records for cosmetic products. However, RPs or facilities engaged in the manufacture, packaging, or distribution of cosmetic products may voluntarily participate in the Remote Regulatory Assessment (RRA) process. The RRA is not considered by FDA to be an “inspection” as contemplated by section 704 of the FD&C Act and refusing to participate in an RRA does not constitute an inspection refusal or result in any FDA enforcement.

  4. FDA Options where there is a Refusal to Comply

Refusing to allow access to or copying of required records during an FDA inspection under section 704(a)(1) is a prohibited act under section 301(e) of the FD&C Act. Violators are subject to federal legal action, including civil injunction (section 302) or criminal prosecution (section 303).

Further, for cosmetic products manufactured outside the United States, under section 801(a) of the FD&C Act (as amended by MoCRA), FDA will refuse entry to imported cosmetic products if there is credible evidence that the RP either did not comply with or denied FDA access to required adverse event records under section 605.

How Records Access and Mandatory Recalls Work Together

The Final Guidance on Mandatory Recalls and the Draft Guidance on FDA Records Access Authority for Cosmetic Products connect through evidence. Under sections 605 and 610 of the FD&C Act, FDA can gather the information that serves as the legal and evidentiary of a mandatory cosmetics recall. Additionally, these records enable the FDA to determine whether any cosmetic products or ingredients are at risk or adulterated beyond a single batch or product type.

As explained above, for FDA to exercise its mandatory recall authority, there must be SAHCOD.  The documents collected under its records access authority, as implemented by the Records Access Guidance, are therefore critical to FDA’s ability to mandate a recall.  For example, FDA cannot use section 610 of the FD&C Act to access and copy records for a minor labeling error. If, however, a microbial contamination hazard arises where FDA reasonably believes the cosmetic product is adulterated such that use or exposure presents a threat of SAHCOD, then FDA’s authority activates in sequence:

• Gather evidence: FDA uses Section 610 of the FD&C Act to access and copy all records related to manufacturing, processing, and distribution.

• Execute the recall: FDA uses that information in implementing the steps of its mandatory recall authority under section 611 of the FD&C Act, which can include issuing targeted notices to track down the affected product batches.

Ultimately, records access and mandatory recall authorities are not isolated tools; rather, they are links in FDA’s risk-based enforcement framework

Practical Takeaways for Cosmetics Brands

1. Reiterating what we said in our previous post, establish adverse event tracking. SAE reports can serve as primary evidence for a mandatory recall order; therefore, you should ensure your adverse event report collection, evaluation, and reporting pipelines are robust.  Be prepared to provide access to FDA when the criteria under sections 605 or 610 of the FD&C Act are met.
2. Train regulatory response teams. Legal, regulatory, and executive teams should understand FDA’s records access authority and the actions FDA can bring if your team does not comply with a proper records request. They should also understand the standards under sections 610 and, for mandatory recall authority, 611 of the FD&C Act, because FDA cannot access records without meeting certain requirements.

For help with MoCRA related issues, or other enforcement matters, please reach out to Rachael Vieder Linowes ([email protected]) and Jamie Woodside ([email protected]).