Entering 2026, the regulatory hammer of the U.S. Food and Drug Administration (FDA) has fallen in rapid succession. Within just three weeks, the FDA released two critical documents targeting PFAS (“forever chemicals”) and records access authority.
The release of these documents is no coincidence; they are direct products of the comprehensive implementation of the Modernization of Cosmetics Regulation Act of 2022 (MoCRA). For companies exporting to the U.S., the threshold for compliance has been raised once again.
I. PFAS Investigation Report: 51 Ingredients Named, Data Gaps Remain a Challenge
On December 29, 2025, the FDA submitted its highly anticipated report on PFAS in cosmetics to Congress. This authoritative conclusion was derived from the first wave of product listing data under MoCRA.
Core Findings:
- Scale: The FDA identified 51 PFAS compounds intentionally added to cosmetics, involving 1,744 product formulations.
- Priority Monitoring: The agency has prioritized 25 substances for toxicological review.
- Safety Conclusions: Currently, toxicological data for most PFAS ingredients is severely lacking, making safety determinations difficult. Only 5 PFAS are considered to have low safety risks under current use conditions.
- Special Warning: The use of an ingredient called “Perfluorohexylethyl Triethoxysilane” in body lotions has been flagged as a potential risk requiring further data verification.
- Current Status: While no mandatory federal ban on PFAS has been issued yet, the FDA explicitly stated it will continue monitoring. This means companies must assess their supply chains early and seek alternatives to prevent regulatory surprises.
II. Records Access Guidance: What’s in the FDA’s “Inspection Kit”?
On January 21, 2026, the FDA issued draft industry guidance regarding records access authority under Sections 605 and 610 of MoCRA. This marks an unprecedented level of “authority” for the FDA during on-site audits of cosmetic companies.
1. Routine Inspections: Adverse Event Records are Mandatory During routine inspections, the FDA has the right to access all of a company’s adverse event records (regardless of whether they are defined as “serious”).
- Retention Period: Generally, companies must keep records for 6 years, while small businesses must keep them for 3 years.
2. Emergency Access: When a Product is Suspected of Being “Toxic” If the FDA has reason to suspect a product may cause serious health consequences or death, the scope of access expands significantly to include:
- Safety Substantiation documents
- Experimental test results and production records
- Analytical reports for raw materials and finished products
- Distribution lists and related internal data
Note: Although the FDA does not have the right to demand product formulas, pricing data, or unrelated personnel records, refusing to provide records within the compliant scope will be considered a legal violation.
III. How Should Exporting Enterprises Respond?
As MoCRA regulations penetrate deeper, the era of “unregulated exposure” in the U.S. cosmetics market has come to an end.
Recommendations for related enterprises:
Coordinated Compliance: Pay close attention to the public comment period for this draft guidance and, if necessary, consult professional compliance agencies to ensure every step—from the lab to the shelf—can withstand an FDA on-site audit.
Self-Audit Ingredient Lists: Immediately verify product listings to identify if they contain any of the 51 PFAS ingredients mentioned in the report.
Improve Traceability Archives: Establish robust Safety Substantiation files and adverse event tracking systems.
