Do I need a safety file to sell my cosmetic, and does the small business exemption cover me?

This is United States federal law: the Federal Food, Drug, and Cosmetic Act, as amended by the Modernization of Cosmetics Regulation Act of 2022. One section creates the safety substantiation duty. Other provisions take it away or keep a product outside it altogether, and the small business exemption that gets quoted most is not one of them.

On this page: Two ways your product is outside this entirely · The duty itself · What the words mean · The small business exemption, read to the end · What each exemption removes · What the subchapter actually says about it · What the Act attaches to not holding one · In force now, and still a rulemaking · Four things to check

Two ways your product is outside this entirely

Two provisions can put a product outside the substantiation section altogether, and both of them reach ordinary consumer products. That is worth settling before the rest of the page, because if either describes your product, the analysis below is about somebody else.

Your product is also a drug. Where a cosmetic product or a facility is also subject to the requirements of subchapter V of the Act, the drugs and devices subchapter, the Act exempts it from seven sections, and safety substantiation is one of the seven (21 U.S.C. 364i(a)). FDA describes an antidandruff shampoo, a fluoride toothpaste with breath and cleansing claims, a deodorant that is also an antiperspirant, and a moisturizer or makeup marketed with sun-protection claims as products that are both, and says such products must comply with the requirements for both (FDA, “Is It a Cosmetic, a Drug, or Both?”, agency guidance rather than law). That exemption has a limb that takes it back: a facility covered by it that also makes cosmetic products not subject to subchapter V is not exempt as to those products (364i(b)). Whether your own product is also subject to those requirements is a classification question before it is a substantiation question, and it is answered separately.

Your product is soap as the Act uses the word. The statutory definition of a cosmetic excludes soap (21 U.S.C. 321(i)). The word is not defined in the Act, and FDA has said by regulation that it interprets the term to apply only to articles meeting two conditions (21 CFR 701.20(a)): the bulk of the nonvolatile matter consists of an alkali salt of fatty acids and the detergent properties of the article are due to the alkali-fatty acid compounds, and the product is labeled, sold, and represented only as soap (701.20(a)(1), 701.20(a)(2)). A product intended for cleansing the body that is not soap on that reading is a cosmetic and is subject to the Act and its regulations (701.20(b)). FDA reads the second condition through the claims: a product consisting of detergents, or primarily of alkali salts of fatty acids, and intended not only for cleansing but also for another cosmetic use such as acting as a deodorant, imparting fragrance, or moisturizing the skin, is regulated as a cosmetic (FDA, “Is It a Cosmetic, a Drug, or Both?”, agency guidance rather than law). So what is on the wrapper is part of what decides it.

The duty itself

Here is the whole of it. A responsible person for a cosmetic product shall ensure, and maintain records supporting, that there is adequate substantiation of safety of such cosmetic product (21 U.S.C. 364d(a)). Two verbs, and they are not the same job. Ensure is about the product. Maintain records is about what you can put in front of someone.

The responsible person is the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product in accordance with section 364e(a) of this title or section 1453(a) of title 15 (364(4)). Read the cross-reference at the end of that definition, because it is the part that says which name counts. Section 364e(a) requires the label to carry a domestic address, domestic phone number, or electronic contact information through which the responsible person can receive adverse event reports (364e(a)). Section 1453(a) of title 15 is the Fair Packaging and Labeling Act requirement that the label specify the identity of the commodity and the name and place of business of the manufacturer, packer, or distributor (15 U.S.C. 1453(a)(1)). So the test is not which mark is largest on the front of the pack. It is whose name is on the label in the way one of those two provisions calls for, and where that is your company the section names you rather than the plant that filled the bottle. And a cosmetic product is defined as a preparation of cosmetic ingredients with a qualitatively and quantitatively set composition for use in a finished product (364(2)). The composition is part of what the thing is, which is why a reformulation is a question about the file and not only about the batch.

One exception sits inside the section. It does not apply to coal-tar hair dye that otherwise complies with the requirements of section 361(a), and a responsible person for a coal-tar hair dye shall maintain records related to the safety of such product, a records duty the subsection states without attaching that condition to it (364d(b)). Read the condition it hangs on. Section 361(a) deems a cosmetic adulterated if it bears or contains any poisonous or deleterious substance which may render it injurious to users under the conditions of use prescribed in the labeling, or under such conditions of use as are customary or usual, and then excepts coal-tar hair dye whose label conspicuously bears the caution legend the clause sets out and whose labeling bears adequate directions for the preliminary testing that legend describes. The same paragraph adds that for its own purposes and those of paragraph (e), the term hair dye does not include eyelash dyes or eyebrow dyes. The 364d(b) exception reaches only a dye that otherwise complies with all of that (361(a)). It swaps one duty for a narrower one. It does not remove the records.

What the words mean, in the statute’s own definitions

Adequate substantiation of safety means tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe (364d(c)(1)). Notice what that definition does. It does not list documents. It sets the bar by reference to what qualified experts would consider sufficient, which is why no form exists and no template can promise to satisfy it.

Safe has its own definition, and it is longer than people expect. It means the cosmetic product, including any ingredient of it, is not injurious to users under the conditions of use prescribed in the labeling, or under such conditions of use as are customary or usual. The Secretary shall not consider a product or ingredient injurious solely because it can cause minor and transient reactions or minor and transient skin irritations in some users. And in determining whether a product is safe, the Secretary may consider, as appropriate and available, the cumulative or other relevant exposure to the product, including any ingredient of it (364d(c)(2)). Two things follow from reading it to the end. Your own label sets part of the test, because the conditions of use prescribed in the labeling are one of the two conditions named. And exposure is in the definition, though as something the Secretary may consider, as appropriate and available, rather than as a stated content requirement for your records. A file that never reaches exposure has nothing to offer on a question the definition opens.

FDA states on its own MoCRA page that neither the law nor FDA regulations require specific tests to demonstrate the safety of individual products or ingredients, that manufacturers can use relevant safety data that is already available, and that animal testing is not a requirement for marketing a cosmetic product. The same passage adds that it is important that all data used to support the safety are derived from scientifically robust methods (FDA MoCRA page, agency guidance rather than law, content current as of August 10, 2026).

The small business exemption, read to the end

Here is the sentence people are relying on. Responsible persons, and owners and operators of facilities, whose average gross annual sales in the United States of cosmetic products for the previous three-year period is less than $1,000,000, adjusted for inflation, and who do not engage in the manufacturing or processing of the cosmetic products described in subsection (b), shall be considered small businesses and not subject to the requirements of section 364b or 364c (21 U.S.C. 364h(a)).

The sentence names the sections it switches off, and it names two. Section 364b is good manufacturing practice (364b(a)). Section 364c is facility registration and cosmetic product listing (364c(a)(1)(A), 364c(c)(2)). Safety substantiation is section 364d, and 364h(a) does not name it. FDA describes the same exemption the same way, as an exemption from GMP, registration, and product listing requirements (FDA MoCRA page, agency guidance rather than law).

The exemption also carries a condition on the front, not just a threshold. It reaches only a responsible person or facility that does not make or process the products listed in subsection (b), and that list is four items: products that regularly come into contact with mucus membrane of the eye under customary or usual conditions of use; products that are injected; products intended for internal use; and products intended to alter appearance for more than 24 hours under customary or usual conditions of use where removal by the consumer is not part of those conditions (364h(b), 364h(b)(1), 364h(b)(2), 364h(b)(3), 364h(b)(4)). Mascara and eyeliner sit in the first item. A semi-permanent brow or lash tint is worth reading against the fourth.

Small business status is not inert, though, and it is fair to say what it does reach. A responsible person who is a small business for the purposes of 364h, and who does not make the 364h(b) products, keeps adverse event records for three years rather than six (364a(e)(1)). That is a shorter retention period on a different duty. It is not an exemption from holding a safety file.

What each exemption removes

What the subchapter actually says about the substantiation section

The text of 21 U.S.C. subchapter VI can be read clause by clause, so the question of which provisions cross-refer to the safety substantiation section can be read rather than remembered. Read that way, the 14 sections of the subchapter come to 162 clauses. Searching every one of them for the section number returns three:

What this count does not evidence. It is a text search of the sections of this one subchapter as read here. It does not catch a provision that engages safety substantiation without naming the section number, and more than one does. The coal-tar hair dye exception in 364d(b) refers to “subsection (a)”. Section 364f(a) reaches safety substantiation data by name without citing the section. And 364j(a) names safety substantiation among the subjects on which no State or political subdivision of a State may establish or continue in effect a requirement for cosmetics that is not identical with the requirement applicable under this subchapter. Searching the same 162 clauses for the word substantiation instead returns five: 361(g), 364d(a), 364d(c)(1), 364f(a) and 364j(a). It says nothing about other statutes, about state law, about FDA regulations or guidance, and nothing at all about how any provision is enforced. It is a reading of what the text cross-refers to, not a count of anything that has happened.

What the Act attaches to not holding one

The mechanism is worth understanding plainly, without anybody being told where they stand. A cosmetic shall be deemed to be adulterated (361) if it is a cosmetic product and the product, including each ingredient in it, does not have adequate substantiation for safety, as defined in 364d(c) (the codified text reads “for”, with an editorial note that it probably should read “of”) (361(g)). The introduction or delivery for introduction into interstate commerce of a cosmetic that is adulterated is a prohibited act (21 U.S.C. 331(a)). That is the chain the file sits at the top of, and it runs through the product rather than through the paperwork alone.

Separately, the Act gives FDA access to records. Where the Secretary has a reasonable belief that a cosmetic product is likely to be adulterated such that use of or exposure to it presents a threat of serious adverse health consequences or death to humans, each responsible person and facility shall, on request and on presentation of credentials and written notice, at reasonable times and within reasonable limits and in a reasonable manner, permit access to and copying of all records relating to that product, and to any other cosmetic product the Secretary reasonably believes is likely to be affected in a similar manner, that are needed to assist the Secretary in determining whether the product is adulterated and presents that threat. Then read the carve-outs in the same subsection. The access is not construed to extend to recipes or formulas for cosmetics, financial data, pricing data, personnel data, research data, or sales data. Three of those six carry an exception written inside them: personnel data other than data as to qualification of technical and professional personnel performing functions subject to the chapter, research data other than safety substantiation data for cosmetic products and their ingredients, and sales data other than shipment data regarding sales (364f(a)). The substantiation data is carved back in by name. Note that 364f is one of the seven sections 364i(a) switches off for a product also subject to subchapter V.

In force now, and still a rulemaking

Two of the things people expect to find in this area are not written yet, and it matters which is which.

Cosmetic good manufacturing practice is a rulemaking. The statute directs the Secretary to establish GMP for facilities by regulation (364b(a)) and sets the schedule for it: a notice of proposed rulemaking not later than two years after December 29, 2022, and a final rule not later than three years after that date (364b(c)). There is an adulteration limb keyed to it, for a cosmetic manufactured or processed under conditions that do not meet the good manufacturing practice requirements of 364b (361(f)). FDA’s MoCRA page, read on August 18, 2026 and stating content current as of August 10, 2026, lists cosmetic GMP under regulations MoCRA requires FDA to establish, and links a 2023 public listening session and a draft guidance rather than a final rule (FDA MoCRA page, agency guidance rather than law). Anything sold to you as the cosmetic GMP regulation should be read against that.

Fragrance allergen labeling is the same shape. The Act requires the responsible person to identify each fragrance allergen on the label, and then says the substances that are fragrance allergens for that purpose shall be determined by the Secretary by regulation, with a proposed and then a final rulemaking on a stated schedule (364e(b)). The list is the regulation’s to make.

Safety substantiation is not in that category. Section 364d is statute, it is on the books now, and it needs no regulation to say what it requires, which is why it does not carry a rulemaking schedule the way 364b and 364e(b) do.

Four things to check

These are a way of reading your own position, not an assessment of it. Take dated copies before you change anything, because a safety file is a controlled record and revising one is your own decision.

1. Settle whether the substantiation section reaches your product at all. Also a drug, or soap on the 701.20(a) reading, and the question changes. Both are worth answering before you spend anything on a file.
2. Check whose name is on the label. The section names the manufacturer, packer, or distributor whose name appears on the label in accordance with 364e(a) or with 1453(a) of title 15, so the question is which company the label identifies in that way rather than which mark is largest. If a contract manufacturer holds a file, whose obligation that file discharges is the thing to be clear about.
3. Open the file and find the conditions of use. The definition of safe is anchored to the conditions of use prescribed in the labeling and to customary or usual use. A file that never states the conditions it assumed has not engaged the definition.
4. Find the exposure reasoning. Cumulative or other relevant exposure is named in 364d(c)(2) as something that may be considered. A conclusion with no exposure basis under it is an assertion with a citation on top.

Related reading, once you know the duty is yours: whether a cheap or template safety report can carry it, and what decides that in each market.