FDA Finalises Recall Rules; The Order Follows the Label

What signal is this?

The FDA finalised "Questions and Answers Regarding Mandatory Cosmetics Recalls: Guidance for Industry" in October 2026. The agency says it reviewed comments on the draft published on 18 December 2025 and finalised the document with no substantive changes. The legal basis is section 611 of the Federal Food, Drug, and Cosmetic Act, newly added by MoCRA.

The authority works as follows. If the FDA finds (i) a reasonable probability that the cosmetic is adulterated under section 601 or misbranded under section 602, and (ii) a reasonable probability that use of or exposure to the product will cause serious adverse health consequences or death, it can order the responsible person to cease distribution and recall the product. The two findings are not alternatives; the power applies where they coincide.

What this document changes is procedure, not duty. No new ground for recall was created; what has been published, in question-and-answer form, is the sequence in which the FDA enforces an existing power. The FDA states that most recalls of cosmetics have historically been voluntary and that it expects most violative cosmetics to continue to be recalled voluntarily. The guidance itself is nonbinding and reflects the agency's current thinking.

There is still a reason to read it now. Once an enforcement sequence is written down, the authority becomes easier to use, and the deadlines inside that sequence become a brand's response time. As we will see, the most operational number in this guidance is ten days. It also interlocks with a separate draft guidance on records access the FDA published in January 2026. That document sets out which records the FDA looks at when a recall is in play — and most of those records sit with the factory, not the brand.

A note on how far to read this. The date of finalisation differs by source. The FDA guidance document itself is labelled October 2026; the "What's New" item on the FDA's MoCRA page gives 29 October, while trade press reported publication on 22 October. This article does not pin a single day and writes "October 2026". The procedural details here — the ten-day hearing, who must be notified, the content of the press release — are drawn from the FDA's published question-and-answer document and its draft text, and any actual determination follows the statute and the FDA's own decision. The records access guidance is still at draft stage and may change on finalisation. This article is not legal advice, and item-level judgements for the U.S. market need confirmation from a local regulatory specialist.

1. The order follows the name on the label

The statute defines the responsible person as the manufacturer, packer or distributor of a cosmetic product whose name appears on the label of that product. The deciding document is the label, not the supply agreement. Regardless of who physically made the product or who designed the formula, the name on the label determines the responsible person.

In an OEM or ODM structure this definition translates straight into practice. Even where a Korean manufacturer made the bulk and filled it, if the brand's name appears on the label of the product distributed in the United States, the cease-distribution and recall order goes to that brand. Conversely, where a U.S. distributor's name goes on the label, the order goes there. So the question to settle early in development is not "who makes this" but "whose name goes on the U.S. label".

The duties attached to the responsible person go beyond recalls. The responsible person submits the product listing, which must include the facility registration number for each manufacturing site, the product name as it appears on the label, the cosmetic category and the full ingredient list, and which is updated annually. On the registration side, every person that owns or operates a facility engaged in manufacturing or processing cosmetics for U.S. distribution must register it, renew every two years, and report changes within 60 days. Registration requires an FDA Establishment Identifier (FEI), and the FDA advises that FEI requests for cosmetic product facilities are typically processed in 7 to 10 business days.

What this structure means is simple. Because the listing carries the manufacturing facility's registration number, the link between the name on the label and the actual production site already exists on the FDA's side. A brand is not in a position of having to explain that production happened elsewhere; that link was submitted at registration. On the FDA's published tallies, there are over 15,000 unique active cosmetic product facility registrations and over one million unique active product listings.

So the contract items to check are a name and some numbers. Whose name goes on the U.S. label, who submits the facility registration and who submits the product listing, and whether the brand actually holds the manufacturing facility's registration number. Where these three do not line up, the mismatch surfaces not in a recall but at the next routine renewal.

• Whether the contract records whose name goes on the U.S. label
• Whether it is settled who submits the facility registration and who the product listing
• Whether the manufacturing facility's registration number is held on file
• Whether the label product name, category and ingredient list submitted in the listing match the actual label

2. The order requires both findings together

The threshold in section 611 has two layers: a reasonable probability of adulteration or misbranding, and a reasonable probability that use or exposure will cause serious adverse health consequences or death. A problem with labelling claims alone does not trigger this authority; the health-consequence probability has to be present as well.

The two axes are different in kind. Adulteration belongs to the domain decided in the factory — ingredients, contamination, manufacturing conditions — while misbranding belongs to the domain the brand decides: label items and wording. Yet the order does not split those domains; it goes to the single entity named on the label. The brand therefore carries the risk created by its own wording and the risk created by the factory's quality in the same place.

The fact that serious health consequences form part of the test gives a clue for reading items by risk. One useful reference point is the small-business exemption. The FDA exempts certain small businesses from facility registration and listing, but excludes specific product types from that exemption — products that are injected, products intended for internal use, and products that regularly contact the mucous membrane of the eye. The law already treats risk levels differently by product type.

Some products fall outside the scope altogether. Products regulated as both cosmetics and drugs or devices are not covered by section 611, and the different recall authority in section 613 may apply instead. In the United States, sunscreens and antiperspirants fall here. The fact that an item classed as a cosmetic in Korea moves into a different legal framework in the United States is itself a development variable: the same formula sent to two markets can face different recall procedures and different governing provisions.

So the thing to record per item is classification. Is this a cosmetic in the United States, or a cosmetic that is also a drug, and on what basis. Once classification is settled, which recall authority applies is settled, and the kind of records to prepare follows from that.

• Whether each item's U.S. classification (cosmetic / cosmetic-drug) is recorded
• Whether claims review and quality review sit under the same responsible person
• Whether products treated differently by risk, such as eye-area and mucous-membrane contact, are classed separately
• Whether the applicable recall provision differs by market for the same formula

3. The voluntary chance comes first, and the hearing is within 10 days

The sequence is set out in the guidance. Where the FDA finds both conditions met, it first provides the responsible person with an opportunity to voluntarily cease distribution and recall the cosmetic. That opportunity is given in writing. If the responsible person does not act voluntarily, the FDA can issue an order to immediately cease distribution.

What follows the order is an informal hearing. The FDA must provide the responsible person subject to an immediate cease-distribution order under section 611(a) with an opportunity for an informal hearing, to be held not later than 10 days after the date the order issues. After the hearing, the FDA may vacate the order, continue it, or amend it to require a recall. Refusing or failing to comply with an order is a prohibited act under section 301.

For a brand, the number this procedure hands over is ten days. What has to be ready inside those ten days is not an explanation but records: which lots the affected scope reaches, where those lots went, and the basis on which the scope can be narrowed that far. Without those three, all that can be said at the hearing is "under review" — and a scope that cannot be narrowed is set at the wider reading.

The difficulty is that most of these records are not on the brand's servers. Lot-level manufacturing records, raw material receipt records and in-process measurements sit at the factory, and distribution records are scattered across importers and distributors. The ten days include the time needed to gather and organise that material. If it has never been requested in normal times, the request itself becomes a first attempt.

So a contract item appears that has to be written as a number. Within how many business days does the manufacturer provide lot-level records when a quality or safety issue arises, who receives that request, and how the count works across weekends and Korean public holidays. A contract that says "shall cooperate" rather than giving a number of business days cannot be used to design ten days.

• Whether the manufacturer's lot-record turnaround is written as a number of business days
• Whether a named contact and channel at the manufacturer appear in the contract
• Whether the route for obtaining distribution records from importers and distributors has been checked
• Whether the setup can answer within 10 days including time zones and public holidays

4. You need a list to send the recall notice to

The guidance also covers notification. If the FDA determines it necessary, it may require the responsible person to provide notice of the order to appropriate persons. Those include persons who manufacture, distribute, import or offer for sale the product subject to the order, as well as the public.

Where the order is amended to require a recall, a press release regarding the recall is published. It includes, at a minimum, the name of the cosmetic subject to recall and a description of the associated risk. The unit of disclosure, in other words, is the product name on the label. Where one bulk has gone out under several product names, how many names a single incident from that bulk pulls in should already be calculated.

A notification list is easy to build and hard to maintain. It takes in importers, distributors, physical retailers, marketplace seller accounts and duty-free or parallel channels, and it changes every time a contract changes. Notify from last year's list and there will be gaps, and gaps remain as stock that was never recalled.

What is needed alongside the list is quantity per entry. Where it is recorded which lots went to which account and in what quantity, the notification scope and the recall scope fall out of the same table. With only "total units shipped to the U.S.", notification widens to every account and the recall to every lot. Narrowing scope is decided by the input granularity of shipment records, not by negotiation after an incident.

One more point: this notification is the place where sentences written by the brand go straight out in public. If the same team handles routine marketing copy and the recall notice, that team also needs to know where the records underpinning the wording are held.

• Whether the notification list including importers, distributors and marketplace accounts is current
• Whether shipment records are entered by account and by lot with quantities
• Whether a table shows how many product names share each bulk
• Whether the person who would draft the recall notice is connected to where the supporting records sit

5. The records are at the factory; the liability is on the label

The document that pairs with recalls is the draft guidance "FDA Records Access Authority for Cosmetic Products" (Docket FDA-2025-D-2243), published by the FDA in January 2026. It is still a draft, but it sets out what the FDA looks at during a recall. Where a product may present a threat of serious adverse health consequences or death, the examples of records the FDA may access and copy include manufacturing records, raw material receipt records, product distribution records and safety substantiation records.

The likely triggers are written down too: when the FDA becomes aware of product recalls, adverse event reports or consumer complaints, and after inspections that reveal such conditions. Recalls and records requests, in other words, do not arrive separately; they arrive together in the same situation.

Here one distinction bears directly on development practice. Records the FDA cannot access under section 610 include recipes and formulas, financial, pricing and personnel information, and most research data. Safety substantiation data, however, is carved out as an exception to that research-data exclusion and is therefore accessible. The formula is protected; the safety substantiation material is produced.

That distinction resolves a problem that has long sat in OEM and ODM contracts. Where the manufacturer does not want to disclose the formula and the brand needs regulatory material, the line can be drawn as: formula confidential, safety substantiation and the raw material receipt, manufacturing and distribution records supplied on request. Write that sentence into the contract with a turnaround in business days and both requirements hold at once. Lump it together as "all materials provided" or "anything formula-related withheld" and the matter has to be renegotiated when a request actually arrives.

Retention periods and the underlying duty are worth confirming as well. Per the draft's section 605 answers, adverse event records are kept for six years, or three years for qualifying small businesses. A responsible person must ensure and maintain records supporting adequate safety substantiation of their cosmetic products. The FDA also notes that it does not require specific tests to demonstrate the safety of individual cosmetic products or ingredients. Which tests to run is not prescribed; what is required is a record of the basis on which the product was judged safe. And again, this guidance is still a draft.

• Whether the "formula confidential, safety substantiation supplied" line exists as a contract sentence
• Whether the turnaround for raw material, manufacturing and distribution records is in business days
• Whether it is settled where safety substantiation records are held per item
• Whether the retention setup reflects the six-year (or three-year small-business) period for adverse event records

The first question for the brief

Instead of writing "planned for U.S. export", change one line: whose name goes on this product's U.S. label? The responsible person in the statute is the one named on the label, and cease-distribution and recall orders follow that name. Settle that line and it also settles who submits the facility registration and who the product listing.

The second thing to write is lots and dates. Into how many lots is one bulk run divided, where is the lot number marked, and within how many days can you say which accounts a given lot reached? The hearing is held not later than 10 days after the order issues. Fail to narrow the scope inside that window and the recall scope is set at the wider reading.

The last is one sentence in the contract. Write "the formula stays confidential, while safety substantiation material and the raw material receipt, manufacturing and distribution records are supplied on request within X business days" — with the number. The fact that the FDA's access authority treats formulas and safety substantiation differently has already drawn a line both the manufacturer and the brand can accept.