Cosmetic Regulatory Pathways: FDA, EU & BIS Compliance for New Brands

Three Regulatory Systems, Three Different Logics

The starting mistake in cosmetic regulatory compliance planning is treating FDA, EU, and BIS requirements as variations on a single theme. They are not. Each system was built around a different enforcement philosophy, and that philosophical difference is exactly what determines how much work has to happen before a product can legally be sold, not just how the paperwork is formatted.

• United States (FDA) — historically a lighter-touch, largely post-market enforcement model under the Federal Food, Drug, and Cosmetic Act, now layered with mandatory pre-market registration and listing duties under the 2022 Modernization of Cosmetics Regulation Act (MoCRA)
• European Union — a pre-market dossier model under Regulation (EC) No 1223/2009, where a completed safety file and a named responsible person are legal preconditions of sale, not a post-launch formality
• India (BIS / Cosmetics Rules) — a hybrid model where the Cosmetics Rules, 2020 set baseline labelling, ingredient, and manufacturing-licence requirements under the Drugs and Cosmetics Act, and BIS mandatory certification applies on top of that for specific notified product categories

None of these systems is "stricter" than the others across the board — each is strict about different things. The EU is strict about pre-market documentation completeness; MoCRA raised the US bar on facility and product traceability without requiring pre-market approval; India layers category-specific certification onto a general compliance baseline. Understanding which system governs each target market determines the entire shape of the compliance project that follows, starting with the one most US-based founders encounter first.

FDA Cosmetic Registration Requirements Under MoCRA

MoCRA is the first substantial overhaul of FDA cosmetic authority since the Federal Food, Drug, and Cosmetic Act was passed in 1938, and it fundamentally changed what "FDA compliant" means for a cosmetic brand. Before MoCRA, FDA oversight of cosmetics relied heavily on post-market enforcement — the agency could act against an adulterated or misbranded product already on shelves, but had no general authority to require registration, mandate recalls, or demand safety substantiation before sale. MoCRA closed each of those gaps directly.

The practical obligations a brand or manufacturer now carries under MoCRA break down into four distinct duties, each with its own deadline and its own party responsible for filing:

1. Facility registration — any facility that manufactures or processes cosmetic products for the US market must register with the FDA and renew that registration every two years
2. Product listing — the responsible person must submit a listing for each marketed cosmetic product, identifying its ingredients, and update that listing annually
3. Adverse event reporting — serious adverse events must be reported to the FDA within 15 business days of the responsible person becoming aware of them
4. Safety substantiation — the responsible person must maintain records adequate to substantiate that the product is safe for its intended use, and produce them on FDA request

MoCRA also gave the FDA mandatory recall authority for cosmetics for the first time, meaning the agency no longer has to rely solely on voluntary manufacturer cooperation when a product poses a serious health risk. For a startup, the practical shift is this: FDA compliance moved from "have good practices and hope nothing goes wrong" to "have the registration, the listing, and the safety file ready before launch, because they can be demanded." That earlier post-market model has largely given way to a documentation-first approach that, while still lighter than the EU's, is no longer a rubber stamp.

EU Cosmetic Regulation 1223/2009 and the CPSR

EU Regulation (EC) No 1223/2009 operates on a fundamentally stricter premise than pre-MoCRA US law ever did: nothing gets sold until the paperwork is complete. Every cosmetic product placed on the EU market must have a named "responsible person" established in the EU, a completed Cosmetic Product Safety Report (CPSR), and a successful notification through the Cosmetic Products Notification Portal (CPNP) before a single unit reaches a shelf. This is a pre-market gate, not a post-launch obligation, and it is the single biggest structural difference formulators moving from a US-only launch need to internalise.

The CPSR itself has two distinct parts, and both are legally required, not optional depth:

• Part A — Safety information — covers the product's quantitative and qualitative composition, physicochemical characteristics and stability, microbiological quality, impurities, packaging material interaction, normal and reasonably foreseeable use, exposure data, toxicological profile of each ingredient, and undesirable effects
• Part B — Safety assessment — a reasoned conclusion on product safety, warnings and instructions for use, and an assessor's reasoning, which must be written and signed by a qualified safety assessor meeting specific EU educational and professional criteria

Real search volume confirms this is exactly where formulators and founders are actually looking for answers — "cosmetic product safety report" and "CPSR" queries return meaningfully more search interest than generic EU regulation searches, which tracks with how concrete and procedural this specific requirement is compared to the broader regulatory framework around it. Getting the CPSR built correctly, with a qualified assessor's sign-off, is the part of EU compliance that actually gates a launch date — everything else in Regulation 1223/2009 largely supports or documents that one central file.

BIS Cosmetic Standards and India's Cosmetics Rules

India's cosmetic regulatory framework is frequently misunderstood as a single BIS certification requirement applied uniformly across every product category, and that assumption causes real launch delays when it turns out to be wrong for a specific product. The actual structure has two layers: a general compliance baseline that applies to essentially all cosmetics, and a narrower, category-specific certification requirement that applies only to products BIS has formally notified.

The general baseline comes from the Cosmetics Rules, 2020, issued under the Drugs and Cosmetics Act, 1940, and covers requirements that apply broadly across the sector:

• Manufacturing licence — domestic cosmetic manufacturing requires a state licensing authority licence, and imported cosmetics require registration with India's Central Drugs Standard Control Organisation (CDSCO)
• Labelling requirements — mandatory declarations including manufacturer details, batch number, manufacturing and expiry or "best before" dates, net quantity, and directions for safe use
• Prohibited and restricted ingredients — India maintains its own list under the Cosmetics Rules, which does not map directly onto either the FDA's more limited restrictions or the EU's Annex system

BIS mandatory certification sits on top of that baseline and applies only where a specific product category has been formally notified under India's Quality Control Order framework — historically including categories such as toothpaste, where a specific Indian Standard and mandatory BIS certification mark apply as a market-entry condition. The list of notified categories is not static; it has expanded over time as India has brought more product types under mandatory certification, so a brand cannot rely on a category being exempt just because it was exempt at an earlier point.

The practical step this demands is straightforward but non-negotiable: confirm the current notified-category status for the exact product type before assuming either that BIS certification is required or that it isn't. A brand that skips this check risks either an unnecessary certification delay it didn't plan for, or a genuine compliance gap it didn't know existed — both of which are far cheaper to resolve during formulation planning than after inventory has already been produced for the Indian market.

Cosmetic Ingredient Restriction Lists Don't Match

The most consequential practical difference between these three systems, and the one most likely to force an actual reformulation rather than just more paperwork, is that FDA, EU, and Indian ingredient restriction lists are not the same list under different names. An ingredient permitted at a given concentration in one jurisdiction can be restricted to a lower concentration, require a specific warning statement, or be prohibited outright in another — and the differences are granular enough that they cannot be safely guessed at.

The EU's approach, built around the Annexes to Regulation 1223/2009, is the most detailed of the three: Annex II lists prohibited substances, Annex III lists substances subject to restrictions with specific maximum concentrations and conditions of use, and Annexes IV through VI govern permitted colorants, preservatives, and UV filters respectively, each with its own permitted list and concentration ceiling. Current US federal cosmetic law restricts meaningfully fewer ingredients by name, placing more of the safety burden on the responsible person's own substantiation rather than a prescriptive list — though MoCRA's substantiation requirement means that burden is no longer just a formality. India's Cosmetics Rules incorporate a separate prohibited and restricted ingredient list under its own schedule, developed independently rather than as a mirror of either the EU or US approach.

For a formulator, this means ingredient screening has to happen against each target market's actual current list — not a single global assumption, and not a list that was accurate two years ago. A preservative system, a UV filter, or a colorant chosen for a US-only launch frequently needs re-evaluation, and sometimes reformulation, the moment EU or Indian distribution enters the plan. This is precisely why sequencing matters — the next question is how to plan the compliance project itself once all three systems, and their ingredient rules, are on the table together.

FDA vs EU vs BIS: A Direct Comparison

Laid out side by side, the structural differences between the three systems become concrete rather than abstract — and the comparison makes clear why "compliant" is a market-specific answer, never a universal one.

Read this table as a planning tool, not a ranking: no jurisdiction is simply "easier" once actual timelines and reformulation risk are accounted for. The EU's pre-market gate concentrates the work earlier and adds real lead time before a launch date, while the FDA's post-registration model shifts more risk to enforcement after launch — and India's category-dependent certification means the honest answer to "how hard is Indian compliance" is genuinely "it depends which product this is." That variability is exactly why sequencing a multi-market launch correctly matters more than treating any single jurisdiction's rules as the default template.

Sequencing a Multi-Market Launch

Brands that plan for FDA, EU, and BIS compliance as one coordinated project consistently launch faster and cheaper than brands that treat each market as a separate afterthought discovered only once a distributor asks for missing paperwork. The sequence below reflects the order these requirements actually bite in a real product-development timeline, not the order they appear in each regulation's table of contents.

1. Fix the target markets before finalising the formula — ingredient restrictions differ enough across FDA, EU, and Indian rules that knowing the launch markets up front avoids reformulating a finished product later
2. Screen every ingredient against each target market's current restricted and prohibited list — not a general "commonly restricted ingredients" checklist, but the specific current Annexes, FDA guidance, and Indian Cosmetics Rules schedule
3. Build the safety substantiation file once, structured to serve multiple markets — stability, microbiological, and toxicological data gathered for a CPSR can generally support FDA substantiation records too, so sequence testing to avoid duplicating work across jurisdictions
4. Confirm BIS-notified-category status early if India is a target market — this determines whether a formal certification and testing process needs to be budgeted into the timeline at all
5. File registration, listing, and notification obligations in parallel, not sequentially — MoCRA registration/listing and EU CPNP notification are independent filings that don't depend on each other, so running them in parallel compresses the overall timeline

The founders who get burned are almost always the ones who treat regulatory compliance as a final step before shipping rather than a parallel track that starts alongside formulation. Building that lead time in from day one turns three separate legal obligations into one coordinated launch plan — which is the difference between a product that clears customs and one that sits in a warehouse waiting on paperwork nobody started early enough.