When you say a cosmetic is «safe,» EU and US regulators don’t hear a slogan. They hear a legal claim that has to be backed by structured data and expert judgement. This article compares what safety substantiation actually means under the EU Cosmetic Product Safety Report (CPSR) system and under US MoCRA, and shows how to build one safety package that satisfies both.
The EU Model: CPSR and Pre-Market Safety Assessment
In the EU and the UK, you cannot legally place a cosmetic on the market without a Cosmetic Product Safety Report (CPSR) signed by a qualified safety assessor.
Regulation (EC) No 1223/2009 requires every cosmetic to undergo a safety assessment documented as a CPSR before it reaches consumers. The report follows a harmonised two-part structure recognised across the EU: Part A covers the safety information itself, composition, raw material specifications, impurities, microbiology, packaging, stability, toxicological profiles, exposure assessment and margin-of-safety calculations. Part B contains the assessor’s conclusion on safety under normal and foreseeable use, along with their reasoning and any conditions of use or warnings.
The CPSR sits inside the Product Information File (PIF), which must stay readily available to authorities and be maintained by the EU or UK Responsible Person. Because the safety opinion is issued before launch, it explicitly answers one question for the specific formula, packaging and use pattern: is this product safe under normal and reasonably foreseeable conditions of use?
In practice, this means safety substantiation is formalised, centralised and front-loaded. No CPSR, no legal placing on the EU market.
The US Model: MoCRA and «Adequate Substantiation of Safety»
MoCRA does not create a US clone of the CPSR, but it does turn safety substantiation into a clear, enforceable obligation rather than a «nice to have.»
Under MoCRA, the Responsible Person must ensure and maintain records supporting «adequate substantiation of safety» for each cosmetic product. The law defines this as tests, studies, research, analyses or other information that experts would consider sufficient to support a reasonable certainty of safety under labelled or customary use. FDA and specialist commentators point to toxicological reviews, ingredient safety data, in vitro and in vivo tests, HRIPT and dermatological tests, along with clinical and consumer data where relevant, as valid building blocks.
These records must be in place and available to FDA on request. They are not pre-approved, but a lack of adequate substantiation can support enforcement action, recalls or warning letters. Mirroring the EU, MoCRA also introduces a US Responsible Person, accountable for compliance including safety substantiation and adverse event management.
In contrast to the EU, MoCRA emphasises post-market oversight backed by mandatory documentation, not a formal pre-market approval or a prescribed report template.
CPSR vs MoCRA: Similar Goals, Different Mechanics
At a high level, both regimes want the same thing: a documented, science-based rationale that the product is safe for consumers. The differences lie in how structured the process is and when it gets checked.
What they have in common:
- Both require a systematic safety assessment covering ingredients, impurities, exposure and vulnerable users.
- Both expect valid scientific evidence rather than assumptions: toxicology data, literature, historical use, testing and reasoned margins of safety where appropriate.
- Both place responsibility on a designated legal entity, the EU/UK Responsible Person or the MoCRA Responsible Person, to hold and present the safety file.
Where they diverge:
- Format and harmonisation: the EU uses a harmonised CPSR structure that assessors and inspectors recognise instantly, while the US has no mandated report format. «Adequate substantiation» is principle-based, which allows flexibility but also creates variability in quality.
- Pre-market vs post-market: EU safety assessment is explicitly pre-market. A product should not be placed on the market without a signed CPSR. MoCRA does not require pre-market approval. Substantiation must exist but is generally reviewed post-market during inspections or in response to concerns.
- Regulatory culture: the EU is more prescriptive, with annexed ingredient lists, SCCS opinions and formal margin-of-safety calculations, while the US is more open-textured, allowing a broader range of data sources and historical use provided the overall package is scientifically sound.
For global brands, the practical message is that a well-done CPSR usually goes a long way towards MoCRA compliance, but it is not automatically sufficient without adaptation to US expectations and product-use specifics.
Building One Safety Package That Works in Both Systems
You can realistically design a single safety core, then format it separately for EU CPSR and US MoCRA.
That core should include:
- Formula and raw material data: full INCI, exact concentrations, specs, impurities, allergens and supplier documentation.
- Toxicology and exposure: ingredient toxicology plus realistic exposure scenarios, including any vulnerable groups.
- Product-specific testing: microbiology, preservative efficacy, stability and packaging interaction, plus patch testing, HRIPT or safety-in-use studies.
- Risk management: clear justification for any use restrictions and label warnings, traceable back to the data.
From there, you shape the same core into an EU CPSR Part A/B with formal margins of safety and an assessor conclusion and organise it separately as a MoCRA safety substantiation file aligned with the «adequate substantiation» definition and ready for FDA inspection.
For brands that already have CPSRs in place, the work is mainly mapping and filling gaps for MoCRA: checking US-specific use patterns and language, then confirming the file clearly meets the US «adequate substantiation» standard.
What This Means for Your Testing Strategy
For brand, regulatory and R&D teams planning global launches, safety substantiation should drive the testing plan, not the other way around.
Plan the safety narrative early: identify your highest-risk ingredients, populations and use patterns, then work out what evidence you will need to feel comfortable in both an EU CPSR and a US MoCRA context.
Prioritise safety-in-use studies: microbiology and stability are essential foundations, but real-world safety-in-use studies (ideally dermatologist-supervised, with additional specialist input where relevant) are what demonstrate that the finished product is well tolerated under normal and slightly exaggerated conditions of use.
If you also want to support performance or «clinically proven» claims, you will need separate, well-designed clinical efficacy studies with clear endpoints, appropriate controls and statistically sound methods. The same applies to consumer perception testing, where structured consumer feedback supports the claims you want to make, so the wording of your claims matches what the data can genuinely show.
Treat documentation as a living file too. MoCRA expects safety substantiation and adverse-event data to stay current over the product life cycle. EU authorities can revisit CPSRs whenever new information emerges.
The end goal is one coherent safety story that would satisfy an EU assessor signing a CPSR and an FDA inspector reviewing MoCRA records. With that in place, when you say «this product is safe,» you are speaking a language both regulators recognise.