FDA’s Adoption of NSF/ANSI 455-3 National GMP Cosmetic Standard Under MoCRA Could Model World Class Example of Public–Private Partnership in a Once-a-Century Opportunity

By Brandi Reinbold

At the close of 2022, Congress made waves in the cosmetics industry with the passage of the Modernization of Cosmetics Regulation Act (MoCRA), which represents the largest change to cosmetic regulations since the Federal Food, Drug, and Cosmetic Act of 1938, and the most expansive new legislation for any U.S. industry since the Food Safety Modernization Act (FSMA).^[1] Among other new requirements, the U.S. Food and Drug Administration (FDA) is now tasked to create Good Manufacturing Practice (GMP) regulations for the cosmetics industry with proposed regulations by December 2024 and final regulations by December 2025.^[2]

With MoCRA, Congress directed FDA to seek existing consensus standards where practicable, to avoid overly burdensome requirements, and to allow for flexibility within the regulations such that manufacturers of all sizes and types can comply without undue economic hardship.^[3] The importance of these details and their implications for industry are hard to overstate. Those interested in the outcome of FDA’s approach to GMP regulations for cosmetics should thus heed this as a call to action and participate in shaping the cosmetics industry of the future.

There is a rare opportunity at this moment to enact a modern regulation that maximizes all the possible benefits for stakeholders in the regulatory design. With smart and targeted regulation that leverages existing consensus standards and the public standards process, FDA can use existing best practices for maximum risk reduction and brand protection to protect the health and safety of U.S. consumers in an optimally efficient manner.

Public–Private Partnership on MoCRA Follows Federal Precedent

The directives to FDA within MoCRA exemplify the shift within the United States over the past decades towards public–private partnership (PPP) within government. This shift was accelerated by the National Technology Transfer and Advancement Act (NTTAA) of 1995, Section 12, Standards of Conformity, in which, for the first time, Congress directed regulators to “coordinate the use by Federal agencies of private sector standards, emphasizing where possible the use of standards developed by private, consensus organizations,’’ and to “coordinate technical standards activities and conformity assessment activities of Federal, State, and local governments with private sector technical standards activities and conformity assessment activities, with the goal of eliminating unnecessary duplication and complexity . . . .’’ NTTAA gives agencies discretion to write new standards when existing consensus standards are “inconsistent with applicable law or otherwise impractical.” If existing consensus standards are not inconsistent with applicable law or impractical, such standards should be adopted.^[4]

NTTAA is supported by executive branch policy of the Office of Management and Budget’s (OMB) Circular A-119-1, which sets policies to guide federal agencies on implementation of NTTAA. Circular A-119-1 states that “[a]ll federal agencies must use voluntary consensus standards in . . . their procurement and regulatory activities, except where inconsistent with law or otherwise impractical.” Agencies can choose to incorporate the standard by duplicating the text within the written regulation or by referring to the standard in whole or in part within the regulation. Agencies can best eliminate duplication by using references to a standard.^[5]

MoCRA echoes the language of NTTAA and OMB regarding “practicability,” understanding that the task before FDA now must be considered in the context of this legislation and policy.

Before delving into the options up for consideration, it is important to understand what agencies are trying to accomplish by execution of these directives.

Private Sector Expertise, Cost-Effectiveness, and Time Savings Are Proven Benefits of Adopting Existing Consensus Standards

The benefits to adopting existing consensus standards rather than writing agency-unique standards include enabling a more cost-effective and timely rulemaking process, allowing the regulating agency to take advantage of the technical expertise of the private sector, and naturally aligning regulation with the best practices of industry rather than imposing a new status quo. In turn, this lessens the burden of compliance on industry by reducing confusion, costs, and time. An additional benefit is an ongoing opportunity for industry to participate in the standard-setting process, which provides a means to address new public health threats as they emerge, implement new best practices over time, and eliminate requirements as they become obsolete.

Similar benefits are gained when agencies use existing conformity assessment activities in lieu of more direct agency activity. Accredited third-party conformance assessments can reduce the operating costs of the agency if the agency is able to access the data for use in its oversight procedures. The private third-party conformance assessment infrastructure is larger than the regulatory apparatus and capable of reaching a greater portion of industry facilities in any given year. Unlike other forms of PPP, the third-party conformance assessment infrastructure is not funded by taxpayers but by industry itself.  

Third-party independent certification allows for early intervention on potential noncompliance issues. Since these independent assessors are not affiliated with FDA, manufacturers are often more open with data and processes during certification inspections. This leads to the most important benefit of adopting existing consensus standards: FDA could enhance industry’s level of compliance without ever setting foot in the door or requiring an additional budget. Voluntary compliance benefits the consumer with safe, more uniform products and allows FDA to impact change in the industry without deploying costly resources.

FDA must set the standard before determining whether using third-party conformance assessments would be feasible. MoCRA continues the trend towards greater PPP by directing FDA to consider national and international standards. FDA must first consider whether the existing standards are “practicable.” If FDA identifies such standards, it should then choose the one that would maximize the benefits to the agency, consumers, and industry. 

NSF/ANSI 455-3 Is the Solution

Public consensus standards can be national or international. International standards may facilitate global trade more seamlessly when such standards are recognized and accepted on a global scale. The current international standard for Cosmetics GMP is International Organization for Standardization (ISO) 22716:2007, which enjoys widespread recognition and acceptance.^[6] Another benefit of ISO 22716 is that a majority of the industry already complies with it to some extent, especially those doing business outside of the United States. Adoption of this standard would thus reduce the overall cost of industry compliance. However, because committee membership for voting on international standards is limited to one representative per country, such standards have a very limited platform for national control, and thus are inflexible to the specific regulatory needs of the United States. Furthermore, the requirements of ISO 22716 are vague, with no guidance on what compliance looks like, and may be inadequate to protect U.S. consumers from adulterated products. This deficiency led FDA to publish draft guidance, hereinafter FDA GMP Compliance, articulating its view of quality management activities and systems that should be in place in U.S. manufacturing facilities, such as requirements for adverse event reporting and microbiological testing.^[7]

National standards designated as American National Standards (ANS), in contrast, achieve balance in a different way. These standards do not limit participation to one representative per stakeholder, but instead follow the American National Standards Institute’s (ANSI) essential requirements for due process, including openness, balance, and consensus.^[8]

Participation in ANSI’s proceedings is thus open to parties of all nations who participate in ANSI standards development with an interest in the standard, and timely public notice of all development activity surrounding such standards is required. The voting member committee consists of a diverse representation of interests in the areas of public health, manufacturing, consumer groups, and users of the standard, and the committee must consider all written views and objections. As new public health threats are identified or existing practices advance or become obsolete, the committee can enact changes via the ANSI process more quickly than is possible under regulation.^[9]

NSF/ANSI 455-3 was developed in 2018 in partnership with the Global Retailer and Manufacturer Alliance (GRMA), a consortium of retailers and manufacturers, to address the need to comply with the ISO 22716 international standard globally, and with FDA GMP Guidance domestically.

NSF/ANSI 455-3 is now an ANSI-accredited standard that incorporates and harmonizes the ISO 22716 and FDA GMP Guidance. Unlike ISO 22716, it provides a platform for national participation and control. In other words, it retains the international trade benefits of a regulatory reference to ISO 22716, which often requires compliance with ISO 22716, while including the additional protective requirements for U.S. consumers of cosmetic products.

Complementing NSF/ANSI 455-3 is a guidance document entitled “Audit Requirements Guideline for NSF/ANSI 455-3 Good Manufacturing Practices for Cosmetics” that provides interpretation on expectations in a flexible way to accommodate a variety of manufacturer processes and situations. Information in the guidance is used to help manufacturers comply without imposing requirements on industry. This allows manufacturers to demonstrate compliance with the standard requirement in other ways where appropriate to their operations. This addresses an important directive of MoCRA: the directive that FDA make its regulations flexible to avoid imposing an undue burden on small entities. The FDA GMP Guidance provides this room for flexibility while maintaining the integrity of the quality requirement in the standard itself, thereby protecting consumers from harm.

NSF/ANSI 455-3 is the GMP consensus standard that meets all the mandates of MoCRA, NTTAA, and OMB A-119-1. It optimizes the desired benefits of a PPP and minimizes the potential limitations of such a regulatory reference. Given the legislative directives in MoCRA, it is the most “practicable” solution. NSF/ANSI 455-3 is aligned with current best industry practices, including those previously conveyed in the FDA GMP Guidance, meets international standards, and is within national control for management over time. To minimize the administrative burden, FDA might incorporate NSF/ANSI 455-3 by reference into its GMP regulations so that it does not have to revise its regulations each time NSF/ANSI 455-3 is updated. FDA should also maintain an open channel of conversation between FDA and stakeholders through Joint Committee participation. Importantly, industry can voluntarily comply with interim standard versions between reference updates, which can provide years of advance notice on what FDA is thinking and where the industry is coalescing. This gives regulated parties the advantage of a longer runway for changes that impact their operations and time to gradually update procedures to stay compliant. This is a best-case scenario of quality and compliance that can be achieved voluntarily by FDA’s participation in the ANSI standard-setting process.

Potential Drawbacks and Limitations of Consensus Standards in Regulations

There are a few drawbacks to incorporating a consensus standard by reference into FDA’s GMP regulations. One potential drawback is that FDA would have incomplete control over the development of standards over time. However, the balance of stakeholders is intended to prevent undue influence of any one interest over the content of a standard, significantly limiting the ability of any one interest group’s ability to make an undesirable change. Further, it is in the best interests of all to develop practical but strong standards. Over a hundred years of consensus standards writing in pharmaceutical, plumbing, water, and other industries provides thousands of examples of the strength of this framework for quality standards development.

Another general limitation on a government agency’s use of reference to a consensus standard is the regulatory requirement under 1 C.F.R § 51.9(b)(2) to include a version.^[10] It is burdensome for FDA to revise this reference each time the standard is updated, as it requires a public notice period for any update under 1 C.F.R. § 51.11. However, agencies have to go through this process for any regulations they promulgate, so this limitation does not impose an additional burden and can be overcome.

A Deep Dive into NSF/ANSI 455-3

NSF/ANSI 455-3 Section 5 describes audit-scheme requirements followed by Certification Bodies (CBs) that certify cosmetic GMP requirements. This section standardizes the audit scheme so that when combined with ISO 17065 accreditation of the Certification Body, it ensures a high level of competency and impartiality in conformance assessments. ISO 17065 is the international standard for conformity assessment of products, services, and processes. It is the gold standard for such activities as evidenced by its global recognition and acceptance. This private ISO 17065-accredited conformance assessment infrastructure can be utilized by FDA to leverage third-party certification to make risk-based enforcement decisions on a voluntary basis with very limited agency resources. Such a scheme not only reduces duplication between private and public efforts but could greatly expand FDA’s reach and visibility into the compliance status of industry.

To illustrate, as part of FSMA, FDA enacted the Accredited Third-Party Certification Program aspect of the Voluntary Qualified Importer Program (VQIP).^[11] Here, FDA only partially incorporated existing third-party conformance assessments. FDA customized the accreditation requirements that the Accreditation Bodies use to approve Certification Bodies. In this program, Certification Bodies have, in a sense, been deputized by FDA and they still have reporting requirements to FDA. The food safety risk to public health was presumably weighed against existing conformance assessment activity, and in this case FDA determined partial customization was appropriate.

Regarding cosmetic manufacturing and the prospect of a regulatory oversight scheme incorporating these activities, a slightly different solution is reasonable.

Because most cosmetic products do not cause serious adverse events, they pose an inherently lower risk than adulterated foods to public health. Accordingly, greater utilization of the existing conformity assessment infrastructure of accreditation to ISO 17065 is appropriate. A custom FDA accreditation program in this instance would be an unnecessary duplication of efforts. By using the existing accreditation system for certification to the public national consensus standard, FDA has access to an extremely efficient oversight tool at no cost to the agency.

Participation in a third-party certification program would need to be voluntary to avoid imposing additional mandatory costs upon industry. Audit reports should remain the property of the manufacturer and may be submitted as part of facility registration on a voluntary and annual basis. FDA could review the report as part of a risk assessment when prioritizing scheduling of routine inspections. Certification Bodies would not have reporting requirements to FDA for voluntary audits because this requirement would introduce a much greater level of complexity into the scheme. A custom accreditation scheme becomes necessary if this is required due to confidentiality requirements of ISO 17065 accreditation. In this way—by ceding any reporting requirement upon CBs—FDA can gain access to a great deal of compliance data from industry as part of facility registration, enabling it to use its resources with precision and to greater effect. Since the agency uses risk-based decision-making to allocate limited resources, facilities that share data could be designated as low-risk and deprioritized on the audit schedule. This scenario maximizes the benefits to all stakeholders.

Conclusion

Because of the continuous management practices of NSF as a standard-writing body, NSF/ANSI 455-3 is the only public standard that can still easily be modified to meet any rulemaking criteria prior to the compliance deadline. As FDA navigates this rulemaking process and reviews the standard, it can engage the NSF/ANSI 455-3 Joint Committee with industry to incorporate new requirements or modify the language of existing requirements. This will ensure that the initial reference serves its purpose for years to come before requiring any update.

NSF/ANSI 455-3 is the existing GMP standard with the greatest utility to maximize benefits and minimize limitations of a regulatory reference. It has the versatility and national control needed to meet current and future needs of U.S. consumers, manufacturers of all sizes, and both domestic and global regulators.

By incorporating the national standard into regulation, FDA could also create an opportunity to harmonize and reduce redundancy in compliance-assessment efforts between government and industry. As part of the process to roll out new regulations, FDA must plan how it will enforce compliance with the goal to protect public health and safety while maximizing the return on investment of expending limited financial resources. Enacting a policy to incorporate third-party conformity assessment activities into federal conformity assessment activities is compliant with Section 12(b) of NTTAA, which requires regulators to look to the availability of existing public consensus standards that are practicable before moving to writing new regulation. It also achieves the benefits sought by eliminating “unnecessary duplication and complexity in the development and promulgation of conformity assessment requirements and measures,” per OMB policy.

For the next year and a half or so, NSF, cosmetics manufacturers, consumers, regulators, retailers, and all of those who are a part of this industry will be able to take advantage of a once-in-a-hundred-year opportunity. By working together in the public space to design a solution that is forward-thinking and practical, we can all reap the benefit of global access to high-quality, affordable cosmetic products made in a regulatory environment that is a world-class example of how PPPs could and should be executed.

 

[1] U.S. Food & Drug Administration, Modernization of Cosmetics Regulation Act 2022 (2023), www.fda.gov/cosmetics/cosmetics-laws-regulations/modernization-cosmetics-regulation-act-2022.

[2] The National Law Review, The Modernization of Cosmetics Regulation Act: What You Need to Know (2023), www.natlawreview.com/article/modernization-cosmetics-regulation-act-2022-what-you-need-to-know.

[3] H.R.2617—117th Congress (2021–2022), Consolidated Appropriations Act, Modernization of Cosmetics Regulation Act (2022), www.congress.gov/bill/117th-congress/house-bill/2617.

[4] U.S. Department of Commerce National Institute of Standards and Technology, Public Law 104-113 National Technology Transfer and Advancement Act of 1995, Including Amendment by Public Law 107-07 Section 1115 on December 28 2001, Utilization of Consensus Technical Standards by Federal Agencies (2001), www.nist.gov/standardsgov/national-technology-transfer-and-advancement-act-1995.

[5] Executive Office of the President Office of Management and Budget, OMB Circular A-119-1: Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities Agency (2016), www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf#:~:text=The%20policies%20of%20Circular%20A-119%20are%20intended%20to,existing%20standard%20would%20meet%20the%20Federal%20government’s%20objective.

[6] International Organization for Standardization, ISO 22716:2007 Cosmetics—Good Manufacturing Practices (GMP)—Guidelines on GMPs (2022), www.iso.org/obp/ui/en/#iso:std:iso:22716:ed-1:v2:en.

[7] U.S. Food & Drug Administration, Draft Guidance for Industry: Cosmetic Good Manufacturing Practices (2013), https://www.fda.gov/regulatory-information/search-fda-guidance-documents/draft-guidance-industry-cosmetic-good-manufacturing-practices.

[8] American National Standards Institute, ANSI Essential Requirements (2022), www.ansi.org/american-national-standards/ans-introduction/essential-requirements. 

[9] American National Standards Institute, ANSI Process Resources (2023), www.ansi.org/resource-center/american-national-standards.

[10] U.S. Code of Federal Regulations, 5 U.S.C. 552(a) 47 Fed. Reg. 34108 (1982), www.ecfr.gov/current/title-1/chapter-II/part-51.

[11] U.S. Food & Drug Administration, Voluntary Qualified Importer Program (VQIP) (2023), www.fda.gov/food/importing-food-products-united-states/voluntary-qualified-importer-program-vqip.