0:00
/
0:00
Preview

[March 2026] MoCRA Records Access for Cosmetics, Medical Device Cybersecurity + OTC Sterility Warning Letter

FDA clarifies what investigators can demand from cosmetics under MoCRA, cybersecurity requirements align with QMSR, and a Texas OTC firm learns that sterility claims require sterility capability.

Welcome to Insider issue #47.

Also, hello to the 389 life science professionals who joined us last month. If you haven’t already upgraded to a paid subscription to unlock our in-depth analysis issues like this one, you can do so here. Read our past deep dives here.

The FDA Group's Insider Newsletter is a reader-supported publication. To receive new posts and support our work, consider becoming a paid subscriber.

This month, we open with new ground under the Modernization of Cosmetics Regulation Act. Diamond Dent-Mitchell walks through the FDA’s draft guidance on records access authority for cosmetic products: what inspectors can now request, what remains protected, and how responsible persons and contract manufacturers should prepare before investigators arrive. The guidance may be “draft,” but its operational implications are immediate.

Jonathan Wacks tackles the FDA’s reissued cybersecurity guidance for medical device premarket submissions. The February 2026 update aligns with the QMSR transition to ISO 13485 and signals that cybersecurity is no longer a bolt-on consideration but a core design control element. If your device connects to anything, this guidance applies to you!

Our warning letter analysis examines a Texas-based OTC contract manufacturer that claimed to produce sterile products without cleanrooms, validated sterilization processes, or any apparent understanding that these might be problems. Kittu Rao dissects the cascading failures and offers a practical framework for sponsors evaluating CMO sterility capability.

Download our slide decks to use any way you’d like:

The full video is for paid subscribers