The Product Information File held continuously
The Product Information File held continuously rather than assembled under pressure, ingredient restrictions checked against live annexes, and registration clocks that run themselves. Built to ISO 22716, mapped to MoCRA, EU Regulation 1223/2009 and Cosmetics Rules 2020, and kept current with regulatory change as part of the product, at no extra cost.
The obligations arrived before the manufacturing rule did
MoCRA gave the FDA authority to write a cosmetic manufacturing practice regulation. That regulation has not been published. Meanwhile facility registration, product listing, safety substantiation and serious adverse event reporting are all in force and enforced, and adverse events have been publicly searchable by product name since September 2025. The obligations landed first, which means the records matter more, not less.
ISO 22716 is the standard everyone actually builds to. In the European Union it carries a presumption of conformity with Article 8. India's Schedule M-II is materially thinner: no change control, no internal audit, no out of specification handling, no complaints or recall procedure. We built the pack to ISO 22716 and treat Schedule M-II as a subset of it.
The controls below run on the same compliance engine every industry uses.
What's tailored for cosmetics
Not just compliance mapping — here's where the modules themselves work differently for this industry.
The Product Information File assembles continuously and stays retained ten years after the last batch placed on the market, instead of being pulled together under pressure.
Retained samples are tracked as inventory, with location, quantity and parent batch, not a shelf someone remembers.
Ingredient restriction checking runs against live annexes, flagging every affected formulation the moment a substance is added.
20 controls, 6 standards
Select a standard to filter
Working draft, not a certified mapping — our own reading of each framework's published scope, not a legal determination.
Coverage by geography
We watch the regulations so you don't have to
Standards don't stay still. The Compliance Engine tracks every one that applies to you: when a rule changes, it tells you what it affects, updates the system, and re-validates before anything goes live. You don't file a change request. It's already handled.
Public adverse-event search absorbed
MoCRA adverse events became searchable by product name; the pack's serious adverse event intake already ran on the 15-business-day clock it needed.
MoCRA obligations
Facility registration on a two-year renewal, annual product listing, safety substantiation, serious adverse event reporting and FDA mandatory recall authority.
IS 4707 Part 2:2025 in force
Replaced the 2017 prohibited and restricted ingredient standard in India. Part 3:2025 on permitted preservatives took effect 9 August 2025.
EU Omnibus Act VIII applied
Non-compliant stock had to be off the market.
EU Omnibus Act IX applies
Carrying new CMR classifications and recent scientific committee opinions.
Every update runs through the same validation discipline as the platform itself — tested against the workflows it touches before it reaches a single client's floor. Nothing ships because a regulation changed; it ships because the change passed.
India licensing, built in
Manufacturing is applied for on Form COS-5, or COS-6 for a loan licence, and granted as COS-8 or COS-9 within 45 days, perpetual thereafter subject to the five-yearly retention fee. Imports run through SUGAM on Form COS-1 to a COS-2 registration certificate, with secondary registration on COS-4 valid three years and new-ingredient approval on COS-12. The pack holds the licence register, the renewal clocks and the Schedule M-II batch record fields an inspector reads first.
Validation readiness
The controls above are enforced in the architecture, not configured on top of it.
- Validation packs (URS, IQ, OQ, PQ, RTM, GAMP 5) are available on the Dedicated tier.
- ISO 27001 certification is in progress.
- Inspection readiness is scored continuously by the Compliance Engine, not assembled the week before an audit.
For the technical detail behind these controls — encryption, access control, audit trail mechanics and backups — see Infrastructure & Security. For what sits in each workspace, see Modules.
Have a compliance requirement to walk through?
Tell us about your regulatory environment and we'll show you exactly how Factro fits.