Key Takeaways
- Cosmetic GMP is a working system: It controls people, premises, materials, equipment, production, records, storage, complaints, and recalls so batches are made consistently and contamination or mix-ups are less likely.
- ISO 22716 is the main international cosmetics GMP guideline: The 2007 edition was reviewed and confirmed in 2022 and remains current.
- A certificate is evidence, not a universal legal pass: Requirements depend on the sales market, product classification, facility, and current law.
- FDA registration is not GMP certification: U.S. facility registration and product listing are separate administrative obligations and are not product approvals or quality certificates.
- Brands should verify performance, not only paperwork: Check the certificate scope and status, then review batch records, deviations, corrective actions, testing, traceability, change control, and recall readiness.
A polished factory, a framed certificate, and a successful sample do not prove that every commercial batch will match. Cosmetic good manufacturing practice, or GMP, is the operating discipline that connects an approved formula to repeatable production. ISO 22716 gives manufacturers a widely recognized framework for that discipline, but it does not replace product testing, market-specific law, or a brand’s supplier oversight.
What Cosmetic GMP Means
Cosmetic GMP is the set of organizational and technical controls used to make, control, store, and ship cosmetics under defined conditions. Its purpose is not to make every batch identical at a molecular level. It is to keep normal variation within approved limits, prevent avoidable contamination and mix-ups, and create records that show what actually happened.
An effective system connects five elements:
- Defined responsibility: Qualified people know who may approve materials, issue instructions, release batches, investigate failures, and authorize changes.
- Controlled resources: Premises, utilities, equipment, cleaning, maintenance, calibration, and personnel practices are suitable for the operation.
- Controlled inputs and processes: Raw materials, packaging components, master instructions, weighing, processing, filling, and labeling have approved status and traceable identity.
- Independent checks: Sampling, in-process controls, specifications, laboratory work, and final release prevent production pressure from becoming the only acceptance criterion.
- Documented learning: Deviations, out-of-specification results, complaints, returns, recalls, change control, corrective actions, and internal audits feed improvements back into the system.
GMP therefore reaches beyond a clean production room. A manufacturer can have stainless-steel vessels and still have a weak system if operators use obsolete instructions, material status is unclear, deviations are closed without investigation, or records are completed after the event. A strong production and quality-control system makes decisions traceable to the exact material lots, equipment, people, process parameters, tests, and approvals involved.
What ISO 22716 Covers—and What It Does Not
ISO 22716:2007 provides guidelines for the production, control, storage, and shipment of cosmetic products. It was reviewed and confirmed in 2022, so the 2007 designation does not mean the standard has expired.[1]
| Control area | What implementation should achieve | Typical evidence |
|---|---|---|
| Personnel | Clear responsibilities, training, hygiene, and access appropriate to the task | Organization chart, job descriptions, training and hygiene records |
| Premises and equipment | Layout, cleaning, maintenance, and use that reduce contamination and mix-ups | Cleaning procedures, maintenance logs, calibration status, area inspections |
| Materials and packaging | Identified, quarantined, sampled, approved, stored, and issued under control | Specifications, supplier files, certificates of analysis, status labels, stock records |
| Production | Authorized instructions and contemporaneous records for weighing, processing, filling, and labeling | Master formula, batch record, line-clearance and in-process records |
| Finished products and laboratory controls | Defined specifications, sampling, testing, approval, rejection, and release | Test methods, results, retain samples, release authorization, OOS investigations |
| Deviations and changes | Unexpected events and planned changes are assessed, approved, and followed through | Deviation reports, risk assessments, change controls, corrective actions |
| Subcontracting | Outsourced work is defined, qualified, and monitored | Quality agreements, contractor approvals, audit records, performance reviews |
| Complaints, returns, and recalls | Product history can be reconstructed and market action can be taken | Complaint files, distribution records, traceability exercises, recall procedure |
| Internal audit and documentation | The system is checked and only current, approved information is used | Audit plans, findings, closure evidence, document history, archival controls |
The standard has important boundaries. It addresses product-quality aspects, but not the plant’s employee-safety or environmental-protection system. It also excludes research and development and the distribution of finished products from its stated scope.[1] It does not by itself decide whether an ingredient is legal in a target market, substantiate product safety or claims, approve a label, register a facility, list or notify a product, or prove that the formula will remain stable in its package.
That is why a credible skincare certifications and product-testing program treats ISO 22716 as one layer of the quality and compliance system—not as a substitute for every other requirement.
Is ISO 22716 Legally Required?
The correct answer depends on the market. Separate the legal duty to follow GMP from the commercial choice to obtain a third-party ISO 22716 certificate.
United States
U.S. cosmetics must not be adulterated or misbranded. Manufacturing or holding a cosmetic under insanitary conditions that may contaminate it or make it harmful can support an adulteration finding, even without a certificate requirement.[2]
MoCRA directs FDA to establish binding GMP requirements for facilities that manufacture or process cosmetics. It also provides specified small-business exemptions, with exceptions for certain product categories.[3] As of August 2026, FDA’s current materials still identify the 2013 Cosmetic Good Manufacturing Practices document as draft, non-binding guidance that the agency intends to withdraw or revise in connection with MoCRA rulemaking.[4]
ISO 22716 remains a useful benchmark because that draft guidance considered the standard, but it also modified or excluded aspects based on FDA’s experience.[4] Treat ISO 22716 as a baseline—not proof of compliance with a future final rule—and monitor the rulemaking. U.S.-bound brands also need a separate gap review for MoCRA duties, adulteration and labeling rules, safety substantiation, serious-adverse-event handling, registration, listing, and product-specific requirements.
European Union
EU Cosmetics Regulation Article 8 requires cosmetics to be manufactured in accordance with GMP. It provides a presumption of compliance when manufacture follows the relevant harmonized standards published in the Official Journal.[5] EN ISO 22716:2007 is the published harmonized standard for this purpose.[6]
This distinction matters: the legal requirement is compliant manufacture. A third-party certificate can provide useful evidence for customers and audits, but a certificate alone does not cure poor implementation, and Article 8 does not state that every manufacturer must purchase a certificate.
Other markets
Countries and retailers may adopt ISO 22716, another cosmetic GMP framework, local certification, or additional controls. Never infer acceptance from the words “international standard.” Confirm the current rules for the country of manufacture, destination market, product type, importer or responsible person, and sales channel.
ISO 22716 Compliance, Certification, and FDA Registration Are Different
These terms answer different questions:
| Term | What it means | What it does not prove |
|---|---|---|
| GMP implementation | The facility operates documented controls intended to produce cosmetics consistently | Independent assessment or compliance with every destination-market rule |
| ISO 22716 conformity | The system is designed and operated against the ISO 22716 guideline | That a third party has audited it, unless certification is also provided |
| ISO 22716 certification | An external certification body has assessed a stated organization, site, scope, and period under its certification scheme | Product approval, continuous perfection, or coverage of unlisted sites and activities |
| FDA facility registration | Required facility information has been submitted under applicable U.S. rules | GMP certification, product approval, or an FDA endorsement |
| Product listing or notification | Product information has been submitted to the relevant system | Safety, efficacy, GMP, or regulatory approval unless that system expressly says so |
ISO does not audit companies or issue certificates; external certification bodies perform that work.[7] FDA likewise warns that cosmetic facility registration and product listing are not approval programs and that it does not issue certificates for them.[8]
When reviewing an ISO 22716 certificate, match the legal company name and exact manufacturing address to the proposed site. Check the standard and edition, certified activities, exclusions, issue and expiry dates, certificate number, certification body, and current status. If a distributor sends a certificate for a different factory in the same group, it does not establish coverage of the site that will make your product. Verification is part of choosing a skincare manufacturer, not a document-collection formality.
How GMP Controls a Cosmetic Batch From Receipt to Release
GMP becomes useful when each batch passes through visible control gates:
- Receive and identify: Record each raw-material and packaging delivery with supplier, item, lot, quantity, condition, and date.
- Quarantine and assess: Keep materials unavailable for use until required sampling, document review, or testing supports an authorized disposition.
- Issue approved instructions: Use the current master formula, manufacturing method, packaging instruction, specifications, and approved artwork version.
- Dispense and verify: Weigh only released materials, record actual quantities and lot numbers, identify containers, and perform required checks.
- Manufacture under controlled conditions: Document equipment, times, temperatures, mixing parameters, yields, in-process results, and unexpected events as work occurs.
- Fill and package with line control: Confirm line clearance, component identity, code accuracy, reconciliation, and prevention of label or product mix-ups.
- Test, review, and release: Compare results with approved specifications and require authorized quality review before commercial distribution.
- Store, trace, and monitor: Maintain suitable storage, distribution traceability, retained records or samples, complaint handling, and recall capability.
The approved skincare project process should identify which formula, packaging, specifications, and tests become the controlled commercial version. A sample approval email is not a replacement for master documents or production release.
What Brands Should Verify Beyond the Certificate
Start with evidence from a recent commercial batch or a realistic mock exercise. A useful supplier review asks whether the system works under normal pressure and when something goes wrong.
| Review question | Evidence to request | Warning sign |
|---|---|---|
| Can one batch be reconstructed? | Completed batch record, material lots, equipment, in-process results, yield, packaging codes, release decision | Blank fields, unexplained overwriting, missing lot links, retrospective entries |
| Are materials controlled before use? | Approved suppliers, specifications, receipt and quarantine records, acceptance results, status labels | Materials used before approval or substitutions based only on availability |
| Are cleaning and equipment controls specific? | Cleaning instructions and records, maintenance, calibration, equipment status | Generic “cleaned” tick boxes with no method, date, equipment, or verifier |
| Are failures investigated? | Deviation and OOS files, root-cause analysis, corrective and preventive action, effectiveness checks | Retesting until a pass, repeated failure with no root cause, CAPA closed without evidence |
| Are formula and packaging changes controlled? | Change request, risk assessment, approvals, updated documents, testing impact review | Supplier or ingredient changes made without brand notice or re-evaluation |
| Can the facility act on a complaint? | Complaint investigation linking the market unit to batch and distribution records | Complaint handled only by customer service with no quality review |
| Is recall readiness demonstrated? | Recall procedure, contacts, traceability or mock-recall result, reconciliation | Inability to identify affected customers, countries, quantities, or remaining stock |
| Are outsourced operations governed? | Quality agreement, contractor qualification, responsibilities, records access | The brand learns about an unapproved subcontractor only after production |
Request controlled, relevant evidence rather than an uncontrolled download of confidential factory files. The contract and quality agreement should define audit rights, notification timelines, deviation and change approval, document access, complaint cooperation, record retention, and recall roles. A structured list of manufacturer documents makes these expectations testable.
High-value questions for a skincare manufacturer should also cover what happens after certification: surveillance audits, expired certificates, major nonconformities, site moves, new equipment, quality leadership changes, and regulatory inspections. A valid certificate is a snapshot within a defined scope, not a reason to stop supplier monitoring.
GMP, Quality Control, and Product Testing Are Not Interchangeable
GMP is the system for controlling how work is performed. Quality control applies specifications, sampling, examination, and testing to decide whether materials, bulk product, packaging, and finished batches are acceptable. Product testing generates evidence about defined risks or performance questions. They support each other, but none replaces the others.
| Activity | Primary question |
|---|---|
| GMP | Was the product made and handled under controlled, documented conditions? |
| Batch quality control | Does this material or batch meet its approved acceptance criteria? |
| Stability testing | Does the product remain within relevant limits over time and under planned conditions? |
| Preservative challenge testing | Can the formulation’s antimicrobial protection control specified introduced microorganisms under the test method? |
| Packaging compatibility | Does the formula-package system remain suitable without unacceptable interaction or functional failure? |
| Safety substantiation and claims support | Is there adequate evidence for safe intended use and for the claims the brand will make? |
An ISO 22716 certificate does not mean every product has passed the right stability, microbiological, compatibility, safety, or claims program. Build the required evidence through a risk-based skincare product-testing plan tied to the exact formula, packaging, intended use, market, and claims.
Final Thoughts
Treat cosmetic GMP as observable control, not a logo. ISO 22716 provides a strong international framework, but the buying decision should combine certificate verification, market-specific legal review, batch-level evidence, a clear quality agreement, and ongoing supplier monitoring. The best manufacturer is not the one with the longest certificate list; it is the one that can show how an approved formula becomes a traceable, tested, consistently released product—and how the system responds when results do not go as planned.
FAQs About Cosmetic GMP and ISO 22716
Is ISO 22716 the same as ISO 9001?
No. ISO 22716 is specific guidance for cosmetic production, control, storage, and shipment. ISO 9001 is a general quality-management-system standard that can apply across industries. A company may use both, but ISO 9001 alone does not demonstrate that cosmetic-specific GMP controls have been implemented.
Must cosmetics made under GMP be sterile?
No. Cosmetics generally do not have to be sterile, but they must not contain harmful microorganisms and their microbial levels must be appropriately controlled.[9] GMP controls should reflect the formula, process, packaging, intended use, and applicable specifications. Products intended to be sterile or regulated as drugs or devices may follow different requirements.
How long should cosmetic GMP records be retained?
There is no single universal period for every record and market. Define retention by applicable law, certification or customer requirements, product life, complaint and recall needs, and the time needed to investigate a marketed batch. Put the applicable periods in a controlled retention schedule and in the quality agreement.
Who handles complaints when a brand uses a contract manufacturer?
The quality agreement should assign intake, regulatory reporting, sample retrieval, batch investigation, root-cause work, response approval, corrective action, and recall decisions. The brand should not assume outsourcing production transfers all responsibilities, and the manufacturer should receive enough information to investigate promptly.
Can production move between two ISO 22716-certified factories without requalification?
Certification at both sites does not prove that their equipment, utilities, scale, process, suppliers, or controls are equivalent. Treat a site transfer as a controlled change. Review technical comparability, produce appropriate transfer or validation batches, repeat affected testing, update records and regulatory files, and obtain required approvals before routine supply.
Sources
[1] International Organization for Standardization. ISO 22716:2007 — Cosmetics — Good Manufacturing Practices
[2] U.S. Food and Drug Administration. Good Manufacturing Practice Guidelines and Inspection Checklist for Cosmetics
[3] U.S. Food and Drug Administration. Modernization of Cosmetics Regulation Act of 2022
[4] U.S. Food and Drug Administration. Draft Guidance for Industry: Cosmetic Good Manufacturing Practices
[5] EUR-Lex. Regulation (EC) No 1223/2009 on Cosmetic Products — Article 8
[6] European Commission. Harmonised Standards for Cosmetic Products
[7] International Organization for Standardization. ISO Certification
[8] U.S. Food and Drug Administration. Registration and Listing of Cosmetic Product Facilities and Products
[9] U.S. Food and Drug Administration. Product Testing of Cosmetics
