ISO 22716 and cosmetics GMP: what it proves and who needs it
Reviewed by our formulation chemist team. Updated October 2026.
What the standard covers, what a certificate does and does not tell you, how to check one, where the law requires GMP (EU, UK, US under MoCRA) and a checklist for auditing a skincare factory.
ISO 22716 is the international guideline for good manufacturing practice (GMP) in cosmetics: how a factory controls its people, premises, equipment, raw materials, production, quality control, storage, shipping, complaints and records. A certificate from an independent certification body shows that an auditor found that system in place at a named site; it does not prove that a product is safe, legal in your market or approved by anyone. The EU and UK require GMP and presume compliance when production follows ISO 22716; the US MoCRA law requires FDA to set GMP rules, but as of October 2026 no proposed rule has been published. China, Southeast Asian regulators, importers and retail buyers commonly ask for a GMP certificate.
What ISO 22716 is
Good manufacturing practice (GMP) means the rules a factory follows so that every batch is made the same way, from approved materials, in clean conditions, with records that let anyone trace what happened. ISO 22716:2007, "Cosmetics, Good Manufacturing Practices (GMP), Guidelines on Good Manufacturing Practices", is the international standard for it in cosmetics. ISO publishes the standard; ISO does not audit factories or issue certificates.
Three points help when you read a manufacturer's claims:
- It is a guideline, not a test. It describes what a GMP system should contain. It does not set limits for microbes or heavy metals; those come from each market's rules and the product specification.
- It covers manufacturing, control, storage and shipment of products. The standard states that it does not cover research and development or the distribution of finished products, and it does not deal with worker safety or environmental protection.
- It is site-specific. A certificate covers the address and activities named on it. A company with two plants can have one certified and one not.
The 2007 edition is the one certificates refer to as of October 2026. ISO reviews standards on a regular cycle, so check the ISO page for any revision before you write the edition into a contract.
What the standard covers, section by section
ISO 22716 is organized by topic. This table translates each section into what you would see in a good factory.
| Section | What it requires, in plain terms | What you can ask to see |
|---|---|---|
| Personnel | Defined responsibilities, trained staff, hygiene and protective clothing rules | Organization chart, training records, gowning rules at the entry to production |
| Premises | Separated areas for storage, production, quality control and washing; clean, maintained, pest controlled | Floor plan with flows, cleaning logs, pest control reports |
| Equipment | Suitable, clean, maintained and calibrated equipment | Calibration stickers and records, cleaning status labels, maintenance logs |
| Raw materials and packaging materials | Purchased against specifications, received, sampled, released or rejected, stored and identified; water quality controlled | Quarantine and released labels, supplier approval list, water test records |
| Production | Written manufacturing and packaging instructions per product; checks at each step; each batch recorded | A blank and a completed batch record (with your formula hidden if it is another brand's) |
| Finished products | Released against acceptance criteria, stored and shipped under control | Release procedure, finished goods storage, shipping records |
| Quality control laboratory | Test methods, sampling, results recorded, retained samples kept | Lab equipment (pH meter, viscometer, microbiology incubator), test records, retained sample storage |
| Out of specification | Investigation and decisions on products or materials that fail a specification | The OOS procedure and a recent closed case |
| Wastes | Waste handled so it does not affect product quality | Waste areas and disposal records |
| Subcontracting | Written contracts with subcontractors (for example a test lab or a filler), with responsibilities defined | List of subcontractors and the contract terms that cover quality |
| Deviations | Any departure from instructions is recorded and justified | Deviation log |
| Complaints and recalls | Complaints recorded, investigated and answered; a recall procedure that can be run fast | Complaint log, recall procedure, a mock recall record |
| Change control | Changes to formulas, materials, equipment or processes are assessed and approved before use | Change control forms |
| Internal audit | The factory audits itself and fixes what it finds | Internal audit schedule and the latest report summary |
| Documentation | Controlled, current documents and records kept for a defined time | Document list, version control, record retention rule |
Retained samples and batch records are part of this system. Under ISO 22716, a factory keeps records of each batch and retains samples of finished products for a defined period under suitable storage, so that a complaint can be investigated against the same batch later. How long depends on the factory's procedure and your contract; write the period into your manufacturing agreement (see our manufacturing agreement guide).
What a certificate proves and does not prove
| An ISO 22716 certificate shows | It does not show |
|---|---|
| An independent auditor found a cosmetics GMP system in place at the named site, for the named activities, on the audit dates | That your product is safe; safety is shown by the safety assessment (CPSR in the EU, safety substantiation in the US) |
| The site keeps batch records, controls materials and releases products against specifications | That a given batch passed; that is the batch COA |
| The certification body will come back for surveillance audits while the certificate is valid | That the product meets a market's ingredient, label or registration rules |
| A basis for the GMP statement in an EU or UK product file | Any approval by the FDA, the EU or another government; an "FDA registered facility" is registered, not approved |
| A certificate number you can verify with the issuer | That the company you are talking to is the factory on the certificate, or that the certificate is still current |
So treat the certificate as an entry ticket. It tells you the factory has a system. Your own checks (samples, COAs, stability data, a visit or video walk-through) tell you how well it runs.
Who certifies, and how to check a certificate
Certification bodies are private auditing companies. They audit the factory against ISO 22716, issue a certificate, and return for surveillance audits, usually every year, with a full recertification on a multi-year cycle. Some are accredited for this scheme by a national accreditation body that belongs to the International Accreditation Forum (IAF); accreditation means someone checks the certifier. A certificate from an unknown body with no verification route is worth little.
- Ask for the certificate copy
A manufacturer should send it without fuss. Many share it under NDA because it names the production site.
- Read the name, address and scope
The legal name and address must match the site that will make your product. The scope should cover the activities you need, for example "manufacturing, filling, packaging, storage and shipment of skincare products". A scope of "storage and distribution" alone does not cover production.
- Check the standard and dates
ISO 22716:2007, an issue date, an expiry date and, ideally, the date of the last surveillance audit.
- Verify with the issuer
Look up the certificate number on the certification body's website, or email the body and ask it to confirm the certificate is valid. If an accreditation mark appears, you can also search IAF CertSearch, which lists certificates issued under accredited schemes whose certifiers take part.
- Match it to the rest
The facility on the certificate should be the one on the FDA facility registration (for US sales), in the EU product file and on the COAs. If the names differ, ask why: it may be a subcontracted site.
EU and UK: Article 8 and the PIF
Article 8 of the EU Cosmetics Regulation says the manufacture of cosmetic products must comply with good manufacturing practice, and that compliance is presumed when manufacture follows the relevant harmonized standards. The harmonized standard published for this purpose is EN ISO 22716. Article 11 then requires the Product Information File (PIF) to include a description of the manufacturing method and a statement on compliance with GMP.
- For an imported product, your EU Responsible Person needs that GMP statement from the manufacturer, usually backed by the certificate copy.
- ISO 22716 is the presumption route, not the only route. A factory can show GMP another way, but then the Responsible Person must be able to defend it to an authority.
- Great Britain keeps the same rule. GOV.UK says GMP can be demonstrated through compliance with the designated standard ISO 22716, and the UK PIF must include GMP records.
Our EU cosmetics regulation guide and UK guide cover the rest of the file.
US: MoCRA GMP status as of October 2026
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) told FDA to set GMP rules for cosmetic facilities (21 U.S.C. 364d), consistent with national and international standards where practicable. The law set deadlines of December 29, 2024 for a proposed rule and December 29, 2025 for a final rule.
- Status: as of October 2026, FDA has not published a proposed cosmetics GMP rule in the Federal Register (we checked the Federal Register on 27 October 2026). FDA's 2013 draft guidance on cosmetic GMP remains the document on record, and trade press reports that the rule is not on FDA's near-term agenda.
- What applies today: a cosmetic is adulterated if it is prepared, packed or held under insanitary conditions that may contaminate it or make it harmful. FDA can inspect facilities, and MoCRA gives it records access and mandatory recall powers.
- Small businesses: businesses with average gross annual US cosmetic sales under USD 1 million over the previous 3 years (adjusted for inflation) will be exempt from the future GMP rule, except for higher-risk products such as those that contact the eye or are injected.
- Registration is not GMP certification: MoCRA facility registration with FDA is a listing of the site, with no audit and no certificate.
In practice, US buyers and insurers use ISO 22716 as the benchmark until FDA's rule exists. Our MoCRA compliance guide tracks the rule.
Korean CGMP and ISO 22716
Korea's Ministry of Food and Drug Safety (MFDS) runs its own voluntary cosmetics GMP scheme, 우수화장품 제조 및 품질관리기준 (often called Korean CGMP), and designates factories that meet it. It is reported to be closely modeled on ISO 22716. The difference that matters to a brand abroad:
| ISO 22716 certificate | Korean CGMP designation | |
|---|---|---|
| Who issues it | A private certification body after its audit | Korea's MFDS, a government authority |
| Recognized where | Worldwide; it is the EU presumption standard | In Korea; abroad, accepted where a market wants a government-issued GMP document |
| Typical use | Importers, EU and UK PIFs, retailers, most registrations | Markets that ask for a GMP qualification issued by the origin country's authority |
Ask which one your importer or regulator wants before you assume one replaces the other.
Which markets and buyers ask for GMP proof
| Who | What they ask for (as of October 2026) |
|---|---|
| EU and UK | A GMP statement in the PIF; the ISO 22716 certificate is the usual evidence |
| US | No GMP certificate required by law today; importers, insurers and retail buyers often ask for ISO 22716 |
| China (NMPA) | For filing an imported general cosmetic without animal toxicology tests, a production quality management qualification issued by the government authority of the producing country, plus a full safety assessment; in 2026 NMPA widened this route to some special cosmetics (reported by regulatory consultancies). A private certificate alone may not be enough; ask your Chinese responsible person |
| Indonesia (BPOM) | The manufacturer's GMP certificate is part of the notification file filed by the local importer (reported) |
| Malaysia (NPRA) and other ASEAN states | A GMP certificate or similar for foreign manufacturers; the ASEAN Cosmetic Directive expects manufacturers to follow ASEAN cosmetic GMP guidelines, which align with ISO 22716 (reported) |
| Gulf importers | Often a GMP certificate copy with the CFS and COA for registration |
| Amazon and other marketplaces | No published blanket GMP certificate rule for cosmetics; reviewers can ask for manufacturer documents in a listing or category review, and sellers report GMP certificate requests in some cases |
| Retailers and distributors | Supplier onboarding forms commonly ask for a GMP certificate or a third-party audit report |
See our export documents guide for the full document list by market.
Audit checklist for visiting a factory
You do not need to be an auditor to learn a lot in two hours on site or on a video walk-through. Use the ISO 22716 sections as your map and ask to see things, not just hear about them.
- Before the visit
Ask for the ISO 22716 certificate copy, the FDA facility registration number if you sell in the US, a list of product types made on site, and the filling lines available for your container size. Sign an NDA if they ask.
- Entrance and hygiene
Is there a changing area, hair and shoe covers, hand washing? Are visitors gowned like staff?
- Raw material warehouse
Look for "quarantine", "released" and "rejected" status labels, first-expiry-first-out storage, and temperature control for sensitive materials.
- Water system
Most skincare is mostly water. Ask how purified water is produced and how often it is tested for microbes.
- Weighing and mixing
Are scales calibrated (stickers with dates)? Are tanks labeled with product, batch and cleaning status? Is there a written batch record at each station?
- Filling and packaging
Are lines cleared between products (line clearance)? Who checks fill volume, cap torque and the batch code and expiry print on each unit?
- QC laboratory
pH meter, viscometer, microbiology incubator and media, stability chambers. Ask to see a recent COA and the raw data behind it.
- Retained samples
Where are finished product samples kept, for how long, and can they find one from a past batch quickly?
- Records and procedures
Ask for the deviation log, the complaint log, the recall procedure, change control forms and the last internal audit summary. You do not need to read them all; you need to see they exist and are used.
- Subcontractors
Which tests go to outside labs? Is any filling or packing subcontracted? Who checks them?
- After the visit
Write down what you saw, ask for the documents you could not see, and put the key points (batch records, retained samples, notice of changes, audit rights) in your agreement.
- Treating an ISO 22716 certificate as proof that a product is safe or legal.
- Accepting a certificate whose name, address or scope does not match the plant making your product.
- Not checking expiry or verifying the certificate number with the issuer.
- Confusing FDA facility registration with FDA approval or GMP certification.
- Assuming MoCRA GMP rules are already in force and asking a factory for an "FDA GMP certificate", which does not exist.
- Assuming a private certificate satisfies China's government-issued GMP qualification route.
- Skipping the retained sample and batch record terms in the contract, then having nothing to investigate a complaint with.
- ISO 22716 certificate copy received
- Name, address and scope match the production site and activities
- Standard edition, issue date and expiry date checked
- Certificate verified with the certification body (or IAF CertSearch where listed)
- Same site on the FDA registration, COAs and EU or UK product file
- GMP statement ready for your EU or UK Responsible Person
- Market-specific GMP document confirmed (for example China or Indonesia)
- Factory walk-through or video tour done, notes kept
- Batch records, retained samples and change notice written into the agreement
- MoCRA GMP rule status checked before each US launch
How KoreanOEM helps
KoreanOEM is a Korean skincare OEM and private label manufacturer: our formulation chemists in Busan (Haeundae-gu) develop every formula, and production runs at an ISO 22716 (cosmetics GMP) facility in Pyeongtaek, Gyeonggi-do, with our own staff on site. The facility is FDA registered under MoCRA. Our own production facility in Busan is being built.
- GMP documents: an ISO 22716 certificate copy for your importer, Responsible Person or registration, plus the GMP information your EU or UK product file needs.
- Batch documents: a COA and microbiology results for every batch, the MSDS (SDS) and the specification, included in the unit price.
- Traceability on the unit: the batch number and expiry are printed on every unit in the format your marketplace asks for.
- Low minimums: ready library formulas from 500 units for serums, creams and ampoules. First orders below 500 units are possible when you share your growth plan (expected volumes for the next orders), reviewed case by case.
- Documents for other markets: we prepare the documents China, ASEAN, Gulf and Indian importers ask for; tell us what you need and our team checks with the lab or partner before anything is promised. See certifications and about us.
Best price, best cost and the lowest minimum order you cannot find anywhere else. We believe in our customers' vision rather than our own profit, so even if we lose money at the beginning, we still support you.
Frequently asked questions
What is ISO 22716 (cosmetics GMP) and do I need a certified maker?
Korean CGMP or ISO 22716: what is the difference?
Does the FDA require GMP for cosmetics in 2026?
Is an FDA registered facility the same as FDA approved?
How do I check that a GMP certificate is real?
What certificates should a manufacturer be able to show me?
Can I visit the factory or get a video audit?
Does the maker keep batch records and retained samples?
Which markets ask for GMP proof?
Sources
- ISO: ISO 22716:2007 Cosmetics, Good Manufacturing Practices (GMP)
- EUR-Lex: Regulation (EC) No 1223/2009, Articles 8 and 11
- GOV.UK: Making cosmetic products available to consumers in Great Britain
- 21 U.S.C. 364d: Good manufacturing practice (MoCRA)
- 21 U.S.C. 364h: Small businesses (MoCRA)
- FDA: Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
- Federal Register: Food and Drug Administration documents
- FDA: FDA does not provide certificates to verify compliance of cosmetic products
- MFDS (Korea): Cosmetics
- CIRS: China NMPA eight matters on cosmetic registration and filing (2026, reported)
- CIRS: ASEAN cosmetics registration by country (reported)
- IAF CertSearch: verify accredited certificates
Checked against these sources in October 2026. Rules and fees change; check with the authority or your importer before you sell.