ISO 22716 GMP for Cosmetics: What Every Manufacturer Must Know

A cosmetic brand we worked with last year had a beautifully formulated product line, a strong CPSR, and a Responsible Person in place. Their EU launch stalled anyway — because their contract manufacturer in Morocco couldn’t demonstrate GMP compliance to the standard expected under EU Cosmetics Regulation (EC) No 1223/2009. The missing piece was ISO 22716.

For cosmetic manufacturers supplying the EU market, ISO 22716 is not a nice-to-have. It is the internationally recognised benchmark for Good Manufacturing Practice (GMP) that EU regulators, retailers, and brand owners use to assess manufacturing quality. Understanding what it requires — and what it doesn’t — is essential for anyone in the cosmetics supply chain.

What Is ISO 22716?

ISO 22716:2007 is the international standard titled “Cosmetics — Good Manufacturing Practices (GMP) — Guidelines on Good Manufacturing Practices.” Published by the International Organization for Standardization, it provides guidance on the production, control, storage, and shipment of cosmetic products.

The standard is explicitly referenced in EU Cosmetics Regulation (EC) No 1223/2009, Article 8, which states that manufacturers who comply with the relevant harmonised standards — of which ISO 22716 is the primary one — are presumed to comply with the GMP requirements of the regulation. This creates a direct legal link between ISO 22716 compliance and EU market access.

Unlike ISO 17025 (which involves third-party accreditation), ISO 22716 compliance is typically self-declared or assessed through second-party audits by brand owners or retailers. There is no mandatory third-party certification scheme, though several certification bodies offer ISO 22716 audits and certificates.

What Are the Core Requirements of ISO 22716?

The standard covers 16 chapters, each addressing a specific aspect of cosmetic manufacturing:

Personnel

All personnel involved in manufacturing must have appropriate education, training, and experience. The standard requires documented training records, clear job descriptions, and health and hygiene requirements — including restrictions on personnel with skin conditions or communicable diseases working in production areas.

Premises

Manufacturing facilities must be designed and maintained to prevent contamination and cross-contamination. This includes adequate space, appropriate surfaces (cleanable, non-absorbent), controlled access, pest control, and separation of incompatible operations. Temperature and humidity controls are required where product stability demands them.

Equipment

All equipment used in manufacturing must be suitable for its intended purpose, properly installed, cleaned, maintained, and calibrated where measurement is involved. Equipment cleaning validation is a common gap we find during pre-audit assessments.

Raw Materials

Incoming raw materials must be received, identified, quarantined, and released through a documented approval process. Supplier qualification — including assessment of supplier quality systems — is expected. Each raw material must have specifications, and incoming testing or supplier certificates of analysis (CoA) must be reviewed against those specifications before release.

Production

The standard requires written manufacturing instructions (batch manufacturing records) for each product. Batch records must document all steps, quantities, equipment used, in-process controls, and the identity of personnel performing each step. Deviations from standard procedures must be documented and investigated.

Finished Products

Finished products must be tested or evaluated against release specifications before distribution. Retain samples must be kept for each batch for a defined period — typically the shelf life plus one year.

Quality Control

A quality control function must exist, independent of production, with authority to approve or reject raw materials, intermediates, and finished products. This doesn’t require a separate department in small manufacturers, but the QC function must have documented authority and independence.

Outsourced Activities

Where manufacturing steps are outsourced to contract manufacturers or testing laboratories, the brand owner (or the party responsible for the finished product) must ensure those contractors meet equivalent GMP standards. Written contracts defining responsibilities are required.

Complaints and Recalls

Documented procedures for handling consumer complaints and executing product recalls must exist and be tested periodically.

How Does ISO 22716 Relate to EU Cosmetics Regulation?

EU Cosmetics Regulation (EC) No 1223/2009 requires that cosmetic products be manufactured in compliance with GMP. Article 8 states that compliance with ISO 22716 creates a presumption of compliance with this GMP requirement.

This means:

• If your manufacturer is ISO 22716 compliant, EU market surveillance authorities presume your manufacturing process meets the regulation’s GMP requirements
• If your manufacturer is not ISO 22716 compliant, you must demonstrate GMP compliance through other means — which in practice means a detailed audit and documentation package that is far more burdensome than ISO 22716 compliance itself

For brands sourcing from non-EU manufacturers (common for North American brands entering the EU, or EU brands sourcing from Asia), the ISO 22716 compliance status of the contract manufacturer is a critical due diligence item.

ISO 22716 vs. EU GMP Annex 1 (Pharmaceuticals)

A common source of confusion: cosmetic GMP (ISO 22716) is not the same as pharmaceutical GMP (EU GMP, as defined in EudraLex Volume 4). The standards have different scopes, different levels of documentation rigour, and different regulatory consequences for non-compliance.

Aspect	ISO 22716 (Cosmetics)	EU GMP / EudraLex Vol. 4 (Pharma)
Regulatory basis	EC No 1223/2009, Article 8	Directive 2001/83/EC; EudraLex Vol. 4
Certification	Self-declaration or second-party audit	Third-party inspection by national authority (e.g., ANSM, MHRA)
Batch release	Internal QC release	Qualified Person (QP) mandatory release
Validation requirements	Cleaning validation recommended	Process validation, cleaning validation mandatory
Regulatory consequence of failure	Market surveillance action, product withdrawal	Manufacturing authorisation suspension
Applicability to borderline products	Cosmetics only	Medicinal products, including some borderline products

Parapharmaceutical products — products that sit on the border between cosmetics and medicinal products — may need to satisfy both frameworks depending on their claims and composition. This is an area where we frequently advise clients at Care Europe.

How to Implement ISO 22716 in Your Facility

For a manufacturer implementing ISO 22716 for the first time, the practical steps are:

1. Gap assessment: Compare current practices against each chapter of ISO 22716. Document gaps systematically — this becomes your implementation project plan.

2. Procedure development: Write SOPs for each manufacturing activity. Prioritise batch manufacturing records, raw material receipt and testing, equipment cleaning, and finished product release.

3. Training: Train all production and QC personnel on the new procedures. Document training completion.

4. Facility assessment: Walk the facility against the premises requirements. Common issues include inadequate pest control documentation, insufficient separation of incompatible operations, and missing environmental monitoring.

5. Supplier qualification: Establish a supplier qualification programme. For key raw material suppliers, this typically means reviewing their quality systems and requiring certificates of analysis with each delivery.

6. Internal audit: Conduct a full internal audit against ISO 22716 before any external assessment. Address all findings.

7. Management review: Document a formal management review of the GMP system.

For a manufacturer with an existing quality system (ISO 9001, for example), the gap to ISO 22716 is typically 3 to 6 months of focused work. For a manufacturer starting from scratch, 9 to 18 months is more realistic.

What Do EU Auditors Look For?

When EU brand owners or retailers conduct second-party GMP audits of contract manufacturers, the areas that generate the most findings are consistently:

• Batch record completeness: Missing signatures, undated entries, or corrections made without explanation
• Equipment cleaning validation: Cleaning procedures exist but haven’t been validated — i.e., there’s no evidence that the cleaning procedure actually removes product residues to acceptable levels
• Raw material specifications: Specifications exist for some materials but not all, or specifications are not linked to incoming testing requirements
• Retain samples: Retain samples are kept but not systematically labelled, stored under appropriate conditions, or retained for the required period
• Complaint handling: Complaint records exist but root cause analysis is superficial or absent

These are the areas we focus on when preparing manufacturers for EU market entry audits.

The French Regulatory Context

In France, ANSM (Agence nationale de sécurité du médicament et des produits de santé) is the competent authority for cosmetic market surveillance. ANSM conducts inspections of cosmetic manufacturers and importers, and ISO 22716 compliance is the baseline expectation.

DGCCRF (Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes) also has oversight of cosmetic labelling and safety, and can initiate market withdrawal actions for products from non-compliant manufacturers.

For North American brands entering the French market specifically, demonstrating ISO 22716 compliance at your contract manufacturer is a prerequisite for the Responsible Person appointment — no competent Responsible Person will accept responsibility for products from a manufacturer with no documented GMP system.

---

ISO 22716 is the practical foundation of EU cosmetic market access. It’s not bureaucratic overhead — it’s the documented evidence that your manufacturing process is controlled, your raw materials are qualified, and your finished products are safe. Brands that treat it as a checkbox exercise tend to fail audits; brands that build it into their operational culture tend to pass them without drama.

At Care Europe, we conduct ISO 22716 gap assessments for manufacturers across Europe and North America, and we support the implementation process from procedure writing through pre-audit preparation. Reach us at [email protected].