ISO 22716 for Cosmetics

A Chinese contract manufacturer sends over a certificate. It carries a logo, a registration number, the words ISO 22716, and an expiry date. The brand owner files it and considers the question closed.

Two things are usually wrong with that. The certificate may not cover what the buyer assumes it covers. And in the European Union, which is where most of this pressure originates, a certificate was never what the law asked for in the first place.

This page sets out what ISO 22716 contains, what European and United States law actually require, how to read a supplier's certificate without being misled, and where good manufacturing practice sits in a compliance file.

What ISO 22716 is

ISO 22716 is titled Cosmetics, Good Manufacturing Practices, Guidelines on Good Manufacturing Practices. It is published by ISO, runs to around twenty pages, and gives guidelines for the production, control, storage and shipment of cosmetic products.

The edition is worth stating plainly, because incorrect versions circulate. There has only ever been one: ISO 22716:2007, published in November 2007. It was last reviewed and confirmed in 2022 and remains current. Any reference to a 2017 edition is wrong.

Three limits are set by the standard itself and are frequently overlooked:

• It covers the quality of the product, not the safety of the people working in the plant, and not environmental protection.
• It does not apply to research and development activities.
• It does not apply to the distribution of finished products.

That last point matters for a brand owner. GMP as defined here stops at shipment from the manufacturing site. What happens in a third party warehouse afterwards is outside its scope.

What European law actually requires

The regulation does not ask for a certificate

Article 8 of the EU Cosmetics Regulation requires that cosmetic products be manufactured in compliance with good manufacturing practice. It does not name a method. Article 8(2) creates a presumption of compliance where manufacture follows relevant harmonised standards published in the Official Journal, which is how ISO 22716 acquired its status.

Article 11.2(c) then sets out what goes in the product information file: a description of the method of manufacturing, and a statement on compliance with good manufacturing practice.

A statement. Not a certificate. The European Commission has said as much in its own documentation, noting that the regulation does not require any kind of certificate to demonstrate GMP compliance, and that the choice of GMP method is left to the manufacturer.

This is not a technicality, and it cuts both ways.

It means a supplier without certification is not automatically non-compliant, and a brand owner can hold a compliant file without one. It also means the reverse: a certificate on its own does not discharge the obligation, because what the file needs is a statement backed by a manufacturing method you can describe and defend.

Two qualifications. Compliance is monitored by member state authorities as in-market control, meaning after products are placed on the market rather than before. And France has gone further than the regulation, introducing a requirement for certain establishments manufacturing or packaging cosmetics on French territory to have their practices certified by an accredited body. If you manufacture in France, check that separately.

Where the United States stands

The GMP rule promised by MoCRA still does not exist

The Modernization of Cosmetics Regulation Act, known as MoCRA, required the Food and Drug Administration to issue a proposed good manufacturing practice rule by 29 December 2024 and a final rule by 29 December 2025. Neither happened.

In the Spring 2026 regulatory agenda the proposed rule moved from the standard agenda to the long-term actions list, with the notice of proposed rulemaking marked as to be determined. In practice that means no proposal is expected within the year. The item has not been abandoned, only deferred.

The obligations that did take effect are separate: facility registration and product listing have applied since December 2023, with foreign facilities required to designate a United States agent and registrations renewed every two years.

The practical position for an importer is therefore unusual. There is no United States cosmetic GMP regulation to comply with, and there is an adulteration provision that still applies, and there is an agency that continues to look at manufacturing controls during inspections.

In that gap, ISO 22716 has become the working benchmark for cosmetic GMP on goods bound for the United States, and the reference most MoCRA readiness work is built on. When the FDA consulted on what its rule should contain, a large share of respondents supported consistency with ISO 22716, while others pointed to its limitations in areas such as water quality, raw materials, retained samples and complaint handling. Whatever the eventual rule says, a supplier already working to ISO 22716 is closer to it than one working to nothing.

The ten areas of cosmetic GMP the standard covers

Area	What it addresses
Personnel	Organisation, responsibilities, training, hygiene and access rules
Premises	Layout, flows, cleaning, maintenance and pest control
Equipment	Design, calibration, cleaning and authorised use
Raw materials and packaging	Purchase, receipt, identification, quarantine, release and storage
Production	Batch documentation, in-process controls, identification and traceability
Finished products	Release criteria, storage, shipment and returns
Quality control laboratory	Methods, sampling, specifications and record keeping
Out of specification	Investigation, decision, and treatment of the affected material
Waste	Handling, segregation and disposal
Subcontracting, deviations, complaints, recalls, change control, internal audit and documentation	Governance around all of the above

Most of these are as much documentary as physical. A factory can be clean, modern and well run and still fall short, because the standard asks whether decisions were recorded, by whom, and against what specification. This is the usual reason a well presented facility fails an assessment: not conditions, but the absence of a written trail behind decisions that were in fact taken sensibly.

Certification against a second party audit

	Third party certification	Second party audit
Who performs it	An accredited certification body	The buyer, or someone acting for the buyer
What it establishes	The site operated a conforming system at the time of assessment	The state of the site against the buyer's own scope, at the time of the visit
Scope	Fixed by the certificate, often narrower than assumed	Set by the buyer, including specific product lines
Output	Pass or fail, with a certificate	A written record of gaps, usable to drive corrective action
Weakness	Sampled, scheduled, and covers only what the scope says	Not recognised by third parties, and only as good as its scope

Neither replaces the other. An ISO 22716 audit run for the buyer and a certificate answer different questions: the certificate is evidence a third party will accept. A buyer led audit is how you find out what your own products actually experience on that site.

How to read a supplier's certificate

Certificates are easy to misread and, occasionally, easy to fake. Six checks, in order:

1. The certification body. Is it accredited, and by which accreditation body? An unaccredited certificate is a private opinion with a border around it.

2. The scope. Read the exact wording. It may cover one production line, one product category or one building, while your goods are made elsewhere on the site.

3. The site address. Compare it to the address your goods actually ship from. Multi-site manufacturers are common, and certificates are site specific.

4. The legal entity. Compare it to the entity on your purchase order and invoice. A trading company presenting its manufacturing partner's certificate is a different situation from a manufacturer presenting its own.

5. The dates. Check validity, and check that surveillance activity has kept it live rather than letting it lapse quietly.

6. The registry. Most accredited bodies publish a verifiable register. Look the number up rather than trusting the document in front of you.

If any of the first four does not match your own paperwork, the certificate may be entirely genuine and still tell you nothing about your goods.

Where GMP sits in your compliance file

For the European Union and the United Kingdom, the product information file needs a description of the manufacturing method and a statement on GMP compliance. That statement should rest on something: a certificate, an audit report, or a documented assessment you can produce if a competent authority asks. The safety report, which sits in the same file, has its own requirement to address the packaging material, which is covered in AQF's cosmetic packaging guide.

For the United States, facility registration and product listing are the live obligations, and GMP is the one still pending. Documented manufacturing controls remain worth holding regardless, because the adulteration provisions apply now.

For products reaching California, Proposition 65 applies independently of any of this, and is triggered by what is in the product and its container rather than by how the site is run. See AQF's Prop 65 compliance guide.

One point specific to sourcing in China. A Chinese manufacturer will hold domestic licences and approvals that are required to operate there. These are not ISO 22716 certification and should not be presented, or accepted, as equivalent. When a supplier says it is certified, establish which document is being referred to.

For assessment of a cosmetics production site, AQF's cosmetics inspection services cover the product side, and AQF's lab testing services cover analysis.

What AQF checks, and when to book it

Inspection	Point in production
Pre-production inspection	Before production starts, at development or pilot run stage
First article inspection	On a sample, before the run is released
During production inspection	Between 20 and 60 per cent of production
Pre-shipment inspection	Between 80 and 100 per cent of production, and best at 100
Container loading supervision	At loading
Defect sorting	A full visual check of every unit, after the fact

Factory audits are separate from inspection and cover supplier qualification, extended factory assessment and social accountability.

What the report contains

A standard report covers the sampling check against the agreed acceptance levels, quantity, specification, marking, labelling and packing, measurement, and any tests carried out on site. Findings, results and photographs are always included. A section verifying a client's own check points, and photographs of general factory conditions, are added on request.

Reports are typically delivered once the inspection is closed, with formats and turnaround options agreed in advance.

Frequently asked questions

What is ISO 22716?

ISO 22716 is the international standard titled Cosmetics, Good Manufacturing Practices, Guidelines on Good Manufacturing Practices. It gives guidelines for the production, control, storage and shipment of cosmetic products, covering areas such as personnel, premises, equipment, raw materials, production, finished products, quality control, out of specification results, waste and documentation.

Which edition of ISO 22716 is current?

ISO 22716:2007, published in November 2007. It is the only edition. It was last reviewed and confirmed in 2022 and remains current, so references to a 2017 edition are incorrect.

Is ISO 22716 certification mandatory in the European Union?

No. The Cosmetics Regulation requires manufacture in compliance with good manufacturing practice and does not name a method, with a presumption of compliance where a harmonised standard is followed. The product information file requires a description of the manufacturing method and a statement on compliance with good manufacturing practice, not a certificate. France has introduced an additional national certification requirement for certain establishments manufacturing on French territory.

Does MoCRA require cosmetics GMP?

Not yet as a regulation. MoCRA, the Modernization of Cosmetics Regulation Act, required the FDA to issue a proposed good manufacturing practice rule by December 2024 and a final rule by December 2025, and neither has been published. The proposed rule has since been moved to the agency's long-term actions list. Facility registration and product listing obligations are separate and have applied since December 2023.

What does ISO 22716 not cover?

It covers product quality rather than worker safety or environmental protection, and it does not apply to research and development activities or to the distribution of finished products. Good manufacturing practice as defined by the standard stops at shipment from the manufacturing site.

Is ISO 22716 the same as ISO 9001?

No. ISO 9001 is a general quality management system standard applicable to any sector. ISO 22716 is specific to cosmetics and addresses the physical and documentary controls of cosmetic manufacturing. A supplier holding ISO 9001 has a quality system, which is useful, but has not demonstrated cosmetics good manufacturing practice.

How do I check whether a supplier's ISO 22716 certificate is genuine?

Check that the certification body is accredited and by whom, read the exact scope rather than the headline, compare the site address to where your goods are actually made, compare the legal entity to the one on your purchase order, check the validity dates and surveillance status, and look the certificate number up in the certification body's public register.

What is the difference between certification and a buyer led audit?

Certification is carried out by an accredited third party and establishes that the site operated a conforming system within a defined scope at the time of assessment. A buyer led audit is carried out by or for the buyer, against a scope the buyer sets, and produces a record of gaps that can drive corrective action. Certification is recognised by others; a buyer led audit tells you about your own products.

Where can I get the ISO 22716 document?

It is published and sold by ISO and by national standards bodies. What can be established without buying it is the structure and scope of the standard, which is usually enough to frame a discussion with a supplier or to brief an assessment.

Does an ISO 22716 certificate mean the products are compliant?

No. It addresses how a site manufactures, not whether a given formulation, its ingredients, its packaging or its labelling meet the rules of a destination market. Ingredient restrictions, safety assessment, packaging suitability and labelling are separate obligations and are assessed separately.

Talk to AQF about your cosmetics supplier

Tell us where your products are made, what your supplier has produced by way of documentation and which markets you sell into, and we can set out what is worth verifying on site.

Contact AQF