ISO 22716 cosmetic GMP explained: what auditors check
ISO 22716 clause by clause: the evidence auditors ask for, how EU Article 8 and MoCRA reference it, and how a brand should qualify a contract manufacturer.
By CSL Regulatory and quality team, Cosmetic Science Lab · Reviewed by Dr. Premalatha, Ph.D., Life Science, Regulatory Consultant
Quick answer
- What is ISO 22716? The international guideline for cosmetic good manufacturing practice (GMP). The current edition, ISO 22716:2007, was last reviewed and confirmed by ISO in 2022 [1]. It sets out how manufacturers control people, premises, materials, production, quality control and documentation so every batch is made consistently and safely.
- In the US, the MoCRA GMP rule has not yet been proposed; ISO 22716 is the practical benchmark buyers expect [4].
- Auditors look for evidence: batch records, deviations, CAPA, line clearance and water quality.
Take-home message for manufacturers
- Use the clause table as your internal audit checklist
- Close every deviation with a root cause and a CAPA effectiveness check
- Monitor purified water for microbial quality routinely
Take-home message for brand owners
- You remain accountable for what your contract manufacturer produces
- Ask for a certificate with matching scope, or a recent audit report
- Put GMP duties in a written quality agreement
01Cosmetic GMP rules by market
ISO 22716 is itself a voluntary standard. What makes it matter is how each market's law refers to it:
| Market | Legal basis | Role of ISO 22716 | Status |
|---|---|---|---|
| EU | Regulation (EC) No 1223/2009, Art. 8 [2] | Harmonised standard (EN ISO 22716:2007); following it presumes GMP compliance | Applies since 11 July 2013 |
| UK | Regulation 1223/2009 as retained in UK law | EN ISO 22716:2007 is the designated standard [3] | Since 1 January 2021 |
| US | MoCRA, FD&C Act section 606 [5] | FDA must write GMP rules consistent with national and international standards where practicable | Proposed rule overdue; listed as a long-term action [4] |
| India | Cosmetics Rules, 2020 [6] | Not referenced; the manufacturing licence requires premises to meet the Seventh Schedule, plus a GMP self-declaration | Notified 15 December 2020 |
| GCC | GSO 2020:2010 [7] | GCC adoption of the ISO 22716 GMP guidelines | Approved 31 March 2010 |
02ISO 22716 clause by clause: what auditors ask for
Clauses 1 and 2 cover scope and definitions. The operational requirements start at clause 3, and each one maps to evidence an auditor will request:
| Clause | Requirement | Evidence an auditor asks for |
|---|---|---|
| 3 Personnel | Defined roles, training and hygiene | Organisation chart, job descriptions, training records |
| 4 Premises | Suitable layout, flow, cleaning and pest control | Site plan, cleaning logs, pest control reports |
| 5 Equipment | Suitable, calibrated and maintained | Calibration certificates, maintenance logs |
| 6 Raw materials and packaging | Specifications, supplier approval, release; water quality | Approved supplier list, certificates of analysis, water monitoring data |
| 7 Production | Written instructions, line clearance, in-process checks | Completed batch records, line clearance checklists |
| 8 Finished products | Release, storage and shipment control | Release records, stock and dispatch records |
| 9 Quality control laboratory | Defined methods, sampling, retained samples | Test methods, results, sample retention log |
| 10 Out-of-specification | Investigation and documented decision | OOS investigations and disposition records |
| 11 Wastes | Controlled, documented disposal | Waste records |
| 12 Subcontracting | Written contract defining responsibilities | Quality agreements, subcontractor audits |
| 13 Deviations | Authorised and documented | Deviation reports with root cause |
| 14 Complaints and recalls | Investigation and recall procedure | Complaint log, mock recall results |
| 15 Change control | Changes assessed before approval | Change requests and approvals |
| 16 Internal audit | Periodic self-inspection | Audit plan, reports and CAPA |
| 17 Documentation | Controlled documents and records | Document control procedure, retention rules |
Findings cluster around documentation: incomplete batch records, deviations closed without a root cause, CAPA with no effectiveness check, skipped line clearance between products, and purified water that is not routinely tested for microbial quality. Walk the table above as an internal audit before any external visit.
03How EU rules and MoCRA reference ISO 22716
EU: Article 8 of Regulation (EC) No 1223/2009 requires cosmetic products to be made under GMP and presumes compliance when manufacture follows the relevant harmonised standards [2], which is EN ISO 22716. The UK keeps the same approach through its designated standards list [3].
US: MoCRA requires FDA to set GMP regulations for cosmetic facilities, consistent with national and international standards where practicable [5]. The statutory deadlines of 29 December 2024 for a proposed rule and 29 December 2025 for a final rule have passed, and the rule is listed as a long-term action with no proposal date [4]. Until a rule is published, FDA's 2013 draft cosmetic GMP guidance is the clearest signal of its expectations, although FDA has said it intends to withdraw or revise it [8].
04What a brand must do
GMP for cosmetics is not only the factory's job. The brand placing a product on the market answers for it, so these steps apply even if you never touch production:
- Map your markets to the rules in Table 1 and note which apply to each product.
- Require evidence, not promises: an ISO 22716 certificate with matching scope, or a recent audit report.
- Sign a quality agreement that splits GMP responsibilities between brand and manufacturer.
- Review batch records for launch batches and after any change of site, formula or supplier.
- Keep records that support your EU product information file or US safety substantiation, and watch the Federal Register for the proposed MoCRA GMP rule; the final rule will set US compliance dates.
05How to qualify a contract manufacturer
- Desk review
Check the certificate's scope, issuing body and expiry date.
- On-site audit
Walk the clause table, sampling real batch records and deviations.
- Trial batch
Review the full record and test results before committing volume.
- Quality agreement
Define release, change control, complaints and recall duties.
- Ongoing monitoring
Re-audit periodically and track deviations and complaints.
Qualification works best when the formula is already scale-ready, so involve your formulation and scale-up team early. If the product carries performance claims, align stability and test batches with your claims substantiation studies. Even bought-in bases, such as the melt-and-pour bases in our guide to how soap is made, need the same supplier approval.
06Questions readers ask
Is ISO 22716 mandatory?
Not as a standard. In the EU and UK, GMP is mandatory and following ISO 22716 is the accepted way to show compliance. Elsewhere it is a widely used benchmark.
Does MoCRA require ISO 22716?
No. MoCRA requires FDA to write its own GMP rule, consistent with national and international standards where practicable. That rule had not been proposed as of October 2026.
What is the difference between cosmetic GMP and ISO 22716?
Cosmetic GMP is the legal or industry requirement to manufacture under controlled conditions. ISO 22716 is the guideline that describes how to meet it.
Choosing or auditing a manufacturer?
We help brands find, audit and manage GMP-compliant contract manufacturers, from pilot batch to scale-up.
07References
- International Organization for Standardization. ISO 22716:2007 Cosmetics — Good manufacturing practices (GMP) — Guidelines on good manufacturing practices. Confirmed 2022. ISO
- Regulation (EC) No 1223/2009 of the European Parliament and of the Council on cosmetic products, Article 8. OJ L 342, 22.12.2009, p. 59–209. EUR-Lex
- Office for Product Safety and Standards. Designated standards: cosmetic products (notice of publication 0003/21, 1 January 2021). GOV.UK
- Crowell & Moring LLP. Cosmetics under the microscope: FDA's expanding regulatory reach under MoCRA. 8 April 2026. Crowell
- U.S. Food and Drug Administration. Modernization of Cosmetics Regulation Act of 2022 (MoCRA). FDA
- Ministry of Health and Family Welfare, India. Cosmetics Rules, 2020 (G.S.R. 763(E), 15 December 2020), Rule 26 and Seventh Schedule. CDSCO
- GCC Standardization Organization. GSO 2020:2010 Cosmetics — Good manufacturing practices (GMP) — Guidelines on good manufacturing practices. GSO
- U.S. Food and Drug Administration. Draft guidance for industry: cosmetic good manufacturing practices. June 2013. FDA
Update log
- Published by Cosmetic Science Lab
This article is general technical information, not legal, regulatory or medical advice. Confirm requirements for your product and market before launch.
