Manufacturer Selection
Good Manufacturing Practice (GMP) for cosmetics is the set of quality assurance principles ensuring products are consistently produced and controlled to specifications, with full traceability, documented procedures, and trained personnel at every stage of production.
That is the textbook definition, and it stops short of the useful part.
What matters is what GMP means when a facility operates under it every day, and how a brand founder can verify compliance.
In 2026, cosmetics GMP is in transition. The EU has required GMP compliance since 2013 under Regulation (EC) No 1223/2009. Article 8(2) presumes compliance where manufacture follows the relevant harmonised standards whose references have been published in the Official Journal, and the Regulation itself never names one. EN ISO 22716:2007 is the standard listed there for cosmetics GMP, which is why certification to it is the practical route: the presumption comes from the standard being on that list, not from the Regulation pointing at it. In the US, MoCRA was signed on December 29, 2022, most of its obligations run from December 29, 2023, and July 1, 2024 is only the date from which FDA enforced facility registration and product listing. The MoCRA GMP rule does not exist yet: the FDA missed both deadlines the Act gave it, and no new date has been announced.
After 30 years in the hair and beauty sector, most recently in private label cosmetics, working with 14+ ISO 22716 certified manufacturers across Europe, Turkey, China, and the US, I have seen both ends of the GMP spectrum.
There are manufacturers whose certificate is framed on the office wall and whose production floor reflects what the certificate describes. And there are manufacturers whose certificate is technically valid but whose practice falls apart under a real audit.
For a brand founder, the certificate is where the check starts.
What counts is whether the GMP system is real.
GMP is not a single document.
It is a way of running a facility where quality is built into the process rather than tested in at the end.
The core idea of GMP is that you cannot test quality into a product.
You can only build it in through the process, then verify that the process worked.
For cosmetics, this means every step from raw material arrival to finished product shipment happens under documented procedures, with trained personnel, in qualified facilities, using calibrated equipment, with records that allow any finished unit to be traced back to every input it came from.
When the system works, quality is the default output.
When the system breaks, the deviations are detected quickly and corrected before they reach consumers.
Contamination. Every cosmetic production environment is a potential site for microbial growth, cross-contamination between formulas, or foreign particle introduction. GMP defines the barriers (air controls, cleaning protocols, personnel hygiene, equipment dedication) that prevent these.
Mix-ups. In any facility producing multiple formulas, the risk of wrong raw material in a batch, wrong label on a product, or wrong finished goods in the wrong shipment is constant. GMP defines the documentation, labeling, and verification practices that prevent mix-ups.
Deviation without detection. Every production run has some variation. GMP ensures variation is measured, recorded, evaluated against specifications, and either accepted (within spec) or investigated (out of spec) before product ships.
First-time founders often assume that end-of-batch testing is what ensures quality.
It is not.
End-of-batch testing verifies that a batch meets its specifications.
But a batch that meets specifications at release can still fail in the market if it was produced under inconsistent conditions, if raw materials varied beyond tested limits, if equipment was not properly cleaned between runs, or if personnel followed procedures inconsistently.
GMP is the system that makes the end-of-batch result reproducible batch after batch after batch.
Without GMP, today’s successful batch tells you nothing about next month’s batch from the same facility.
ISO 22716 is the international standard for cosmetics GMP, published in 2007 and adopted as the harmonized European standard under Regulation (EC) No 1223/2009.
It is the closest thing to a universal language for cosmetics manufacturing quality.
The International Cooperation on Cosmetic Regulations (ICCR), formed by the US, Canada, EU, and Japan, designated ISO 22716 as the reference standard for cosmetics GMP across member regulators.
In the EU, what Regulation 1223/2009 requires is GMP itself, and following the standard is the route to the presumption of compliance under Article 8(2). In Japan, Canada, Korea, and most other developed markets, ISO 22716 either underpins local GMP requirements or is accepted as evidence of compliance. The US FDA has referenced ISO 22716 as a benchmark, and the GMP rule MoCRA ordered it to write has never been published.
For a brand selling internationally, ISO 22716 certification of the manufacturing facility is the single most useful document for simplifying market entry documentation.
The standard runs to 17 chapters; chapters 3 to 17 define the operational requirements, from Personnel through Documentation.
An auditor assessing a facility works through these sections systematically.
Section 3: Personnel. Who does what, training programs, hygiene requirements, and health monitoring. The standard requires that personnel are adequately trained, experienced, and qualified for their assigned tasks, with documented training records.
Section 4: Premises. Facility design, separation of incompatible activities, environmental controls, cleaning and maintenance protocols. The production area must prevent contamination and mix-ups through physical and procedural controls.
Section 5: Equipment. Design, installation, qualification, calibration, and maintenance of production equipment. Equipment contacting product must be constructed of non-reactive materials and be cleanable to a verifiable standard.
Section 6: Raw Materials and Packaging Materials. Supplier qualification, receipt inspection, sampling, testing, approval for use, storage, and inventory management. Every raw material that enters the facility has a defined path from receipt to release to production.
Section 7: Production. Batch documentation, in-process controls, equipment cleaning between batches, deviation handling, and batch release procedures. This section covers the core manufacturing activity itself.
Section 8: Finished Products. Quality control testing, release criteria, storage, and shipping procedures. Every finished batch must meet defined specifications before release to market.
Section 9: Quality Control Laboratory. Laboratory procedures, equipment qualification, method validation, sample retention, and stability testing. The laboratory must operate under controls that ensure test results are reliable.
Section 10: Treatment of Product That Is Out of Specification. Procedures for handling products that fail release testing, investigation, and disposition (rework, reprocessing, reject, or destruction).
Section 11: Wastes. Handling, storage, and disposal of waste materials, including returned product and expired raw materials.
Section 12: Subcontractors. Qualification, contract requirements, and oversight of any third parties performing operations under the GMP scope.
Additional sections cover Deviations (Section 13), Complaints and Recalls (Section 14), Change Control (Section 15), Internal Audit (Section 16), and Documentation (Section 17), completing the framework.
Two important exclusions.
ISO 22716 does not apply to research and development activities. The R&D laboratory where formulas are developed is outside the GMP scope, though many manufacturers voluntarily apply GMP-equivalent controls.
ISO 22716 does not cover distribution after the finished product leaves the manufacturer. Warehousing, retail storage, and consumer handling are outside the standard’s scope. This becomes relevant when products arrive at retail with apparent quality issues and it is unclear whether the cause is manufacturing or downstream handling.
ISO 22716 does not prevent every quality problem. What it gives you is a documented system: when a problem appears, you can trace the cause and fix it at the source. Manufacturers without the system can only hope the problem does not repeat.
ISO 22716 is the harmonized international reference. The United States is building a parallel framework under MoCRA, and it matters for brands selling into the US market.
The United States regulatory environment for cosmetics is in mid-transition. What matters right now for a brand founder is specific.
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) was signed on December 29, 2022. Facility registration and product listing were owed from December 29, 2023, and FDA began enforcing them on July 1, 2024 after six months of enforcement discretion, which did not move the statutory date.
For the first time, the FDA has mandatory authority over cosmetics manufacturing facilities in areas previously covered only by voluntary guidance.
Facility registration. Facilities manufacturing or processing cosmetic products for the US market must register with FDA using Form FDA 5066, with biennial renewal. Section 612 exempts small businesses from registration, listing and MoCRA good manufacturing practice: responsible persons and facility owners under 1,000,000 dollars of average gross annual US cosmetic sales over the previous three years, adjusted for inflation, who do not manufacture or process any of the four product types listed in section 612(b). Facilities that registered by the July 1, 2024 deadline are due for renewal by mid-2026. Each facility has a unique FEI number (FDA Establishment Identifier) assigned before filing through the Cosmetics Direct portal.
Product listing. Each cosmetic product must be listed with FDA using Form FDA 5067, providing formulation information, product category coding, and the responsible person’s identity, subject to the same section 612 exemption.
Adverse event reporting. The responsible person must report serious adverse events within 15 business days of receiving the report.
FDA enforcement authority. The FDA can access company records, suspend facility registrations, and mandate product recalls in cases of reasonable probability of serious health consequences.
The GMP rule itself does not exist, and the duty to write it is the FDA’s, not the manufacturer’s.
MoCRA told the FDA to publish a proposed GMP rule by December 29, 2024 and to finalize it by December 29, 2025. Both dates passed with nothing published. The Federal Register still holds no document under the rule’s own identifier, its RIN, neither a proposal nor a final rule, and no new date has been announced for either. ISO 22716 is the commercial benchmark in the meantime, and it is not the American rule.
Read those two dates for what they are: deadlines on the FDA, not on your plant. The deadline this Act put on industry is the registration one, and it fell in December 2023. The delay is not a grace period either. Until a rule exists there is no MoCRA good manufacturing practice duty on a facility to be excused from, while registration, product listing, serious adverse event reporting and safety substantiation have all been owed since that same date, and the adulteration provisions of the FD&C Act apply with or without a GMP rule. In the interim, manufacturers selling to the US market are expected to align their practices with ISO 22716 standards, and FDA warning letters issued in 2025 and 2026 have applied de facto GMP expectations when serious safety issues arose at non-compliant facilities.
For a brand selling in the US, the practical approach is simple.
Ask for the manufacturer’s FEI number and check it in the FDA’s FEI Search Portal, which confirms that the number resolves to the same firm name and physical address. Registration status itself is not publicly searchable, so also ask for the facility’s registration confirmation from Cosmetics Direct, which carries the registration status and the renewal date. Verify ISO 22716 certification, which is both EU compliance evidence and de facto US GMP evidence during the interim period. Confirm that your product listing has been filed with FDA either by the manufacturer (if they are the responsible person) or by your brand (if you are the responsible person as the name on the label).
The rules will tighten further when the FDA GMP rule lands, and nobody can say today when that will be. Brands whose manufacturers already operate at ISO 22716 standard will experience the transition as minor. Brands whose manufacturers operate below that standard will face compliance disruption when the rule takes effect.
The ISO 22716 certificate is a document. Real compliance is a day-to-day operational state. Verification requires methods that go past the paperwork.
Not every certificate presented as ISO 22716 is what it appears to be.
The major certifying bodies for ISO 22716 (SGS, Intertek, TÜV SÜD, DQS, Bureau Veritas, Kiwa, and regional equivalents) maintain searchable public registries. Search by the manufacturer’s company name, by certificate number, or both, and confirm:
The certificate is currently active, not expired.
The company name on the registry matches the entity you are dealing with exactly.
The certificate scope covers the product category you intend to produce.
The certifying body is accredited under a recognized accreditation framework. A real ISO 22716 certifying body will be accredited under IAF (International Accreditation Forum) member bodies such as UKAS, ACCREDIA, DAkkS, or ANAB depending on region.
If any of these fails, the certificate has no practical value regardless of how official it appears.
A manufacturer operating under genuine GMP can produce documentation quickly when asked.
Request the following and observe how the manufacturer responds.
A redacted batch record from a recent production run showing the documentation structure for a complete batch. A GMP-compliant manufacturer can produce this within a day or two.
The certificate of analysis (COA) for a recent batch of the product category you intend to produce. A real COA shows the tested parameters, the specifications for each, the measured values, and signatures of the responsible personnel.
An example stability testing protocol for the category (emulsion, serum, anhydrous product, makeup). A manufacturer with real quality systems has documented protocols for each product type they produce.
The organizational chart for the quality function and the CV or qualifications summary of the quality manager. GMP requires a named quality function with authority independent of production.
Vague, delayed, or incomplete responses to these requests are signals that the documented system exists only on paper.
For production commitments above a few thousand units, verification beyond documentation is not optional.
A site visit allows you to observe the operation directly. Production areas, warehouse conditions, laboratory setup, personnel practices, the condition of equipment, and the general order of the facility all communicate information that documents cannot. A well-run GMP facility looks and feels different from a facility where the paperwork is performed but the culture is not.
A third-party audit conducted by an independent firm (SGS, Intertek, TÜV SÜD, Bureau Veritas) produces a formal written report against ISO 22716. Audit cost typically runs 1,500 to 4,000 EUR/USD depending on facility size and scope, with 5-10 business days turnaround for the report. For significant production commitments, this is a standard professional investment. (Cost figures in this article are indicative estimates that vary by manufacturer, region, and project scope.)
Manufacturers whose GMP compliance is real welcome third-party audits. Manufacturers whose compliance is cosmetic resist them. The cosmetics manufacturer red flags guide covers the specific resistance patterns.
A simple and powerful verification method.
Pick one of the finished products the manufacturer has supplied (your own product, if you are already producing, or a sample unit provided during evaluation). Identify the batch number. Ask the manufacturer to produce the full traceability record for that batch: raw material lots used, intermediate batch numbers, quality control results, personnel signatures on release, shipping records.
A manufacturer with a functioning GMP system produces this within 24 to 48 hours for any batch produced in the last three years. A manufacturer whose system is incomplete produces partial information, delays, or requests to schedule the response at a convenient time.
The fastest way to learn whether a GMP system works is to ask it to perform. Systems that function respond quickly under pressure. Systems that exist only on paper produce delays, excuses, and incomplete answers. The response time is the audit.
The quality of the response is the verification. A fast, complete trace tells you the system works. A slow or missing one tells you what the production reality is, regardless of what the certificate claims.
Understanding GMP in the abstract is useful. Applying it during manufacturer selection is where it actually matters.
For a brand producing a few hundred units of white label products under known stock formulas, the GMP risk is lower because the manufacturer is using established processes at scale for many clients.
For a brand producing a private label line at 2,000 to 10,000 units, the risk profile changes. You are committing significant capital, the product carries your brand’s reputation, and any recall or compliance issue falls on you as the responsible person on the label. GMP verification moves from optional to necessary.
For a brand planning to sell in regulated markets (EU, US, Canada, Japan), GMP stops being a preference: in the EU the responsible person’s Product Information File must itself contain a statement on compliance with good manufacturing practice (Article 11(2)(c) of Regulation 1223/2009), and you cannot stand behind that statement without having verified the facility. Cosmetics regulations across major markets are specific about what the brand must document regarding its manufacturing source.
The cost of proper verification (third-party audit 1,500 to 4,000 euros, independent document review 1,500 to 3,000 euros for a legal and regulatory check) is small compared to the cost of what happens when an uncertified or weakly-certified manufacturer produces a compliance issue.
Product recall costs typically start at 50,000 euros for small-scale cases and climb into six and seven figures for larger issues. Border rejections of shipments range from 5,000 to 50,000 euros per incident depending on volume. Regulatory investigations, brand reputation damage, and potential legal liability add to the stack.
The economics of GMP verification are not complicated. The upfront cost is small, and the downside cost of skipping it is large. Brands that skip GMP verification are deferring a cost that appears later at higher amounts.
A common confusion for first-time founders is the relationship between GMP and quality control.
GMP is the overall system ensuring the facility operates under controlled conditions. Quality control is the specific function within that system responsible for testing raw materials, in-process samples, and finished products against specifications.
A facility can have a competent quality control laboratory and still have GMP gaps elsewhere (personnel training, equipment calibration, documentation practices). GMP is the umbrella; quality control is one function under it. The complete framework on cosmetics quality control processes covers the QC function in more detail.
Both matter. Neither alone is sufficient.
Is GMP certification required for cosmetics manufacturers?
GMP is required in the European Union. A certificate is not. Article 8(1) of Regulation (EC) No 1223/2009 requires the manufacture of cosmetic products to comply with good manufacturing practice, and the Article names no standard. Article 8(2) adds that compliance is presumed where manufacture follows the relevant harmonized standards whose references are published in the Official Journal, and the list for cosmetics holds a single entry, EN ISO 22716:2007. A third party certificate is a common commercial proof of GMP, not a legal obligation: a manufacturer can be compliant without one and can demonstrate GMP by other means, starting with the statement on compliance with good manufacturing practice that Article 11(2)(c) requires inside the Product Information File (PIF). In the United States, MoCRA orders the FDA to issue a binding GMP rule, and the FDA has not published one: both dates the Act set have passed and no new date has been announced. In the interim, FDA references ISO 22716 as a benchmark and has applied de facto GMP expectations in enforcement actions. For a manufacturer serving international markets, ISO 22716 certification is the common commercial reference across most regulated markets, which is why clients and importers ask for it even where no law does.
What is the difference between GMP and ISO 22716?
GMP is the general concept of Good Manufacturing Practice applied to cosmetics, defined as the system of controls ensuring products are consistently produced and controlled to specifications. ISO 22716 is the specific international standard that defines how GMP is implemented and verified for cosmetics, organized into structured sections covering personnel, premises, equipment, materials, production, finished products, laboratory, and related functions. A manufacturer that is ISO 22716 certified is formally audited against the standard by an accredited certifying body. A manufacturer that "follows GMP" without ISO 22716 certification is making a claim no accredited third party has audited, which is a question of evidence rather than of legal compliance.
How do I verify a cosmetics manufacturer’s GMP compliance?
Four steps. First, verify the ISO 22716 certificate through the issuing certifying body’s public registry, confirming it is active, matches the manufacturer’s entity, and covers your product category. Second, request specific GMP documentation (batch records, COAs, stability protocols, quality organization chart) and observe the manufacturer’s response time and completeness. Third, arrange a site visit or commission an independent third-party audit through a firm like SGS, Intertek, TÜV SÜD, or Bureau Veritas, at typical cost of 1,500 to 4,000 euros. Fourth, test the traceability system by requesting a full trace on a specific batch, with a 24 to 48 hour response expectation. Fast, complete responses indicate real compliance, while delays, evasion, or incomplete responses indicate paper compliance.
What happens if a cosmetics manufacturer fails GMP compliance?
Consequences depend on jurisdiction and severity. In the EU, a GMP failure is one of the grounds listed in Article 25 of Regulation (EC) No 1223/2009: the competent authority must require the responsible person to take appropriate measures, including corrective action, withdrawal from the market or recall, within a deadline set against the risk, and must act itself if the responsible person does not. Every measure Article 25 provides attaches to the product, not to the plant. Penalties sit outside the Regulation: Article 37 leaves them to each Member State, so whether non-compliance also brings criminal liability is a question of national law. In the US under MoCRA, the FDA has authority to suspend facility registration, halt product distribution, mandate recalls, and apply import alerts to products from non-compliant foreign facilities. For brand owners using a non-compliant manufacturer, the consequences include product recalls at brand expense, border rejections of imports, regulatory investigations that can expand to the brand itself, and lasting damage to brand reputation in the trade and consumer channels.
Do small cosmetics manufacturers have to follow GMP?
In the EU, yes, with no size exemption under Regulation 1223/2009. In the US, section 612 of MoCRA goes further than simplification: responsible persons and facility owners whose average gross annual US cosmetic sales over the previous three years are under 1,000,000 dollars, adjusted for inflation, and who do not manufacture or process any of the four product types listed in section 612(b), owe neither facility registration, nor cosmetic product listing, nor MoCRA good manufacturing practice. Above that threshold, and for those four product types at any turnover, the duties apply in full, and the statute tells FDA to include simplified good manufacturing practice requirements for smaller businesses in the rule it has not yet published. In practice, smaller manufacturers serving regulated markets typically pursue ISO 22716 certification regardless of exemptions, because the certification is commercially necessary for export to most markets and for relationships with brand clients that require documented compliance as a contractual condition.
How often is a GMP certification audited?
Initial ISO 22716 certification involves a two-stage audit (documentation review followed by on-site system audit). After initial certification, surveillance audits are typically conducted annually, with full recertification audits every three years, depending on the certifying body’s specific program. Non-conformities identified during any audit trigger corrective action requirements with defined timelines, and failure to close non-conformities can result in certificate suspension or withdrawal. A manufacturer whose certificate is in good standing has passed recent surveillance audits, which is itself an ongoing verification that the system remains functional.
What does GMP compliance cost a manufacturer, and why does it matter to brand founders?
Initial ISO 22716 certification costs for a small to mid-size cosmetics manufacturer typically run 15,000 to 40,000 euros, covering gap analysis, documentation development, training, initial certification audit, and surveillance audits in the first cycle. Ongoing annual costs for certification maintenance and internal quality systems run 10,000 to 30,000 euros. These costs explain why the lowest-priced manufacturers in the market often operate below full GMP standard: they are not investing in the infrastructure that compliance requires. For a brand founder, understanding this economics is useful because it explains the correlation between extremely low manufacturing costs and GMP gaps. A manufacturer operating at genuine ISO 22716 standard cannot realistically match the prices of facilities that skip the investment.
Keep reading
Independent cosmetics consultant or manufacturer "free advice": what each actually covers, the structural limits of each, and how to decide which role you need at each phase. From 30 years in the industry, the honest framework.
The contract clauses that protect a cosmetics brand: formula ownership, IP, exclusivity, quality standards, termination. From 30 years of contracts reviewed and disputes seen, the practical guidance founders need before signing.
An honest comparison of cosmetics manufacturing regions (EU, Turkey, Korea, China, and the US), covering quality, compliance, MOQ, pricing, and when each region is the right choice. From 30 years working across four continents.
