Testing & manufacturing guide

Cosmetic good manufacturing practice under ISO 22716, explained.

Cosmetic GMP is the documented system that governs how a product is produced, controlled, stored, and shipped. In the EU and UK it is a legal requirement, not a best practice. ISO 22716:2007 is the harmonised standard that demonstrates compliance, and regulators treat adherence to it as a presumption of conformity under Regulation (EC) No 1223/2009, Article 8.

What is cosmetic GMP?

The term “GMP” in cosmetics is not interchangeable with pharmaceutical GMP. The two frameworks share a philosophy but differ substantially in scope and stringency. Pharmaceutical GMP (EudraLex Volume 4) is far more prescriptive; ISO 22716 GMP cosmetics guidance is risk-proportionate and designed for the cosmetic industry specifically.

The practical consequence: a product manufactured without GMP controls is a product whose safety cannot be reliably demonstrated. That is the difference between a batch that is reproducible and one that varies in microbial load, pH, or preservative efficacy from run to run.

What does ISO 22716 require?

Personnel: Every person involved in production, control, storage, or shipment must have defined responsibilities, documented training, and health and hygiene standards appropriate to their role.

Premises and equipment: Facilities must be designed to prevent cross-contamination and mix-ups. Equipment must be maintained, cleaned to validated procedures, and calibrated where measurement accuracy affects product quality.

Raw materials and packaging: Incoming materials require documented receipt, identification, quarantine, testing or verification against specifications, and release before use. Supplier qualification is expected, not optional.

Production: Batch manufacturing records must capture every step, every material quantity, every in-process check, and every operator. A batch number must be assigned before manufacture begins.

Quality control: Sampling plans, test methods, acceptance criteria, and out-of-specification (OOS) investigation procedures must all be documented. Retain samples must be held for a defined period.

Deviations, CAPA, and change control: Departures from procedure must be recorded, investigated to root cause, and closed with verified corrective actions. Changes that could affect product quality require formal approval before implementation.

Complaints, recalls, and internal audits: A complaint system must trend by batch. Recall procedures must be tested. Internal audits must be independent, scheduled, and documented, with findings tracked to closure.

Documentation: The entire system rests on controlled documents and retrievable records. If it is not written down, it did not happen. That principle is the foundation of every GMP inspection.

ISO 22716 does not cover personnel occupational safety, environmental protection, or research and development activities. Its scope is the quality and safety of the finished cosmetic product.

Which markets require cosmetic GMP compliance?

The EU mandates GMP under Regulation (EC) No 1223/2009, Article 8. Compliance with EN ISO 22716:2007, published in the Official Journal of the EU as a harmonised standard, creates a presumption of conformity. A GMP declaration must be included in the Product Information File under Article 11. Non-compliant products can be withdrawn from the market.

The UK mirrors this requirement. The UK retained Regulation (EC) No 1223/2009 as amended by the Product Safety and Metrology etc. (Amendment etc.) (EU Exit) Regulations 2019. The Office for Product Safety and Standards (OPSS) confirms that ISO 22716 is the designated standard for demonstrating GMP compliance in Great Britain. The enforcement framework sits in SI 2013/1478, the Cosmetic Products Enforcement Regulations 2013.

The US is moving in the same direction. MoCRA (the Modernization of Cosmetics Regulation Act of 2022) introduced a statutory GMP requirement for the first time. The FDA was required to propose implementing GMP regulations by 29 December 2024 and finalise them by 29 December 2025. The final rule has not yet been issued as of the date of this guide, but the statutory obligation exists. ISO 22716 is widely referenced as the benchmark standard, and brands building GMP-compliant systems now will be positioned ahead of the rule.

Switzerland aligns with EU cosmetics law under its own framework, and GMP compliance consistent with ISO 22716 is expected for products placed on the Swiss market.

The practical takeaway: if your brand is selling or planning to sell in any of these markets, cosmetic GMP compliance is not optional. It is the price of market access.

What is GMP certification for cosmetics, and do you need it?

What is required is evidence. That evidence can take the form of a self-declaration supported by internal audit records, a second-party audit by a brand owner or Responsible Person, or a third-party certificate. The certificate is the most defensible form of evidence in a regulatory inspection or a commercial due-diligence process.

In practice, third-party ISO 22716 GMP certification is increasingly expected by retailers, contract manufacturers, and export markets.

The decision depends on your market footprint and risk appetite. A brand selling exclusively through its own DTC channel in the EU may rely on a robust internal audit programme. A brand supplying major retailers or exporting to multiple markets will find that a third-party certificate removes friction at every checkpoint.

How does GMP connect to your CPSR and EU notification?

Part A of the CPSR is the safety information dossier; Part B is the assessor’s signed conclusion. The safety assessor needs batch records to verify reproducibility, stability data generated under controlled manufacturing conditions, microbial test results from production batches, and a description of the manufacturing method. All of that information originates in the GMP system. A weak GMP system produces a weak CPSR, and a weak CPSR will not pass a qualified assessor’s review.

The same logic applies to CPNP notification in the EU and the equivalent notification to OPSS in the UK. The PIF that underpins the notification must include a GMP statement. If the GMP documentation is incomplete, the notification is incomplete.

The sequence is: GMP system in place, manufacturing records generated, stability and microbial data available, CPSR completed by a qualified assessor, PIF assembled, notification submitted. Skipping or shortcutting any step breaks the chain.

A CPSR from CIGREG costs between $450 and $600 per product, with a qualified assessor sign-off included. The assessor will identify GMP documentation gaps before they become a notification problem.

How do you implement ISO 22716 in a cosmetic manufacturing facility?

Step 1: Document your quality system. Write SOPs for every GMP activity: personnel hygiene, equipment cleaning, raw material receipt, batch manufacturing, in-process testing, finished product release, deviation handling, CAPA, complaints, recalls, and internal audits. Documents must be version-controlled and accessible to the people who use them.

Step 2: Train your people. Training is not a one-time event. Every person performing a GMP activity must be trained before they perform it, and that training must be recorded. Competency verification, not just attendance, is what auditors look for.

Step 3: Validate your cleaning procedures. Cleaning validation is one of the most frequently cited audit gaps. Define the cleaning agent, contact time, rinse procedure, and acceptance criteria for each piece of equipment. Run the validation and keep the records.

Step 4: Implement batch record discipline. Every batch must have a batch manufacturing record completed in real time, not reconstructed afterwards. Every entry must be signed and dated by the person who performed the step.

Step 5: Run internal audits. Schedule audits across all GMP clauses on a defined cycle. Auditors must be independent of the area being audited. Findings must be tracked to closure with verified corrective actions.

Step 6: Review and improve. GMP is not a static state. Change control, deviation trending, complaint analysis, and management review are the mechanisms that keep the system current and effective.

For brands working with contract manufacturers, the implementation burden shifts to supplier qualification. You need written agreements that define GMP responsibilities, audit rights, and the documentation you will receive for each batch.

What are the most common GMP audit failures?

Incomplete batch records: Missing signatures, blank fields, retrospective entries, or absent raw-material lot numbers. A batch record with gaps cannot demonstrate traceability. Auditors treat gaps as evidence that the step either did not happen or was not controlled.

Weak raw-material traceability: Incoming materials received without documented inspection, accepted on the basis of a certificate of analysis alone without any verification testing, or stored without quarantine status clearly marked.

Document control failures: Outdated SOPs still in use on the production floor. Revision history missing. Records that cannot be located when requested. Document control is the backbone of the GMP system; failures here undermine every other clause.

Cleaning and sanitation gaps: Cleaning procedures that exist on paper but are not validated. Sanitation schedules that are not consistently followed or recorded. Equipment with residue from a previous batch.

CAPA not closed: Deviations recorded but not investigated to root cause. Corrective actions defined but not implemented. Effectiveness checks not performed. An open CAPA is a finding in itself.

Training records missing: Operators performing GMP tasks without documented training. Training records that show attendance but not competency. New starters performing critical steps before their training is complete.

Internal audit weaknesses: Audits not performed on schedule. Auditors not independent of the area they are reviewing. Findings left open past the agreed closure date. An internal audit programme that exists on paper but is not functioning is a major red flag.

How does CIGREG support GMP compliance?

That accountability is not discharged by simply signing a form; it requires active oversight of the GMP documentation that sits in the PIF.

CIGREG reviews GMP documentation as part of every product onboarding. Where gaps exist, they are identified before notification, not after a market authority requests the PIF. The CPSR process, priced at $450 to $600 per product, includes qualified assessor sign-off and a review of the manufacturing method and GMP statement.

For brands launching across EU and UK simultaneously, the EU+UK launch pack at $1,500 per product covers Responsible Person appointment, PIF review, CPSR coordination, and CPNP and OPSS notification in a single engagement. There is no need to manage separate providers in each jurisdiction.

For ongoing compliance, the Compliance Care plan at approximately $490 per month covers continuous Responsible Person obligations: monitoring regulatory updates, managing serious undesirable effect (SUE) reporting, maintaining the PIF, and responding to market authority requests. GMP is not a one-time exercise; it is a continuous obligation, and the Compliance Care plan is structured to reflect that.

CIGREG does not manufacture products or run manufacturing audits on behalf of brands. What CIGREG does is ensure that the GMP evidence your manufacturer produces is complete, correctly documented, and sufficient to support a defensible PIF and CPSR. That is the gap between a product that clears notification and one that stalls at the first regulatory checkpoint.