Guide
ISO 22716: The GMP Backbone for EU and Global Cosmetics
ISO 22716:2007 is the international standard for Good Manufacturing Practices for cosmetics, and the practical reference framework cited by Article 8 of EU Cosmetics Regulation (EC) 1223/2009 as the route to compliance. It is also the GMP framework increasingly referenced by ASEAN, MERCOSUR, and other regional regulators, and the framework MoCRA (US) Responsible Persons benchmark against even though MoCRA's own GMP rule is still in development. Unlike pharma GMP, ISO 22716 is light on prescription and heavy on principle — which makes it easy to implement badly. This guide walks through the structural sections, the EU 1223/2009 linkage, the inspection patterns, and a practical path to a defensible cosmetics GMP programme. It is written for QA and operations leads, technical managers, and Responsible Persons at cosmetics manufacturers and brand owners.
Start free trial Free trial, no credit card, onboard in days, not months.
The structure: nine technical sections plus internal audit
ISO 22716 is organised around nine technical chapters — Personnel, Premises, Equipment, Raw materials and packaging materials, Production, Finished products, Quality control laboratory, Treatment of out-of-specification product, Wastes — plus chapters on Subcontracting, Deviations, Complaints and recalls, Change control, Internal audit, and Documentation. The structure mirrors the actual flow of a manufacturing site, which is its great strength as a teaching standard. The weakness is that the language is high-level — 'should be' and 'as appropriate' appear constantly — and a site can pass a tick-box audit while failing the spirit. Inspectors and certification bodies in 2026 are looking through the language to the underlying control.
EU 1223/2009 Article 8 and the Responsible Person
EU Regulation 1223/2009 places overall safety responsibility on a designated Responsible Person (RP) established in the EU, and Article 8 names ISO 22716 as the harmonised standard for GMP compliance. The RP holds the Product Information File (PIF), notifies products on the CPNP, and is the point of contact for competent authorities. ISO 22716 is the framework the RP uses to demonstrate the manufacturing portion of the PIF is robust. The link cuts both ways — an ISO 22716 audit that finds the PIF cannot be reconstructed from the on-site records is a serious deficiency even where the certificate is otherwise issued.
Personnel, training and access to areas
Chapter 3 (Personnel) is the chapter sites most often underestimate. Job descriptions, training (initial and ongoing), hygiene and health monitoring, gowning, and visitor controls are all in scope, and auditors test by walking the floor and asking operators what they were trained on, when, and what they would do in defined scenarios. The chapter on Production (Chapter 7) ties back hard to Personnel — every step must be performed by trained personnel, with batch documentation referencing the training records. A training matrix that exists in HR but is not visible to QA at the point of batch release is the recurring weakness.
Production, finished products and out-of-specification handling
Chapters 7, 8, and 9 carry the core GMP weight: Production controls (master formula, batch documentation, in-process controls), Finished product controls (specifications, release testing, retention samples), and OOS handling (investigation, decision, disposition, trend analysis). Issue 9 of BRCGS and the cosmetics-specific FDA enforcement focus in MoCRA-prep inspections have raised the bar for OOS investigations — the 'lab error, retest, OK' shortcut that survived audits in 2018 will not survive in 2026. ISO 22716 expects investigations to consider lab, sampling, and manufacturing root causes with documented logic and disposition.
Internal audit, complaints, recalls and change control
Chapters 14, 15, and 16 cover the back-end controls that make the front-end GMP credible. Internal audits at planned intervals covering every applicable chapter, with documented findings and follow-up to closure. Complaints handled with investigation, response, and trend analysis. Recalls executable from the documentation — the test is whether the manufacturer can identify and recover every unit of a finished batch from the records, end-to-end, within hours not days. Change control over premises, equipment, raw materials, packaging, processes, methods, and personnel responsibilities. A site that runs each of these as a separate spreadsheet system invariably has gaps between them — the gap is where the audit finding sits.
A 60-day readiness path
Days 1 to 10: gap assessment against all 17 chapters of ISO 22716 with priority on Production, Finished products, OOS, and Internal audit; check PIF reconstructability per product. Days 11 to 30: close the production-side gaps — batch records, in-process controls, OOS workflow; refresh personnel training matrix and link to batch sign-off. Days 31 to 45: internal audit covering every chapter; close findings; rehearse a mock inspection led by the RP. Days 46 to 60: stand up the recall test, the complaint trend report, and the change control register; freeze the baseline for certification or competent authority inspection.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Cosmetics QMS
ISO 22716 chapters mapped into one QMS spine, no spreadsheet gaps.
Product Information File
PIF reconstructable from live records for every product.
Electronic batch records
Production and finished-product controls with training-linked sign-off.
OOS, complaints & CAPA
Investigation flows that survive 2026 audit scrutiny.
Compliance self-assessment
Score the GMP programme against all 17 ISO 22716 chapters.
Industries this hits hardest
Frequently asked
Is ISO 22716 certification mandatory in the EU?
Compliance with the principles of ISO 22716 is required by Article 8 of Regulation 1223/2009; certification to ISO 22716 is not mandatory but is the most common way manufacturers demonstrate compliance to brand-owner customers and to competent authorities. Many cosmetics distributors and retailers contractually require a third-party ISO 22716 certificate.
How does ISO 22716 differ from pharma GMP?
ISO 22716 is principle-based and significantly less prescriptive than EU GMP for pharmaceuticals — no Qualified Person sign-off, no Annex 1 contamination control strategy, less stringent cleaning validation, less prescriptive computerised systems requirements. The trade-off is that the manufacturer carries more of the interpretation burden, and shallow implementation is easier to fall into and harder to spot.
Does ISO 22716 satisfy MoCRA (US) requirements?
MoCRA includes a GMP rule (still in development as of 2026) which FDA has signalled will draw heavily on ISO 22716. A facility already running a credible ISO 22716 programme will be substantially closer to MoCRA GMP readiness than a facility running only on internal SOPs — but Responsible Persons should track the final MoCRA GMP rule for specific US-only deltas (adverse event reporting, facility registration, product listing already in force).
Who can certify a site to ISO 22716?
Several accredited certification bodies issue ISO 22716 certificates globally (Cosmetics Cluster, Eurofins, SGS, Bureau Veritas, TÜV organisations, and others). Choose a certification body with cosmetics-specific auditor competence and with recognition from your target export markets — not all certificates are equally accepted across regions.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.