GMP Cosmetics Manufacturing: ISO 22716 & What It Covers

GMP certification tells you that a cosmetic factory follows documented, consistent production processes — it does not certify that any specific product is safe, effective, or compliant with your target market's regulations. The distinction matters a lot when you're choosing a contract manufacturer.

Most brand buyers treat GMP as a binary checkbox. The factory either has it or it doesn't. The reality is more layered than that: there are multiple GMP frameworks for cosmetics, certification quality varies by issuing body, and the certificate itself tells you far less than the audit report behind it.

This guide explains what GMP actually covers in a cosmetics context, where the standard's limits are, and what documentation to request before committing to a manufacturing partner.

A GMP-certified production environment: controlled access, documented procedures, traceable batch records at every stage.

What GMP means in cosmetics manufacturing: ISO 22716 explained

GMP stands for Good Manufacturing Practice. In the cosmetics industry, the dominant international standard is ISO 22716, published by the International Organization for Standardization. It covers how a factory should manage eight interconnected areas of operation:

Personnel sets the training and hygiene baseline — who is qualified to do what, and what written evidence proves it. In practice, this means every operator handling product should have dated training records for the specific process they're running, not just a general onboarding checklist.

Premises covers facility design and cleanliness, including air handling, pest control, and drainage. The intent is that the physical environment cannot introduce contamination into the product — layout, airflow direction, and surface materials all matter.

Equipment requires calibration, scheduled maintenance, and documented cleaning validation between production runs. This is where allergen cross-contamination risk lives: a factory that runs fragranced products on the same filling line as fragrance-free products without a validated cleaning procedure between runs is out of spec even if everything else looks fine.

Raw materials demands supplier qualification before a material enters production, not after a problem surfaces. Incoming inspection, certificate review, and quarantine until release are the minimum — and a factory that substitutes a raw material without client notification fails this requirement regardless of whether the substitute is technically equivalent.

Production means documented batch records, in-process controls at defined checkpoints, and yield tracking. Deviations from the standard process have to be recorded and investigated, not just corrected silently.

Finished products sets release criteria — what testing must pass before a batch ships — and requires retention samples for each lot. Shelf-life assessment and stability data sit here too.

Quality control covers testing protocols, how out-of-specification results are handled, and what triggers a complaint investigation. This is where the gap between a factory's GMP certificate and its actual QC capability is most visible.

Documentation ties everything together: record retention periods, batch traceability (can you trace every ingredient in a finished product back to its supplier lot?), and change control (how does a formula or process change get approved and documented before it affects a production run?).

ISO 22716 is a guideline standard, not a regulation. Factories get certified through accredited third-party auditors — organizations like Bureau Veritas, SGS, Intertek, or TÜV — who conduct on-site inspections and review documentation. The European Union references ISO 22716 directly in Cosmetics Regulation EC 1223/2009, which made it the de facto legal baseline for factories supplying the EU market.

The US FDA does not currently have a mandatory GMP standard for cosmetics, though the Modernization of Cosmetics Regulation Act (MoCRA) signed in December 2022 authorizes the FDA to establish one. Guidance is still being developed as of 2026.

Quality control testing in a GMP-compliant cosmetics lab. ISO 22716 requires documented test protocols, release criteria, and out-of-spec investigation procedures — not just the equipment itself.

What GMP certification does not cover — and where buyers get caught out

This is where buyers consistently get caught out.

GMP does not evaluate your formula. A GMP-certified factory can manufacture a product with a sensitizing fragrance, a legally questionable claim ingredient, or a concentration of an active that exceeds the limit in your target market — and still be fully GMP-compliant. GMP governs the process, not the outcome.

GMP does not mean the factory is approved to sell in your market. In the EU, the Responsible Person must verify product safety through a Cosmetic Product Safety Report (CPSR). In the US, MoCRA now requires facility registration and serious adverse event reporting. GMP certification is a supporting document in that process, not a substitute for it.

GMP does not cover supply chain ethics. Animal testing policies, raw material sourcing transparency, and labor practices are outside the standard's scope. Brands with sustainability or cruelty-free commitments need to audit those separately.

GMP does not freeze-frame factory conditions. Certification is a point-in-time assessment, typically renewed annually for surveillance and every three years for full recertification. The surveillance audit date and the certificate issue date are often several weeks apart — a factory can receive a certificate in March for an audit conducted in January, and conditions may have shifted in the interval. The certificate tells you about one moment; the ongoing relationship tells you about everything after that.

From VEILTA's manufacturing floor: The most revealing document a factory can share isn't the GMP certificate — it's a batch record from a recent production run. Ours includes raw material lot numbers, in-process viscosity and pH readings at defined intervals, equipment cleaning logs, and the name of the QC inspector who signed off on release. We share a redacted sample on request. In our experience, factories that hesitate on this document often have a reason to.

When buyers visit our facility, the questions that catch less-prepared manufacturers off guard aren't about the certificate at all. They're about what happens at the edges: what does the factory do when a filling machine runs slow and the batch takes 30% longer than planned? Is that deviation recorded? Who approved continuing production? Does the batch record show it? These are the questions that distinguish a factory that lives GMP from one that files for it.

A batch record documents every step of production — materials used, in-process checks performed, deviations noted, and QC release authorization. Requesting a sample record is the fastest way to assess a factory's real GMP discipline.

GMP frameworks for cosmetics: ISO 22716, GMPC, and cGMP compared

When sourcing from Chinese manufacturers specifically, you'll run into several overlapping frameworks:

Most professional contract manufacturers targeting export markets hold ISO 22716 certification. GMPC was more common before China's National Medical Products Administration (NMPA) aligned more closely with international standards — you still see it on older certifications and smaller domestic-focused factories.

If a factory offers you a GMP certificate, ask specifically which standard it's certified against and which body issued it. "GMP certified" without that detail is almost meaningless for verification purposes.

GMP requirements by export market. ISO 22716 is the only standard with broad multi-market recognition — factories targeting the EU, US, and ASEAN simultaneously need ISO 22716 as the baseline.

How to verify GMP certification before signing with a cosmetic manufacturer

The certificate itself is the starting point, not the endpoint. Here's what to request and what to look for:

Request the full audit report, not just the certificate. The report will list any nonconformances found — major, minor, or observations. A major nonconformance means the factory failed to meet a core requirement of the standard. Factories can still receive certification with minor findings, provided they submit a corrective action plan. You want to see that report, not just the summary page.

Check the certifying body's accreditation. The issuing organization should itself be accredited under IAF (International Accreditation Forum) MLA (Multilateral Recognition Arrangement). Bureau Veritas, SGS, Intertek, and TÜV are all IAF-accredited. Be cautious of certificates issued by bodies you can't verify through the IAF directory.

Verify the certificate scope. ISO 22716 certificates specify the product categories the factory is certified to produce. A factory certified for facial masks may not have an equivalent scope for transdermal patches or medicated formulations. Scope matters.

Ask about internal QC lab capabilities. GMP requires quality control, but doesn't mandate that testing be done in-house. A factory that outsources all microbial and stability testing has a longer feedback loop than one with internal lab capacity. Neither is automatically wrong, but the turnaround time on out-of-spec results affects your lead time.

Request a batch record sample. A batch record is the per-production document that tracks every material used, every step performed, every measurement taken, and every person involved in making a specific lot. A well-maintained batch record is probably the clearest signal of how seriously a factory takes GMP in practice, not just on paper.

GMP in the context of VEILTA's product categories

Different product types interact with GMP requirements differently. Some examples relevant to skincare patches and masks:

Acne patches and hydrogel eye patches are classified as cosmetics in most markets. ISO 22716 applies. The main GMP-relevant considerations are: adhesive material stability, microbial contamination control during moisture-intensive filling, and temperature-controlled storage for hydrogel products.

Transdermal wellness patches (sleep patches, pain relief patches) sit in a more complex regulatory space. If they contain ingredients at levels that produce a pharmacological effect, they may be regulated as drugs rather than cosmetics — which triggers pharmaceutical GMP (cGMP in the US, Eudralex Annex 13 in the EU) rather than ISO 22716. Contract manufacturers need to be explicit about which category a given formula falls into.

Microneedle patches are an emerging category where regulatory classification is still evolving. Some regulators are treating dissolvable microneedle cosmetic patches as cosmetics; others are examining them as medical devices or drug delivery systems. GMP requirements follow the classification, and classification depends on the claims made and the active ingredients used.

When buyers tour our facility and see acne patch production specifically, three things consistently surprise them. First, how much temperature control matters for hydrogel adhesive stability — storage and filling areas have to stay within narrow bands or the adhesive layer changes properties. Second, how many in-process checks happen before the product reaches the packaging line, not just after. Third, the sheer volume of documentation: a single batch of 50,000 hydrogel patches generates a batch record that runs to dozens of pages of entries, measurements, and sign-offs. That's not bureaucracy — that's traceability. If a batch has a problem six months later, that record is what lets us find exactly which raw material lot was involved and which clients received which pallets.

Skincare patch manufacturing under GMP conditions: temperature-controlled environment, automated sealing equipment, continuous in-process monitoring at each stage.

GMP-compliant documentation at the product level: PIF, CoA, and CPSR

If you're preparing to sell in the EU, your Responsible Person needs a Product Information File (PIF) for each product. GMP certification from the manufacturer is one component of that file, but it needs to be accompanied by:

• Cosmetic Product Safety Report (CPSR) — assessed by a qualified safety assessor
• Product description — including formula, function, and intended use
• Manufacturing method — GMP compliance statement from the factory
• Proof of efficacy — for any claims made on packaging
• Consumer complaint records — post-market tracking

The GMP certificate goes in section 4 of the PIF. It supports the safety report but doesn't replace any other section.

For US market entry under MoCRA, requirements include facility registration (which your contract manufacturer must complete), product listing, and serious adverse event reporting. The factory's GMP status is relevant to FDA inspection risk but is not currently a formal registration requirement.

Questions to ask a GMP-certified cosmetic manufacturer before you commit

Before signing a manufacturing agreement, these are worth asking directly:

1. Which GMP standard are you certified against, and who issued the certificate?
2. When was your last full recertification audit, and can I see the audit report including nonconformances?
3. What product categories does your GMP scope cover?
4. Do you have an in-house QC laboratory? What tests are performed in-house vs. outsourced?
5. Can I see a sample batch record from a recent production run?
6. How do you handle raw material substitutions if a primary supplier is out of stock?
7. What is your corrective action process if a batch fails release testing?

A manufacturer who hesitates on questions 1, 2, or 5 is worth being cautious about, regardless of what their certificate says.

FAQ