In-Depth Interpretation of the ISO 22716 International Standard: Is Your OEM Factory Truly Compliant?

When you ask an OEM factory, "Do you have GMP certification?" most sales representatives will answer "Yes" without hesitation.

But the real question is never just "Do you have it?", but rather: What does this certification actually entail behind the scenes?

ISO 22716 is the internationally recognized standard for Good Manufacturing Practices (GMP) in the cosmetics and personal care industry, widely adopted by regulatory bodies and professionals in major markets such as the EU, the US, and Southeast Asia. However, the gap between a factory that merely "holds a certificate" and one that is "truly compliant" is much wider than most brand owners imagine. This article will take you deep into the standard to help you build your own core evaluation framework.

I. What is ISO 22716, and What Problems Does It Solve?

ISO 22716 provides a globally recognized guidance framework for Good Manufacturing Practices (GMP) in the cosmetics and personal care industry. It covers all stages of production, packaging, storage, and distribution, offering practical methods for comprehensively managing product quality and consumer safety.

Developed by the International Organization for Standardization (ISO), its core mission is singular: to ensure that risks in the cosmetic production process are systematically identified and eliminated before the product ever reaches the consumer's skin.

The EU Cosmetics Regulation (EC) No 1223/2009 explicitly recognizes ISO 22716 as the harmonized standard for cosmetic GMP compliance. For manufacturers supplying the EU market, ISO 22716 is not a "nice-to-have" bonus; it is the internationally recognized benchmark used by regulators, stakeholders, and brand owners to assess manufacturing quality.

A crucial note: ISO 9001 is a generic quality management standard applicable to all industries and cannot replace ISO 22716. ISO 9001 lacks the specific requirements for contamination control, batch traceability, and laboratory testing unique to cosmetics. These specific aspects are what you must focus on when evaluating an OEM. Always explicitly request the ISO 22716 certificate; do not accept ISO 9001 as a substitute.

II. Core Architecture of the Standard: A Panoramic Breakdown of 10 Modules

ISO 22716 outlines ten key areas of Good Manufacturing Practices to help enterprises establish a robust quality system: raw material control, facility design, process control, personnel hygiene, equipment management, packaging control, quality control laboratories, storage and product management, non-conforming product management, and internal audits/management review.

Below are the core requirements and practical implementation checkpoints for each module:

1. Personnel: ISO 22716 requires personnel to be adequately trained to produce, control, and store products according to specified quality requirements. It mandates clear definitions of organizational structure, key responsibilities, training systems, personal hygiene, health status, and supervision.

   ✅ Audit Checkpoint: Does the factory have written training records? Are production personnel health files complete and up to date?

   
   

2. Premises: The location, design, construction, and use of facilities must ensure products are effectively protected, while facilitating cleaning, disinfection, and maintenance to minimize the risk of cross-contamination between products, raw materials, and packaging.

   ✅ Audit Checkpoint: Are production, raw material, and finished product areas physically separated? Are temperature and humidity monitoring records complete?

   
   

3. Equipment: Equipment must be suitable for its intended purpose, easy to clean, and, when necessary, capable of being sanitized.

   ✅ Audit Checkpoint: Are equipment cleaning validation records properly archived? Are measuring instruments calibrated regularly?

   
   

4. Raw Materials and Packaging: The identity of raw materials must be verified to ensure received materials match specifications, supported by identity testing and documentation (e.g., Certificates of Analysis) provided by suppliers.

   ✅ Audit Checkpoint: Is there a robust Incoming Quality Control (IQC) process with documented verification?

   
   

5. Production: All production operations (weighing, batching, mixing, filling, etc.) must have written Standard Operating Procedures (SOPs) and execution records. Batch Manufacturing Records (BMRs) must be complete and traceable.

   ✅ Audit Checkpoint: Are BMRs meticulously maintained? Are there clear In-Process Quality Control (IPQC) checkpoints throughout the process?

   
   

6. Quality Control Laboratory: The QC lab must ensure necessary controls are applied to incoming materials and finished products, ensuring they meet specified acceptance criteria before approval for use or dispatch. Principles of personnel, facilities, equipment, subcontracting, and documentation apply equally to the QC lab.

   ✅ Audit Checkpoint: Does the lab have in-house microbial testing capabilities? Are testing instruments regularly validated/calibrated?

   
   

7. Documentation: Documentation is the core principle of ISO 22716. Every critical process must be clearly defined, fully recorded, and under controlled management. This ensures repeatability—a serum produced today and one produced months later will follow the exact same documented process. Effective process control systems reduce human error, and clear inspection nodes prevent operational shortcuts.

   
   

8. Complaints and Recalls: All complaints received must be reviewed and investigated. If a serious or high-risk safety or quality issue is identified, the enterprise must be able to rapidly and effectively initiate a product recall, with a systematic documented plan to notify relevant authorities.

   
   

9. Subcontracting (Outsourced Activities): Contracted activities (including outsourced testing or manufacturing) must be governed by formal agreements, with clear division of responsibilities. The subcontractor must also comply with relevant ISO 22716 requirements. This is crucial for cross-border brands choosing Chinese OEMs—you must confirm the factory's outsourced production qualifications are explicitly listed in their permitted scope.

   
   

10. Internal Audits and Management Review: Internal audits are key to ensuring GMP implementation and evaluating overall enterprise performance. Audits must be conducted by qualified personnel to identify strengths and weaknesses in the quality management system, providing action plans to overcome GMP deficiencies. Issues found must be corrected and verified.

    
    

III. The Certification Process: How Far is it from "Having a Certificate" to "Truly Compliant"?

For manufacturers with an existing quality system (like ISO 9001), achieving ISO 22716 compliance typically requires 3 to 6 months of preparatory work. For those building a compliant system from scratch, it takes 9 to 18 months.

A formal ISO 22716 certification process consists of two stages:

• Stage 1 (Document Review): Assesses the documentation system, objectives, management review results, and internal audit results to determine if the quality management system is sufficiently established and ready for certification.

• Stage 2 (On-site System Audit): Auditors evaluate the effectiveness of all on-site process management, ultimately providing a detailed findings report and potential improvement analysis.

This means a truly valid ISO 22716 certificate is backed by the certification body's deep, on-site inspection of the factory's actual operations in Stage 2, not just a desk review of documents.

IV. Common Compliance Pitfalls: Signs Your OEM is "Certified but Not Compliant"

A certificate alone does not guarantee quality; what truly matters is how the standard is implemented in daily operations. Compliant manufacturers integrate GMP into documentation, facility design, personnel training, and continuous monitoring.

The following four scenarios are typical signs of an OEM being "certified but not compliant." Cross-border brands should actively look out for these during factory audits:

1. The certificate has expired or is about to expire. ISO 22716 certification is typically valid for 3 years, with annual surveillance audits. If a factory's certificate is expired or nearing expiration without renewal, it indicates fundamental flaws in their compliance management.

2. Documentation is an "Audit-Ready" version. If the factory's SOPs, batch records, and inspection reports were frantically prepared just before the audit and sit as dusty archives afterward, rather than being the actual documents used in daily operations, the certificate's practical value is severely diminished.

3. Lack of effective deviation management and CAPA mechanisms. Any factory truly complying with cosmetic GMP maintains written procedures for managing Out-of-Specification (OOS) results, conducting Root Cause Analysis, and implementing Corrective and Preventive Actions (CAPA). If the factory cannot clearly explain their deviation management process, their certification is likely just for show.

4. Mismatch between lab testing capabilities and product categories. A factory producing masks, lotions, or serums without complete microbial testing capabilities, or producing sunscreens without the capability to conduct or outsource SPF testing, has severe blind spots in their outgoing quality control.

Scaling up should not mean re-learning the formula.

The most expensive stage of a launch is usually the second trial — the one where a bench formula meets the filling line and the numbers move. We engineer for the line, not the beaker.

Packaging compatibility, stability and fill accuracy are validated before commercial scale rather than discovered during it.

By collaborating with Explore our skincare manufacturing capabilities you gain access to industry-leading expertise and innovative formulations that set your brand apart in the competitive global market. Share your target output and packaging format; we will confirm line feasibility before you commit.

OEM Factory Conclusion

The European cosmetics industry is the largest and most competitive market in the world, valued at over €80 billion. Against the backdrop of strict regulations and growing consumer demand for safe, high-quality products, compliance with industry standards is absolutely critical for any business operating in this space.

ISO 22716 is the passport to this market—and inevitably, to multiple other core global markets. But the validity of that passport depends entirely on the genuine reality behind it.