GMP for cosmetics manufacturers: an ISO 22716 roadmap

Why GMP became a legal baseline for cosmetics, not a nice-to-have

A mid-sized cosmetics manufacturer wins its first private-label contract with a European retail group. The onboarding pack lands, and halfway down sits a line that stalls the whole deal: proof of manufacturing under recognised good manufacturing practice, ideally an ISO 22716 certificate. The factory has made good products for years, but nothing is written down in the form an auditor expects. This is where most cosmetics GMP projects actually begin, under deadline, after the commercial promise has already been made.

The legal driver sits in the EU Cosmetics Regulation, (EC) No 1223/2009. Article 8 requires every cosmetic placed on the market to be manufactured in line with good manufacturing practice, and compliance is presumed when you follow the harmonised standard, EN ISO 22716. The Product Information File that the Responsible Person keeps under Article 11 has to carry a statement of GMP compliance. Turkey applies the same logic through its national Cosmetics Regulation under the authority TITCK, so a manufacturer selling at home and exporting faces one expectation, not two. GMP is therefore a baseline you owe by law, and ISO 22716 is the route auditors, retailers and Responsible Persons recognise for proving it.

Reading ISO 22716 once tells you what good looks like across personnel, premises, equipment, materials, production, quality control and the records that bind them together. It does not tell you the order to build them in. That order is the whole game, because a few decisions carry long lead times and everything else depends on them. The roadmap below follows those dependencies rather than the chapter order of the standard.

Begin with a gap analysis, not a folder of templates

The first instinct under deadline is to buy a documentation pack and start filling in templates. That produces paper an auditor will see through in an hour. Begin instead by fixing scope and running an honest gap analysis. Decide which sites, lines and product families are in, confirm who the Responsible Person is and what they need from manufacturing, and choose early whether you want accredited third-party certification or a self-declared statement in the Product Information File. Buyers in retail and private label increasingly want the certificate, so that choice shapes how formal the system has to be.

Walk the floor against each section of ISO 22716 and write down what already happens next to what the standard expects. Group the gaps by how long they take to close. Premises and equipment changes are slow and often need budget, so they surface first. Documentation and training are faster but voluminous. A gap analysis that sorts findings by lead time, not by chapter number, becomes the actual project plan.

Fix the building and the flow before the paperwork

Premises are the longest-lead item, so they start early even though they sit in the middle of the standard. ISO 22716 expects a layout that separates activities and moves materials in one logical direction, from goods-in and quarantine through weighing, manufacturing, filling and packing, to finished-goods storage. The aim is to prevent mix-ups and cross-contamination by design rather than by vigilance. Cleanable surfaces, a controlled water supply where water is an ingredient, defined cleaning regimes and pest control all belong here.

Equipment runs in parallel. Each machine needs a maintenance plan, cleaning procedures that prevent carry-over between batches, and calibration for anything that measures a critical parameter such as weight, temperature or fill volume. None of this is exotic, but it has to be assigned, scheduled and recorded. Settling the physical environment first means the documentation you write next describes a real, stable operation instead of an aspiration.

Build the documentation backbone that carries the audit

With the building stable, the written system becomes the spine of GMP. ISO 22716 rests on a simple idea: say what you do, do what you say, and keep the record that proves it. In practice that means a documentation hierarchy with procedures for each operation, specifications for raw materials, packaging, bulk and finished product, and a batch manufacturing record that travels with every production lot. The batch record is the single most important document in a cosmetics audit, because it lets an auditor trace one finished unit back through filling, bulk manufacture and every raw material that went into it.

Keep the system proportionate. A small manufacturer does not need the validation apparatus of pharmaceutical GMP, and ISO 22716 deliberately stops short of demanding it. What it does demand is traceability and consistency, so write procedures people will actually follow and version-control them properly. Our detailed guidance on ISO 22716 cosmetics GMP certification sets out how these documents map to the sections of the standard.

Bring materials, production and quality control online in order

Now the operational sections lock together in sequence. Materials control comes first: qualify suppliers, define incoming acceptance with a quarantine and release step, and identify and trace every lot of raw and packaging material. Production then has clean inputs to work from. Here line clearance, in-process checks and unambiguous identification of bulk and finished product prevent the mix-ups that cause recalls.

Quality control closes the loop. Sampling plans, microbiological and physico-chemical testing, retained samples and a clear release decision sit at the end of the line, along with a defined route for handling product that falls out of specification. This is where laboratory work meets the system, and many manufacturers pair the GMP build with a programme of cosmetic product testing so that release decisions rest on real data rather than assumption. Sequencing matters: testing capacity and specifications need to exist before the first batch is released, not after.

The supporting processes auditors probe hardest

Certification rarely turns on whether you have procedures. It turns on whether the system reacts when something goes wrong. ISO 22716 builds in deviations, complaints and recalls, change control, subcontracting and internal audit precisely because these reveal whether GMP is lived or merely filed. An auditor will ask to see a real deviation and what you did about it, trace a complaint to its root cause, and check that a change to a formula or a supplier passed through a controlled assessment.

People sit underneath all of it. Defined responsibilities, a separation between production and quality control decisions, hygiene rules and a training record that proves competence are what make the documented system credible. A procedure no one was trained on is a finding waiting to happen.

From internal audit to the certification decision

Before inviting a certification body, run a full internal audit against every section of ISO 22716 and clear the findings. This is the rehearsal, and it is where you want the uncomfortable discoveries to surface. Treat each gap as a corrective action with an owner and a date, the same way an external auditor will.

Accredited certification then follows the standard two-stage audit pattern, and our ISO 22716 certification page sets out what each stage involves. A certificate is not the finish line. The Responsible Person still references GMP in the Product Information File, and the product itself still has to be notified before sale, through the CPNP in the European Union and the product tracking system in Turkey. Handling that cosmetic product notification correctly is what turns a compliant factory into a product legally on the shelf. Built in this order, ISO 22716 stops being a binder you assemble for an audit and becomes the way the plant runs every day.