ISO 22716:2007 is the international guideline on good manufacturing practices (GMP) for cosmetics. It covers how products are produced, controlled, stored and shipped, from personnel and premises to complaints, recalls and internal audit. It does not cover research and development, distribution of finished products, staff safety or environmental protection.
For cosmetics brands and manufacturers in the GCC and India, ISO 22716 matters because regulators, retailers and export markets increasingly refer to it. It is also the practical baseline a brand owner should use when choosing and auditing a contract manufacturer.
This guide explains the main requirements, what auditors look for and how a small brand used the standard when it moved production to Ajman.
Where ISO 22716 sits in regulation
European Union: Regulation (EC) No 1223/2009 requires cosmetic products to be manufactured in line with GMP, and compliance is presumed where manufacture follows the relevant harmonised standards. EN ISO 22716 is the standard used for this.
GCC: GSO 1943, on safety requirements for cosmetics and personal care products, is referenced in GCC requirements, and regulators commonly look for evidence of GMP such as ISO 22716. Confirm the current version and how each country applies it. Registration or notification rules are set nationally, by SFDA in Saudi Arabia and the relevant authorities in the UAE, so check before launch.
India: the Cosmetics Rules, 2020, under the Drugs and Cosmetics Act, 1940, govern manufacture and import. Manufacturing needs a licence from the State Licensing Authority, and imports need registration with the Central Licensing Authority. ISO 22716 is a useful framework for meeting and exceeding the Rules' premises and hygiene requirements.
Many certification bodies certify sites against ISO 22716, but a certificate is not regulatory approval, and it does not replace the product safety assessment.
The main requirements of ISO 22716
Personnel and premises
Staff must be trained for their roles, follow hygiene rules and wear suitable clothing, with responsibilities shown in an organisation chart. Premises are designed for a logical flow of materials and people, with suitable separation of storage, production and laboratory areas, and are cleaned, maintained and pest-controlled to documented programmes.
Equipment and materials
Equipment must be suitable, cleanable, calibrated where it measures and maintained. Raw materials and packaging are bought to specifications from approved suppliers, checked on receipt, labelled with their status (quarantine, released or rejected) and stored to prevent mix-ups.
Production and finished products
Each batch is made to a documented formula and manufacturing instructions, with line clearance, weighing checks, in-process controls and packaging checks. Finished products are released only after review against acceptance criteria, then stored and shipped so that every batch can be traced.
Quality control laboratory
Testing follows written methods, with sampling plans, reagent and reference controls, retained samples and documented results. Out-of-specification results are investigated before any decision on the batch.
The systems that hold it together
Treatment of out-of-specification products, waste, subcontracting under a written contract, deviations, complaints and recalls, change control, internal audit and documentation complete the standard. These are where small manufacturers most often fall short. A clear set of procedures helps; see how to write an effective SOP.
What auditors check and common gaps
| ISO 22716 area | What auditors check | Common gaps |
|---|---|---|
| Personnel | Training records, hygiene rules, organisation chart | Temporary staff not trained or recorded |
| Premises | Layout, flow, cleaning and pest control records | Raw materials and finished goods in one unmarked store |
| Equipment | Cleaning, calibration and maintenance records | Balances used without routine checks |
| Raw materials and packaging | Specifications, supplier approval, status labels | Materials accepted on a certificate of analysis alone |
| Production | Batch records, line clearance, weighing checks | Batch records completed after the event |
| Finished products | Release, storage, traceability | Goods shipped before release |
| Quality control laboratory | Methods, sampling, retained samples | No retained samples kept |
| Out-of-specification product | Investigation, decision, records | Rework without approval |
| Wastes | Disposal routes and records | Rejected product not destroyed under control |
| Subcontracting | Written contract, evaluation of the contractor | No quality agreement |
| Deviations | Records, justification, approval | Deviations handled verbally |
| Complaints and recalls | Complaint log, investigation, recall procedure | Recall procedure never tested |
| Change control | Assessment and approval of changes | Supplier changed without assessment |
| Internal audit | Programme, findings, follow-up | Audits planned but not done |
| Documentation | Control, review, retention | Uncontrolled copies on the shop floor |
Worked example: a lip-care brand moves to a contract manufacturer in Ajman
A small brand makes lip balms and sugar lip scrubs in a home kitchen and sells online in the UAE. Demand grows, a retailer wants to list the range, and the founders decide to move production to a contract manufacturer in Ajman.
Before signing, they use ISO 22716 as their checklist. On a site visit they review the manufacturer's ISO 22716 certificate and scope, walk the material flow from receipt to dispatch, and ask to see a completed batch record and evidence of a recall exercise.
They then agree a written quality agreement covering:
- Who approves the formula, specifications and label artwork.
- Specifications and approved suppliers for beeswax, shea butter, oils, sugar and flavour.
- Batch records, release criteria and retained samples for every batch.
- Microbiological testing, decided with the safety assessor. Anhydrous balms usually carry lower microbial risk, but scrubs in open jars can be contaminated by wet fingers.
- Notification to the brand of deviations, complaints, recalls and proposed changes.
- The brand's right to audit the site.
A few months later, the manufacturer proposes a cheaper beeswax supplier. Because change control is in the agreement, the brand asks for the new specification and certificate of analysis, plus a trial batch with stability and packaging compatibility checks, before approving.
When a customer later complains of a grainy balm, batch traceability links it to a cooling-rate deviation recorded in the batch record, not to the new wax. The manufacturer adjusts the cooling step under change control and the brand closes the complaint with evidence. See deviation vs change control vs CAPA.
Common mistakes
- Assuming the contract manufacturer's certificate makes the brand compliant.
- Working without a written quality agreement.
- Specifications that say only cosmetic grade.
- Treating GMP and the product safety assessment as the same thing.
- Changing suppliers, fragrance or packaging without change control.
- Never testing the recall procedure.
Key takeaway: ISO 22716 sets out the GMP controls that make every batch of a cosmetic consistent and traceable. Regulators in the EU, GCC and India expect GMP, so brand owners should use the standard to choose, contract and audit their manufacturers.
Frequently Asked Questions
Is ISO 22716 mandatory?
ISO 22716 is a voluntary standard, but GMP itself is often a legal requirement. In the EU, cosmetics must be made under GMP and EN ISO 22716 is the recognised route. GCC and Indian requirements also expect good manufacturing practice. Check the current rules with the authority in each market where you sell.
Is ISO 22716 a certification?
ISO 22716 is a guideline rather than a management system standard, but many certification bodies audit and certify sites against it. A certificate gives customers and regulators confidence, yet it is not regulatory approval. Always check the certificate's scope, validity and issuing body, and whether that body is accredited for this scheme.
What is the difference between ISO 22716 and ISO 9001?
ISO 9001 is a general quality management system standard for any organisation. ISO 22716 is specific to cosmetics manufacturing and focuses on practical GMP controls such as premises, hygiene, materials, batch records and recalls. Many manufacturers hold both, using ISO 9001 for the management system and ISO 22716 for production controls.
Does ISO 22716 apply to small cosmetic brands?
Yes, the principles apply whatever the size of the business. A brand that makes its own products needs GMP controls scaled to its operation. A brand that uses a contract manufacturer still carries responsibility for the product, so it should apply ISO 22716 through supplier selection, a quality agreement and regular audits.
Does ISO 22716 cover product safety assessment?
No. ISO 22716 covers manufacturing, control, storage and shipment. Product safety is assessed separately, by a qualified safety assessor where the law requires one, considering ingredients, exposure, microbiological quality and stability. Good GMP supports the safety assessment by ensuring every batch matches the formula and quality that were assessed.
Next steps
To apply ISO 22716 and GCC product rules in practice, see Cosmetics GMP & GCC Product Compliance. If you would like advice on where to start, speak to a counsellor.
Related reading: how to write an effective SOP, deviation vs change control vs CAPA and document control best practices for QMS.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.