Understanding ISO 22716 and GMPC

If you are sourcing personal care products internationally, two certifications come up again and again: ISO 22716 and GMPC. Both signal that a manufacturer follows recognized quality management practices. But they are not the same thing, and many brands misunderstand what each one actually covers.

This article explains what each standard requires, how they differ, and how to verify a manufacturer’s certification is current and meaningful.

ISO 22716 — The International Standard

ISO 22716 is the international standard for cosmetics — Good Manufacturing Practices (GMP) — Guidelines on Good Manufacturing Practice. It was first published in 2007 and updated in 2020. The standard was developed by ISO Technical Committee 217 (Cosmetics) with input from regulators, industry associations, and manufacturers worldwide.

What ISO 22716 Covers

The standard provides guidance on the production, control, storage, and shipment of cosmetic products. Its scope is intentionally broad, covering the full lifecycle of a product within the manufacturing facility:

• Quality management system — documented procedures, responsibilities, and change control
• Documentation — specifications, batch records, and traceability
• Production — equipment, premises, materials handling, and contamination control
• Quality control — sampling, testing, and release procedures
• Storage and distribution — warehouse conditions, FIFO/FEFO, and shipping integrity

What ISO 22716 Does NOT Cover

The standard explicitly excludes:

• Product safety assessment — that is the responsibility of the brand owner, not the manufacturer
• Regulatory approval — ISO 22716 certifies the manufacturing process, not the product
• Worker safety — covered by occupational health and safety standards (ISO 45001)
• Environmental impact — covered by ISO 14001

In other words, ISO 22716 says: “We make your product consistently, the way you specified.” It does not say: “Your product is safe for consumers.” That distinction belongs to the brand owner.

Who Uses ISO 22716

ISO 22716 is recognized in the EU, Asia, and Latin America. In the European Union, ISO 22716 is considered the benchmark for GMP compliance under Regulation 1223/2009. Major retailers (Sephora, Ulta, Douglas) often require ISO 22716 from their brand suppliers.

The standard is voluntary — there is no law that requires a cosmetics manufacturer to be ISO 22716 certified. But in practice, retailers and major buyers make it effectively mandatory.

GMPC — The American-Aligned Standard

GMPC stands for Good Manufacturing Practice for Cosmetics. The most commonly referenced version is the U.S.-aligned standard, originally published by the Personal Care Products Council (then CTFA) and now maintained by independent certification bodies.

What GMPC Covers

GMPC is structurally similar to ISO 22716 but with stronger emphasis on:

• Facility cleanliness and hygiene — more detailed requirements for sanitation, pest control, and personnel practices
• Personnel training — documented training records, gowning procedures, and hygiene monitoring
• Equipment qualification — installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ) for production equipment
• Documentation discipline — change control, deviation reports, and corrective action procedures

GMPC is the de facto standard for cosmetics sold in the United States. The FDA does not directly certify cosmetics manufacturers, but FDA inspections of cosmetic facilities often reference GMPC expectations.

GMPC vs ISO 22716 — Key Differences

Aspect	ISO 22716	GMPC
Origin	International (ISO)	U.S. industry association
Geographic focus	Global, strong in EU and Asia	United States
Detail level	High-level guidelines	More prescriptive, especially on sanitation and personnel
Audit approach	System audit by accredited body	System audit by accredited body
Recognition	EU, Asia, Latin America retailers	U.S. retailers (Walmart, Target, Sephora USA)

In practice, the two standards overlap by about 80%. A manufacturer that holds both certifications is operating under a comprehensive quality system.

The Audit Process

Both ISO 22716 and GMPC are verified through third-party audits. Here is what a typical certification audit looks like:

1. Stage 1 audit (Documentation review) — the auditor reviews your quality manual, procedures, and records before visiting.
2. Stage 2 audit (On-site assessment) — the auditor spends 2-4 days at your facility, observing production, interviewing staff, and checking records.
3. Non-conformity reports — any gaps between your practices and the standard are documented. You have a defined period (usually 60-90 days) to address them.
4. Certification decision — if the auditor is satisfied, the certification body issues the certificate. Certificates are typically valid for 3 years, with annual surveillance audits in between.

A real certification audit is rigorous. The auditor will:

• Trace a raw material from incoming inspection through to finished product release
• Ask a production operator to explain their cleaning procedure, then watch them do it
• Review deviation reports and corrective actions from the last 12 months
• Inspect equipment maintenance logs and calibration records
• Interview the QC manager about out-of-specification results

How to Verify a Manufacturer’s Certification

Many manufacturers display certificates on their websites that are expired, scope-limited, or issued by unaccredited bodies. Here is how to verify a certificate is meaningful:

1. Check the Issuing Body

The certificate must come from an accredited certification body. Look for accreditation from:

• IAF (International Accreditation Forum) — globally recognized
• ANAB (ANSI National Accreditation Board) — U.S.
• UKAS (United Kingdom Accreditation Service) — UK
• DAkkS (Deutsche Akkreditierungsstelle) — Germany
• CNAS (China National Accreditation Service for Conformity Assessment) — China

If the issuing body is not accredited by one of these organizations, the certificate has limited value.

2. Verify the Certificate Number

Most certification bodies allow you to search for a certificate by its number on their website. A quick check takes 30 seconds and confirms:

• The certificate is real
• It is currently valid
• The scope covers the product categories you need

3. Check the Audit Scope

ISO 22716 and GMPC certificates have a defined scope — they cover specific product categories and activities. A certificate that covers “production of shampoo” does not automatically cover “production of skincare.” Make sure the scope includes your product type.

4. Check the Surveillance Audit Status

A certificate is only valid if surveillance audits are being conducted annually. Ask for the most recent surveillance audit report (or at least confirmation that one was completed).

5. Visit the Facility

A real audit takes hours. A facility visit lets you see whether the documented procedures match what actually happens on the production floor. Major clients of Timvive regularly visit our Kunshan facility — we welcome the scrutiny.

Common Misconceptions

“We follow ISO 22716” is not the same as “We are ISO 22716 certified”

Many manufacturers say they “follow” ISO 22716 practices without holding the certification. There is a meaningful difference: certification requires independent verification by an accredited body. Following the standard internally is a weaker claim.

A certificate does not guarantee product quality

ISO 22716 and GMPC certify the process, not the product. A certified manufacturer can still produce a poorly formulated product. Formulation quality depends on the skill of the R&D team and the quality of raw materials — separate concerns.

Multiple certifications do not always mean better quality

Some manufacturers stack every certification they can get, including irrelevant ones. ISO 22716 for personal care is what matters. Other certifications (ISO 9001 for general quality management, ISO 14001 for environmental management) are nice to have but do not directly impact cosmetics quality.

How Timvive Approaches Compliance

At Timvive, our quality system is built on both ISO 22716 and GMPC. We hold current certificates for both standards, audited annually by accredited bodies. Our internal QC program includes:

• Raw material qualification — every supplier audited and every ingredient lot tested
• In-process controls — pH, viscosity, appearance, and fragrance checked at multiple production stages
• Finished product release — microbiology, stability, and packaging integrity tested before any batch ships
• Stability program — every formula placed on accelerated stability (40°C / 75% RH) for 3 months plus real-time stability monitoring
• Retention samples — every production batch retained for the full shelf life plus 25%, stored under controlled conditions

If you would like to see our current certificates or arrange a facility visit, please contact us. We are happy to share documentation with serious buyers.