If you manufacture, fill, label or store cosmetic products in the European Union, ISO 22716 is not optional: it is the technical reference that underpins your compliance with Regulation (EC) No 1223/2009. Many companies in the sector — from natural cosmetics laboratories to large dermocosmetics manufacturers — wonder whether they are truly obliged, what the difference is between «complying» and «being certified», and how much effort it takes to implement a Good Manufacturing Practices (cosmetics GMP) system. This article answers those questions with data updated to 2025-2026.
What ISO 22716 is and why it exists
ISO 22716:2007 — published by the International Organization for Standardization and adopted in Europe as EN ISO 22716 — establishes the guidelines for Good Manufacturing Practices in cosmetics (GMP). It was created to harmonise production, control, storage and dispatch criteria for cosmetic products at a global level, in response to the fragmentation of national requirements that existed before its publication.
Its scope is broad: it covers raw materials, packaging materials, in-process products and finished products. It does not regulate manufacturing in the strict sense alone, but the entire internal production chain, including subcontractors and suppliers involved in the elaboration of the final product.
The standard is structured around eight main blocks: personnel, premises, equipment, raw materials, packaging materials, production, quality control and subcontracting. Each block defines responsibilities, mandatory records and acceptance criteria that the company must demonstrate it meets.
The legal link with the European cosmetics Regulation
Regulation (EC) No 1223/2009, applicable in all Member States since July 2013, establishes in Article 8 that cosmetics manufactured in conformity with harmonised standards — whose references are published in the Official Journal of the European Union — are presumed to comply with the Good Manufacturing Practices required by the Regulation.
EN ISO 22716:2007 was referenced in the Official Journal of the EU (C 258 of 10.9.2011) as a harmonised standard under this Regulation. This means that following ISO 22716 is the most direct way to demonstrate compliance with the legal GMP requirement. Not complying with the standard does not automatically constitute an infringement, but it does require demonstrating compliance by another route — far more costly in terms of documentation and potentially more exposed during an inspection by the AEMPS or the competent health authority.
Who must comply with ISO 22716?
Article 8 of Regulation 1223/2009 obliges every responsible person for the manufacture of a cosmetic product distributed in the EU. In practice, this includes:
- Own manufacturers: companies that produce, blend, fill or label cosmetics under their own brand or for third parties (private label).
- Distributors that reformulate or re-label: if you change the composition or name of an imported product to place it on the EU market, you assume the status of manufacturer.
- Importers from outside the EU: whoever introduces into the EU a cosmetic manufactured outside must ensure it complies with GMP equivalent to ISO 22716.
- Active subcontractors: the laboratory that manufactures for a third-party brand must implement ISO 22716; the brand owner is also responsible for verifying this.
Not directly obliged — but subject to traceability and safety obligations — are pure distributors who do not alter the product, nor final retailers that only sell finished, already-labelled product.
The difference between compliance and ISO 22716 certification
This is the point that generates the most confusion. The standard does not require third-party certification: the European Regulation speaks of «manufacturing in conformity with GMP», not of «being certified». However, obtaining the ISO 22716 certificate issued by an accredited body (such as AENOR, Bureau Veritas or SGS) brings very concrete advantages:
- Presumption of conformity before AEMPS or regional health inspectors.
- Requirement demanded by major distribution chains (perfumeries, pharmacies, large-format retailers) that audit their suppliers.
- Differentiator in tenders and B2B contracts for brands that outsource manufacturing.
- Competitive advantage in export markets (USA, Japan, South Korea, Gulf region) where local buyers recognise and request the European certificate.
In short: compliance is mandatory; certification is the smartest way to demonstrate that compliance without depending on ad hoc documentation every time someone demands it.
The ten critical controls that most often fail in audits
Based on accumulated experience in cosmetics-sector implementations, these are the requirements where companies accumulate the most non-conformities in certification audits:
| ISO 22716 requirement | Typical error detected | Impact in audit |
|---|---|---|
| Personnel qualification (§4) | Training not recorded or out of date | Frequent minor non-conformity |
| Access control to production areas (§5) | Crossing personnel flows without physical barrier or procedure | Minor non-conformity |
| Equipment calibration (§6) | Balances and meters without a current calibration certificate | Major non-conformity if it affects dosing |
| Raw material specifications (§7) | No approved technical specification for each raw material | Major non-conformity |
| Batch management and traceability (§9) | Paper records with no structure or correlation to the finished batch | Major non-conformity |
| Finished product quality control (§10) | No systematic microbiological analysis for preservatives | Major non-conformity or blockage |
| Returns and complaints management (§12) | No documented procedure or corrective action record | Minor non-conformity |
| Internal GMP audit (§13) | Not conducted or no approved annual plan | Major non-conformity |
| Subcontractor management (§14) | No written agreement or audit of the supplier manufacturing ingredients | Major non-conformity |
| System documentation (§15) | Procedures without version control; records with unauthorised amendments | Minor or major non-conformity depending on extent |
Knowing these critical points before the pre-audit allows you to focus effort where it truly matters and avoid surprises that delay the certificate.
How to implement ISO 22716 step by step
The implementation process for a GMP system compliant with ISO 22716 follows a logical sequence that, when well executed, can be completed in four to eight months depending on the size of the company and the starting point:
1. Initial diagnosis (gap analysis)
The company's current state is assessed against each requirement of the standard. The result is a map of gaps prioritised by impact and closure effort. This phase avoids investing resources in areas that already comply and concentrates work where the risk of non-conformity is greatest.
2. Design of the documentary system
Procedures, technical instructions, forms and mandatory records are developed. The ISO 22716 documentary system is more pragmatic than ISO 9001: the standard does not require a system manual, but does require specific records for each critical production and control operation.
3. Plant team training
GMP training is not a bureaucratic formality: production operators, quality managers and warehouse staff must understand why they make each record and what risk they are preventing. Companies that only train «on paper» are those that accumulate non-conformities due to procedural non-compliance on the line.
4. Implementation and trial run
Over four to twelve weeks the new procedures are applied under real conditions, generating the documentary evidence the auditor will review. This is the time to detect operational friction before the certification body sees it.
5. Prior internal audit
A rigorous internal audit — or better still, an external pre-audit carried out by specialised consultants — identifies outstanding non-conformities and allows them to be closed before the official audit. This step makes the difference between obtaining the certificate on the first visit or facing a second audit that is costly in time and money.
6. Certification audit and certificate issuance
The accredited body (AENOR, Bureau Veritas, SGS or another recognised body) audits the system. If there are no open major non-conformities, it issues the certificate with a three-year validity and annual surveillance audits.
If you need support in any of these phases, at Summum Calidad we accompany cosmetics companies from the diagnosis through to the certification audit: see our ISO 22716 implementation service.
ISO 22716 and the Product Information File (PIF)
One aspect that is often overlooked is the relationship between the GMP system and the Product Information File (PIF), mandatory for each cosmetic reference under Regulation 1223/2009.
The PIF must include, among other things, the safety assessment report, the description of the manufacturing method and confirmation of GMP compliance. Having ISO 22716 implemented and certified enormously simplifies the drafting of this section of the PIF and gives the dossier solidity before any request from the AEMPS or the competent authority of another Member State.
Furthermore, national authorities are paying greater attention to the coherence between the toxicological assessment and real manufacturing conditions, in line with successive updates to the European regulatory framework for cosmetics. A documented and audited GMP system provides that coherence automatically.
ISO 22716 in the context of export
Spanish cosmetics companies that export outside the EU find in ISO 22716 certification an internationally recognised technical passport. Some concrete examples:
- United Kingdom: after Brexit, the UK Cosmetics Regulation (UK SI 2020/1617) maintains a GMP scheme practically identical to the European one. The ISO 22716 certificate facilitates registration with the OPSS (Office for Product Safety and Standards).
- United States: the Modernization of Cosmetics Regulation Act (MoCRA), in force since December 2022, requires manufacturers selling in the USA to implement GMP for the first time. The FDA was required to publish its proposed GMP rule by the end of 2024, but missed the deadline; as of mid-2026 the rule remains classified as a long-term action with no confirmed publication date, though ISO 22716 principles are at the centre of the technical discussion.
- South Korea and Japan: both markets require their own GMP certificates, but recognise implementations based on ISO 22716 as a basis for local inspection.
- Saudi Arabia and the United Arab Emirates: the SFDA (Saudi Arabia) and the Emirates Authority for Standardization and Metrology require that foreign manufacturers hold recognised GMP; ISO 22716 is the standard reference.
Frequently asked questions
Is ISO 22716 certification mandatory to sell cosmetics in Spain?
Not in the strict sense: Regulation (EC) 1223/2009 requires manufacturing in conformity with GMP, but does not require a formal third-party certificate. However, following ISO 22716 is the recognised route for presuming that compliance. In practice, major distributors and pharmacy chains are increasingly demanding the certificate as a contractual condition, so certification becomes a commercial necessity even if it is not a direct legal requirement.
How long does it take to implement ISO 22716 from scratch?
For a small or medium-sized company with already organised cosmetics production, the typical timeframe ranges between four and eight months. The factors that most extend the process are the absence of prior documentation, the variety of references manufactured and the maturity level of the quality team. With structured external support, timelines are significantly reduced because common mistakes are avoided and the system is already consolidated by the time of the audit.
What is the difference between ISO 22716, ISO 9001 and pharmaceutical GMP?
Pharmaceutical GMP (medicinal product GMP standards, governed by EudraLex Volume 4 in Europe) is far stricter and involves process validation, classified cleanrooms and exhaustive analytical control. It does not apply to cosmetics, although some companies manufacturing products on the cosmetic-medicine boundary (high-SPF sunscreens, certain toothpastes) may be subject to mixed criteria. ISO 9001 is a general quality management system that does not cover the specific technical requirements of the cosmetics sector; it can coexist with ISO 22716 as a corporate management layer. In cosmetics, ISO 22716 is the specific standard and the one required by Community legislation.
Can a small cosmetics company (fewer than ten employees) implement ISO 22716?
Yes, and in fact many micro-enterprises and artisan producers do so, especially in the natural and organic cosmetics segment. The standard is scalable: it does not require in-house analytical laboratories (analytical control can be subcontracted), nor large-scale industrial facilities. What it does require, without exception by size, is that every batch is documented, that personnel are trained and that critical processes have written instructions. Summum Calidad works with companies of all sizes and adapts the scope of the system to the operational reality of each one.
Do you have questions about whether your company falls within the scope of ISO 22716, or would you like to know what an implementation involves in your specific case? Contact us without obligation about our ISO 22716 implementation and certification service and we will explain the shortest path to the certificate.