GMP Gap Analysis
We audit your facilities, existing documentation and current processes against the requirements of ISO 22716. We deliver a gap report with criticality ratings, priorities and a realistic roadmap to certification.
Normas sectoriales
ISO 22716 · Good Manufacturing Practices for Cosmetics
Regulation (EC) 1223/2009 requires GMP compliance from every manufacturer placing cosmetics on the European market since July 2013. ISO 22716 is the harmonised standard that demonstrates this compliance to health authorities and major distributors.
Any company that manufactures, packs or stores cosmetic products for the European market is required by Article 8 of Regulation (EC) 1223/2009 to produce in accordance with Good Manufacturing Practices (GMP). ISO 22716:2007 is the harmonised standard recognised by the European Commission: compliance creates a legal presumption of conformity. Non-compliance exposes the responsible person — manufacturer, importer or brand owner — to health sanctions, product withdrawal and exclusion from tenders and organised distribution channels.
ISO 22716 governs four main areas: production (facilities, equipment, cleaning, personnel hygiene), control (raw materials, semi-finished and finished products, batch management and traceability), storage and dispatch (environmental conditions, quarantines, returns management) and quality system (documentation, internal audits, management of non-conformities and complaints). The standard applies equally to in-house laboratories, contract manufacturers and private-label companies, regardless of their size: there is no revenue or headcount threshold that exempts a business from compliance.
At Summum Calidad we guide cosmetic manufacturers and laboratories from the initial gap analysis through to the certification audit conducted by an accredited body (AENOR, Bureau Veritas, SGS, Intertek or others). With more than seventeen years of experience and close to two hundred ISO certifications accompanied across regulated sectors, our team is familiar with the requirements of AEMPS inspectors and the documentary requirements of the product information file (PIF). We do not certify: certification is always issued by an accredited third party; we prepare your company to pass it.
The ISO 22716 process.
The process · four stagesDocumentary System Design
We draft or adapt the mandatory procedures: raw material controls, manufacturing and cleaning records, batch management, non-conformities, internal audits and customer complaints — all aligned with your actual process, without unnecessary bureaucracy.
Implementation and Training
We support the team during roll-out: hands-on training for production and quality staff, review of initial documentary runs and adjustment of procedures until they work in daily operations.
Pre-audit and Certification Support
We conduct a simulated internal audit before the certification body's visit. We address the deviations found and accompany you during the certification audit to resolve technical queries in real time.
What is included
What ISO 22716 includes.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
-
Gap analysis
Detailed assessment of facilities, equipment, documentation and processes against every requirement of ISO 22716, with a priority report and effort estimate.
-
GMP Manual and standard operating procedures
Complete set of standard operating procedures (SOPs): production, cleaning, quality control, batch management, storage, returns and dispatch.
-
Raw material control system
Specification sheets, reception, quarantine and release procedures for raw materials and packaging materials.
-
Non-conformity, complaint and recall management
Procedures for opening, root-cause investigation, corrective actions and closure, including a batch recall protocol if required.
-
Internal audit programme
Annual planning, area-specific checklists, audit report and action tracking through to closure — ready to present to the certification body.
-
Support with the Product Information File (PIF)
We review the PIF section on the manufacturing method and the GMP declaration of conformity that the responsible person must keep available for ten years.
Summum cluster
How it connects with its sisters.
Cosmetic compliance rarely stops at GMP: when the project involves digital traceability or advanced document management, Summum Sistemas connects the ERP with GMP records; and if the company exports outside the EU with consumer data privacy requirements, Summum Consultoría covers GDPR.
calidad
Summum calidad
ISO 9001 provides the base quality management system on which ISO 22716 builds its cosmetic-specific GMP requirements: many companies implement both standards in parallel.
View service → calidadSummum calidad
Summum Calidad's outsourced internal audit service keeps the GMP audit programme active when the company has no qualified in-house auditor.
View service → consultoríaSummum consultoría
Cosmetic manufacturers that process consumer data for cosmetovigilance or loyalty programmes must comply with GDPR: Summum Consultoría manages that compliance layer.
View service →Frequently asked questions about ISO 22716.
Is ISO 22716 certification mandatory to sell cosmetics in Europe?
Complying with GMP is mandatory under Article 8 of Regulation (EC) 1223/2009. However, certification by an accredited third party is voluntary: the company may self-declare conformity. In practice, major distributors, pharmacy chains and private-label buyers require the certificate as a prerequisite for any order, making certification almost unavoidable to access those channels.
Does ISO 22716 apply to small laboratories or natural cosmetics packers?
Yes. The standard sets no size or production volume threshold. An artisan laboratory making soaps or creams for the European market is subject to the same GMP obligations as an industrial manufacturer. The standard's flexibility allows the level of documentation to be adapted to the actual complexity of the processes.
How long does it take to implement ISO 22716 from scratch?
For a company with between 5 and 50 employees and relatively straightforward manufacturing processes, the full journey — from gap analysis to passing the certification audit — typically takes 4 to 6 months. The timeline depends mainly on the starting maturity of existing documentation, the internal team's availability to validate procedures and the certification body's scheduling lead time.
What is the difference between complying with ISO 22716 and obtaining the certificate?
Complying with the standard means your processes and documentation meet the GMP requirements: that is the legal obligation. Certification means an accredited body (AENOR, Bureau Veritas, SGS, Intertek…) has audited that compliance and validated it with a formal certificate. The certificate is valid for three years with annual surveillance audits, and is the document that buyers and health authorities request to verify compliance objectively.
What happens if the AEMPS inspects and we have no GMP in place?
The Spanish Agency of Medicines and Medical Devices (AEMPS) may request the product information file, which must include a GMP declaration of conformity. If the manufacturer cannot demonstrate compliance, the authority may order product withdrawal from the market, impose financial penalties and open a disciplinary proceeding. Additionally, product liability insurance policies may not provide cover for claims if GMP compliance cannot be proven.