GMP for Cosmetics: Pass Audits & Stop Contamination

Quick Answer

GMP for cosmetics is defined internationally by ISO 22716, the standard covering personnel, premises, equipment, raw materials, production, quality control, documentation, and audits. 

The European Union and the United Kingdom make GMP a legal requirement, while the United States has not yet finalised its rule, since the FDA moved the proposed cosmetic GMP regulation to its long-term actions list after missing the December 2024 statutory deadline. 

Implementing ISO 22716 now is the practical route, because the FDA has signalled it will reference that standard and existing adulteration provisions remain fully enforceable regardless.

Introduction

Most formulators meet GMP for cosmetics as a phrase on a supplier questionnaire and assume it means a sterile facility they cannot afford. That assumption stops small manufacturers from starting, and it is wrong.

Good manufacturing practice is a system of controls and records that proves a product was made the way you say it was. Buildings matter far less than documentation and discipline.

I have audited small production rooms with better traceability than large facilities. The difference was never the equipment budget; it was whether anyone could reconstruct a batch from paper a year after it shipped.

By the end of this guide, you will understand what ISO 22716 requires, how the US and EU positions differ, and how to implement GMP in a small cosmetic business without pretending you run a pharmaceutical plant.

What GMP for Cosmetics Actually Means?

Good manufacturing practice is a quality system covering how a product is made, processed, packed, and held. Its purpose is consistency, since a formula that is safe once must be safe in every batch.

ISO 22716 is the international GMP standard written specifically for cosmetics. It was designed as guidance for the whole supply chain, from raw material receipt to finished product release.

The standard organises requirements into clear chapters. Personnel, premises, equipment, raw and packaging materials, production, finished products, the quality control laboratory, out-of-specification handling, waste, subcontracting, deviations, complaints and recalls, change control, internal audits, and documentation each get their own section.

Nothing in that list demands pharmaceutical infrastructure. What it demands is that decisions are controlled and recorded.

ISO 22716 Versus FDA GMP

The most common question from brands selling internationally concerns how the standards compare. The table below sets out the current position in each market.

MoCRA directed the FDA to issue a proposed GMP rule by 29 December 2024 and a final rule a year later. Both deadlines passed, and the proposed rule has since moved to the agency’s long-term actions list, meaning no proposal is expected within the next twelve months.

That delay creates no safe harbour. Inspections continue under existing adulteration provisions, FDA references ISO 22716 in its draft guidance, and any future rule will be tighter rather than looser.

Small businesses in the US receive a statutory GMP exemption, generally where average annual cosmetic sales fall under roughly one million dollars. It does not extend to products contacting the eye’s mucous membrane, injected products, internal-use products, or those altering appearance for more than 24 hours without consumer removal.

Documentation: The Foundation

GMP documentation for cosmetics is the whole system rather than a supporting file. An auditor cannot see how you worked last March, so records are the only evidence that controls existed.

Three document types carry most of the weight. Standard operating procedures describe how a task is performed, specifications define what is acceptable, and records capture what actually happened.

Write procedures for what you genuinely do rather than an aspirational version. A procedure nobody follows is worse than none, since it proves noncompliance in writing.

Version control matters as much as content. Every document needs an author, an approval, a date, and a revision history, so anyone can identify which version was applied on a given day.

Batch Records

GMP batch records are where traceability lives. Each production run needs a record allowing you to reconstruct exactly what was made, from which materials, by whom, and with what result.

A complete batch record captures the following:

• A unique batch number and the date of manufacture
• Every raw material with the supplier, lot number, and quantity used
• Equipment used and cleaning confirmation before start
• Actual process parameters, including temperatures, times, and mixing speeds
• In-process checks, such as pH and viscosity, with the operator’s initials
• Yield reconciliation and any deviations recorded honestly
• Packaging materials, lot numbers, and final release signature

Record the actual values, not the target values. Writing the intended temperature rather than the observed one destroys the entire purpose of the document.

Retain batch records for the product’s full shelf life plus a margin. If a complaint arrives two years later, that record is your only defence and your only diagnostic tool.

Premises, Equipment, and the Cleanroom Question

GMP cleanroom requirements for cosmetics are widely misunderstood. ISO 22716 does not mandate a classified cleanroom of the kind pharmaceutical manufacturing uses.

What the standard requires is premises designed for the work: surfaces that can be cleaned, adequate separation of activities, controlled access, pest control, and air and water quality appropriate to the products made. A small clean room with hard surfaces and disciplined hygiene can satisfy this fully.

Water deserves particular attention. Water-containing cosmetics need water of defined microbiological quality, and an untested tap supply is one of the most common contamination routes in small operations.

Equipment must be suitable, cleanable, and maintained, with cleaning validated rather than assumed. Document the cleaning method and prove it removes residues, since carryover between batches is a genuine safety risk.

Quality Control and Testing

GMP quality control for cosmetics rests on defined specifications and verified conformance. You cannot release a batch against a standard you never wrote down.

Incoming raw materials need acceptance criteria and supplier certificates, checked rather than filed unread. Finished products need release testing against specification, typically covering appearance, odour, pH, viscosity, and microbiological quality.

Retention samples close the loop. Keep a sealed sample of every batch for its shelf life, since it becomes the reference point when a customer complaint arrives.

Preservation efficacy and stability data support the specification rather than replacing routine testing. Both feed the safety assessment that the EU and UK require before any sale, a linkage Formula Chemistry emphasises when brands treat testing as a launch formality.

Training and Competence

GMP training for cosmetics is a requirement, not a courtesy. ISO 22716 expects personnel performing production, control, and cleaning tasks to be trained and for that training to be recorded.

Training records should name the person, the topic, the date, and who delivered it. Competence assessment matters more than attendance, so confirm the person can perform the task correctly rather than that they sat through a session.

Hygiene training carries outsized weight in cosmetics. Handwashing, protective clothing, illness reporting, and behaviour in production areas prevent the contamination that laboratory testing only detects afterwards.

Retrain when procedures change. An updated procedure with untrained staff is a deviation waiting to be written.

Internal Audits and Continuous Improvement

A GMP audit for cosmetics tests whether your system works in practice rather than on paper. Internal audits are an explicit ISO 22716 requirement and the cheapest way to find problems before a regulator or retail customer does.

Audit against your own procedures first. Pick a recent batch, trace it from raw material receipt to dispatch, and see whether the paperwork supports every step.

Findings need corrective and preventive action, with a root cause rather than a restated symptom. Recording that an operator forgot is not a root cause, whereas an unclear procedure or absent training is.

External audits arrive whether you invite them or not. Retailers, contract clients, and regulators all request evidence, and a facility that audits itself quarterly is never caught unprepared.

How to Implement GMP in a Small Cosmetic Business

Small manufacturers can implement GMP incrementally without stopping production. Work in this order, since each step supports the next.

1. Read ISO 22716 and map its chapters against what you already do.
2. Write procedures for the tasks you perform most often, starting with cleaning and production.
3. Build a batch record template and use it for every run from today.
4. Define specifications for raw materials and finished products.
5. Establish supplier approval and incoming material checks.
6. Set up training records and retention samples.
7. Run an internal audit, log the findings, and correct them.

Start with documentation rather than construction. Records cost time instead of capital, and they deliver most of the compliance benefit immediately.

Scale controls to genuine risk. A single anhydrous balm needs less environmental control than a water-based emulsion, and GMP explicitly allows risk-based judgement.

Budget for water testing and microbiological analysis before you budget for equipment upgrades. Contamination ends brands, whereas an older mixer merely slows them.

Common GMP Mistakes

Small manufacturers fail GMP in recognisable ways, and each mistake below has a direct fix. Correcting them costs far less than a recall.

The first mistake is treating GMP as a building specification. Founders assume they need a cleanroom, so start with documentation and hygiene discipline, which deliver most of the benefit.

Writing aspirational procedures is a second error. They describe an ideal nobody follows, so document your actual process and improve it deliberately.

Recording target values instead of actual values is a third mistake. It feels tidy, yet it voids the batch record entirely, so write down what genuinely happened, including deviations.

Assuming the US GMP delay removes obligations is a fourth error. Adulteration provisions and inspections continue regardless, so operate to ISO 22716 now rather than waiting for a rule.

Skipping water quality controls is a fifth mistake. Untested water contaminates water-based products invisibly, so test and control it before scaling any emulsion.

The sixth error is treating internal audits as optional. They are an explicit requirement and your cheapest early warning, so schedule them and act on every finding.

Which Approach Fits You

A US small business under the sales threshold is currently exempt from the forthcoming GMP rule, but not from safety substantiation or adulteration provisions. Implementing ISO 22716 voluntarily gives you inspection readiness and retailer credibility ahead of any final rule.

Anyone selling into the EU or UK must comply with GMP already, since it is a legal requirement rather than a recommendation. ISO 22716 is the accepted route to demonstrate that compliance.

Brands using a contract manufacturer inherit their partner’s GMP posture. Audit that facility rather than assuming certification, because a certificate on the wall is not evidence of current practice.

Whatever your scale, build the record system first and improve the premises second. To start this week, create a batch record template and use it for your very next production run.

Frequently Asked Questions

Key Takeaways

GMP for cosmetics is a documented system of controls rather than an expensive building, and ISO 22716 is the standard that defines it. Records, traceable batches, and trained personnel deliver more compliance value than any equipment upgrade.

The EU and UK already require GMP by law, while the US rule remains unpublished after FDA moved it to long-term actions. That delay changes nothing practical, since adulteration provisions stay enforceable and any future rule will reference ISO 22716.

Implement incrementally and scale controls to real risk. To begin today, build a batch record template capturing actual values, use it on your next production run, and trace that batch end-to-end to see where your system breaks.

• Olivem 1000 vs Polawax: Which Emulsifier Wins?
• GMP for Cosmetics: Pass Audits & Stop Contamination
• Private Label vs Custom Formulation: Stop R&D Capital Waste
• Fix: Scaling DIY Formulas to Commercial Production
• How to Start an Indie Beauty Brand: Complete Guide