ISO 22716 vs GMPC Certification: What a Buyer’s Auditor Actually Checks

Buyers who raise the ISO 22716 vs GMPC certification question usually want a one-line answer about which logo looks better in a quotation pack. The honest answer is that they are not the same kind of document: ISO 22716:2007 is a numbered international standard with a fixed clause list, while GMPC is a scheme name that different certification bodies fill with different reference documents. Neither one is a license to manufacture anything. What a compliance team actually reads is the scope statement, the accreditation mark and the audit history behind the certificate, and this piece walks through all three, plus the five checks I run before I quote a new brand.

ISO 22716 vs GMPC Certification: One Is a Standard, the Other Is a Scheme Name

ISO 22716 was published in 2007 by ISO/TC 217, the technical committee for cosmetics, under the title Cosmetics — Good Manufacturing Practices (GMP) — Guidelines on Good Manufacturing Practices. It is structured as 17 sections running from personnel in clause 4 through premises, equipment, raw and packaging materials, production, finished product, quality control, waste, subcontracting, deviations, complaints and recalls, change control and internal audits, ending with documentation in clause 17. There is no product specification anywhere in it. The standard describes how a plant should be organized so that the same batch can be made twice and traced backwards six months later.

GMPC has no ISO number and no single owner. When a plant sends a “GMPC” certificate, it is usually one of two documents: a US-flavored scheme that adapts 21 CFR 210/211, the pharmaceutical GMP rules, to cosmetic processes; or an EU-flavored scheme that cites Regulation (EC) 1223/2009 and, underneath that, ISO 22716 itself. Some plants hold both, issued by two different bodies, with two letterheads and two scopes. That is why the ISO 22716 vs GMPC certification comparison trips up procurement teams: one side of the comparison is a standard, the other is a family of schemes with a shared nickname.

One detail is worth knowing before you read any GMPC document. The US FDA does not issue GMP certificates for cosmetics and does not endorse a “GMPC” paper. Since MoCRA in December 2022 the agency has had authority to set cosmetic GMP rules and to require facility registration, but registration produces an acknowledgement, not a certificate. A US-facing GMPC certificate is therefore a third-party audit attestation. That is still worth money. It is just not a government document, and no importer should file it as one.

What the ISO 22716 Certificate Covers — and the Four Things It Does Not

An ISO 22716 certificate answers a narrow question: on the days the auditors were on site, did this plant’s documentation system hold up against the clauses. It does not answer four other questions, and each of them has burned a brand I know.

Site, not company

The certificate names one legal entity at one address. If the annex lists Building A on the industrial park road and your 30 ml airless pump batch was emulsified and filled in Building C — a normal setup once a plant outgrows its first hall — then the certificate does not cover your goods. The check takes thirty seconds: the address on the certificate has to match the address printed on the batch record and on the manufacturing license. When it does not, you are buying from a plant whose GMP evidence belongs to its neighbor. The plant page for any serious factory should show which building fills which format, because buyers ask this exact question on the first call.

Scope wording

Scope sentences are written by the certification body and they are deliberately literal. “Manufacture of cosmetic emulsions and liquids” covers a serum. “Filling and packing of cosmetics” covers a converter that buys bulk elsewhere — legal, common, and awkward for your Product Information File, because the EU Responsible Person then has to name the bulk manufacturer as a separate entity. Read the scope for the dosage forms you actually order: aqueous, emulsion, gel, anhydrous oil. A scope that stops at emulsions does not cover the anhydrous 20% THD oil serum sitting in the same catalog as the retinol platform.

Subcontracting

ISO 22716 clause 12 permits subcontracting but requires a written agreement and evidence that the subcontractor works to the same standard. In practice most plants emulsify and fill in-house and outsource something smaller: label printing, carton assembly, shrink wrapping, occasionally secondary packing in a rented hall. All of that is fine when it is declared. Undeclared subcontracting is the finding I see most often in buyer-run second-party audits, and it is the reason a plant with a clean certificate can still fail your own visit in an afternoon.

Validity and surveillance

Certificates run on a three-year cycle with a surveillance audit every twelve months. A PDF that expired last spring and is “in renewal” is not a valid certificate, and a renewed certificate normally carries a new number and a new issue date. Check the certification body’s public registry rather than the PDF. The PDF is a picture; the registry entry is a record.

None of this makes the certificate worthless. It makes it an instrument with a specific resolution. The ISO 22716 vs GMPC certification question only becomes useful once both documents are read at that resolution.

Reading a GMPC Certificate: The Three Lines That Decide It

Before comparing schemes, decide what the certificate has to survive. Three or four lines on the document carry almost all of the weight.

Line on the certificate	What a defensible answer looks like	What it means when it is missing
Accreditation mark	CNAS, UKAS, DAkkS or ANAB mark with an accreditation scope that names cosmetics	The body audited against its own checklist; a retailer’s compliance team will file it as marketing
Reference document	ISO 22716:2007, or 21 CFR 210/211 adapted for cosmetics, stated by revision	A scheme name with no reference document cannot be audited against anything specific
Scope and site	One address, one legal entity, the dosage forms you actually buy	A group certificate covering five plants says nothing about the one filling your batch
Audit type and date	Initial certification or surveillance within 12 months, plus a traceable certificate number	A desktop review is a document check, not a plant visit

I have turned down two suppliers on the third line alone. Both had valid group certificates and neither could produce the certificate for the building where the filling line stood — one of them was filling in a hall that appeared on the group certificate as a warehouse.

The Ten-Minute Check I Run Before Quoting a New Brand

The whole ISO 22716 vs GMPC certification question collapses into five steps once you stop reading cover pages. I run this before I send a unit price, and buyers can run it on us.

1. Registry lookup, two minutes. Take the certificate number and the body name into the national accreditation registry — CNAS for a Chinese plant, UKAS, DAkkS or ANAB elsewhere. No entry means no certified audit.
2. Address match, one minute. Certificate address against the batch record address against the manufacturing license address. Three documents, one address, or the conversation is over.
3. Scope match, one minute. Find your dosage form in the scope sentence. Aqueous, emulsion, gel, anhydrous. If your product is not named, the certificate is not about your product.
4. Surveillance date, thirty seconds. Within the last twelve months, with the previous cycle closed.
5. Two live documents, five minutes. Ask for the latest internal audit summary — ISO 22716 clause 16 — and the deviation or CAPA log for the past six months, which is clause 13 in daily operation.

Step five is the only one that tells you anything about the other 362 days of the year. A QA manager who opens a folder and reads out three entries — a pH drift on a niacinamide batch, a fill-weight excursion on a 30 ml airless line, a conductivity alarm on the water loop — is running a plant that records its problems. A plant that reports zero deviations across forty batches in a year is either unusually lucky or not logging, and the second case is worse than the deviation. The quality and certification page is where that log belongs, not in a sales deck.

Where Neither Certificate Is Enough: Five Markets, Five Different Papers

A certificate that satisfies one market is often the wrong paper for the next, and the gap shows up at customs rather than at quoting. That is where the ISO 22716 vs GMPC certification discussion stops being theoretical.

• EU. Regulation (EC) 1223/2009 Article 8 requires GMP and gives presumption of conformity to the harmonised standard, which is ISO 22716. The CPNP notification carries the product label and the Responsible Person’s details, not the certificate. The certificate lives in the Product Information File, where Annex I expects a statement of GMP compliance. That is why the export documentation checklist puts the GMP statement next to the CoA rather than next to the label artwork.
• UK. SCPN filing plus a UK Responsible Person, and the same GMP evidence. Some UK retailers go further and insist on a UKAS-accredited certificate; an ISO 22716 certificate from an unaccredited body gets questioned in exactly that channel.
• Gulf. Saudi and UAE registration attach the manufacturer’s GMP certificate, and the importer will usually want it legalized by the embassy before the LC opens — 10 to 20 working days and roughly USD 150 to 400 per document set, paid before you ship.
• ASEAN. Indonesia’s BPOM works off CPKB, the national GMP scheme. A foreign ISO 22716 certificate supports the registration file but does not replace the local manufacturer’s obligations.
• US. There is no government GMP certificate for cosmetics. MoCRA facility registration and product listing are submissions; the paper that decides your shelf space is the retailer’s own supplier audit, which is stricter than most certification bodies.

And then the paper buyers forget: on the manufacturing side, the mandatory document in China is the cosmetics production license, 化妆品生产许可证, issued per category. A license covering the aqueous liquid unit with skin toner listed permits essences and toners; it does not permit a cream without the cream and emulsion unit. A factory can hold a handsome ISO 22716 certificate and a license that excludes your dosage form, and then it cannot legally make your product. Buyers who treat a certificate as proof of legality find that gap at the port, not at the quoting stage.

What Holding Both Certificates Costs — and Why It Barely Moves Your Unit Price

Cost questions around the ISO 22716 vs GMPC certification usually run the wrong way: buyers assume the certificate is a line in the unit price and negotiate against it. It is a line, but a small one, and the number that actually moves is the system behind it.

An initial ISO 22716 audit for a mid-size plant runs three to five auditor-days plus the preparation that nobody invoices: rewriting SOPs, training operators to answer questions in their own words, closing the findings. All-in, USD 6,000 to 12,000. Surveillance in years two and three costs 40 to 60% of that, and year three adds recertification. A second GMPC certificate from a different body adds USD 3,000 to 6,000 because a US buyer asked for the word on the paper.

Spread across three years of output — 30 SKUs a year at 1,000 pcs per SKU, so 90,000 units — that is around USD 0.20 a unit. The certificate is not what makes a serum expensive.

What costs money is the system the certificate audits. Batch records of 8 to 12 pages per batch with three signature checkpoints. A 12-week stability study per formula at 40°C and 75% relative humidity plus a freeze-thaw cycle before you commit to a shelf life claim. Retention samples held for the shelf life plus 12 months. A purified water loop at 5 µS/cm and 100 CFU/ml sampled at three points weekly. Environmental monitoring in the filling room, where ISO 8 at rest allows 3,520,000 particles of 0.5 µm and larger per cubic meter and our internal settle-plate alert limit is 50 CFU per four-hour exposure. Micro testing to ISO 17516 category 2 limits, which means TAMC of 1,000 CFU/g or below, TYMC of 100 CFU/g or below, and absence of Staphylococcus aureus, Pseudomonas aeruginosa and Candida albicans in one gram.

That bill arrives whether or not a buyer asks for it. A plant running the system charges for the system; a plant holding a certificate without the system is selling a photograph of one. Which of the two you are buying is decided by step five of the ten-minute check, not by the logo. It is also why a 0.3% encapsulated retinol starter with a full stability file costs more per unit than a 1.0% free retinol formula with none — the encapsulation is the cheap part, the file is the expensive one.

FAQ

Do I need ISO 22716 if I sell in the EU?

The regulation requires GMP, not a specific certificate. ISO 22716 gives presumption of conformity, so most EU Responsible Persons accept it without argument. The ISO 22716 vs GMPC certification question normally ends at that point: a GMPC certificate whose reference document is ISO 22716 is defensible, but your RP will ask for the scope and the accreditation mark, and you will lose a week to email either way.

How do I tell a real certificate from a template?

Look for a certificate number and a body name you can find in a national accreditation registry, then compare the address on the certificate with the address on a batch record. A template fails both tests; a real certificate survives both. If the supplier sends a scan where the number is cropped out, ask again — the crop is usually not an accident.

Do I need both certificates on a 1,000 pcs order?

No. For a first order, ask for ISO 22716, the production license, a CoA for the batch you are buying and an MSDS. GMPC becomes relevant when a specific market, importer or retailer asks for it by name, and at that point you should ask which reference document their compliance team expects. Our OEM and ODM service page lists what ships with a first order, and the formula library shows which of the 24 formulas already carry a 12-week stability file.

—

Send us your brief with your target markets and we will return the certificate pack for the right scope — ISO 22716, GMPC, COA and MSDS — plus a formula and a unit price within 48 hours. 1,000 pcs MOQ per SKU, samples in 7 days, bulk in 35 days.