GMP for Cosmetics: The Complete Guide to ISO 22716 Compliance
Every cosmetics manufacturer in the EU must produce in a GMP-compliant manner — this is unambiguously required by the EU Cosmetics Regulation (EC) No 1223/2009. The recognised standard for this is ISO 22716. Nevertheless, many companies in the DACH region fail at the practical implementation: not because they lack the knowledge, but because documentation, processes and record-keeping obligations get lost in day-to-day business.
Small manufacturers, artisan producers and young brands in particular underestimate the documentation effort — and only notice it when a trade partner demands an audit or market surveillance is at the door. That is when it gets expensive and stressful.
This guide explains what ISO 22716 specifically requires of you, which documents really count in daily practice, where the typical pitfalls in audits lie and at what point spreadsheets and paper forms become a risk. With concrete practical examples from cosmetics manufacturing — not with abstract standard texts.
What GMP means for cosmetics — and why ISO 22716 is the benchmark
GMP stands for Good Manufacturing Practice — good manufacturing practice. In the cosmetics sector, ISO 22716 defines the internationally recognised GMP standard. The standard was first published in 2007 and has been listed as a harmonised standard in the Official Journal of the EU since 2013.
Article 8 of the EU Cosmetics Regulation requires cosmetic products to be manufactured in compliance with good manufacturing practice. The European Commission refers directly to ISO 22716 here. Anyone who complies with the standard enjoys a so-called presumption of conformity — the authority assumes that the GMP requirement is met.
Why this is relevant to you
GMP is not an option but a legal obligation for every cosmetics manufacturer in the EU — regardless of company size or product category. Market surveillance in Germany (BVL/regional authorities), Austria (BASG) and Switzerland (Swissmedic/cantonal chemists) inspects on the basis of ISO 22716.
Important: GMP means not just clean manufacturing but demonstrably documented manufacturing. The principle is: what is not documented is deemed not to have been done. This maxim runs through all 17 chapters of the standard.
ISO 22716 requirements: what the standard specifically requires
At around 30 pages, ISO 22716 is comparatively slim — especially compared with pharmaceutical GMP. It is deliberately formulated as a guide and allows a proportionate implementation. Nevertheless, it covers all areas of cosmetics manufacturing: from organisation through raw materials and production to complaints and recalls.
The 17 chapters of the standard at a glance
Scope
Applies to the manufacturing, control, storage and shipment of cosmetic products.
Terms
Definitions such as batch, bulk, finished product, deviation and CAPA.
Personnel
Qualification, training, hygiene and clear responsibilities.
Premises
Requirements for production, storage, QC laboratory and sanitary areas.
Equipment
Maintenance, calibration, cleaning and labelling of equipment.
Raw materials and packaging materials
Goods receipt, testing, release, storage and traceability.
Production
Manufacturing instructions, batch records, in-process controls.
Finished products
Testing, release, storage and shipment of finished products.
Quality control laboratory
Sampling, test methods, retained samples and results documentation.
Treatment of non-conforming products
Quarantine storage, decision procedures, reworking or destruction.
Waste
Disposal, prevention of contamination and cross-contamination.
Subcontractors
Requirements for contract manufacturers, contract laboratories and service providers.
Deviations
Recording, root cause analysis and corrective actions (CAPA).
Complaints and recalls
Complaint handling, decision procedures and recall plans.
Change control
Change control for formulations, processes and specifications.
Internal audit
Regular self-inspection and effectiveness review of the GMP system.
Documentation
Control, versioning, archiving and access control of all documents.
For the daily practice of most manufacturers, chapters 6 (raw materials), 7 (production), 13 (deviations) and 17 (documentation) are the most critical. This is where most audit findings arise.
GMP documentation for cosmetics: which documents really count in daily practice
Chapter 17 of ISO 22716 governs documentation — and it is the chapter that most frequently leads to findings in audits. Not because companies have no documents, but because they have the wrong ones, cannot find the right ones or the versioning is off.
At its core, ISO 22716 requires four levels of documentation:
SOPs (work instructions)
Versioned instructions for recurring activities: goods receipt, manufacturing, cleaning, deviation, recall.
Specifications
Requirement profiles for raw materials, packaging and finished products with test criteria and release limits.
Manufacturing instructions
Fixed master formulations per product with quantities, order, temperature, stirring times and process parameters.
Records
Batch-specific records: batch records, test records, releases, deviation reports.
The challenge is not creating these documents once. It lies in keeping them current, complete and traceable with every batch, every change and every deviation — over the course of years.
Practical tip
Clearly separate prescriptive documents (SOPs, manufacturing instructions) from evidence documents (batch records, test records). Prescriptive documents describe the target. Evidence documents record the actual. The two must match — and both must be findable.
Practical example: batch traceability for a natural cosmetics cream
A small natural cosmetics manufacturer in southern Germany produces a face cream in batches of 300 units. In the event of a customer complaint (discolouration), it must determine within 24 hours:
- Which raw material batches are in the affected product batch (forward traceability)
- In which other product batches the same raw material batch was used (backward traceability)
- Which customers were supplied (distribution)
Without end-to-end batch documentation with LOT numbers, this is not feasible. In its batch record, the target quantity, the actual quantity and the LOT number of the raw material must be recorded for every ingredient. Only in this way does the chain emerge: raw material LOT → product batch → delivery.
| Raw material (INCI) | Target | Actual | LOT no. | Supplier |
|---|---|---|---|---|
| Aqua | 750.00 g | 750.18 g | W-2026-0087 | In-house |
| Prunus Amygdalus Dulcis Oil | 120.00 g | 119.95 g | PAD-2026-0031 | Manske GmbH |
| Cetearyl Alcohol | 45.00 g | 45.12 g | CA-2025-0198 | BASF SE |
| Tocopherol | 3.00 g | 3.02 g | TOC-2026-0014 | DSM Nutritional |
In this case it turns out that the discolouration goes back to a Tocopherol raw material batch that was close to expiry. The LOT number in the batch record makes it possible to identify all other affected product batches within minutes. Without this documentation, the manufacturer would have to recall all batches from the last few months across the board — an avoidable economic loss.
Preparing for a cosmetics GMP audit: what inspectors really look for
A GMP audit can come from various directions: from the competent market surveillance authority (in Germany the regional authorities, coordinated by the BVL), from a trade partner, from a client (in the case of contract manufacturing) or as an internal audit within your own quality management system.
The inspection process almost always follows the same pattern: the auditor selects one or more batches and traces the documentation flow from start to finish. If the manufacturer can present complete documentation for every batch, half the audit is already passed.
The 7 most common pitfalls in cosmetics GMP audits
1. Missing LOT numbers in the batch record
The raw materials are weighed in, but the batch numbers of the raw materials are missing. Traceability is therefore impossible.
2. No documented release
Batch produced and shipped, but no release record with the signature of a qualified person on file. A breach of ISO 22716 chapter 8.
3. Outdated SOPs in circulation
The current cleaning instruction is version 4, but version 2 is still posted in production. No document control.
4. Open CAPAs without effectiveness review
The deviation was documented, the action defined — but never implemented or reviewed. The CAPA cycle remains open.
5. Target/actual deviations without assessment
In the batch record the actual quantity deviates from the target, but there is no assessment of whether the deviation is acceptable.
6. No training records
Employees operate equipment and carry out processes without any documented training on file. A breach of chapter 3.
7. Unstructured archiving
Documents exist, but nobody can find them. Batch record for a 2024 batch? Somewhere in a folder. Or on the computer of a former employee.
Tip from practice: Do a self-test before every audit. Pick any product batch and try to present the complete batch record, all raw material LOTs, the test records and the release within 15 minutes. If you cannot manage that, your system is not audit-ready.
Practical example: from Excel chaos to an auditable batch record
A contract manufacturer in Austria has documented its production in Excel for years. For every batch there is an Excel file with raw materials, quantities and batch designation. The problem becomes apparent during a customer audit by a large retail group:
- No change history: The auditor asks whether the batch record was changed afterwards. In Excel there is no audit trail — the question cannot be answered.
- No access protection: Every employee can open and change any file. There is no access control and no permissions.
- Formula errors: In 3 of 20 batch records checked, the sum of the actual quantities does not match the total weight. The reason: overwritten formulas.
- Archiving gaps: Some batch records from 2022 can no longer be found — the hard drive of the former employee was formatted.
The auditor identifies four deviations, two of them as “major”. The contract manufacturer is given a 90-day deadline for corrective action. The result: a switch to a structured system with automatic batch number assignment, target/actual recording and PDF export. The follow-up audit three months later passes without any findings.
Digital GMP documentation: when the switch makes sense
Paper and Excel work with a low batch frequency and few products. But they do not scale. Beyond a certain point — typically when you regularly produce more than 5–10 batches per month — the manual effort exceeds the benefit.
Where Excel and paper reach their limits
No audit trail
Who changed what and when? Not traceable in Excel. Yet ISO 22716 chapter 17 requires exactly that.
No access control
Anyone can open and change everything. Data integrity is not guaranteed.
Error-prone calculations
Overwritten formulas, incorrect cell references, manual typing errors. Particularly critical for target/actual comparisons.
No linking
Raw material LOT numbers in one file, batch records in another, test results in a third. Traceability only with considerable effort.
Archiving risk
Files are deleted, hard drives fail, folders disappear. 10 years of secure archiving is barely achievable with local files.
No PDF exports
Authorities and trade partners expect clean, tamper-proof documents. Excel printouts rarely meet this requirement.
A structured digital system does not solve these problems automatically — but it provides the foundation: central data storage, end-to-end linking from raw material to finished product, versioned exports and controlled access.
It does not have to be an enterprise system straight away. For small and medium-sized cosmetics manufacturers there are specialised solutions tailored to the needs of the industry — without the complexity (and the cost) of large quality management systems.
GMP-compliant batch records — without the complexity
INCIkit creates batch records with target/actual comparison, batch traceability and PDF export. Specifically for cosmetics manufacturers in the DACH region.
Checklist: ISO 22716 compliance at a glance
Use this checklist as a quick reference for your GMP conformity check. It does not replace an internal audit, but gives you a quick overview of the critical points.
GMP checklist under ISO 22716 (as of 2026)
Organisation & personnel
- Organisation chart with responsibilities current and approved
- Training records available for all production staff
- Hygiene instructions documented and trained
Documentation & SOPs
- SOPs versioned, approved and given an effective date
- Manufacturing instructions (master instructions) available per product
- Document control procedure: distribution, withdrawal of old versions
- Archiving concept documented for at least 10 years
Production & batches
- Batch records complete: target/actual quantities, LOT numbers, process parameters
- Batch numbers assigned uniquely and without gaps
- In-process controls documented (pH, viscosity, appearance, odour)
- Batch release by a qualified person with signature and date
Traceability & quality
- Forward traceability: raw material LOT → product batch possible
- Backward traceability: product batch → all raw material LOTs possible
- Deviations recorded systematically with the CAPA cycle closed
- Recall procedure documented and simulated at least once
- Complaint procedure with root cause analysis in place
You will find a printable version of this checklist as a free GMP template in our templates section.
Conclusion: GMP is not a project but a system
ISO 22716 is not a document you work through once and then tick off. GMP is an ongoing system: every batch, every change, every deviation creates documentation obligations. Anyone who internalises this and creates the right structures is prepared for any audit.
Most problems in audits do not arise from a lack of expertise. They arise from a lack of structure — from lost documents, from systems without a change history, from processes without record-keeping.
The most important takeaways:
- GMP under ISO 22716 is effectively mandatory for all EU cosmetics manufacturers
- Documentation is the foundation: batch records, SOPs, releases, CAPAs
- Traceability must work in both directions — forwards and backwards
- Excel and paper do not scale and offer no audit trail
- Switching to a structured system pays off at the first audit
FAQ: Frequently asked questions about GMP for cosmetics and ISO 22716
Is ISO 22716 legally mandatory for cosmetics manufacturers?
ISO 22716 is formally a voluntary standard, not a legal statute. However, Article 8 of the EU Cosmetics Regulation (EC) No 1223/2009 refers to GMP-compliant manufacturing. The European Commission has recognised ISO 22716 as a harmonised standard. Anyone who complies with the standard meets the regulation's GMP requirement. In practice it is therefore effectively mandatory for every manufacturer in the EU.
What is the difference between GMP under ISO 22716 and pharmaceutical GMP?
ISO 22716 is aimed specifically at cosmetics manufacturing and is less extensive than pharmaceutical GMP (EU GMP Guide, Annex 1 ff.). There is no cleanroom-class requirement, no validation obligation in the pharmaceutical sense and no official manufacturing authorisation. Nevertheless, both systems share the core principles: documentation, traceability, deviation management and release processes.
How long must GMP documents be retained under ISO 22716?
Article 11 of the EU Cosmetics Regulation requires product documentation to be retained for at least 10 years after the last batch is placed on the market. This covers batch records, test records, release decisions and deviation documentation. Many companies archive for 10 years plus the minimum durability period to be on the safe side.
As a small manufacturer, do I need the same GMP system as a large corporation?
No, but the core elements are identical. ISO 22716 explicitly allows a proportionate implementation — a one-person operation does not need a 200-page quality manual. However, batch records with target/actual documentation, raw material traceability, documented releases and a deviation procedure are non-negotiable, regardless of company size.
What happens if I fail a GMP audit?
The consequences range from conditions with a deadline for corrective action, through production stoppages, to recalls and fines. In the case of serious deficiencies, the competent market surveillance authority can impose a ban on placing the product on the market. In addition, many trade partners and clients lose trust when an audit is failed — for contract manufacturers this can be existentially threatening.
How do I prepare for a GMP audit?
Begin an internal review at least 4 weeks before the audit: Are all batch records complete? Are there open CAPAs? Are SOPs current and versioned? Make sure you can present the complete documentation for any given batch within minutes. Check traceability on a spot-check basis: take a raw material batch and trace it forward to the finished product.
Further resources
Creating a PIF — practical guide
The Product Information File documents GMP conformity — here is how to create a complete PIF.
CPNP notification step by step
After the PIF and GMP comes the notification — here is how to register your product correctly in the EU portal.
Free GMP templates
Batch record, batch log, GMP checklist and PIF structure as a download.
Want to document your cosmetics with full compliance?
INCIkit builds PIF, INCI list and batch records from your formula data — ready for the authority check.
INCIkit Editorial
Cosmetics Compliance Desk
More articles
Starting a Home-Based Cosmetics Business: Step-by-Step Guide
Want to sell cosmetics from home? This guide explains business registration, choosing a structure, GMP requirements, insurance and taxes – written for small home producers across the EU.
Making and Selling Soap: Everything You Need to Know
Want to sell your homemade soap? This guide explains all the rules, from the EU Cosmetics Regulation through the safety assessment and INCI list to the CPNP notification. With a practical example and cost table.
Selling Homemade Cosmetics Legally: The Complete Beginner's Guide
Want to sell your handmade cosmetics? This guide explains the 5 steps from business registration through the safety assessment to the CPNP notification — with concrete costs, real-world examples and a checklist.