Last Updated on May 29, 2026 by Hafsa J.

How to Implement ISO 22716 in Your Cosmetics Operation

A brand I came across had everything the textbook says you need. A beautifully formulated product line, a complete safety file, a Responsible Person properly named. The EU launch stalled anyway. Not because of the formula, not because of the paperwork the brand controlled, but because the contract manufacturer making the product could not demonstrate GMP compliance to the standard the market expected. Everything the brand owned was in order. The thing it did not own, the factory, was where the implementation actually lived, and that is where it fell apart.

That is the gap between reading about ISO 22716 and implementing it. The standard itself is not mysterious. It lays out ten areas of good manufacturing practice in plain language, and you can read the whole thing in an afternoon. Implementation does not fail on understanding. It fails on execution, and most often it fails in the part of the operation the brand owner can see least clearly. This article is about doing it properly, in the right order, with the traps named before you hit them.

Before you start: the gap assessment that defines the whole project

Every successful ISO 22716 implementation I have seen started with the same unglamorous step, and every failed one skipped it. Before you write a single procedure, you assess the gap between what you do now and what the standard asks for, chapter by chapter.

This is not a formality. The gap assessment is the project plan. You take each of the ten areas the standard covers and ask one honest question of each: what do we actually do here today, and what does the standard require? The distance between those two answers, written down area by area, is your implementation roadmap. Nothing more elaborate is needed at the start, and nothing less will do.

The mistake I see most often is brands treating the gap assessment as a box to tick, racing through it to get to the real work of writing documents. That gets the order backwards. A documentation push that is not grounded in a real, honest gap assessment produces a binder full of procedures that describe a factory you wish you had, not the one you operate. Auditors see through that immediately, and so does a contamination event.

There is a second reason the gap assessment matters more for cosmetics than people expect, and it sits underneath the whole rest of this article: a large share of the gap is usually not in your building at all. It is in your supplier’s. But before we get there, here is the full map of what the standard actually asks of you.

What each chapter asks you to do, in practice

The cards above are the quick map. Here is the longer answer, because the difference between knowing a chapter exists and implementing it is all in the detail. For each area, the question is the same: not what is this chapter, but what do we actually do here, and can we prove it.

Personnel. Write job descriptions that match what people really do, record their training, and set hygiene rules the floor can follow under real conditions. The work is not writing the rules; it is building the habit and re-checking it, because hygiene discipline decays the moment supervision relaxes.

Premises. Lay out the space so material flows one way, from raw goods to finished product, without crossing paths that invite contamination or mix-ups. Surfaces have to be cleanable, and the cleaning has to be scheduled and logged, not done from memory. An auditor walks the flow; if it makes sense on foot, it usually makes sense on paper.

Equipment. Everything that touches product must be suitable, cleanable, and on a calibration and maintenance schedule. The trap is reactive maintenance: fixing equipment when it breaks rather than maintaining it on a calendar. A current, forward-looking maintenance log is the evidence; a reconstructed one after a problem is not.

Raw and packaging materials. Inspect, identify, and approve every input before it enters production, buy only from qualified suppliers, and keep it traceable by batch. When something goes wrong downstream, this is what lets you trace it back to the lot and the supplier rather than guessing.

Production. Make each batch to a defined process and document it as it happens, not afterward. In-process checks catch a deviation while you can still act on it. The deliverable is a batch record complete enough that someone who was not there could reconstruct exactly how that batch was made.

Finished products. Release against defined acceptance criteria, and hold anything that does not meet them. The release decision needs a name and a date behind it. A batch that ships on assumption rather than on a documented release is a gap waiting to be found.

Quality control laboratory. This is where the most expensive failures hide. Testing has to confirm the product is what it claims, and crucially, that it stays safe across its shelf life, not just on the day it leaves the line. Release testing alone is a snapshot; the lab chapter is where you prove the product holds over time.

Out-of-specification product. Define the route for product that fails: quarantine it, investigate, decide, then dispose or rework. The single rule that matters is that nothing failing ever quietly re-enters the flow. Most contamination scandals trace back to a failed batch that was not properly contained.

Waste, returns, and subcontracting. Handle waste so it cannot contaminate, assess returns before any decision about them, and, most importantly for brand owners, hold subcontracted manufacturing to equivalent GMP under written contract. This is the chapter that decides whether your quality system stops at your own door, and it gets its own section below.

Deviations, complaints, and internal audits. Build a documented way to handle the unexpected: deviations recorded and investigated, complaints logged and analysed for patterns, a recall plan that has actually been tested, and regular internal audits against the standard. This is the chapter that makes the whole system self-correcting, the one that finds your gaps before an inspector does.

Read those as ten questions rather than ten topics. Implementation is having a defensible answer to each, and the gap assessment is simply the exercise of asking all ten honestly, in your own operation, before anyone asks them for you.

Which chapters actually trip people up

You have the full map. Now the honest part: some of those chapters are easy to write and hard to live, and knowing which is which before you start saves months. The heatmap below frames how binding GMP expectations actually are across the markets you might sell into, which shapes how far you need to push each area.

With that market picture in mind, here is where the real difficulty sits, based on my experience walking manufacturers through this. Personnel and hygiene looks like the simplest chapter and is one of the hardest to sustain: writing the procedure takes an afternoon, getting every person on the floor to follow it on a Friday at the end of a long shift is a culture problem, not a documentation one.

The quality control laboratory chapter is where the most expensive failures hide. A manufacturer that tests at release and stops there has a documented QC process and an undocumented risk, which is exactly the gap that turned into a public recall for at least one premium brand I have written about separately. And production controls trip people up through drift: procedures written correctly, then quietly eroded by a shortened step or a skipped cleaning validation. These slow erosions are the most common non-compliances I see.

The blind spot nobody plans for: implementing GMP you don’t control

Here is the situation most ISO 22716 guides quietly assume away: that you own the factory. A large share of cosmetics brands do not. They formulate, they brand, they market, and they hand the actual manufacturing to a contract manufacturer, often in another country. And the moment they do that, implementation stops being something they can do entirely inside their own walls.

You can run a flawless gap assessment, write excellent procedures, train your own team perfectly, and still fail your implementation, because the chapters that matter most are being executed by a company you do not manage. Your name is on the product. Their hygiene practices are your compliance. The standard does not let you outsource the responsibility along with the manufacturing.

ISO 22716 is explicit about this, in the chapter on subcontracting that first-time implementers skim. Where manufacturing or testing is outsourced, the party responsible for the finished product has to ensure the contractor meets equivalent GMP standards. Not hope they do. Ensure it. In practice that means three things most brands do not have in place:

• A written contract that defines exactly which GMP responsibilities sit with whom.
• A documented right to audit the contractor against the standard.
• Evidence, not assurance, that they actually comply.

The regulatory stakes differ sharply by market. In the EU, Article 8 of the Cosmetics Regulation makes compliance with ISO 22716 a presumption of conformity with the legal GMP requirement, the highest legal weight the standard carries anywhere. The matrix below lays out how that status varies across the four major markets.

This is also where the Responsible Person role stops being a title and becomes an operational burden, carrying the legal accountability for manufacturing they did not personally perform. The brand whose launch stalled in this article’s opening had a Responsible Person in place. What it did not have was proof that the factory three time zones away was working to the same standard. That single missing piece was the whole failure.

Documentation, training, internal audit: making it stick

Once the gap assessment is done and the subcontracting question is handled, implementation comes down to three disciplines that turn a project into a living system.

Documentation first, but not a thick binder. The goal is records that are traceable, current, and actually used. The test is simple: if an investigator picked any finished batch at random, could you trace it back through production, raw materials, and quality control to the day it was made? If yes, your documentation works. If you would have to reconstruct it, you have paper, not a system.

Training is the discipline brands consistently underfund. The failure mode is treating it as one-time onboarding. A team trained once in January is not a trained team in October. The implementations that hold are the ones where training is a recurring rhythm, not a certificate filed and forgotten.

Internal audits are the mechanism that catches drift before an inspector or a contamination event does. A manufacturer that runs honest internal audits finds its own problems first, which is always cheaper than the alternative, and an audit checklist built around the standard is the practical starting point.

The thread running through all three is the same: implementation is not an event with an end date. It is a system that has to be fed. The most common reason ISO 22716 implementations fail after a strong start is that the company built everything correctly, then stopped maintaining it. Building it is the project. Keeping it is the point.

If you want a fast read on whether your system is genuinely set up to stay current, rather than just built once, the self-assessment below scores the GMP areas that decide exactly that.

A realistic timeline, and what it actually costs

Manufacturers always want the same two numbers up front: how long and how much. The honest answer is that both depend on where your gap assessment landed. A manufacturer already running food- or drug-grade discipline might formalise in a few months. One starting from a quality system built for retail, with manufacturing outsourced and no supplier-audit program, is looking at considerably longer, because the hardest gaps are the ones in someone else’s building.

The gap assessment defines the scope. Documentation is the bulk of the early effort. Training and the first internal audit cycle take real calendar time. If you outsource manufacturing, supplier qualification runs in parallel and is often the long pole. Only once the system is running and audited does formal certification make sense, and the certification path and its cost and timeline are worth mapping separately once you know your starting point. The order matters more than the speed: brands that rush to certification before the system is real end up paying twice.

The implementation sequence, in order

If you take one thing from this article, take the sequence. Implementation done in the wrong order is the most common way to waste money on ISO 22716.

• Run an honest gap assessment against all ten chapters, area by area. This is your project plan.
• Identify which gaps sit inside your operation and which sit with a contract manufacturer. Treat the second group as the high-risk pole.
• For outsourced manufacturing, put written GMP responsibility contracts, audit rights, and compliance evidence in place. Without these, the rest does not count.
• Build documentation that describes the factory you actually run, traceable from finished batch back to raw material.
• Train every person involved, and schedule the training to recur, not to happen once.
• Stand up an internal audit cycle and run it honestly, so you find your own gaps before an inspector or an incident does.
• Only then pursue certification, against a system that is already real and already audited.

ISO 22716 rewards the manufacturers who treat it as how they run, not as a certificate they acquire. The factory you can prove is clean, the supplier you can prove is compliant, the batch you can trace in an afternoon: that is what implementation buys you, and it is worth far more than the logo at the end of it.