ISO 22716 vs GMPC: The Difference for Cosmetics Buyers

TL;DR - Short answer: ISO 22716 is the international cosmetics GMP standard (guidelines for production, control, storage, and shipment). GMPC is the umbrella term for regional GMP codes — the US FDA's, the ASEAN Guideline, and the EU's all sit under it. ISO 22716 is a certifiable standard; "GMPC certified" is looser language that needs unpacking — always ask which code, issued by whom, and to which entity. - Practical rule for buyers: accept ISO 22716 from an accredited certification body as your factory baseline everywhere; treat any GMPC claim as "check which version and verify the number." - The overlap is ~90%: premises, equipment, personnel hygiene, production discipline, QC, complaints, recalls, documentation. The differences are administrative, not architectural — a factory genuinely running one system is most of the way to the other. - For US shelves post-MoCRA: FDA's cosmetics GMP rule is still phasing in; ISO 22716 is the best available proxy today and the system you'll want in place when the final rule lands.

Buyers see "ISO 22716 certified" and "GMPC certified" on the same factory's homepage, sometimes both, sometimes interchangeably — and assume they're choosing between two levels of quality. They're not. This article fixes the vocabulary, shows the overlap, and gives you the verification questions that sort real systems from certificate walls.

The vocabulary, fixed

The point most articles get wrong: GMPC and ISO 22716 are presented as competing certifications, as if a factory picks one or the other. In reality, ISO 22716 is the international GMP standard for cosmetics, while GMPC is a family of regional codes: the US FDA's GMP guidance for cosmetics, the ASEAN Cosmetic Directive's GMPC (heavily used in Southeast Asian markets), the EU's GMP expectation (enforced through Regulation 1223/2009 Article 8 and Read Across ISO 22716), and China's own production license inspection criteria. A factory "certified to GMPC" is usually certified against one of these regional codes by a local or international body.

Why the confusion exists: certification bodies market both. Chinese factories typically hold both ISO 22716 and a GMPC certificate because Middle East registration (e.g., SFDA in Saudi Arabia) and ASEAN market access often ask for "GMPC" by name, while European buyers ask for ISO 22716. Same factory, two documents, one underlying system.

What each actually covers

The practical differences you'll feel as a buyer:

1. Certificate pedigree. ISO 22716 certificates from accredited bodies are traceable (CB name, accreditation mark, certificate number, scope, site address). GMPC certificates range from rigorous to photocopier-grade. The document quality variance is the real difference.
2. Regulatory hooks. Saudi SFDA registration effectively expects GMPC-aligned documentation; EU CPSR assessors look for GMP evidence and happily accept ISO 22716; US MoCRA's coming GMP rule will reference its own framework but inspection reality favors mature ISO 22716 systems.
3. Inspection depth. A serious ISO 22716 audit covers document control, deviation management, training records, and internal audits. Weak GMPC certificates sometimes reflect a one-day paperwork review. Ask for the audit report summary, not just the certificate.

The ~90% overlap (what a real system looks like either way)

Whether the certificate says ISO 22716 or GMPC, the system underneath should include:

• Premises & flow: clean zones, cross-contamination control, pest control, maintenance
• Equipment: cleaning/sanitization logs, calibration (your pH meters, viscometers), preventive maintenance
• Materials: supplier qualification, incoming QC, lot traceability from drum to batch
• Production: batch records, in-process checks, line clearance
• QC lab: incoming/in-process/final testing, retention samples, OOS (out-of-spec) handling
• Personnel: hygiene rules, training records, gowning discipline
• Documentation: SOPs, deviations, CAPA, internal audits, management review
• Complaints & recalls: traceability sufficient for a mock recall

The buyer's test is behavioral, not documentary: ask the factory to walk you through their last deviation (what went out of spec, how it was dispositioned, what the CAPA was). Factories with real systems answer in minutes with a case; certificate-only factories get vague. This single question outperforms any PDF.

Which certificate for which shelf

Our network standard: we require both — ISO 22716 from an accredited body plus the regional GMPC document where the target market names it — and we verify certificate numbers with the issuing bodies during vetting. Certificate copies are available on request.

How to verify any certificate in 10 minutes

1. Read the entity name. Does it match your contracting entity exactly? (Borrowed certificates are the oldest trick — see our factory verification guide.)
2. Read the site address. The certificate covers a site. A group with three buildings may show you the certificate of the building that isn't making your product.
3. Read the scope. "Cosmetics manufacturing" vs. specific categories — some scopes exclude color cosmetics or aerosols.
4. Check the accreditation. ISO 22716: CB name + accreditation mark (CNAS/UKAS/ANAB). GMPC: ask which body and which code version (FDA guidance / ASEAN guideline).
5. Check validity and surveillance. 3-year cycles with annual surveillance audits; a "certificate" with no surveillance history is suspect.
6. Call or email the CB. Certificate numbers are verifiable with issuing bodies; real factories encourage it.

The supplier claim to distrust: "We are GMPC, ISO, FDA certified" — three nouns, zero numbers. Every real certificate has a number, an issuing body, a scope, and a site address. The sentence "certificates available, numbers on request" is normal; the refusal to provide numbers is the signal.

A case from our own compliance files (anonymised)

A colour-cosmetics subcontractor we assessed for overflow capacity showed us a glossy GMPC certificate from a body we didn't recognise. Steps: entity name on the certificate matched the business license (good); the site address matched the licensed production address (good); but the certificate's scope read "skincare manufacturing" while the factory pitched eyeshadow palettes and lipsticks (gap). The CB turned out to be legitimate but accredited for a different scheme family — their "GMPC" was a self-declared conformance document, not a certified audit.

We didn't reject them; we scoped them. They now handle skincare-only overflow for us under a corrective plan (a proper ISO 22716 audit within 6 months, category scope extended only after a witnessed production run).

The lesson: certificates aren't pass/fail stamps — they're scope documents. Match scope to product, entity to contract, site to address, and the certificate becomes a tool instead of a trap.

FAQ

Q: If a factory has ISO 22716, do I still need the GMPC certificate? A: Only if your target market names GMPC (Saudi SFDA, some ASEAN registrations). Otherwise ISO 22716 from an accredited CB covers the GMP evidence needs of EU, UK, and US pathways.

Q: Is "FDA GMP certified" a thing? A: No. FDA does not certify cosmetics facilities to a GMP standard — it registers facilities (MoCRA) and, for OTC drugs, inspects against 21 CFR 210/211. "FDA certified" from a cosmetics factory usually means "FDA facility registered" — a much weaker claim. See our MoCRA checklist.

Q: What's the difference between ISO 22716 and ISO 9001? A: ISO 9001 is a general quality management standard for any industry; ISO 22716 is cosmetics-specific GMP covering hygiene, contamination control, and cosmetic-specific QC. For cosmetics buyers, ISO 9001 alone is not sufficient evidence of cosmetics GMP.

Q: Can I audit the factory myself instead of relying on certificates? A: Yes, and large buyers do. But a first-time small brand typically can't audit remotely — which is exactly why our own supplier vetting runs certificate verification + live video audit + sample stress test before any subcontractor touches a batch — and why you can ask us for the audit summary.

Q: The factory's ISO 22716 expired last month. Deal-breaker? A: Not automatically — surveillance audits get scheduled late. Ask for the surveillance audit booking and the previous audit report summary. A factory that lets certification lapse and shrugs is a different signal than one that's mid-renewal with evidence.

Q: Do I need GMP certificates for private label from a factory's stock formulas? A: Yes — arguably more. You're further from the production process, so the factory's system is your quality system. GMP evidence plus batch documentation is what your compliance file (CPSR/MoCRA substantiation) stands on.

Work with a factory whose certificates survive verification

Our own five production bases hold verified ISO 22716 and market-appropriate GMPC documentation — checked with the issuing bodies, scoped to the sites and categories your product needs. Request a quote with your target market and we'll confirm the matching certificates in the reply.

• MoCRA compliance checklist for US importers

About China Cosmetics Labs

China Cosmetics Labs is a Guangzhou-based cosmetics manufacturer running five production bases totalling 56,487 m² of workshop floor, with 405 staff and 191 units of production equipment. We hold our own Chinese cosmetics production licences for skincare, masks, sun care (SPF), hair care, body care, colour cosmetics and personal care, work to ISO 22716 + GMPC, and are registered with the US FDA under MoCRA.

Request a quote → · Manufacturing services → · WhatsApp wa.me/8618027666258