Cosmetics GMP and ISO 22716: A Compliance Guide for Canada, the EU and the US

Cosmetics look simple on the shelf, but the quality system behind a compliant cream, serum or sunscreen is not. A cosmetic that separates, grows mould, or carries a contaminated batch can injure consumers and trigger a recall in days. That is why regulators in Canada, the European Union and the United States all point manufacturers toward one common foundation: cosmetic good manufacturing practice, known as GMP, and its international benchmark, ISO 22716.

For Canadian brands and contract manufacturers, GMP is no longer a nice-to-have. Export markets demand it, inspectors increasingly ask for it, and the line between a cosmetic and a drug is thinner than most owners assume. This guide explains what cosmetics GMP and ISO 22716 actually require, how the rules differ across Canada, the EU and the US, and the practical steps a facility takes to stay inspection ready. It is written for founders, quality managers and regulatory leads who need a defensible answer, not a marketing summary.

Executive Summary

Cosmetic GMP is the set of controls that keeps a product consistent, uncontaminated and traceable from raw material to finished shipment. ISO 22716 is the globally recognized standard that describes those controls for cosmetics specifically. The regulatory weight it carries depends on your market.

• European Union: GMP is mandatory under Article 8 of Regulation (EC) No 1223/2009, and EN ISO 22716 is the harmonised standard that gives a presumption of conformity.
• Canada: Health Canada does not publish a dedicated cosmetic GMP regulation. It relies on the Cosmetic Regulations, cosmetic notification, the Cosmetic Ingredient Hotlist and safety substantiation, so ISO 22716 is voluntary but strongly expected by trading partners and retailers.
• United States: The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) directs the FDA to set cosmetic GMP rules, but that rulemaking has slipped past its statutory deadlines, so ISO 22716 remains the practical benchmark for now.
• Products that make a therapeutic claim, such as many sunscreens and acne treatments, can be regulated as drugs, which triggers far stricter drug GMP and inspection exposure.

The rest of this article breaks each of these down, gives a compliance checklist, and reviews the most common mistakes we see during gap assessments and audits.

What Is Cosmetics GMP and ISO 22716?

What it is. ISO 22716:2007, titled Cosmetics, Good Manufacturing Practices (GMP), Guidelines on Good Manufacturing Practices, gives organizational and practical guidance on the human, technical and administrative factors that affect product quality. It covers the production, control, storage and shipment of cosmetic products. It deliberately does not cover research and development, the distribution of finished products, worker safety, or environmental protection, which are handled by other frameworks.

Why it matters. A cosmetic that is made without documented controls cannot be trusted to be safe or consistent from batch to batch. GMP converts good intentions into evidence. It gives you records that show what was made, from which materials, by whom, under what conditions, and whether it met specification before release. That evidence is exactly what an auditor, a retailer, or an importing regulator wants to see.

What companies should do. Treat ISO 22716 as the structure for your quality management system even if your market does not legally require it. The standard is built around ten practical chapters that map neatly onto how a cosmetics facility actually operates.

These chapters are not abstract. Each one becomes a set of standard operating procedures, records and responsibilities inside your business. Building them well is the difference between passing an audit and scrambling to reconstruct history after a complaint.

Cosmetics GMP in the European Union

What it is. The EU Cosmetics Regulation, Regulation (EC) No 1223/2009, is the single most influential cosmetic law in the world, and many non-EU markets model their rules on it. Article 8 requires that the manufacture of cosmetic products complies with good manufacturing practice. Where a manufacturer follows the relevant harmonised standard, the references of which are published in the Official Journal of the European Union, compliance with GMP is presumed. EN ISO 22716 is that harmonised standard.

Why it matters for Canadian exporters. If you sell into the EU, GMP compliance is not optional and it is not a certificate you can skip. Your product must have a Responsible Person in the EU, a Product Information File, and manufacturing that meets GMP. An importer or distributor will almost always ask for evidence that your site follows ISO 22716 before they place an order. A gap here can stop a launch cold.

What companies should do. Note an important distinction: the EU does not require ISO 22716 certification. It requires manufacturing in accordance with GMP. Certification by a third party is one way to demonstrate that, and many buyers prefer it, but a well-documented internal system that maps to the standard can also satisfy the requirement. Decide early whether your target customers expect a certificate or accept a documented system, because that choice shapes your budget and timeline.

Cosmetics GMP in Canada: What Health Canada Actually Requires

What it is. Cosmetics in Canada are regulated under the Food and Drugs Act and the Cosmetic Regulations. The core obligations are notification, ingredient control and labelling rather than a prescriptive GMP code. A company must submit a Cosmetic Notification Form to Health Canada, and this notification is required within ten days after the first sale of the product in Canada. The notification is not an approval. It lets Health Canada monitor the market and act on safety issues.

Ingredient control. The Cosmetic Ingredient Hotlist is Health Canada's administrative list of substances that are prohibited or restricted in cosmetics. Health Canada updates it as science evolves. A consultation on proposed Hotlist changes ran from 19 November 2025 to 17 February 2026, including proposals to restrict substances such as polyaminopropyl biguanide in certain product forms. Brands should reformulate and relabel in step with Hotlist changes, and our related guide on fragrance allergen disclosure and the 2026 Hotlist update walks through the reformulation roadmap in detail.

Why GMP still matters in Canada. Even without a dedicated GMP regulation, the Food and Drugs Act prohibits selling a cosmetic that is manufactured, prepared, preserved, packaged or stored under unsanitary conditions, or that may injure the user under normal use. In practice, the only reliable way to prove you meet that bar is a functioning GMP system. Retailers, importers and international buyers routinely ask Canadian manufacturers for ISO 22716 alignment, so voluntary adoption has become a commercial necessity for anyone with export ambitions.

The cosmetic versus drug line. This is where many Canadian businesses stumble. If a product makes a therapeutic or health claim, or contains certain active ingredients, Health Canada may regulate it as a drug or a natural health product rather than a cosmetic. That reclassification pulls the product into a completely different and far stricter GMP regime. Sunscreens, antiperspirants, anti-dandruff shampoos and acne products are common examples. Our analysis of whether exosome skincare is a cosmetic or a drug shows how quickly a product can cross that line.

Cosmetics GMP in the United States Under MoCRA

What it is. The Modernization of Cosmetics Regulation Act of 2022 was the first major update to US cosmetic law in decades. It introduced mandatory facility registration, product listing, adverse event reporting, safety substantiation and, importantly, a requirement for the FDA to establish good manufacturing practice regulations for cosmetics.

Why it matters. MoCRA required the FDA to publish a proposed GMP rule by 29 December 2024 and a final rule by 29 December 2025. The FDA did not meet the proposed-rule deadline, and the GMP rulemaking has since been moved to the agency's long-term actions list. Industry analysts do not expect a final cosmetic GMP rule before late 2026 at the earliest. Until it lands, US-bound cosmetics have no binding federal GMP code, but they are still expected to be made under sound manufacturing controls, and the FDA's long-standing draft guidance on cosmetic GMP is closely aligned with ISO 22716.

What companies should do. Do not wait for the final rule. Build your system to ISO 22716 now. When the FDA rule is published, the comment period will be the industry's best chance to shape it, and a facility already operating to the international standard will have little to change. If you also make sunscreens or other over-the-counter drug products, remember that those fall under full drug current good manufacturing practice, which is enforced today and does not wait for MoCRA.

A Real Inspection Lesson: When Personal Care Meets Drug GMP

On 8 July 2026, the FDA issued a warning letter to Spa De Soleil, Inc., a California manufacturer of topical over-the-counter drug products, following an inspection of its Sun Valley facility from 20 to 26 January 2026. The letter is a useful case study for the cosmetics sector because the same company operates in the personal care space where the cosmetic and drug categories overlap.

The FDA cited a failure to validate the manufacturing processes used to make the products, a failure to establish adequate written procedures for production and process control, and a failure to establish laboratory controls with scientifically sound specifications. The agency also noted that between May 2024 and July 2025 the company did not properly investigate 51 out-of-limit and out-of-specification results. The company's response to the earlier inspection findings was judged inadequate because it lacked supporting documentation and evidence of corrective action.

Every one of those findings maps directly onto an ISO 22716 chapter: production controls, documented procedures, the quality control laboratory, and the treatment of out-of-specification product. A facility running a real GMP system investigates deviations, validates its processes and keeps the records to prove it. The lesson for cosmetics manufacturers is simple. If your product can be classified as a drug, or if you make both cosmetics and OTC drugs on the same lines, you are exposed to full drug GMP inspection, and weak procedures will be found. A gap assessment and audit-readiness review catches these problems before an inspector does.

Canada, the EU and the US Compared

The table below summarizes how cosmetic GMP obligations differ across the three markets Canadian brands most often target. Use it to plan which evidence you need before you export.

Cosmetics GMP Compliance Checklist

Use this checklist as a starting point for a self-assessment against ISO 22716. It is not exhaustive, but it covers the controls inspectors and buyers ask about most often.

• Quality system: a documented quality policy, an organization chart, and defined roles and responsibilities are in place.
• Personnel: staff are trained for their tasks, training is recorded, and hygiene rules are written and enforced.
• Premises: the facility is designed and cleaned to prevent contamination and mix-ups, with pest control in place.
• Equipment: equipment is maintained, calibrated on schedule and cleaned using validated procedures.
• Materials: raw and packaging materials are purchased from approved suppliers, identified on receipt, and released before use.
• Production: each batch has a batch record capturing materials, processing steps, in-process checks and the operators involved.
• Quality control: finished products are tested against written specifications and released only when they meet them.
• Deviations and out-of-specification results: deviations, complaints and out-of-specification results are investigated, documented and closed with corrective and preventive action, known as CAPA.
• Traceability and recall: batch numbering and distribution records allow you to trace and recall product quickly.
• Internal audits: the facility audits itself against ISO 22716 on a schedule and records the findings.

Common Cosmetics GMP Mistakes

Across gap assessments and audits, the same weaknesses appear again and again. Watching for them will save you a costly finding.

• Treating notification as approval. A Cosmetic Notification Form in Canada, or a CPNP entry in the EU, records your product. It does not certify that your manufacturing is compliant. GMP is a separate obligation.
• No process validation. Assuming a process works because the product looks fine is not evidence. Validate the processes that determine quality and preservation.
• Weak supplier control. Buying raw materials without qualifying suppliers or checking certificates of analysis lets contamination and substitution slip in.
• Ignoring the drug line. Adding a therapeutic claim or an active ingredient can reclassify a cosmetic as a drug and trigger far stricter GMP. Confirm classification before you make claims.
• Undocumented deviations. Fixing a problem on the floor without recording and investigating it removes the evidence an auditor needs and lets the root cause recur.
• Records that cannot be trusted. Missing signatures, backdated entries and gaps in batch records are among the fastest ways to fail an audit and are treated as data integrity concerns.

Frequently Asked Questions

Is ISO 22716 certification mandatory to sell cosmetics?

It depends on the market. The EU requires manufacturing in accordance with GMP under Article 8 of Regulation (EC) No 1223/2009, and following EN ISO 22716 gives a presumption of conformity, but the EU does not require a third-party certificate. Canada and the United States do not currently mandate ISO 22716 at all, though it is widely expected by buyers. Many brands still pursue certification because retailers and importers ask for it.

Does Health Canada require cosmetic GMP?

Health Canada does not have a dedicated cosmetic GMP regulation. It regulates cosmetics through the Cosmetic Regulations, mandatory notification, the Cosmetic Ingredient Hotlist and safety substantiation. However, the Food and Drugs Act prohibits selling cosmetics made under unsanitary conditions, and a GMP system is the practical way to meet that standard and satisfy export customers.

What is the difference between a cosmetic and a drug in Canada?

The distinction turns on the claim and the ingredients. A cosmetic cleans, beautifies or alters appearance. If a product claims to treat or prevent a condition, or contains a recognized active ingredient, Health Canada may regulate it as a drug or a natural health product, which brings much stricter GMP and licensing requirements. Sunscreens and acne treatments are common examples of products that cross the line.

When will the FDA finalize cosmetic GMP rules under MoCRA?

MoCRA required a proposed rule by December 2024 and a final rule by December 2025, but the FDA missed those deadlines and moved the GMP rulemaking to its long-term actions list. As of 2026, a final rule is not expected before late 2026 at the earliest. Until then, ISO 22716 and the FDA's draft cosmetic GMP guidance remain the working benchmarks.

How long does it take to implement ISO 22716?

For a small or medium cosmetics manufacturer, building a documented ISO 22716 system typically takes a few months, depending on the starting point. The work involves writing standard operating procedures, setting up batch records, qualifying suppliers, training staff and running an internal audit. A gap assessment at the start tells you exactly how far you are from the standard and how to sequence the work.

Can a contract manufacturer's GMP cover my brand?

Partly. If you outsource manufacturing, your contract manufacturer's GMP system covers how the product is made, but you remain responsible for oversight, supplier and contractor qualification, product safety and, in the EU, the Responsible Person duties. You should audit your manufacturer, hold their certificates and batch records, and have a written quality agreement that defines who does what.

How MFLRC Can Help

MF License and Regulatory Consultants helps cosmetics brands and contract manufacturers build quality systems that hold up under audit and open export markets. Whether you are launching your first product or preparing for an EU buyer's due diligence, we turn ISO 22716 from a document into a working system.

• Gap assessments that measure your facility against ISO 22716 and give you a prioritized action plan.
• SOP and quality system development for personnel, premises, equipment, production, quality control and documentation.
• Audit and inspection readiness, including mock audits and CAPA support, through our audit services.
• Regulatory and licensing support for cosmetic notification, the cosmetic versus drug question, and market entry into Canada, the EU and the US, through our regulatory affairs, licensing and import/export team.
• Quality control and validation so your testing, specifications and process validation are defensible, backed by our quality control and validation services.

If you want a clear read on where your cosmetics operation stands against ISO 22716 and the rules in your target markets, we can help you get there with a practical, senior-led plan. Reach out to our regulatory team for a conversation tailored to your business.

Conclusion

Cosmetics GMP is the quiet infrastructure behind every trustworthy product. ISO 22716 gives that infrastructure a shared shape across Canada, the EU and the US, even though the legal weight it carries differs by market. In the EU it is effectively mandatory. In Canada and the US it is voluntary today but expected by buyers and, in the US, on track to become a formal rule. The businesses that win are the ones that stop treating GMP as paperwork and start treating it as the system that keeps their products safe, consistent and market ready. Build it once, build it properly, and it will serve every market you enter.

Sources and References

• ISO 22716:2007, Cosmetics, Good Manufacturing Practices (GMP), International Organization for Standardization.
• Regulation (EC) No 1223/2009 on cosmetic products, EUR-Lex, European Union.
• Harmonised standards for cosmetic products, European Commission.
• Regulatory information for cosmetics, Health Canada.
• Cosmetic Ingredient Hotlist, Health Canada.
• Modernization of Cosmetics Regulation Act of 2022 (MoCRA), US Food and Drug Administration.
• Warning Letter, Spa De Soleil, Inc. (728508, 8 July 2026), US Food and Drug Administration.