GMP and ISO 22716: What Beauty Buyers Should Verify

By Tyler · 4 min read · Manufacturing, Quality, GMP and Testing

GMP, ISO 22716, and NSF are not the same kind of proof. A buyer who treats them as interchangeable can end up accepting a logo, a screenshot, or an expired certificate instead of verifying the factory behind the document.

GMP is a manufacturing quality system. ISO 22716 is an international standard for cosmetic good manufacturing practices. NSF is a separate certification and audit program. Each one has a different scope and a different verification path.

This guide explains what each document means, what to check on the certificate, what to request from a factory, and what not to accept without verification.

GMP, ISO 22716, and NSF Are Not the Same

GMP

GMP stands for Good Manufacturing Practice. It covers the production environment, equipment, people, raw materials, batch records, cleaning, deviation handling, and quality management.

Different countries, industries, and certification bodies may use different GMP programs. When a factory says it has GMP, ask:

• Which standard or audit program?
• Which factory and production line are covered?
• Who issued the certificate?
• When does it expire?
• Does the certificate name match the actual production entity?

ISO 22716

ISO 22716 is an international standard for cosmetic good manufacturing practices. It usually covers the quality system from raw material receipt through finished-product release.

The certificate does not automatically prove that every product, line, or process is covered. The buyer should check the scope, site, issuer, and validity date. The certificate should also match the factory that will actually make the product.

NSF

NSF is a separate certification and audit system. It is not another name for GMP or ISO 22716. If a factory claims to be NSF certified or registered, ask what is certified, which legal entity is covered, and whether the certificate is current.

NSF is not a replacement for ISO 22716, and the absence of NSF does not mean a factory cannot produce cosmetics. The right question is whether the certification covers the product and process relevant to your project.

What to Check on a Certificate

A certificate is not a marketing image. Before accepting it, check:

1. The legal entity named on the certificate
2. The site address and production lines covered
3. The standard or audit program
4. The issuing body
5. The certificate number
6. The issue date and expiry date
7. The scope of certification
8. The current validity status

A blurry screenshot or a cover page is not enough. The buyer should be able to verify the certificate through the issuer or a verifiable official channel.

A Certificate Should Be Searchable

For many export-focused cosmetics factories, GMPC and ISO 22716 are important quality-system documents. In the EU, cosmetic GMP is a core requirement, and ISO 22716 is often used as the framework.

Ask for the certificate number, not only the certificate image. Then check the legal entity, scope, and validity through the issuing body or official verification channel. If the certificate cannot be found, do not automatically assume fraud, but keep asking. It may be expired, replaced, outside the claimed scope, or not exist.

What to Request From the Factory

In addition to the certificate, request:

• The certificate number and issuer verification link
• An explanation of the certificate entity and the production entity
• The last audit or renewal date
• Samples of quality records relevant to your product
• The process for deviations, rework, complaints, and corrective actions
• A live video review or on-site audit

These requests are not an accusation. They help the buyer understand what the certificate actually covers.

Five Common Buyer Mistakes

1. Treating GMP, ISO 22716, and NSF as the same certificate.
2. Looking at the logo but not the entity, address, or scope.
3. Writing “certified” into brand marketing without checking the current status.
4. Treating a factory certificate as the brand’s own certification.
5. Continuing to use an expired or replaced certificate.

Conclusion

GMP, ISO 22716, and NSF can all support a supplier review, but they mean different things. A buyer should treat each certificate as a document to verify, not a badge to trust.

Check the entity, site, scope, issuer, certificate number, and expiry date against the actual project. If the information is incomplete, ask for more. “It looks certified” is not a verification method.