By Peiwen Sun · Cosmetics R&D & Innovation · Published 07 Apr 2026
“GMP certified” and “ISO 22716 certified” show up on almost every OEM manufacturer’s website, often side by side, sometimes used almost interchangeably. For a brand owner trying to vet a manufacturing partner, that overlap is genuinely confusing: are these two separate credentials, or two names for the same thing? Getting the distinction right matters, because the two terms are not interchangeable, and knowing the difference changes what questions you should actually be asking a factory.
This guide breaks down what Good Manufacturing Practice (GMP) means as a concept, what ISO 22716 specifically certifies, how the two relate to each other, and which one should carry more weight when you are evaluating an OEM cosmetics manufacturer — particularly if you are selling into Malaysia or the wider ASEAN region. For related compliance topics, see our Regulation & Compliance hub.
Key takeaways
- GMP is a broad quality principle; ISO 22716 is a specific, auditable certification that implements cosmetic GMP.
- A factory can claim to follow “GMP” without ever having been independently audited against a defined standard.
- ISO 22716 certification means a third-party auditor has verified the factory against a fixed checklist.
- For Malaysian NPRA notification, alignment with ASEAN Cosmetic GMP is the practical baseline expectation.
- ISO 22716 is increasingly requested by export buyers as a stronger, more verifiable quality signal.
What Good Manufacturing Practice actually means
Good Manufacturing Practice is not a single certificate or a single document — it is a broad set of principles covering how products should be consistently produced and quality-controlled, spanning everything from facility hygiene and staff training to raw material handling, in-process checks and record-keeping. Because GMP is a set of principles rather than one fixed, universally certified standard, it is possible for a manufacturer to describe itself as “GMP compliant” based on internal self-assessment, without having gone through any external, independent verification. That does not necessarily mean the claim is false — but it does mean the claim, on its own, is not verifiable the way a specific certification is.
Where ASEAN Cosmetic GMP fits in
Within the ASEAN region, including Malaysia, there is a regional reference standard known as the ASEAN Cosmetic GMP guidelines, which harmonise cosmetic manufacturing quality expectations across member states. This is the practical baseline regulators in the region expect manufacturers to work toward, and it is closely aligned with international cosmetic GMP principles more broadly. When a Malaysian manufacturer says they follow GMP, this ASEAN framework is usually the specific reference point, even if it is not always stated explicitly.
What ISO 22716 specifically is
ISO 22716 is the international standard that defines Good Manufacturing Practices specifically for the cosmetics industry, published by the International Organization for Standardization. Unlike the general concept of GMP, ISO 22716 is a detailed, written standard with specific, auditable requirements covering personnel, premises, equipment, raw materials, production, quality control, storage, shipping, subcontracting, deviations, complaints, recalls and change control. It is comprehensive by design, intended to give manufacturers, buyers and regulators a shared, specific reference point rather than a general aspiration.
The key difference: principle versus certification
The clearest way to understand the relationship is that GMP is the underlying principle, and ISO 22716 is a specific, certifiable standard that implements that principle for the cosmetics sector. Being “GMP compliant” is a claim a factory can make about itself. Being “ISO 22716 certified” means an accredited, independent third-party auditor has physically assessed that factory against ISO 22716’s defined checklist and issued a certificate with a specific scope and expiry date. One is a description; the other is a verified credential you can check.
How to actually verify an ISO 22716 claim
Do not accept a logo on a website as proof. Ask the manufacturer directly for a copy of their current ISO 22716 certificate, and check three things: the certifying body’s name (search whether it is an accredited certification body), the certificate’s scope (does it cover the specific product category and production line you will be using, since certification can be limited to certain processes), and the expiry date (certifications lapse and need to be renewed through periodic re-audits). A manufacturer confident in a genuine, current certification will produce this documentation without hesitation.
Why the distinction matters for your compliance file
If you are notifying a product with NPRA in Malaysia, having a manufacturer that can demonstrate ASEAN Cosmetic GMP alignment strengthens your compliance position, and an ISO 22716 certificate strengthens it further by giving you a specific, third-party-verified document to reference. Brand owners building a Product Information File benefit from being able to cite a concrete certification rather than a general assurance, particularly if a retailer, export partner or regulator ever asks for evidence of manufacturing quality standards.
Is ISO 22716 mandatory in Malaysia?
No — for domestic NPRA notification, ISO 22716 certification is not a strict legal requirement, and alignment with ASEAN Cosmetic GMP principles is generally what is expected. However, “not mandatory” does not mean “not valuable.” Many international retailers, distributors and export markets increasingly ask for ISO 22716 specifically as a condition of doing business, particularly for brands with ambitions beyond the domestic market. If export is part of your long-term plan, working with an ISO 22716-certified manufacturer from the start avoids having to requalify a supply chain later.
What ISO 22716 does not guarantee
It is worth being precise about the limits of this certification too. ISO 22716 certifies that a manufacturer’s processes and quality management systems meet the standard — it does not certify that any specific formula is safe, effective, or compliant with a given country’s labelling and claims rules. Product-level safety assessment and regulatory notification remain separate obligations that sit alongside, not underneath, a factory’s ISO 22716 status.
Questions to ask a manufacturer about their quality certifications
Beyond simply asking “are you GMP certified,” ask more specific questions: which specific standard or guideline are you certified against, who is the certifying body, when was the last audit and when is the next one due, and does the certification cover the exact product category and production line relevant to your order. These follow-up questions quickly separate manufacturers with genuine, current, scoped certification from those relying on a general claim.
How this fits into your broader manufacturer evaluation
Certification status is one input into a much broader evaluation of a manufacturing partner — it should sit alongside category expertise, MOQ flexibility, documentation practices and communication quality. A factory with strong ISO 22716 certification but poor communication or limited category experience is not automatically the right partner; equally, a factory without ISO 22716 but with strong ASEAN GMP alignment and deep category expertise may still be a solid choice for a domestic-focused brand. Treat certification as one clear, verifiable data point among several — see our broader guide on OEM, ODM and private label in cosmetics for the rest of the evaluation picture.
How certification claims tend to get overstated
It is worth understanding how a “GMP certified” claim can drift from accurate to misleading without anyone deliberately lying. A factory might have been ISO 22716 certified several years ago, let the certification lapse after an audit cycle was missed, and continue using the same marketing language on their website out of habit rather than intent. Or a factory might hold ISO 22716 certification for one production line but describe their entire facility as certified, when in reality a newer line added for a different product category has not yet been through an audit. Neither scenario is necessarily fraudulent, but both mean the claim as presented is not fully accurate — which is exactly why asking for the actual certificate, rather than relying on website copy, is worth the extra five minutes every time.
What to do if a manufacturer cannot produce documentation
If a manufacturer claims GMP or ISO 22716 status but cannot produce a certificate, or produces one that is expired, scoped differently than claimed, or issued by a body you cannot verify, that is not automatically disqualifying — but it does shift the burden onto you to decide how much risk you are comfortable carrying. Some brand owners will proceed anyway, particularly for a lower-risk domestic launch, provided other signals (facility visit, sample quality, documentation practices) are strong. Others will treat missing or unverifiable certification as a hard stop, especially if export markets are part of the plan. Either way, make the decision consciously, with the gap named clearly, rather than assuming the claim is accurate because it appeared on a slide deck.
Frequently asked questions
Is ISO 22716 the same thing as GMP?
No. GMP is a broad quality principle; ISO 22716 is the specific, internationally recognised, third-party-certifiable standard that implements cosmetic GMP in detail. A factory can claim GMP compliance without holding ISO 22716 certification.
Do I need an ISO 22716-certified manufacturer to notify with NPRA?
Strict ISO 22716 certification is not a mandatory requirement for NPRA notification in Malaysia. Alignment with ASEAN Cosmetic GMP guidelines is the practical expectation, though ISO 22716 provides a stronger, independently verified credential.
How do I check if an ISO 22716 certificate is genuine?
Request the certificate directly, note the certifying body and certificate number, and verify the certifying body is an accredited organisation. Also check the scope and expiry date to ensure it actually covers your product category and is currently valid.
Does ISO 22716 certification mean a product is automatically safe?
No. ISO 22716 certifies the manufacturer’s production and quality management processes, not any individual formula’s safety or regulatory compliance. Product-level safety assessment and notification remain separate steps.
This article is general educational information, not regulatory or legal advice. Certification requirements and standards can be updated — always verify current status directly with the certifying body or the manufacturer.
About the author
Peiwen Sun is a China-based cosmetics R&D and innovation executive with senior-level experience in beauty product research, formulation and innovation management. Her work focuses on translating cosmetic science and emerging technologies into commercially relevant beauty products. LinkedIn
