What Indie Beauty Brands Get Wrong About ISO 22716 GMP: Five Shortcuts That Always Backfire

In 2023, cosmetics and personal care products appeared in approximately 14% of all EU Safety Gate notifications — a figure that has held remarkably steady for five consecutive years. What’s less visible in the headline number is the breakdown by company size. A disproportionate share of those notifications involve small and mid-sized brands, not multinationals with armies of quality assurance staff. The multinationals have expensive problems of their own, but “incomplete GMP documentation” and “unverified raw material identity” aren’t usually among them.

For indie beauty brands, they are. Repeatedly.

Article 8 of EU Regulation 1223/2009 requires every cosmetic product placed on the EU market to be manufactured in compliance with good manufacturing practice. Commission Decision 2013/674/EU makes explicit that ISO 22716:2007 — “Cosmetics — Good Manufacturing Practices (GMP)” — is the reference standard. Not a benchmark to aspire to. The reference standard. Whether you’re producing 150-unit batches of face serum in a shared manufacturing space in Bordeaux or running a mid-scale production line in the Netherlands, that obligation applies to you equally.

The difference between a small brand and a large one isn’t which rules apply. It’s how much runway you have when things go wrong.

Why the Responsible Person Designation Is Not Paperwork

Before getting into the specific shortcuts, it’s worth being direct about accountability. The Responsible Person (RP) — the legal entity designated under Article 4 of Regulation 1223/2009 as bearing compliance responsibility for a product — isn’t an administrative formality. When market surveillance authorities in France (DGCCRF), Germany, or the Netherlands request a Product Information File within 3 working days, it’s the RP who must produce it. When a product is found non-compliant, it’s the RP who faces the enforcement action.

French courts have imposed fines reaching six figures for serious GMP non-compliance. German market surveillance agencies have ordered product withdrawals within 48 hours for microbiological failures. And “I relied on my supplier’s paperwork” has not, in any of these cases, served as a defence.

That context matters when we talk about testing shortcuts. Every shortcut that saves €500 in a launch budget is a shortcut that the RP has personally assumed liability for.

Five GMP Shortcuts That Create Far More Risk Than They Eliminate

Shortcut 1: Accepting a supplier Certificate of Analysis without independent identity verification

This is the most common non-conformity we see, by a wide margin. Section 10 of ISO 22716 is explicit — incoming raw materials must undergo defined quality controls, including identity verification, before use in production. A supplier’s Certificate of Analysis confirms that the supplier tested the material. It says nothing about what arrived in your facility.

For most raw materials, incoming identity testing can be relatively simple: near-infrared (NIR) spectroscopy for bulk ingredients, thin-layer chromatography (TLC) for botanical extracts, organoleptic checks against a retained reference standard. The key is that it’s your test, documented in your batch record, conducted before the material enters production.

This matters even more for botanical actives. Adulteration rates for high-value plant-derived ingredients — certain essential oils, adaptogens, exotic extracts — can reach 30–70% depending on the supply chain and harvest year. A CoA from a supplier whose own sourcing is two or three steps removed from origin tells you very little about what’s actually in the barrel. Independent identity confirmation isn’t paranoia; it’s basic incoming control.

Shortcut 2: Skipping ISO 11930 challenge testing because the formulation is “natural”

The rise of clean beauty has created a widespread misconception: that formulations preserved with glycols, fermentation-derived ingredients, low-pH buffering systems, or essential oils are somehow outside the scope of preservative efficacy testing. They’re not.

ISO 11930:2019 — “Cosmetics — Microbiology — Evaluation of the antimicrobial protection of a cosmetic product” — applies to any product with an antimicrobial preservative strategy, including “self-preserving” systems. The test challenges a finished product with five organisms (Pseudomonas aeruginosa, Staphylococcus aureus, Candida albicans, Aspergillus brasiliensis, and Escherichia coli) and measures log reductions at 14 and 28 days. A Category A pass requires a 2-log reduction by day 14 for bacteria; Category B permits a slower trajectory. Without a test result on file, you have no evidence that your preservative system works — only a formulator’s opinion.

The microbiological limits under ISO 17516:2014 are the floor, not the ceiling: a maximum of 1,000 CFU/g for most product types, and 100 CFU/g for products intended for the eye area, mucous membranes, or children under 3 years. A product that passes visual inspection but fails microbiologically is the kind of product that generates Safety Gate notifications. And the “it’s natural” argument will not appear anywhere in the DGCCRF’s report.

Shortcut 3: A one-month accelerated stability dataset as the entire evidence base

Stability testing has two functions in cosmetics compliance: it supports the shelf life labelling requirement (an expiry date is mandatory under Regulation 1223/2009 for products with a shelf life of less than 30 months) and it supports the Period After Opening (PAO) claim. A one-month study at 40°C ± 2°C and 75% ± 5% relative humidity can detect obvious formulation problems — gross separation, severe discolouration — but it tells you almost nothing about what will happen at months 18, 24, or 30.

A defensible stability programme includes accelerated testing across a minimum of 3 months at the conditions above, plus concurrent real-time samples stored at 25°C that are evaluated at 6, 12, and 24-month intervals. Section 15 of ISO 22716 requires that stability data support the shelf life claim. If your data runs to 30 days and your label claims a 30-month shelf life, you have a compliance gap — and you have no early warning system for the emulsion that will start separating at month 22.

Shortcut 4: A template Cosmetic Product Safety Report that wasn’t actually completed

The Product Information File must include a Cosmetic Product Safety Report (CPSR) as specified in Annex I of Regulation 1223/2009. Part A is a safety information compilation — toxicological profile of each ingredient at its used concentration, physicochemical data, microbiological data. Part B is the safety assessor’s narrative conclusion: a reasoned statement that the product, as formulated, is safe for its intended use.

Part B must be signed by a qualified safety assessor — specifically, a professional holding a degree in pharmacy, toxicology, medicine, or a closely related discipline as defined in Article 10(2) of the Regulation. And the conclusion must actually engage with the specific formulation. A generic template that copies standard INCI safety profiles without addressing actual concentrations, actual raw material specifications, or actual test results isn’t a CPSR. It’s a document that creates the appearance of compliance while providing the substance of none.

We’ve reviewed PIFs for brands who paid for “CPSR services” and received a 4-page template with their formula list pasted in. That document would not survive a 15-minute DGCCRF audit.

Shortcut 5: Quality control records that aren’t actually traceable

ISO 22716 Section 12 requires that quality controls use defined, documented methods and that results are recorded with full traceability — meaning every batch number can be linked to a specific set of test results, tested by a specific person, on a specific date, using a specific method. Not a general log. A traceable record.

pH measurements taken with an uncalibrated pocket meter and noted on a production whiteboard don’t satisfy this requirement. Viscosity assessments described in a batch record as “checked, OK” provide no traceability. If a contaminated batch is identified in the market at month 20, the RP needs to reconstruct the entire production and release chain from documents. The standard specifically exists because verbal accounts are inadmissible and memory is unreliable.

The documentation overhead for a small brand running 10–15 SKUs is genuinely manageable. A master batch record template, a calibration log for testing equipment, and signed release records per batch constitute the core of a defensible system. What isn’t manageable is trying to reconstruct that documentation retroactively when an authority is already asking questions.

What a Lean, Defensible GMP Programme Actually Looks Like

ISO 22716 is scalable. It was designed for the full range of cosmetics manufacturers, and nothing in the standard requires a dedicated quality department or a purpose-built GMP facility. What it requires is systematic documentation and a defined relationship with an accredited external laboratory for tests that require validated methods or specialist equipment.

For a small EU cosmetics brand, a practical GMP baseline includes:

• A master batch record template applied to every production run, regardless of batch size
• Written incoming control procedures with defined identity testing protocols for each ingredient category, including specification limits and acceptance criteria
• ISO 11930 challenge test results from an ISO/IEC 17025-accredited external laboratory for every formulation at launch and after any preservative system change
• A stability protocol with a minimum 3-month accelerated dataset and concurrent real-time samples, reviewed at defined intervals
• A CPSR authored by a named, credentialed safety assessor who has reviewed the actual formulation data — not a template
• A complete PIF for every SKU, maintained and accessible for 10 years after the last batch placed on the market

This costs money. But it costs considerably less than a market withdrawal, a product recall, or an enforcement action. And it costs nothing compared to the reputational damage of a Safety Gate notification in your brand’s third year.

Indie beauty is one of the most genuinely innovative spaces in the EU cosmetics market right now. The brands building lasting businesses in it are, almost without exception, the ones who treated compliance infrastructure as a business cost from day one — not as a problem to solve after launch.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO/IEC 17025-accredited cosmetic product testing — Independent ISO 11930 challenge testing, raw material identity, stability studies, and microbiological assays for EU-market cosmetics
• Cosmetic and NHP compliance testing for the Canadian market — Health Canada GMP-aligned testing services for European brands entering the Canadian market