ISO 22716 GMP vs FDA Cosmetics Requirements: The Gap Analysis European Exporters Need

A lot of European cosmetics manufacturers arrive at the US border with one assumption: we’re ISO 22716 certified, so we must be covered. It’s an understandable conclusion. ISO 22716:2007 is the internationally recognised GMP standard for cosmetics, it’s mandatory under EU Regulation 1223/2009, and it’s genuinely rigorous. But it was written by ISO — not by the FDA. And the FDA, with its December 2022 Modernization of Cosmetics Regulation Act (MoCRA), has now imposed a set of requirements that ISO 22716 simply wasn’t designed to address.

This matters because the cost of finding out late is high. Import refusals under FDA Import Alert 53-02 can freeze an entire product line. Warning letters are public. And under MoCRA, FDA now holds mandatory recall authority for cosmetics — something it lacked entirely before the Act was signed on 29 December 2022.

The gap analysis below reflects what we consistently see when European brands bring us their documentation for a pre-export compliance review.

What ISO 22716 Was Designed to Do — and Where It Stops

ISO 22716:2007 (Cosmetics — Good Manufacturing Practices (GMP) — Guidelines on Good Manufacturing Practices) covers eight core areas: personnel, premises, equipment, raw materials, production, finished products, quality control, and waste. It’s a process standard. It tells manufacturers how to build a quality system — documenting procedures, managing contamination risk, qualifying suppliers, retaining records.

For EU compliance, it works well. Regulation 1223/2009 references GMP as a requirement under Article 8, and Commission Decision 2013/674/EU makes EN ISO 22716 the recognised framework. If you’re certified to ISO 22716 and your Product Information File is in order, you’re meeting the EU’s manufacturing quality expectations.

But ISO 22716 says nothing about registering your facility with a national authority, reporting serious adverse events within a legally mandated timeframe, maintaining a designated US agent for regulatory correspondence, or disclosing specific fragrance allergens according to a US-mandated list. These are precisely the areas where MoCRA creates obligations that fall entirely outside the ISO 22716 scope.

The Five Gaps That Most Often Catch European Exporters Off Guard

Gap 1: Facility Registration Is Now Mandatory Under MoCRA

Under Section 607 of MoCRA (21 U.S.C. §364f), every facility that manufactures or processes cosmetics marketed in the United States must register with the FDA. The initial registration deadline was 29 December 2023 for existing facilities. New facilities must register before beginning distribution.

ISO 22716 doesn’t touch registration. There’s no equivalent requirement in the EU framework — the CPNP (Cosmetic Products Notification Portal) notification covers the product, not the facility. European manufacturers accustomed to the EU model are frequently surprised to learn that their factory in Lyon or Hamburg must appear in FDA’s registry before a single unit crosses the Atlantic.

Registration must be renewed biennially, in the October–December window of each even-numbered year. Miss it, and your registration lapses — taking your legal right to distribute with it.

Gap 2: Serious Adverse Event Reporting Has a Hard 15-Business-Day Deadline

This is the single most operationally significant gap. MoCRA Section 605 requires manufacturers, packers, and distributors to report serious adverse events — defined to include events requiring medical intervention, hospitalisation, or resulting in disfigurement — to the FDA within 15 business days of receiving a consumer or healthcare provider report.

ISO 22716 addresses complaint management and product recall triggers in the context of quality control, but it prescribes no reporting window to a regulatory authority. EU Regulation 1223/2009 has its own cosmetovigilance framework under Articles 21–23, with ANSM notification obligations, but the triggers, formats, and timelines differ substantially from the FDA’s requirement.

The practical implication: a European brand receiving a consumer complaint that meets MoCRA’s “serious adverse event” definition needs a documented escalation process — from initial intake to FDA submission — that completes in 15 business days. Most ISO 22716-compliant quality systems aren’t built around that clock. Records of all adverse event reports must be retained for 6 years under the Act.

Gap 3: Your EU Responsible Person Is Not an FDA-Recognised US Agent

EU Regulation 1223/2009 requires every cosmetic product placed on the EU market to have a designated Responsible Person — an EU-established entity that bears legal responsibility for compliance, signs off on the safety assessment, maintains the PIF, and handles CPNP notifications.

MoCRA creates a parallel — but legally separate — structure. The responsible person under US law is the manufacturer, packer, or distributor whose name appears on the label. Beyond that, foreign facilities must designate a US agent for FDA contact purposes (as referenced in FDA’s Unified Registration and Listing System guidance).

These are not the same role, and one doesn’t substitute for the other. Your French or German Responsible Person has no legal standing with the FDA. A European brand that appoints an EU RP, assumes that covers them globally, and ships to the US without a designated US agent is running a regulatory gap that FDA import investigators will not overlook.

Gap 4: The Prohibited Ingredients Lists Are Asymmetric — in Both Directions

EU Annex II to Regulation 1223/2009 lists over 1,300 prohibited substances. The EU has banned formaldehyde-releasing preservatives above certain concentration thresholds, restricted hundreds of fragrance components, and updated the Annex repeatedly as new toxicological data emerge. European formulators tend to be very thorough about Annex II screening, and rightly so.

FDA’s prohibited cosmetics ingredients list — codified under 21 CFR 700.11 through 700.35 — explicitly prohibits 11 substances, including chlorofluorocarbon propellants, hexachlorophene above 0.1% in most products, and mercury compounds. A broader range of ingredients can be addressed under FDA’s adulteration provisions (21 U.S.C. §361), but there is no equivalent to Annex II as a searchable, regularly updated prohibited list.

The asymmetry runs both ways. An EU-compliant formula may contain an ingredient that triggers FDA adulteration concerns. And an EU-prohibited ingredient may not appear on FDA’s short list, creating a false sense of security for brands using Annex II screening as their sole ingredient gatekeeping tool.

PFAS (per- and polyfluoroalkyl substances) is the ingredient category generating the most discussion right now. California’s AB 2771 (effective 1 January 2025) prohibits intentionally added PFAS in cosmetics — stricter than the current EU position. Federal FDA guidance is actively evolving. ISO 22716 addresses none of this; it’s a process standard, not a substance standard.

Gap 5: Fragrance Allergen Disclosure Requirements Are Diverging

The EU’s fragrance allergen disclosure regime was substantially expanded by Commission Regulation (EU) 2023/1545, which requires disclosure of 88 fragrance allergens at concentrations above 0.001% in leave-on products and 0.01% in rinse-off products. This is a significant expansion from the previous 26-allergen list and affects virtually every fragrance-containing product reformulated or placed on the market since 2025.

FDA has no equivalent list-based disclosure system currently in force, but MoCRA Section 608 directs the FDA to develop a fragrance allergen disclosure rule, including a list of allergens requiring on-label disclosure. The FDA issued a proposed rule in 2024; a final rule will create US-specific labelling obligations that won’t map cleanly onto the EU’s 88-allergen framework.

The operational risk is subtle but real: a European brand reformulating to meet the EU’s expanded allergen disclosure requirements may assume EU disclosure is sufficient for US labelling, then find itself out of compliance once FDA’s final rule takes effect.

Building a Dual-Compliance GMP System Without Starting From Scratch

The solution isn’t to abandon ISO 22716 — EU compliance demands it, and it’s an excellent quality foundation. The goal is to layer MoCRA-specific requirements on top of your existing ISO 22716 quality management system, not run parallel systems.

In practice, that means addressing five areas:

Documentation architecture. Your quality manual should explicitly address FDA facility registration, serious adverse event reporting procedures with a 15-business-day escalation pathway, and records retention aligned with MoCRA’s 6-year requirement. Map these against your existing ISO 22716 procedures clause by clause.

Facility registration. Complete FDA registration via the Unified Registration and Listing System (URLS) before any US-bound shipment. Build biennial renewal — October through December of even-numbered years — into your regulatory calendar.

US agent appointment. Designate a US-based agent before your first US shipment. This is typically a regulatory consulting firm or a US distributor with appropriate contractual authority. It’s not optional for foreign facilities, and it’s not the same role as your EU Responsible Person.

Ingredient screening workflow. Your raw material qualification process under ISO 22716 should include a US-specific ingredient review layer. Annex II screening is necessary but not sufficient. Consider building a dual-jurisdiction ingredient database — or working with a partner lab that maintains one — so that new formulations are cleared against both EU Annex II and FDA’s adulteration framework before scale-up.

Labelling dual-review. Label artwork should pass simultaneous EU (Regulation 1223/2009 Article 19) and US (21 CFR 701) compliance checks. These can be run against a single review template, but they need separate sign-off criteria — presentation order, language requirements, and net quantity statement formatting differ materially.

We work with European cosmetics manufacturers across France, Germany, the Netherlands, and Benelux to build exactly this kind of dual-compliance system. In our experience, the documentation gap — not the formulation gap — is where most market entry delays occur. A facility that’s been ISO 22716-certified for years usually has solid processes; what it typically lacks is the FDA-specific procedural layer and the US regulatory relationships that MoCRA now demands.

Done methodically, EU-to-US market entry for a cosmetics manufacturer is achievable on a structured, predictable timeline. The prerequisite is not assuming that what satisfies the ANSM will automatically satisfy the FDA — and running the gap analysis before your first shipment, not after your first import refusal.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• FDA 21 CFR compliance and ISO 17025-accredited cosmetics testing for US market entry — Qalitex Laboratories supports foreign manufacturers with ingredient screening, finished-product testing, and FDA compliance documentation.
• Health Canada cosmetics and NHP registration support for European brands — Androxa helps European brands navigate Canada’s parallel cosmetics and natural health product framework under NHPD and the Cosmetic Regulations.