Ask ten factories for their certificates and you get ten different lists. The lists look impressive and tell you very little, because certificates cover different things: some audit the factory, some audit a product, and some only cover a claim. Here is how to read the pile.
Two certificates that describe the factory
GMPC and ISO 22716 both describe how a site is run — documentation, batch records, cleaning, training, deviation handling and traceability. GMPC is the older cosmetics guideline used by the US FDA and ASEAN schemes; ISO 22716 is the international standard and the one EU customers recognise. A site audited to ISO 22716 is normally also compliant with GMPC, not the other way round.
What it proves: the factory can make a batch the same way twice and can show you the records. What it does not prove: that your product is safe, legal or effective.
FDA: registration is not approval
The US has no pre-market approval for cosmetics. "FDA registered" describes a facility listing, not a certified product. Under the current MoCRA rules the documents that matter are the facility registration and the product listing, so ask for the registration number and check it in the FDA database rather than accepting a certificate-shaped PDF.
Halal, vegan and cruelty-free: claims, not competence
Halal — JAKIM, MUI or a local body — covers ingredients, cross-contamination and often the production line itself. Vegan and cruelty-free certify a supply-chain decision. None of them say anything about whether the factory can hold a fill weight. They matter for market entry in Malaysia, Indonesia and the Gulf, and they are usually checked last, after the manufacturing documents.
Four checks before you accept a scan
- Read the scope. A certificate for a cream emulsion unit does not cover your serum. The scope line has to name the product types you are actually buying.
- Read the expiry date. ISO 22716 runs on a three-year cycle with annual surveillance audits. A certificate dated 2021 with no renewal behind it is a historical document.
- Read the legal name. The certificate must name the entity that invoices you, at the address that ships. Sister companies in the same group are common and are not interchangeable.
- Verify at the source. Bureau Veritas, SGS, Intertek and JAKIM all publish verification portals. A certificate that cannot be found there is worth nothing, however good the scan looks.
What we send with every quote
ISO 22716 from Bureau Veritas, GMPC, JAKIM Halal for our Malaysia site, plus the product-level pack: MSDS, stability data, challenge test and a CPSR input file your safety assessor can sign off quickly. If a buyer needs a certificate we do not hold, we say so in the first reply rather than in month three.