Certificates are the most requested and least examined documents in cosmetics sourcing. This page explains what each one covers, so a certificate tells you something rather than reassuring you.
GMPC — Good Manufacturing Practice for cosmetics
GMPC is a manufacturing standard covering premises, equipment, personnel, documentation, process control and quality assurance. It certifies the facility and its systems, not any individual product. Two important consequences: a GMPC certificate does not mean a specific formula is safe, and the certificate has a scope that lists the product categories audited — check that your category is inside it.
ISO 22716
ISO 22716 is the international standard for cosmetics GMP, structurally similar to GMPC with a different auditing lineage. Many facilities hold both because different buyers ask for different ones. Neither replaces product-level testing.
Halal
Halal certification for cosmetics addresses ingredient origin — alcohol, animal-derived materials, and cross-contamination in production — and, in stricter schemes, the whole supply chain. It is scheme-specific: a certificate from one body is not automatically accepted by another. If your market requires Halal, confirm which body the regulator or retailer recognises before production, not after.
Vegan and cruelty-free
These are usually self-declared or third-party registered claims rather than manufacturing certifications. Vegan addresses animal-derived ingredients; cruelty-free addresses animal testing. They are independent: a product can be vegan and tested on animals, or cruelty-free and contain beeswax. Both claims also depend on suppliers, so they need documentation from raw material vendors.
ISO 9001 and ISO 14001
ISO 9001 is general quality management and ISO 14001 is environmental management. Useful signals about how a company is run, but neither is a cosmetics-specific safety or GMP standard. Do not accept them as a substitute for GMPC or ISO 22716.
Product-level documents, which matter more
- Certificate of analysis (COA) — batch-specific test results
- MSDS / SDS — handling and transport safety
- Stability and compatibility reports — does the product survive its shelf life
- Microbiological challenge test — does the preservation system hold
- CPSR — the EU safety report required before CPNP notification
- SPF and clinical test reports, where claims depend on them
How to verify a certificate
Check the certificate number on the issuing body's own website, not on the supplier's. Confirm the legal entity name matches the company you are contracting with — group structures often mean the certificate belongs to a different legal entity than the one invoicing you. Check the expiry date and the audit scope. Then ask for the most recent audit report summary, which is harder to fake than a PDF certificate and tells you far more.
If a supplier hesitates on any of these four steps, that hesitation is the answer.