Why ISO 22716 is Saving Our Skins (and Millions of Dollars)

MoCRA & the FDA Dragnet: What Every Cosmetics Brand Must Know（Cosmetic Compliance）

Hi there. I’m Donny, and I’m a senior formulation chemist here at Beslocosmetics. If you were to walk into my lab right now, you’d probably find me staring intensely at a newly developed emulsion, agonizing over the perfect shear rate or tweaking a preservative system to survive an oven stability test. For a long time, that was my entire world—beakers, homogenizers, rheometers, and the endless pursuit of the perfect skin feel.

But over the last few years, the reality of my job has completely transformed. It’s no longer just about making a product that feels luxurious and performs beautifully. It is about making sure that the very creation of that product doesn’t accidentally bankrupt our company or our clients.

The global cosmetic manufacturing landscape has shifted violently. We are living through what I can only describe as a historic regulatory inflection point. The days of “mix it, bottle it, and ship it” are dead and buried. Today, the international supply chain is an intricate minefield of compliance, and as an OEM/ODM manufacturer, Beslocosmetics is standing right on the front lines.

I want to talk to you today not just about ingredients, but about the terrifying, yet absolutely essential, evolution of cosmetic compliance—specifically how we moved from the comforting (but flawed) embrace of GMPC to the rigid, life-saving structure of ISO 22716, and how navigating US and EU regulations is the only thing keeping us from million-dollar disasters.

The Illusion of Safety: Why GMPC Had to Go

If you’ve been around the industry as long as I have, you remember when GMPC (Good Manufacturing Practice for Cosmetics) was the gold standard. Whether it was the US version, the EU version, or the ASEAN version, having that GMPC certificate on the wall meant you were a “good factory.”

But let me tell you a secret from the factory floor: GMPC was largely a fragmented, regional checklist. It was heavily focused on the physical environment. Did your staff wear hairnets? Yes. Were the floors clean? Yes. Did you wash the tanks? Yes. It was an encouraging set of guidelines, but it fundamentally lacked teeth on a global scale.

Because it lacked a unified international accreditation body, a GMPC certificate from one region meant practically nothing in another. As Beslocosmetics started expanding our export operations, we found ourselves drowning in redundant audits. Every buyer from a different country wanted something slightly different.

More importantly, from a formulation and quality control perspective, GMPC was too shallow. It looked at the final result rather than the deep, systemic roots of quality. It didn’t force us to look upstream at our raw material suppliers with enough scrutiny, nor did it mandate the kind of aggressive, closed-loop Corrective and Preventive Actions (CAPA) that truly prevent recurring issues.

That’s why the industry’s shift toward ISO 22716:2007 wasn’t just a bureaucratic update; it was a systemic downgrade of the old ways. ISO 22716 isn’t just a checklist; it’s a living, breathing quality ecosystem. It forces us to trace everything—from the moment a barrel of glycerin hits our loading dock to the exact pallet a finished lotion sits on in a warehouse in California. It changed my life in the lab because suddenly, my formulations had to be born into a system of total traceability and rigorous risk assessment. It became the absolute baseline for survival.

The MoCRA Earthquake and the FDA’s New Muscle

If you want to know what keeps a formulator awake at night in 2026, it’s a five-letter acronym: MoCRA.

When the US passed the Modernization of Cosmetics Regulation Act in 2022, it was the biggest shakeup to FDA authority since 1938. Before MoCRA, the FDA’s approach to cosmetics was mostly reactive—they’d catch things on the market and issue recalls. Now? They have built an inescapable digital dragnet.

Here at Beslocosmetics, we had to completely overhaul our US export strategy. MoCRA mandates that every single facility manufacturing cosmetics for the US market must be registered and obtain an FDA Establishment Identifier (FEI). Furthermore, every single product I formulate has to be listed with the FDA, detailing its ingredients and the facility it was made in.

Do you realize the data visibility the FDA has now? They have millions of product listings cross-referenced with thousands of facilities. If a specific raw material—let’s say a certain botanical extract from a specific global region—suddenly shows a safety signal for contamination, the FDA can press a button and instantly see every single product Beslocosmetics has formulated using that ingredient. They can implement targeted interventions before the product even hits the retail shelves.

This brings me to the terrifying reality of Import Alerts and the “Detention Without Physical Examination” (DWPE) mechanism. If the FDA decides your facility or your products are non-compliant, they put you on a Red List. Your goods arrive at a US port and are instantly detained. No testing, no questions asked. The burden of proof completely shifts to us, the manufacturer, to pay for exorbitantly expensive third-party lab testing just to prove our innocence.

I read FDA Warning Letters like some people read true crime novels. They are cautionary tales. Take the case of a competitor factory in Xiamen a couple of years ago. The FDA walked in and found their purified water system was stagnant, breeding biofilms. In the formulation world, water is your most critical, and most dangerous, ingredient. Microbes love it. When I read that their management told the FDA “microbial growth is inevitable,” I nearly dropped my coffee. Under ISO 22716, that kind of attitude is grounds for immediate termination. We constantly monitor our reverse osmosis systems, pressure, and temperature precisely because biofilms are a death sentence for a product.

Even worse, that factory was accepting raw materials like glycerin and ethanol blindly based on the supplier’s Certificate of Analysis (COA). Any chemist worth their salt knows you have to test ethanol for methanol, and glycerin for Diethylene Glycol (DEG)—impurities that have literally killed people. At Beslocosmetics, our ISO 22716 protocols mandate independent verification. I don’t care how nice a supplier’s COA looks; until our internal QC lab runs the GC-MS tests and confirms the identity and purity, that raw material does not touch my compounding tanks.

Data Integrity and the “Responsible Person” Trap

Another thing MoCRA brought into sharp focus was data integrity. You can’t just write test results in a notebook with a pencil anymore. The FDA wants to see 21 CFR Part 11 compliance. They want audit trails on our lab equipment.

I remember the headache of upgrading our lab systems. Now, every analyst has their own login for the LIMS (Laboratory Information Management System) and the chromatographs. If a Junior Chemist re-integrates a peak on a preservative assay, the system logs who did it, when, and why. There is no “recycling bin” for bad data. You can’t hide a failed test. If a batch fails, we launch a full CAPA investigation. It’s rigorous, it’s stressful, but it makes the products bulletproof.

As an OEM, we also had to get really smart about legal boundaries. A lot of contract manufacturers try to be “one-stop shops” for their clients and accidentally register themselves as the “Responsible Person” (RP) under MoCRA. That is financial suicide. The RP is legally on the hook for serious adverse event reporting, safety substantiations, and endless liability. At Beslocosmetics, we act solely as the registered manufacturing facility. We provide a registered US Agent for communications, but our brand clients—the ones marketing and selling the product—take on the role of the RP. We build the legal firewall so we can focus on what we do best: safe, compliant manufacturing.

Navigating the European Fortress

If the FDA is focused on facilities and processes, the European Union is obsessed with toxicology and paperwork. The EU Cosmetics Regulation (EC) No 1223/2009 is arguably the most stringent regulatory framework on the planet, and it shapes every single decision I make at the lab bench.

You literally cannot sell a cosmetic in the EU without a Product Information File (PIF) that includes a mandated declaration of GMP compliance based specifically on ISO 22716. But the real monster inside the PIF is the Cosmetic Product Safety Report (CPSR).

As a formulator, creating a product for the EU means working hand-in-hand with a certified Safety Assessor (usually a toxicologist). I can’t just throw in a nice fragrance or a new emulsifier because it feels good. I have to calculate the exact systemic exposure dosages for the consumer. I have to provide challenge testing data, stability data, and trace impurity profiles for every single raw material.

I was reading up on some recent updates because, let’s face it, keeping track of the EU regulations is practically a full-time job in itself. If you’re ever curious about the nitty-gritty of how this impacts product development, there’s a really solid breakdown on understanding EU Cosmetic Regulation (EC) 1223/2009 in product development that I actually force our junior formulators to read. It perfectly captures why we have to be so meticulous from day one.

The EU’s Safety Gate (formerly RAPEX) alert system is ruthless. They actively hunt down banned CMR (Carcinogenic, Mutagenic, or Reprotoxic) substances. Take Lilial (BMHCA), a fragrance allergen that used to be in everything. When the EU banned it, we saw hundreds of products ripped off shelves across Europe in a matter of weeks. Now, they are coming down hard on PFAS (forever chemicals).

This is why formulation is now an act of constant surveillance. Before I even write the first draft of a formula on my computer, I cross-reference our ingredient database against the latest EU annexes and California Proposition 65 lists. If a raw material supplier can’t provide a pristine toxicology dossier, I don’t use their ingredient. Period. The risk is simply too high.

The Mathematics of Disaster

So, why do we go through all this trouble? Why did Beslocosmetics invest heavily in ISO 22716 certification, digital audit trails, and agonizingly slow raw material verification?

Because the economics of non-compliance are apocalyptic.

Industry studies show that a major consumer product recall costs an average of 10 million dollars in direct costs alone. That’s the reverse logistics, the notifications, the physical destruction of the goods, and the overtime pay.

But honestly, that 10 million is just the tip of the iceberg. The real killer for an OEM/ODM like us is business interruption. If the FDA puts us on an Import Alert and shuts down our US exports, our cash flow freezes. We’d have idle production lines, canceled contracts, and rent still due.

Then comes the brand death. In a world where regulatory actions are public information, getting flagged by the FDA or the EU Safety Gate is a permanent stain. It’s called the “delisting effect.” Once you are viewed as a liability, retailers drop your clients’ SKUs, and those brand clients immediately terminate their contracts with you. A single contaminated batch of lotion—caused by trying to save a few pennies on unchecked glycerin—can trigger a geometric multiplier effect that wipes out a multi-million dollar business.

Commercial insurance rarely covers the true cost of a recall, and specialized product recall insurance is exorbitantly expensive and hard to claim. The only real insurance is doing it right the first time.

The Future from the Bench

I’ve spent my entire career making cosmetics, and while the regulatory burden today is heavier than it has ever been, I honestly welcome it.

Yes, it takes me twice as long to get a formula approved for production. Yes, the paperwork can be mind-numbing, and fighting with suppliers over trace impurity data is exhausting. But when I look at a finished Beslocosmetics product rolling off our automated filling lines, I know with absolute certainty that it is safe.

By embracing ISO 22716, adopting unshakeable data integrity, and respecting the immense power of MoCRA and EU regulators, we aren’t just jumping through hoops. We are building a fortress of trust for our clients. In this industry, trust is the only currency that really matters. The global market is too competitive, and the risks are far too high, to operate any other way.

Now, if you’ll excuse me, I have a stability test in the oven that needs checking. Stay safe out there.