Thai FDA GMP vs ISO 22716: What Buyers Need to Verify

What each one actually is

ISO 22716 is an international standard published by the International Organization for Standardization that sets out guidelines for good manufacturing practices for cosmetics. It covers the practical disciplines of making a cosmetic product: personnel and training, premises, equipment, raw material and packaging control, production, finished product handling, quality control laboratory operations, treatment of out-of-specification product, waste, subcontracting, deviations, complaints, recalls, change control and documentation. It is a voluntary standard. A manufacturer demonstrates conformity by engaging an accredited third-party certification body, which audits the site and issues a certificate with a defined scope and validity period, usually with surveillance audits in between.

Thai FDA GMP refers to cosmetic good manufacturing practice as administered by Thailand's Food and Drug Administration, the national regulator for cosmetics in Thailand. Thailand's cosmetic framework sits within the ASEAN harmonisation arrangement, and the ASEAN cosmetic GMP guidelines are closely aligned in content with ISO 22716 — which is precisely why the two documents look so similar when you read them side by side. The Thai FDA assesses manufacturers and issues GMP certification for cosmetic manufacturing sites.

So the honest summary is this: the technical content of the two is largely convergent. The difference that matters to you as a buyer is not what is written in the standard. It is who issued the document, what scope it covers, whether it is still valid, and what consequences follow if the site stops complying. Because the details of Thai requirements are updated from time to time, verify current specifics directly with the Thai FDA rather than relying on a summary, including this one.

The real difference: issuer, enforcement and consequence

Four differences change how much weight you should give each document.

Issuer and accountability. An ISO 22716 certificate comes from a private certification body, which is itself accredited by a national accreditation authority. Thai FDA GMP certification comes from the regulator that has statutory authority over cosmetic manufacturing in Thailand. One is a voluntary conformity assessment; the other sits inside a regulatory system.

What failure means. If a site drifts out of conformity with ISO 22716, the certification body can suspend or withdraw the certificate — a commercial consequence. If a site falls short of regulatory requirements, the consequences lie with the regulator and can affect the site's ability to operate or to have products accepted. For a buyer, that difference tells you which document carries more weight in the country of manufacture.

Recognition abroad. ISO 22716 is widely recognised internationally and is often the document overseas buyers, distributors and retailers ask for by name, because it is the same standard everywhere. A national GMP certificate is authoritative at home but may be unfamiliar to a buyer in another region, which is one reason many export-oriented sites hold both.

Scope definition. This is where buyers get caught. Both kinds of certificate have a scope — specific facilities, specific product categories, sometimes specific lines. A certificate that covers a liquids and creams line does not automatically cover an aerosol line, a hot-fill wax line, or a powder line in the same building. Always read the scope, not the headline.

What neither certificate tells you

This section is the one buyers most often need and least often get, so it is worth being blunt. A GMP certificate of either kind tells you that a site was assessed against a set of manufacturing disciplines at a point in time, within a defined scope. It does not tell you:

• Whether your product will be good. GMP governs how consistently a site makes what it is asked to make. It says nothing about the quality of the formula you agreed, the grade of raw materials you chose, or whether the texture will satisfy your customers.
• Whether they can make your format. Capability is specific. A site with excellent systems may simply lack the right filling equipment for your product.
• Whether the formula is legal in your market. Ingredient restrictions, permitted claims and registration requirements are set by the authority in the country where you sell, and they differ. A certificate from the country of manufacture does not substitute for that.
• Whether the certificate is current. Certificates expire, get suspended, and change scope. A scanned PDF with a date on it proves very little by itself.
• Who actually makes the goods. A trading company can present a certificate belonging to a factory it buys from. The certificate holder's name must match the entity you are contracting with, or you need to understand the relationship.
• Commercial reliability. On-time performance, responsiveness, and how a supplier behaves when something goes wrong are not audited by either standard, and they are what you will live with.

How to verify a certificate claim

Treat every certificate as a claim to be checked, not a document to be filed. A verification routine that takes a few days:

First, get the certificate as a full document, not a cropped image. You need the certificate number, the exact legal name and address of the certified site, the scope statement, the issue and expiry dates, and for ISO 22716 the name of the certification body.

Second, check the issuer independently. For an ISO certificate, confirm the certification body is accredited and ask them or search their public client directory to confirm the certificate is live and in the stated scope. For a national certificate, verify through the issuing authority's own channels. If verification is refused or impossible, that is information.

Third, match the names. The certified legal entity must be the entity on your contract, invoice and purchase order. If the names differ, ask for the ownership or supply relationship in writing. This single check catches a large share of misrepresentation.

Fourth, read the scope against your product. Ask explicitly: is my product format inside this scope, and which line will run it?

Fifth, ask for the audit history: when was the last audit, what type, and were there findings. A manufacturer confident in its systems will discuss this.

Sixth, verify at the site. A video walkthrough is a reasonable minimum; an in-person visit or a commissioned third-party audit is better before a significant commitment. When you are comparing several **Thai OEM/ODM factories**, apply the identical routine to each — inconsistent diligence is how a shortlist gets decided by whoever answered fastest.

Using both in a buyer's checklist

In practice you are not choosing between the two documents. You are using them as two of several inputs. A workable sequence:

Start with regulatory standing in the country of manufacture. For a Thai site, that means the certification and licensing the Thai FDA requires for the category you are making. This is the baseline; a site without it is not a candidate, whatever else it holds.

Add ISO 22716 as evidence of an internationally recognised quality system, particularly if you will sell into markets or retailers that ask for it by name. Many export-focused sites hold both, and a site that holds only a national certificate is not disqualified — it may simply serve a domestic market.

Layer category-specific certifications where they are relevant to your product and your market, and discuss them in general terms until you have seen and verified the documents. Halal, organic and similar schemes are separate systems with their own scopes and issuing bodies.

Then add what no certificate covers: format capability demonstrated with examples, in-house versus outsourced testing, documentation the site can issue per item and per batch, change control, and how they handle a deviation.

Finally, keep the paperwork live. Diarise expiry dates and re-verify before each significant order. If you work through an intermediary that coordinates production across a **partner factory network**, ask which specific site will run your product and verify that site's documents — the coordinator's own credentials are not a substitute. The same applies to **global sourcing** across multiple countries: verify per site, per scope, every time.