Malaysia Cosmetic GMP (ASEAN Cosmetic GMP and ISO 22716)

In Malaysia, cosmetics run on a notification system rather than pre-market approval, managed by the National Pharmaceutical Regulatory Agency (NPRA) under the Ministry of Health per the Control of Drugs and Cosmetics Regulations 1984, and fully aligned with the ASEAN Cosmetic Directive (ACD). Although the system does not review products one by one, it shifts quality responsibility upstream to Good Manufacturing Practice (GMP) at the manufacturing end: any cosmetic to be notified for market in Malaysia must have its manufacturing plant meet the ASEAN Cosmetic GMP guideline—this is the underlying condition for whether a notification can be established and whether a product can stay on the market.

The regulatory coordinates of cosmetic GMP

Cosmetic GMP is not the same as pharmaceutical GMP. Drug manufacturers follow PIC/S GMP (for pharmaceuticals, the strictest); cosmetics follow the ASEAN Cosmetic GMP guideline, whose content is collected in Annex I Part 11 of NPRA's Guidelines for Control of Cosmetic Products in Malaysia. NPRA additionally lists equivalently recognised standards in Annex I Part 12, "List of Equivalent Cosmetic GMP Guidelines," among which ISO 22716:2007 (cosmetic GMP) is recognised as equivalent. That is, obtaining ISO 22716 certification can serve as evidence of compliance with ASEAN Cosmetic GMP.

What aspects does GMP cover

ASEAN Cosmetic GMP revolves around "consistent, safe, traceable," with core chapters covering: personnel and training, premises and equipment, raw material and packaging material management, production and process control, quality control (QC), finished product release, storage and transport, complaints and recalls, internal audit and documentation records. Among these, quality control is an essential part of GMP, providing the assurance that a product is "consistent in quality between batches and fit for its intended use"; before release, every batch of finished product should complete the prescribed testing and retain the data to ensure it meets the established specification. Raw materials and packaging materials must have their sources controlled through incoming-material inspection and supplier records, to prevent non-conforming or adulterated ingredients entering the line.

Plant inspection and document preparation

When facing an NPRA plant inspection or internal audit, complete documentation is often the key to whether you pass. It is advisable to prepare in advance: the various standard operating procedures (SOPs), batch production and packaging records, raw material/packaging material incoming inspection and supplier data, finished product QC and release records, equipment and environmental cleaning and calibration records, employee training records, and records of complaint, return and recall handling. These documents are both a focus of the plant inspection and the basis for tracing batches and defining responsibility later. In practice, pay attention to version control and complete sign-off, avoiding handwritten alterations, missing signatures or records that do not match the actual process—these are all common deductions in audits.

The difference between local manufacturing and imports

• Local manufacturing plants: a new manufacturer or a new production line must undergo NPRA's GMP plant inspection before cosmetic notification; only after passing can it notify, and it remains subject to periodic GMP audits thereafter to ensure ongoing compliance.
• Imported products: overseas plants usually demonstrate compliance with the equivalent standard through their local/international GMP (such as ISO 22716); the local responsible company (CNH, i.e. Company Named in Notification) holds the notification and bears market responsibility. Whether local or imported, GMP documents should be included in the Product Information File (PIF) for inspection.

Common mistakes

• Mistaking ISO 9001 (quality management system) for cosmetic GMP—the two differ; GMP corresponds to ISO 22716.
• Assuming a successful notification exempts you from plant inspection—local plants still face prior inspection and periodic audits.
• GMP documents disconnected from the PIF, so process and QC records cannot be produced at audit.
• When outsourcing manufacturing (OEM/ODM), looking only at the contractor's quote without confirming whether it holds NPRA-recognised cosmetic GMP; if the contractor is non-compliant, the brand's held notification is affected too.
• Passing off the overseas parent company's pharmaceutical GMP certificate as cosmetic GMP—the two standards differ and cannot replace each other.

Frequently asked questions (FAQ)

Q: Must cosmetics have GMP to be sold in Malaysia? Yes. The manufacturing plant must meet ASEAN Cosmetic GMP; this is the prerequisite for a cosmetic notification to be established, and local plants must first pass NPRA plant inspection.

Q: Is ISO 22716 equal to ASEAN Cosmetic GMP? NPRA recognises ISO 22716:2007 as an equivalent standard in Annex I Part 12, which can serve as evidence of compliance with cosmetic GMP, but local plants are still subject to NPRA plant inspection and periodic audits.

Q: Is cosmetic GMP the same as PIC/S pharmaceutical GMP? No. PIC/S is GMP for pharmaceuticals; cosmetics follow ASEAN Cosmetic GMP / ISO 22716; the two systems and their inspecting authorities differ and cannot replace each other.

Q: Does the overseas plant of an imported cosmetic also get inspected by NPRA? Usually NPRA does not inspect overseas plants one by one, but the overseas plant must hold equivalent GMP (such as ISO 22716), and the relevant evidence and process documents should be included in the PIF for inspection.

Q: Do GMP records have to be retained? Yes. Batch records, QC data, complaint and recall records, etc. are all GMP documents and should be kept complete and available for audit and tracing.

Self-check checklist

• [ ] The manufacturing plant meets ASEAN Cosmetic GMP or the equivalent ISO 22716
• [ ] A new local plant/new production line has passed NPRA's prior plant inspection
• [ ] Quality control and batch release have complete records
• [ ] GMP-related documents are included in the Product Information File (PIF)
• [ ] Periodic internal audits are conducted and complaint/recall records retained

Conclusion: In Malaysia, the quality defence line for cosmetics is built on manufacturing-end GMP. Recognise that "cosmetic GMP ≠ pharmaceutical PIC/S," make good use of the ISO 22716 equivalence route, and link GMP documents with the PIF and the notification, and your product can stand firm. Want to confirm whether your ingredients and labelling are compliant? Run a free label check now

Further reading: Malaysia cosmetic NPRA notification overview, cosmetic notification process and CNH, Product Information File PIF and safety assessment.

This article is compiled from official sources for reference only; actual compliance is subject to the latest official texts and reviews of the competent authorities.