Cosmetic Manufacturing Agreement: Quality, Change and IP

A cosmetic manufacturing agreement decides who is responsible when something changes or goes wrong: a supplier is swapped, a batch fails, a customer reports a reaction, or the brand moves production. Price and MOQ get the attention during sourcing; the agreement is what you rely on later.

This is a pre-signing checklist for brands working with an OEM, ODM or private label manufacturer: what to settle, who usually owns each decision, and where the law already assigns the answer.

Two documents, not one: the manufacturing agreement and the quality agreement

Most well-run projects use two linked documents.

The manufacturing (or supply) agreement is the commercial contract. It covers what is being made, ordering and forecasting, pricing and payment, intellectual property, confidentiality, liability, insurance, term and termination, and how disputes are resolved.

The quality agreement is the technical document that turns good manufacturing practice into named responsibilities. It says who writes and approves specifications, who releases each batch, how deviations and out-of-specification results are handled, what counts as a change and who must approve it, which records are kept and for how long, and how complaints and recalls are run.

Keeping them separate is a practical choice, not a legal requirement: quality terms are revised more often than commercial ones. Link them by stating that the quality agreement forms part of the contract and which document wins if they conflict.

Why it matters legally: in the EU, Regulation (EC) No 1223/2009 requires cosmetic manufacture to comply with good manufacturing practice (Article 8), and compliance is presumed where production follows the harmonised standard, EN ISO 22716. In the US, MoCRA requires FDA to set GMP regulations for cosmetic facilities. Check the current status, because FDA's published GMP material at the time of writing is still a non-binding draft guidance. Either way, the quality agreement is where the shared GMP duties are divided between brand and factory. For background on the standard itself, see our ISO 22716 and GMPC guide.

Start with who the "responsible person" is

Before negotiating anything else, settle who carries the legal responsibilities in each market, because the contract cannot move them.

• EU: a product can only be placed on the market if a responsible person established in the EU is designated. A manufacturer outside the EU must appoint one by written mandate, and for imported products the importer is the responsible person unless it designates someone else in writing (Article 4). That person keeps the product information file for ten years after the last batch is placed on the market (Article 11) and must act on non-compliance, including withdrawal or recall (Article 5).
• US: under MoCRA, the responsible person is the manufacturer, packer or distributor whose name appears on the label. That person must list products with FDA, keep safety substantiation records and report serious adverse events. The facility that manufactures or processes the product must register with FDA and renew every two years (FDA MoCRA overview).

In most projects the brand or its importer is the responsible person and the overseas factory is the manufacturer. The agreement should make the factory's support concrete: which documents it supplies for the product information file or safety substantiation, how fast, and how it cooperates with an authority's request. See our MoCRA compliance guide for the US detail.

Specifications, approved samples and batch release

Disputes about "bad batches" usually come from a specification that was never written down. Agree these before the first production order:

• Product specification: appearance, colour, odour, pH, viscosity and any other measurable parameters, with acceptance ranges and test methods. Include the microbiological criteria and the stability basis the shelf life relies on. See our stability testing guide.
• Approved formula version: the exact formula, with a version number and date, that the specification belongs to.
• Approved sample: a retained, signed and dated reference for sensory attributes that numbers cannot fully describe. State who holds it, how long it is retained and what tolerance applies.
• Raw materials and packaging: approved suppliers or grades where they matter, and component specifications for bottles, closures, pumps and labels. Pack compatibility should be part of the approval, not an afterthought; see packaging compatibility testing.
• Batch release: who tests, against which specification, and who signs. Many projects have the factory release against the agreed specification and the brand confirm acceptance within an inspection window. Either way, state who decides on rework or destruction of a failed batch, and who pays.

The cosmetic manufacturing process guide walks through where release sits in production.

Change control: the clause that prevents silent reformulation

A product can drift from what you approved without bad faith: a material is discontinued, a supplier or line changes, a test method is updated. Change control makes these visible before they reach customers.

Define in the quality agreement which changes need prior written approval from the brand, which need notification only, and which can be handled internally with a record. Buyers commonly put these in the prior-approval category:

• any formula change, including concentration adjustments and substitutions;
• a change of raw material supplier or grade for listed or critical materials;
• primary packaging changes, including material, supplier, closure or pump;
• a change of manufacturing site, line or key process step;
• a change of release test method or specification limit;
• anything that changes label content, the ingredient list, claims or regulatory information.

For each change, agree the evidence required (comparative tests, stability or compatibility data), who decides on retesting or re-notification, and who pays. Record every change with its date, first affected batch and approver; without that, traceability in a complaint becomes guesswork.

Formula ownership and intellectual property

Paying a development fee does not, by itself, settle who owns a formula. Ownership depends on what the contract says, and on the law that governs it. Write it down explicitly rather than assuming.

Separate these questions:

• Background IP: what each party brings in. A manufacturer's base formulas, know-how and processes usually stay its own.
• Foreground IP: what is created during the project, and who owns it once created.
• Licence instead of ownership: if the manufacturer keeps ownership, what licence the brand receives. Is it exclusive or non-exclusive, and limited by territory or product category? How long does it last, and does it survive termination?
• Exclusivity: whether the manufacturer may sell the same or a substantially similar formula to others, and how "substantially similar" is judged.
• Technology transfer: if the brand may move production, what the manufacturer must hand over. That can include the full formula, raw material specifications and suppliers, process instructions and test methods. Agree when the handover happens and at what cost.
• Confidentiality: which information is covered, how long the duty lasts, and how it applies to the manufacturer's subcontractors and staff.
• Brand assets: trademarks, artwork and label files, and who may use them.

The models start from different positions: a private label catalogue formula is normally licensed, not sold; an ODM development can go either way; under OEM the brand typically supplies a formula it already controls. See what formulation quotes include for how published contracts split ownership and buy-outs, and OEM vs ODM for choosing the model.

Subcontracting, audit rights, records and traceability

Subcontracting. Decide whether the manufacturer may subcontract any manufacturing, filling, testing or storage. If it can, require your prior approval and require the subcontractor to work under equivalent quality terms. The manufacturer should stay responsible to you for its subcontractors.

Audit rights. Agree how often you can audit, with how much notice, and for what reasons. Common triggers include a serious complaint, a critical deviation or a site change. Also agree whether remote audits are acceptable and how findings are closed. Our factory audit checklist and factory audit page cover what to look at once you are inside.

Records. List the records kept, for how long, and how fast they reach you or an authority. FDA's draft GMP guidance recommends batch records that capture each ingredient's lot and quantity, every production step, in-process checks, batch and finished-product lot numbers and the accept/reject decision, and records adequate for an effective recall. That is a benchmark, not a legal requirement. Under MoCRA, FDA can access certain cosmetic records when specific conditions are met (records access draft guidance), so require the manufacturer's cooperation.

Traceability. In the EU, the label must carry a batch number or another reference that identifies the product (Article 19(1)(e)). The contract should make sure that number links back to the raw material lots, packaging lots, batch record, release result and shipment for that batch. A simple test before signing is to ask the manufacturer to trace one past batch both ways, from a finished lot back to raw material lots and from a raw material lot forward to the shipments that contained it.

Complaints, adverse events, recalls and CAPA

Legal deadlines sit with the responsible person. Under MoCRA, the responsible person must report a serious adverse event to FDA within 15 business days of receiving it, with a copy of the label. Adverse event records must be kept for six years, or three years for qualifying small businesses (MoCRA, H.R. 2617). In the EU, the responsible person and distributors must notify serious undesirable effects to the competent authority without delay (Article 23).

The agreement should therefore cover:

• Notification: how quickly each party tells the other about a complaint, an adverse event or a quality signal. The manufacturer's deadline to the brand needs to leave the brand time to meet its own legal deadline.
• Investigation: who investigates, which retained samples and batch records are checked, and whether independent testing is used. Set when an investigation report is due.
• CAPA: who decides root cause and corrective and preventive actions, and how their effectiveness is checked.
• Returns: how returned or rejected goods are handled and recorded.
• Recall: who decides on a recall or withdrawal, who talks to authorities and customers, and how costs are shared when the cause is a manufacturing fault, a brand-supplied specification or label, or something unclear. In the EU the responsible person must act on non-compliance, including recall (Article 5), and authorities can require it, including for GMP non-compliance (Article 25). In the US, FDA can order a mandatory recall if the responsible person refuses to recall voluntarily (mandatory recall guidance).

FDA's draft GMP guidance also recommends written complaint procedures; ask to see the manufacturer's, not just a statement that one exists. Our quality control process page shows how release and investigation records connect.

Commercial terms to put on the negotiation list

These vary widely, so treat them as questions to settle, not standards to expect:

• Forecasts and orders: whether forecasts are binding, how far ahead, and how firm purchase orders are confirmed.
• MOQ: for the finished product and, separately, for packaging components and raw materials, which can be higher.
• Lead time: what starts the clock (approved artwork, approved sample, deposit, materials received) and what pauses it.
• Late delivery: what counts as late, what notice is given, and what remedies apply.
• Price changes: what can trigger a revision (raw material, packaging, currency, regulatory changes), with what notice and evidence.
• Raw material and packaging stock: who pays for materials bought against forecasts that are later cancelled.

Liability, insurance, termination and disputes

These carry the most legal risk and depend most on jurisdiction. Raise them early and take advice:

• Warranties: what the manufacturer warrants (conformity to specification, GMP, approved materials) and what the brand warrants (lawful formula, labels, claims and IP it supplies).
• Indemnities and limitation of liability: who covers third-party claims arising from each party's fault, and whether liability is capped or excluded for certain losses.
• Insurance: whether product liability and recall cover is required, and for whom.
• Term and termination: for what reasons the agreement can end, and with how much notice.
• Exit: what happens to remaining stock, work in progress, brand-specific packaging, moulds and tooling, retained samples, records and formula documents when the relationship ends.
• Governing law and disputes: which law applies, and whether disputes go to court or arbitration, where, and in what language. Consider whether a judgment or award would be enforceable where the other party's assets are.

Pre-signing checklist for buyers

• Responsible person named for each target market, with the manufacturer's support duties listed
• Quality agreement signed and referenced in the manufacturing agreement, with a precedence rule
• Product specification, formula version and approved sample identified and retained
• Batch release responsibility and rejected-batch handling written down
• Change categories defined: prior approval, notification only, internal record
• Formula ownership, licence scope, exclusivity and technology transfer stated explicitly
• Subcontracting rules and audit rights agreed
• Record types, retention periods and response times agreed; one batch traced both ways
• Complaint, adverse event, investigation, CAPA and recall responsibilities mapped to your legal deadlines
• Forecast, MOQ, lead time, delay and price-change terms negotiated
• Warranties, indemnities, liability limits, insurance, exit and dispute terms reviewed by a lawyer

Planning a project with us

Preparing an OEM or ODM project? Send your product brief, target markets and any draft quality agreement or specification. We will confirm which documents and records we can provide for that product and where your draft needs more detail. Our certifications page lists what you can verify before signing.

Frequently Asked Questions

What is the difference between a cosmetic manufacturing agreement and a quality agreement?

The manufacturing agreement covers the commercial relationship: ordering, price, IP, liability, termination and disputes. The quality agreement assigns the technical GMP responsibilities, such as specifications, batch release, deviations, change control, records, complaints and recalls. They are usually separate but linked, with a rule for which document applies if they conflict.

Do I own the formula if I pay for development?

Not automatically. Ownership depends on the contract and the law that governs it. If the agreement is silent, you may have less control than you expect. State who owns the result, what licence applies if you do not own it, whether it is exclusive, and what you receive if you move production.

Which changes should need my approval before they happen?

Buyers commonly require prior written approval for formula changes, raw material supplier or grade changes for critical materials, primary packaging changes, site or process changes, test method or specification changes, and anything affecting the label or regulatory information. The quality agreement should list these explicitly.

Who is responsible for a recall?

Legally, the responsible person in each market: the EU responsible person, or under MoCRA the company named on the label. The agreement should set how the manufacturer supports an investigation and recall, who communicates with authorities and customers, and how costs are shared depending on the cause.

How fast must the manufacturer tell me about a complaint?

No single rule applies to the manufacturer. The deadline should be set in the agreement and leave you time to meet your own obligations. For the US, MoCRA requires the responsible person to report serious adverse events to FDA within 15 business days. For the EU, Regulation 1223/2009 requires notification without delay.

Is ISO 22716 or GMPC certification enough, or do I still need a quality agreement?

Certification shows the factory runs a GMP system. It does not say who does what for your product. You still need a quality agreement that applies that system to your specifications, changes, records and complaints.

Can I use a template manufacturing agreement?

A template can help you build a list of topics, but it will not reflect your markets, product risks or the laws that apply. Use it as a starting point for negotiation, and have the final document reviewed by a qualified lawyer in the relevant jurisdictions.

Sources

• European Union, Regulation (EC) No 1223/2009 on cosmetic products, consolidated text. Articles 4 and 5 (responsible person and obligations, including recall), 8 (GMP), 11 (product information file, 10-year retention), 19(1)(e) (batch number on label), 23 (serious undesirable effects), 25 (authority-required corrective measures and recall).
• European Commission, Publication of harmonised standards under Regulation 1223/2009 (2011/C 123/04). EN ISO 22716:2007 listed as the harmonised GMP standard.
• U.S. FDA, Modernization of Cosmetics Regulation Act of 2022 (MoCRA). Definition of responsible person, facility registration, product listing, safety substantiation records, adverse event reporting, records access, mandatory recall, GMP rulemaking requirement.
• U.S. Congress, H.R. 2617 (Consolidated Appropriations Act, 2023), enrolled text. MoCRA provisions: 15-business-day serious adverse event reporting, 6-year (or 3-year small business) record retention, GMP regulation requirement, label contact information for adverse events.
• U.S. FDA, Draft Guidance: Cosmetic Good Manufacturing Practices (PDF). Non-binding recommendations on batch records, recall-adequate records, complaint procedures.
• U.S. FDA, Draft Guidance: FDA Records Access Authority for Cosmetic Products. FDA records access under FD&C Act sections 605, 610 and 704.
• U.S. FDA, Draft Guidance: Questions and Answers Regarding Mandatory Cosmetics Recalls. Mandatory recall under FD&C Act section 611.

This article provides general information for planning purposes and is not legal advice.