Direct Answer
A quality agreement for private-label skincare is the document that assigns quality duties between the brand and its manufacturer: who approves specifications and artwork, who reviews batch records and releases product, who tests, who handles deviations and complaints, who controls change, and who holds audit rights and records. It works with the manufacturer's GMP system rather than replacing it — ISO 22716 governs practice inside the factory, while the agreement governs the interface between the factory and the brand. A compliant factory can still produce a non-compliant product when the interface is undefined, which is why the agreement is a launch deliverable rather than a legal formality.
Opening Hook
A brand received its first pallet of serum, listed it with a distributor, and fielded a complaint three months later: a batch had separated in transit. The brand asked the OEM for the batch record, the deviation log, and the stability data. The OEM replied that the specification had been approved by the brand's marketing lead, the release had been signed internally, and no deviation had been recorded because the brand's brief had listed no acceptance criteria. The complaint had no owner: each party believed the other held responsibility. At ubitglow, the quality agreement is signed before the first production run. The structure below is the one we work to with brand partners.
What a Quality Agreement Actually Does
A quality agreement is not a duplicate of the commercial contract and not a restatement of GMP. It exists to assign decisions at the interface between two organisations, where responsibilities otherwise default to whoever notices the problem.
| Without an Agreement | With an Agreement |
|---|---|
| Specification approval is assumed, not assigned | Named approver and a written specification |
| Batch release blurs between parties | Defined release authority and record review |
| Deviations are handled informally | Documented deviation and disposition process |
| Complaints stall on ownership | Named investigation owner and timeline |
| Change notification is discretionary | Controlled change notification with impact review |
The document works when it is short, specific, and tied to the factory's actual quality system. A twenty-page template that restates the regulation adds nothing; eight clauses that name parties, documents, and deadlines change how the two companies behave.
ISO 22716 GMP: The Shared Baseline
ISO 22716 defines good manufacturing practices for cosmetics and describes what the factory must control: premises, equipment, personnel, documentation, production, and quality control. The standard gives the brand a baseline to verify, not a system to administer on the OEM's behalf.
| GMP Area | What the Manufacturer Controls | What the Brand Should Verify |
|---|---|---|
| Documentation | Batch records, specifications, procedures | Records are reviewable and complete |
| Production | Process controls and in-process checks | Acceptance criteria match the brief |
| Quality control | Sampling, testing, release | Test scope covers the finished product |
| Personnel and hygiene | Training and gowning | Current certification and audit history |
| Premises and equipment | Cleanliness, calibration, maintenance | Audit reports and remediation |
The verification point matters because a certificate is a starting position, not a conclusion. The brand's job is to confirm that the certified system covers the product being made, that acceptance criteria exist, and that records can be produced on request. Where cleanroom classification affects the product, the cleanroom classification under ISO guide covers how the facility class maps to the process, and the microbiology testing guide sets out the release testing a quality agreement should assign.
Data: ISO 22716 specifies good manufacturing practices for cosmetic products across production, quality control, storage, and documentation, giving regulators and trade partners a recognised benchmark for how a cosmetic was made and how it was released.
Judgment: Make current ISO 22716 certification a qualification requirement before signing, then write the audit right into the quality agreement; a certificate that cannot be re-verified on request is a snapshot, while an agreement with audit access keeps the certification meaningful across the supply relationship.
Source: ISO — ISO 22716 Cosmetics Good Manufacturing Practices (2024)
Clause by Clause: What Belongs in a Quality Agreement
A workable agreement covers eight areas. Each clause should state the responsible party and a timeline, because an obligation without an owner and a deadline does not survive its first dispute.
- Specification approval — who writes, approves, and versions the finished product specification.
- Artwork and label control — who proofreads label text and confirms claim evidence before print.
- Sampling and testing — which tests run, at what frequency, and who pays and holds records.
- Batch record review and release — who reviews the batch record and who authorises release.
- Deviation and out-of-specification handling — how a deviation is recorded, assessed, and dispositioned.
- Change control — how formula, process, supplier, or pack changes are notified and approved.
- Complaints, returns, and recall — who investigates, who decides, and who notifies authorities.
- Audit rights and document retention — access terms and how long records are kept.
Clause five is the one most often missing, and it is the one that resolves the scenario every brand eventually faces: a batch that fails an in-process check. The agreement should say whether the manufacturer can rework, whether the brand must approve, and what happens to material that cannot be brought into specification.
The Responsibilities Matrix: Brand Versus Manufacturer
The fastest way to expose a gap is to lay responsibilities side by side. The matrix below is a starting point for a private-label skincare relationship.
| Activity | Brand Owner | Manufacturer |
|---|---|---|
| Formula and specification | Approves | Proposes against the brief |
| Ingredient safety evidence | Holds in the product file | Supplies ingredient data |
| Artwork and claim text | Approves and substantiates | Applies approved artwork |
| Batch record review | Receives summary on request | Performs and retains |
| Release decision | Delegated per agreement | Signs authorised release |
| Deviation handling | Notified and consulted | Records and dispositions |
| Complaint investigation | Owns the customer response | Provides technical investigation |
| Regulatory submission | Files in each market | Provides manufacturing data |
Data: Public health guidance on quality and safety for health-related products stresses traceable responsibility from manufacture through distribution, so that a defect or safety signal can be traced to its origin and acted on promptly.
Judgment: Split responsibilities in writing at the clause level and sign it before the first production run; a defect investigation without a pre-agreed owner loses days to negotiation, while a matrix that names the investigating party moves straight to root cause and containment.
Source: World Health Organization — Quality and Safety Guidance for Health Products (2024)
Change Control, Deviations, and Audit Rights
Change control is the clause that protects the file you built for market entry. Any change to formula, process, supplier, or packaging can invalidate a specification, a stability conclusion, or a regulatory submission, and the agreement is what forces notification before the change takes effect.
| Change Type | Typical Impact | Required Action |
|---|---|---|
| Formula change | Safety assessment and notification | Pre-approval by the brand |
| Supplier change | Traceability and specification | Notification and re-qualification |
| Process change | Batch record and validation | Impact review before production |
| Packaging change | Compatibility and label text | Compatibility test and artwork update |
| Site change | GMP certification and registration | Re-verification before shipping |
Audit rights belong in the same clause family. A brand should be able to request the manufacturing data, the certification status, and the deviation log, and to conduct a periodic on-site audit with reasonable notice. Where the product is exported, the filing data your market entry depends on — such as registration and listing evidence under a regime like U.S. MoCRA — is produced by the manufacturer and transferred to the brand's file, so the agreement should name that deliverable explicitly. Filling and packaging changes also affect the release specification, which the liquid filling production guide covers in operational detail.
Data: U.S. cosmetics regulation now requires facility registration and product listing with adequate safety substantiation, obligations that make the manufacturer's documentation a direct input to the brand's compliance file rather than an internal record.
Judgment: Write the transfer of manufacturing and registration data into the quality agreement as a named deliverable with a timeline; when a regulator or retailer requests the file, the brand should be holding it already, not requesting it from the factory under time pressure.
Source: U.S. FDA — Cosmetics Registration, Listing & GMP under MoCRA (2024)
Data: Independent ingredient safety assessments consolidate the published toxicology behind individual cosmetic ingredients, giving a brand an indexed basis for the ingredient-level content of its safety and specification file.
Judgment: Attach consolidated ingredient safety reviews to the specification clause so both parties reference the same evidence; when a specification limit or a claim is questioned, the indexed review is what makes the position defensible rather than a matter of opinion.
Source: Cosmetic Ingredient Review (CIR) — CIR Ingredient Safety Assessments (2024)
The Bottom Line
A private-label skincare quality agreement assigns the decisions that GMP alone cannot: specification and artwork approval, testing scope, batch release, deviation disposition, change control, complaints and recall, audit rights, and record retention — each with a named party and a deadline. Verify ISO 22716 certification as the baseline, then write audit access and data-transfer obligations into the agreement, because the manufacturing records a brand needs for market entry and post-market response live with the factory. Sign the agreement before the first production run, and update it when the relationship changes rather than after a complaint finds the gap.
At ubitglow, the quality agreement is part of onboarding: specification, testing, change control, and data transfer are agreed before the first batch is produced, so both parties work from one controlled document.