Should contract manufacturers hold their own GMP compliance certification?

Contract manufacturers are not legally required to hold their own GMP compliance certification in all cases, but in practice, most reputable CMOs operating within the EU do hold a valid GMP certificate issued by a national competent authority. Whether a CMO needs its own certification depends on the regulatory framework, the type of product being manufactured, and how responsibilities are allocated in the contractual arrangement.

For companies sourcing manufacturing partners, understanding the distinction between legal obligation and practical necessity is critical. A CMO without its own GMP certificate creates real compliance risks that can delay approvals, trigger regulatory action, or expose the marketing authorisation holder to liability. The sections below unpack the key questions you should be asking before signing any contract manufacturing agreement.

What does GMP compliance certification actually cover?

GMP compliance certification confirms that a manufacturing facility has been inspected by a regulatory authority and found to operate in accordance with Good Manufacturing Practice standards. The certificate covers the facility’s premises, equipment, personnel, documentation systems, quality control processes, and production procedures for specific product types and dosage forms.

In the EU, GMP certificates are issued following inspections carried out by national competent authorities and are recorded in the EudraGMDP database. A certificate specifies the site address, the activities covered (such as manufacture, testing, or packaging), and the product categories for which the site is approved. It is not a blanket endorsement of everything a site does. A CMO certified for sterile injectables, for example, is not automatically certified for oral solid dosage forms.

GMP compliance also encompasses the quality management system that governs how deviations, out-of-specification results, change controls, and corrective actions are handled. Certification signals that these systems have been reviewed and found adequate, not just that the facility looks clean and modern.

Who is legally responsible for GMP compliance in a contract manufacturing arrangement?

The marketing authorisation holder (MAH) bears ultimate legal responsibility for GMP compliance, even when manufacturing is fully outsourced to a contract manufacturer. Under EU pharmaceutical legislation, the MAH cannot transfer or delegate this responsibility. The CMO has its own obligations, but the MAH remains accountable to regulators for the quality of the finished product placed on the market.

This shared but asymmetric responsibility is why the quality agreement between an MAH and a CMO is so important. The quality agreement defines which party is responsible for each GMP-relevant activity, from raw material testing to batch release. It does not shift the MAH’s regulatory accountability, but it does create contractual obligations for the CMO and provides a clear operational framework.

The Qualified Person (QP) responsible for batch certification also plays a central role. In the EU, the QP must confirm that each batch has been manufactured and tested in accordance with GMP and the terms of the marketing authorisation before it can be released to the market. If the CMO’s site is not GMP-certified or has an outstanding critical finding from a recent inspection, the QP cannot certify the batch without significant risk.

Are contract manufacturers required by law to hold a GMP certificate?

Yes, in the EU, any site that manufactures, imports, or performs certain testing activities on medicinal products for human or veterinary use must hold a manufacturing authorisation, which is only granted following a satisfactory GMP inspection. This requirement applies to the CMO directly and is not something the MAH can satisfy on the CMO’s behalf.

The legal basis in the EU is Directive 2001/83/EC and its implementing regulations, which require that any manufacturer of medicinal products hold a manufacturing authorisation issued by the competent authority of the member state where the site is located. For sites outside the EU supplying products to the EU market, equivalent GMP compliance must be demonstrated, and many countries have mutual recognition agreements or rely on inspections by EU authorities.

For medical devices, the regulatory framework differs. Manufacturers must comply with EU MDR or IVDR requirements and hold a CE mark supported by a relevant conformity assessment, but the concept of a GMP certificate as used in pharma does not apply in exactly the same way. ISO 13485 certification is the relevant quality management standard for device manufacturers, and it is typically required as part of the notified body assessment.

What are the risks of using a CMO without its own GMP certification?

Using a contract manufacturer that lacks valid GMP certification exposes your company to serious regulatory, commercial, and patient safety risks. Batches manufactured at a non-certified site cannot be legally released onto the EU market, meaning any product manufactured there is effectively unsellable until compliance is established.

The practical consequences can include:

• Batch rejection or recall: Regulators can require batches to be recalled if they were manufactured at a site that was not GMP-certified at the time of manufacture.
• Regulatory action against the MAH: The MAH can face warning letters, import alerts, or suspension of the marketing authorisation if it cannot demonstrate that its supply chain is GMP-compliant.
• Supply chain disruption: If a CMO’s certification lapses or is withdrawn following a failed inspection, you may face sudden loss of your manufacturing partner with no compliant alternative in place.
• Delayed market approval: Regulators reviewing a marketing authorisation application will assess the GMP status of all named manufacturing sites. A site without valid certification will trigger questions or outright rejection of the application.
• Reputational damage: Quality failures linked to a CMO’s non-compliance reflect on the MAH’s brand and can damage relationships with regulators, healthcare providers, and patients.

Beyond the regulatory consequences, working with an uncertified CMO often signals deeper quality system weaknesses that create operational problems even before regulators become involved.

How should companies verify a contract manufacturer’s GMP status?

Verifying a CMO’s GMP status should be a structured process that goes beyond asking the CMO to provide a copy of its certificate. A certificate alone tells you the site was compliant at the time of the last inspection, not whether it remains compliant today.

A robust verification approach includes the following steps:

1. Check EudraGMDP: The European Medicines Agency maintains the EudraGMDP database, which lists all manufacturing authorisations and GMP certificates issued by EU member state authorities, as well as inspection outcomes. This is the primary public source for verifying EU GMP status.
2. Review the certificate scope: Confirm that the certificate covers the specific activities and product types relevant to your product. A certificate for one dosage form does not automatically cover another.
3. Request the most recent inspection report or summary: Some authorities publish inspection findings. Ask the CMO directly for details of its most recent inspection outcome and any corrective actions taken.
4. Conduct a supplier audit: A site audit by qualified personnel, or a review of a recent third-party audit report, gives you direct evidence of the CMO’s current quality system status rather than relying solely on regulatory records.
5. Review the quality agreement: Ensure the quality agreement clearly defines GMP responsibilities, requires the CMO to notify you of any inspection findings or changes to its authorisation, and includes provisions for what happens if its certification lapses.
6. Monitor ongoing compliance: GMP status is not static. Build a process for periodic re-qualification of your CMOs, including checking EudraGMDP for any new inspection outcomes or changes to their authorisation.

For products manufactured outside the EU, verifying GMP compliance is more complex. You may need to rely on batch certificates, third-party audit reports, or inspections carried out by EU authorities under mutual recognition agreements. regulatory support services can help you navigate these requirements for non-EU sites.

How Starodub supports your CMO compliance strategy

Selecting and managing contract manufacturers is one of the most compliance-sensitive decisions a pharmaceutical or medical device company makes. We work with companies at every stage of this process to ensure their CMO relationships are built on a solid regulatory foundation.

Here is how we can support you:

• CMO GMP status assessment: We review your contract manufacturers’ authorisations, recent inspection history, and quality system documentation to give you a clear picture of their compliance standing.
• Quality agreement drafting and review: We help you develop quality agreements that clearly allocate GMP responsibilities and protect your regulatory position.
• Supplier audit support: Our team can conduct or support audits of your CMOs, providing expert assessment of their quality systems against GMP requirements.
• Regulatory submission support: When manufacturing sites need to be included in a marketing authorisation application or variation, we manage the regulatory documentation to ensure the site’s GMP status is correctly represented.
• Ongoing compliance monitoring: We help you build and maintain a supplier qualification programme that keeps pace with changes in your CMOs’ regulatory status.

If you are evaluating a new contract manufacturer or want to strengthen oversight of your existing supply chain, we would be glad to help. Get in touch with our team to discuss your situation and how we can support your GMP compliance strategy. You can also learn more about who we are and the expertise we bring to every client engagement.

Related Articles

• What are the benefits of regulatory intelligence for risk management?
• Why do regulatory submissions get rejected by the FDA?
• How do you develop a regulatory affairs strategy?
• What are the steps for Class III device approval?
• How long does medical device regulatory approval take?

This content was generated with the help of AI and it may contain mistakes