1What document control covers.
EU GMP Chapter 4 divides GMP documentation into two primary types: instructions, such as specifications, manufacturing formulae, processing, packaging and testing instructions, procedures and protocols; and records and reports, which provide evidence of what was done. The types of documents and media used should be “fully defined in the manufacturer’s Quality Management System”, whether paper, electronic or photographic, and “written” means recorded on media from which data may be rendered in a human readable form.¹ ICH Q7 asks for all documents related to the manufacture of intermediates or APIs to be “prepared, reviewed, approved and distributed according to written procedures”, on paper or electronically.²
ISO 13485 draws the same line. In the preamble to the QMSR final rule, FDA notes that clause 4.2.4 of ISO 13485 “specifies that documents required by the quality management system shall be controlled”, and that “records are a special type of document and shall be controlled according to the requirements given in 4.2.5.”³
2The requirements side by side.
| Control | 21 CFR 211 (US drugs) | EU GMP Chapter 4 | ICH Q7 (APIs) | Devices (ISO 13485 under the QMSR) |
|---|---|---|---|---|
| Approval before use | Production and process control procedures, and changes to them, are drafted, reviewed and approved by the appropriate units and reviewed and approved by the quality control unit.⁴ | Documents containing instructions are approved, signed and dated by appropriate and authorised persons.¹ | The quality unit approves all procedures impacting quality, and specifications and master production instructions.² | ISO 13485 clause 4.2.4 controls the documents the quality system requires; MDSAP auditors verify that procedures for controlling documents and records, of internal and external origin, are defined, documented and implemented.³⁵ |
| Identity and effective date | Master production and control records are dated and signed by one person and independently checked, dated and signed by a second.⁶ | Unambiguous contents, uniquely identifiable, effective date defined.¹ | Issuance, revision, superseding and withdrawal controlled, with revision histories.² | Current versions identified and available for use.⁵ |
| Review and currency | Part 211 sets no periodic review interval for procedures.⁴ | “Regularly reviewed and kept up-to-date.”¹ | No periodic interval; all documents affected by an approved change are revised.² | MDSAP auditors may take obsolete procedures in use as evidence that document control is ineffective.⁵ |
| Retention | Batch records at least one year after the batch’s expiration date.⁷ | Batch documentation one year after expiry or at least five years after QP certification, whichever is longer.¹ | Production, control and distribution records at least one year after expiry; three years after distribution for APIs with retest dates.² | Records and at least one obsolete copy of controlled documents for at least the lifetime of the device, and no less than two years from product release.⁵ |
3Approval and the quality unit.
In the US, the quality control unit “shall have the responsibility for approving or rejecting all procedures or specifications impacting on the identity, strength, quality, and purity of the drug product”, and its own responsibilities and procedures are in writing.⁸ ICH Q7 lists approving specifications, master production instructions and “all procedures impacting the quality of intermediates or APIs” among the responsibilities the quality unit should not delegate.² FDA’s quality systems guidance connects this to control of revisions: it recommends “a formal process be established to change procedures in a controlled manner”.⁹
4Keeping the current version in use.
Approval is only half the job. EU GMP expects documents within the quality system to be “regularly reviewed and kept up-to-date”, the reproduction of working documents from master documents not to introduce errors, and an inventory of the documents in the quality system.¹ WHO adds that “when a document has been revised, a system should exist to prevent inadvertent use of the superseded version”, and that superseded documents are kept for a specific period.¹⁰ When a change is approved, ICH Q7 asks for “all documents affected by the changes” to be revised.² MDSAP’s audit approach gives obsolete procedures in use, or required records that are unavailable, as examples of evidence that document control is ineffective.⁵
5Records made at the time of the work.
Records follow good documentation practice. US CGMP requires production and process control functions to be “documented at the time of performance”.⁴ EU GMP asks for handwritten entries to be clear, legible and indelible, records to be made “at the time each action is taken”, and any alteration to be signed and dated so the original stays readable, with the reason where appropriate.¹ ICH Q7 asks for entries to be made directly after the activity and to identify the person making them, and for corrections to be dated and signed and to “leave the original entry still readable”.² US records are readily available for inspection at the establishment during the retention period, and records that can be retrieved electronically from another location meet that requirement.⁷
6Electronic and hybrid documents.
EU GMP Chapter 4 applies equally to all media. It expects the relationships and controls for master documents, official copies, data handling and records to be stated for hybrid and homogeneous systems, controls for electronic templates, forms and master documents, and record integrity throughout the retention period.¹ ICH Q7 asks for electronic signatures on documents to be “authenticated and secure”.²
The European Commission consulted on a revised Chapter 4 from 7 July to 7 October 2025, drafted by the EMA GMDP Inspectors Working Group with PIC/S. The draft makes risk management central within a data governance system and clarifies the management of electronic records and signatures.¹¹ As of 6 November 2026, the Chapter 4 listed on the EudraLex Volume 4 page is still the version of January 2011.¹²
7How it runs in Seal.
In Seal’s document control, each version moves from draft through review and approval to effective, and approval alone does not make a version effective: the effective date is coordinated with training, form deployment and the exchange of controlled copies. Search and point-of-use views are configured to serve the effective version, printed copies carry the document ID, version and print date, and outstanding copies are reconciled when a version is superseded. A revision identifies the affected roles and a configured automation can assign the training linked to the new version.
The document system links each procedure to the forms, training and execution rules it governs, and completed records keep the version they used. Neil, Seal’s AI agent, can compare procedure revisions and trace a revised requirement into the configured process; process and quality owners assess the impact, training and verification it needs.
References
- 1EudraLex Volume 4, Chapter 4: Documentation, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ chapter4_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 2ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, sections 2.2, 6 and 13, ICH, 10 November 2000. https:/
/ database. ich. org/ sites/ default/ files/ Q7%20Guideline. pdf (read 6 November 2026) - 3Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496, FDA, 2 February 2024. https:/
/ www. federalregister. gov/ documents/ 2024/ 02/ 02/ 2024- 01709/ medical- devices- quality- system- regulation- amendments (read 6 November 2026) - 421 CFR 211.100, Written procedures; deviations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- F/ section- 211. 100 (read 6 November 2026) - 5MDSAP AU P0002.009, MDSAP Audit Approach, chapter 1, task 8, Medical Device Single Audit Program, revision date 6 August 2024, on FDA’s MDSAP audit procedures page. https:/
/ www. fda. gov/ media/ 166672/ download (read 6 November 2026) - 621 CFR 211.186, Master production and control records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 186 (read 6 November 2026) - 721 CFR 211.180, Records and reports: general requirements, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 180 (read 6 November 2026) - 821 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- B/ section- 211. 22 (read 6 November 2026) - 9Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations, FDA, September 2006. https:/
/ www. fda. gov/ media/ 71023/ download (read 6 November 2026) - 10WHO good manufacturing practices for pharmaceutical products: main principles, WHO Technical Report Series No. 986, Annex 2, section 15, World Health Organization, 2014. https:/
/ cdn. who. int/ media/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ inspections/ trs986annex2. pdf (read 6 November 2026) - 11Stakeholders’ Consultation on EudraLex Volume 4, Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22, European Commission, July 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 12EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026)
AQuestions and answers
What is the difference between a document and a record?
A document tells people what to do, such as a specification, procedure or batch instruction. A record is evidence of what was done, such as a completed batch record or test result. EU GMP calls these instructions and records, and FDA notes that under ISO 13485 records are a special type of document with their own controls.
How long must GMP documents and records be kept?
In the US, batch records at least one year after the batch’s expiration date. In the EU, batch documentation one year after expiry or at least five years after QP certification, whichever is longer. For APIs under ICH Q7, at least one year after expiry, or three years after distribution for APIs with retest dates. MDSAP auditors expect device records and an obsolete copy of each controlled document to be kept for at least the device’s lifetime and no less than two years from release.
Do controlled documents have to be electronic?
No. EU GMP accepts paper, electronic and hybrid documentation, and ICH Q7 paper or electronic, provided the controls are defined for each and records stay intact throughout their retention period. EU GMP does ask for documents not to be handwritten, with enough space left where data has to be entered.
What is a controlled copy?
A copy issued through the document system so that it can be identified and replaced when the document is revised. EU GMP asks for the relationship between master documents and official copies to be stated, and WHO asks for a system that prevents inadvertent use of a superseded version.
Does document control apply to external documents?
Yes, where the quality system requires them. MDSAP auditors check that device manufacturers control documents of both internal and external origin required by the quality system, and EU GMP expects every type of document the quality system uses to be defined.