1The manufacturer stays responsible.
ICH Q10 extends the pharmaceutical quality system to “the control and review of any outsourced activities and quality of purchased materials”, and says the pharmaceutical company “is ultimately responsible” for that control.¹ Its processes should use quality risk management and include four activities:¹
- assessing the suitability and competence of a material supplier before selecting it, for example by audits, material evaluations or qualification;
- defining responsibilities and communication for quality-related activities, in a written agreement for outsourced activities;
- monitoring and reviewing the quality of the material from the provider, and making any needed improvements;
- monitoring incoming materials to ensure they come from approved sources through the agreed supply chain.
EU GMP Chapter 5 turns this into requirements for starting materials. Their selection, qualification, approval and maintenance should be documented as part of the pharmaceutical quality system, with supervision “proportionate to the risks posed by the individual materials”, taking account of source, manufacturing process, supply chain complexity and final use. Evidence for each supplier and material approval is kept, and materials should be bought directly from the manufacturer where possible.² Primary and printed packaging suppliers get similar attention.²
In the US, the quality control unit has the authority to approve or reject all components, containers and closures, and each lot is withheld from use until the unit releases it.³⁴ FDA regards contract testing laboratories, packers and labellers as “an extension of the manufacturer’s own facility”.⁵
2The steps of a qualification.
| Step | What the texts expect | Source |
|---|---|---|
| Rank the risk | Supervision in proportion to the material’s risk; for excipients, a formalised risk assessment classifying each one, for example as low, medium or high risk | EU GMP 5.27 and 5.29; Commission guidelines 2015/C 95/02 |
| Assess before approval | Evidence, such as past quality history, that the manufacturer can consistently supply material that meets specifications | ICH Q7 7.31; ICH Q10 2.7 |
| Audit where required | Audits of active substance manufacturers and distributors for GMP and GDP compliance, by the authorisation holder or a contracted entity, with a report that fully reflects what was done and seen | EU GMP 5.29 |
| Agree the requirements | Quality requirements agreed with the supplier, with production, testing, handling, labelling, packaging, distribution, complaints, recalls and rejection set out in a quality agreement or specification | EU GMP 5.28 |
| Approve a defined source | Purchase against an agreed specification from suppliers approved by the quality unit and, where a critical material comes from someone other than its manufacturer, know the manufacturer’s name and address | ICH Q7 7.12 and 7.13 |
| Check each delivery | Package integrity and agreement between the delivery note, purchase order, supplier labels and approved manufacturer and supplier information | EU GMP 5.30 |
| Monitor and requalify | Further audits at intervals set by quality risk management, periodic full analysis compared with the certificate, and changes of source through change control | EU GMP 5.29; ICH Q7 7.14 and 7.31 |
For active substances, EU GMP also requires supply chain traceability from the active substance starting materials to the finished product, with the risks formally assessed and periodically verified, and traceability records kept by the EEA manufacturer or importer.² Audits should be long enough and broad enough for “a full and clear assessment of GMP”, including the risk of cross-contamination from other materials on site, and any corrective actions they require should be implemented.²
3Reducing incoming testing on the strength of qualification.
Qualification is what allows a manufacturer to rely on a supplier’s results. In the US, at least one identity test is run on each component. A supplier’s report of analysis can replace the other tests only if the manufacturer runs a specific identity test and “establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals”.⁴ For containers and closures, a certificate of testing can be accepted with at least a visual identification.⁴
ICH Q7 sets the API version: an identity test on each batch, a certificate of analysis in place of other tests only where the manufacturer has a system to evaluate suppliers, and “Full analyses should be conducted on at least three batches before reducing in-house testing.” A full analysis is then repeated at appropriate intervals and compared with the certificates.⁶
EU GMP requires the finished product manufacturer to perform, as a minimum, identification testing of each batch of starting material. Using the supplier’s results for the rest needs a documented rationale and five conditions: control of distribution, risk-based audits of the sites that test, a certificate signed by a designated person, experience with the supplier, and periodic full analysis. If that analysis finds a discrepancy, acceptance of the supplier’s certificates stops until the investigation’s measures are complete.²
4Excipients, contract sites and medical devices.
The Commission’s guidelines of 19 March 2015 on formalised risk assessment for excipients put into practice the duty in Article 46(f) of Directive 2001/83/EC to ensure excipients are suitable by ascertaining the appropriate GMP. They ask the manufacturing authorisation holder to assess each excipient from each manufacturer for risks including transmissible spongiform encephalopathy, viral and microbiological contamination, impurities, sterility claims, cross-
For API manufacture, ICH Q7 expects the contract giver to evaluate contract manufacturers and laboratories for GMP compliance. A written contract defines each party’s GMP responsibilities and lets the contract giver audit. Work should not be subcontracted without the contract giver’s prior evaluation and approval, and changes to the process, equipment, test methods or specifications need the contract giver’s approval.⁶ FDA’s 2016 guidance on quality agreements says the agreement should identify which party will establish processes “for auditing, qualifying, and monitoring component suppliers”.⁸
For medical devices, the Quality Management System Regulation in 21 CFR Part 820, effective 2 February 2026, incorporates ISO 13485:2016 by reference.⁹¹⁰ FDA’s questions and answers confirm that the QMSR gives it authority to inspect supplier audit reports, which the old regulation exempted from review under 820.180(c).¹⁰
5How it runs in Seal.
In Seal’s supplier quality management, each receipt is compared with the recorded qualification scope: the manufacturer, site, material and specification the approval covers. A new site or revised specification becomes linked qualification work, approvals can carry conditions and expiry, and qualification, material disposition and batch release remain separate decisions. Neil, Seal’s AI agent, can check a receipt against the approved supplier scope and prepare an exception-review package; supplier quality decides qualification and disposition.
For ongoing monitoring, Neil builds supplier scorecards by counting on-time and in-full delivery from every receipt line and quality from inspections and nonconformances, with each number linked to the records it was counted from. It drafts each supplier’s quarterly review, and your team edits it and holds the meeting.
References
- 1ICH Q10 Pharmaceutical Quality System, ICH, 4 June 2008, section 2.7. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026) - 2EudraLex Volume 4, Part I, Chapter 5: Production, European Commission, in operation since 1 March 2015. https:/
/ health. ec. europa. eu/ document/ download/ 4a1fdb4f- 6f6f- 49c4- b264- 8056e5bbe078_ en?filename=chapter_ 5. pdf (read 6 November 2026) - 321 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 22 (read 6 November 2026) - 421 CFR 211.84, Testing and approval or rejection of components, drug product containers, and closures, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 84 (read 6 November 2026) - 521 CFR 200.10, Contract facilities (including consulting laboratories) utilized as extramural facilities by pharmaceutical manufacturers, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 200. 10 (read 6 November 2026) - 6ICH Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, ICH, 10 November 2000, sections 7 and 16. https:/
/ database. ich. org/ sites/ default/ files/ Q7%20Guideline. pdf (read 6 November 2026) - 7Guidelines of 19 March 2015 on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients of medicinal products for human use (2015/C 95/02), Official Journal of the European Union. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:52015XC0321(02) (read 6 November 2026) - 8Contract Manufacturing Arrangements for Drugs: Quality Agreements, Guidance for Industry, FDA, November 2016. https:/
/ www. fda. gov/ media/ 86193/ download (read 6 November 2026) - 921 CFR Part 820, Quality Management System Regulation, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820 (read 6 November 2026) - 10Quality Management System Regulation: Frequently Asked Questions, FDA. https:/
/ www. fda. gov/ medical- devices/ quality- management- system- regulation- qmsr/ quality- management- system- regulation- frequently- asked- questions (read 6 November 2026)
AQuestions and answers
Do you have to audit every supplier?
Not under one rule for all. EU GMP requires audits of active substance manufacturers and distributors, and controls excipient suppliers according to a formalised risk assessment. The US component rules in 21 CFR 211.84 don’t prescribe audits, but require the quality control unit to approve each lot and any reliance on supplier results to be validated at intervals.
Can we rely on a supplier’s certificate of analysis?
Partly. You still test identity on each batch or lot yourself, and you check the supplier’s results at appropriate intervals; EU GMP and ICH Q7 do this by running a full analysis and comparing it with the certificate. ICH Q7 asks for full analysis of at least three batches before reducing in-house testing for API manufacture.
How often should suppliers be requalified?
The texts set no fixed interval. EU GMP asks for further audits at intervals defined by quality risk management, and ICH Q7 for full analyses at appropriate intervals compared with the certificates. The interval should follow the material’s risk and the supplier’s performance.
What should a supplier quality agreement cover?
EU GMP lists production, testing and control, handling, labelling, packaging and distribution requirements, complaints, recalls and rejection procedures. For contract manufacturers of APIs, ICH Q7 expects a written contract that defines each party’s GMP responsibilities and lets the contract giver audit, with subcontracting and changes approved by the contract giver.
Does approving a supplier cover all of its sites?
Not automatically. Qualification applies to a defined material from a known manufacturer through an agreed supply chain. ICH Q7 expects you to know the manufacturer’s name and address when a critical material comes through someone else, and treats a change in the source of a critical raw material as a change control.
Who approves a supplier?
The quality unit. ICH Q7 says materials should be bought from suppliers approved by the quality unit, and US CGMP gives the quality control unit the authority to approve or reject components, containers and closures.