Guidance on good manufacturing practice and good distribution practice: Questions and answers

The product review is expected annually. Review timeframes can be appropriately adjusted based upon manufacturing and campaign duration with adequate justification. The timeframe criteria should be established in a SOP. The trending can include results gathered from the previous period to ensure its robustness. Even if no manufacturing has occurred in the review period, the quality and regulatory review should be conducted as per section 1.10 and include stability results, returns, complaints, recalls, deviations (including those arising from qualification and validation activities) and regulatory background. The review of the last PQR should also be conducted.

Metal could originate from raw materials as well as from equipment in manufacturing processes where metal parts could generate fragments due to the conditions of operation or damage to the equipment.

It is recommended that metal detection is used for processes prone to this.

In order to avoid routine use of metal detectors the company must demonstrate that it has identified and managed the risks such that the use of metal detectors for that particular process is not needed.

• Questions and answers on implementation of risk based prevention of cross contamination in production and 'Guideline on setting health based exposure limits for use in risk identification in the manufacture of different medicinal products in shared facilities' (EMA/CHMP/CVMP/SWP/169430/2012) (updated 30/04/2018)
• Guideline on setting health based exposure limits for use in risk identification in the manufacture of different medicinal products in shared facilities

The document 'guidance on the occasions when it is appropriate for competent authorities to conduct inspections at the premises of manufacturers of active substances used as starting materials', published as part of the Community procedures, states that it is expected that manufacturing-authorisation holders will gain assurance that the active substances they use are manufactured in accordance with GMP through audit of the active-substance suppliers. Small manufacturers may not have the necessary expertise or resource to conduct their own audits.

Section 5.25 of the GMP guideline requires starting materials to be purchased from approved suppliers and about whom the manufacturer has a particular and thorough knowledge.

An audit conducted by the manufacturing-authorisation holder itself should be integral to the manufacturer's quality-assurance system and subject to the basic GMP requirements, i.e. conducted by properly qualified and trained staff, in accordance with approved procedures. It should be properly documented. These aspects can be inspected as necessary by the competent authorities.

If a third party is involved, the arrangements should be subject to chapter 7 of the GMP guideline. There should be evidence that the contract-giver has evaluated the contract-acceptor with respect to the aspects described above.

All parties involved should be aware that audit reports and other documentation relating to the audit will be made available for inspection by the competent authorities if requested. This should normally provide sufficient assurance that the results of an audit carried by the third party are credible, thus waiving the need for an audit conducted by the manufacturing-authorisation holder itself. However, it must also be satisfactorily demonstrated that there are no conflicts of interests. Conflicts of interests could arise for example from:

• a commercial relationship between the organisation performing the audit and the organisation being audited;
• a personal conflict on the part of the auditor where he / she has been employed by the organisation being audited in the recent past (i.e. within the last three years) or has a financial interest in it.

This topic should also be addressed in the technical contractual arrangements. Any measures taken by the contract-giver should be documented, e.g. signed undertakings by the auditors.

Similarly, the principles outlined above could be used to allow sharing of audit reports between different manufacturing-authorisation holders using the same active substance supplier, provided that the scope of the audits can be shown to be applicable to the active substances of mutual interest.

GMP inspectors have discussed the desirability of more than one batch number appearing on the packaging of medicinal products.

It is normal practice for companies to use a bulk batch number that is different from the finished product batch when the bulk is packaged as several sub-batches. There is normally an element in the numbering format common to the bulk batch and finished product batches that clearly ties these together. The difference normally takes the form of a suffix, prefix or both.

A matter of concern for the inspectors is when the bulk and finished product batch numbers are completely different and there is no obvious connection between the two. Even though the manufacturer has a system of traceability, the inspectors agree that this is an undesirable practice and should be avoided. The main reasons for this are:

• patients and healthcare professionals may mistakenly believe that there has been a packaging error;
• hospitals often remove products from the outer packaging and traceability may therefore be lost;
• confusion may occur in the case of recall, rendering such action potentially ineffective.

It is accepted that there may be exceptional cases where multiple batch numbers are displayed on a pack, such as in combination product packages. Manufacturers are recommended to discuss individual cases with the relevant supervisory authority. In all cases, traceability must be maintained.

The supply chain for each active substance must be established back to the manufacture of the active substance starting materials. This should be documented and must be kept current. The risks associated with this supply chain should be formally documented. Control of each incoming consignment of active substance should include verification that it has been received from the approved supplier and approved manufacturer. The entire supply chain should be verified for a supplied batch periodically to establish a documented trail for the batch back to the manufacturer(s) of the active substance starting materials. The frequency of this verification should be based on risk.

Normally, such an approach should be avoided as each batch is made from the same initial quantity of material and should remain as an individual batch of finished medicinal product bearing a unique batch number. Therefore, any other approach should be thoroughly justified by applying the principles of Quality Risk Management (QRM) taking into account at least the following criteria:

• length of time the equipment has been in use;
• pharmaceutical form of the drug product that cannot be homogenised (tablet, capsules, etc);
• expiry date of the drug products;
• ongoing stability study design and results;
• reference samples plan for each batch;
• criticality of the drug product and the risk of shortage that may arise from any quality issue;
• prior approval of the MAH.

Irrespective of the outcome of the QRM, such an approach can only be accepted if each individual batch of the combined "super batch" undergoes all the in-process control and finished drug product testing as specified in the marketing authorisation dossier.

In the event of a recall, the entire “super batch” should be recalled.

Medicinal products that are relabelled or repacked with the purpose of parallel trade should be in compliance with any specific national legislation or guidance in relation to the batch number(s) that are to be present on the parallel distributed traded packs.

In the absence of specific national legislation or guidance, the outer packaging should have only one batch number, as allocated by the parallel trader. This batch number allocated by the parallel trader should incorporate two components; (1) the batch number of the original pack and (2) a unique code identifying the repackaging/relabelling run.  The code for the repackaging run may comprise numbers or letters or a combination of both.  The parallel trader’s batch number should be such that Component 1 above (originator batch number) is followed by Component 2 (a code related to the repackaging/relabelling run on that batch). Any deviation from this approach should be presented to and should be authorised by the supervisory authority. The traceability between the original batch number and the parallel trader’s batch number should be documented in the manufacturer’s repackaging records.

In the case of human medicinal products, the unique identifier generated by the parallel trader when (re)placing safety features should reflect the 2 component batch number as described above. The link between the original batch numbers and parallel trader’s two component batch number should be maintained in the EU repositories system as per Article 34(4) of Commission Delegated Regulation (EU) 2016/161. Any batch number applied to the primary packaging components (e.g. blister strips, bottle labels, etc.) during the repackaging operation should be the same as that applied to the outer carton of the repackaged/relabelled product.

Chapter 7 describes that a written Contract between the Contract Giver and the Contract Acceptor must be established and where the marketing authorization holder (MAH) and the manufacturer are not the same, appropriate arrangements should be in place, taking into account the principles described in chapter 7. Are direct agreement a requirement between the MAH, MIA holder responsible for QP certification and sites involved in the various stages of manufacture, importation, testing and storage of a batch before it undergoes certification?

A direct written contract should be in place between MAH and the MIA holder responsible for QP certification of the product.

A direct written contract should also be in place between the MIA holder responsible for QP certification of the product and sites involved in the various stages of manufacture, importation, testing and storage of a batch before it undergoes certification (hereafter: contract manufacturers).  It is also acceptable to have a direct written contract between multiple parties, such as MAH and MIA holder responsible for QP certification of the product and contract manufacturers or any other entities included in the manufacturing/supply chain, provided that relevant activities and responsibilities for each entity are clearly defined.

A “chain of contract” setup may exceptionally be acceptable instead of direct written contracts as detailed above, provided the following principles are adhered to:

1. It should be ensured that robust and timely communication between the MAH, the MIA holder responsible for QP certification and the contract manufacturers is secured through the “chain of contracts”.
2. The MIA holder responsible for QP certification should have access to all of the contracts in the “chain of contracts”. Contract manufacturers should have access to those contracts in the “chain of contracts” relevant to the activities they perform and the associated responsibilities. As per EU GMP Chapter 4 all of these contracts are to be considered as part of the Pharmaceutical Quality System.
3. The MIA holder responsible for QP certification should accept in writing the arrangements taken in the “chain of contracts” after performing a written assessment of their suitability and functionality.
   The assessment should be carried out with a view to ensure, that the “chain of contracts” sufficiently addresses the requirements mentioned in EU GMP Chapter 7: 7.14-7.17. The specific setup and products in question and their traceability through the "chain of the contracts" should be taken into account in the evaluation and be covered by the contracts.
4. The MIA holder responsible for QP certification should ensure that if any of the contracts in the “chain of contracts” are changed, such changes are notified to and accepted by the MIA holder responsible for QP release prior to the change of the respective contracts. Such acceptance can be documented by use of e.g. a change control system.
5. The MIA holder responsible for QP certification should ensure that all parties in a “chain of contracts” setup are audited and evaluated as per the requirements mentioned in EU GMP Chapter 7 and Annex 16.
6. All parties in a “chain of contracts” setup should be reflected in the supply chain diagram mentioned in EU GMP Annex 16: 1.7.2.  
7. All contracts in a “chain of contracts” setup are to be reviewed as part of the product quality review (PQR) process.
8. The MIA holder performing QP release should have an adequate number of personnel with the necessary qualifications and practical experience (according to EU-GMP Chapter2: 2.1) for reviewing and assessing the records and the results related to the outsourced activities (according to EU GMP Chapter 7: 7.8 This responsibility remains with the MIA holder irrespective of the number of parties involved (cf. EU-GMP chapter 7: 7.11).
9. It should be ensured through the “chain of contracts” the integrity of the records related to the manufacturing activities throughout the retention period is secured at a site holding a MIA. Archiving of documents might be off-site under the responsibility of the MIA-holder. .

Regardless of the contract setup used, it must be ensured that all relevant activities and responsibilities for each entity are clearly defined and that the contract setup complies with any additional requirements of the national legislation.

The following terminology are used throughout this document:

Written contract: A contract accordance to the requirements of EU GMP chapter 7. The word Technical agreement as used in EU GMP annex 16 are in this context considered identical to a written contract

Direct written contract: Contract signed between the parties, that actually perform the activities stated in the contract, e.g. the MIA holder responsible for QP certification as a contract giver and the contract manufacturer as a contract acceptor or the MAH as a contract giver and the MIA holder responsible for QP certification as a contract acceptor.   

“Chain of contract” setup: A setup where one or more parties (sites/companies) are acting as signatory in a chain of contracts that links them together. Thus, the setup introduces one or several  separate legal entities between the contract giver - e.g. a MIA holder responsible for QP certification and the contract manufacturer as a contract acceptor. In fact, the GMP activities concerned are sub-contracted over one or several levels.

Suspected product quality defects (e.g. product deterioration, packaging mix-up, among others) should be reported to the competent authority with responsibility for the manufacturing site (or importer where the manufacturer is located outside the EEA), and to the competent authority in each EEA market supplied. In case of impact to EU centrally authorised products, the EMA must also be notified. This notification should be prior to taking any market action, unless, as per paragraph 8.26 of Chapter 8, the need for market action is so serious as to warrant immediate action to protect patient or animal health.

Confirmation of a quality defect does not require completion of the investigation. Reporting should be initiated when available information supports the detection of the issue and when the initial assessment of the potential risks presented to patients/animals indicates that it could result in market action. Notification to competent authorities should typically take place within one working day of confirmation that reporting is required.

In cases where a suspected quality defect involves multiple manufacturing sites, reporting responsibilities should be defined in a technical agreement. It is normal expectation that the MAH and site of final EU batch certification should take the lead on reporting, unless otherwise justified.

Manufacturers are encouraged to notify their national competent authority (or EU Supervisory Authority for sites located outside the EEA) of confirmed serious GMP issues with the potential to lead to a suspected product defect requiring market action (e.g. media fill failure, serious equipment failure, etc.). Confirmation of a serious GMP issue does not require completion of the investigation; reporting should be initiated when available information confirms the detection of the issue.

Serious GMP issues which may result in an abnormal restriction in supply should be notified to the MAH and relevant competent authorities in accordance with legal obligations given in Art 23(2) of Directive 2001/83/EC, Art 27 of Directive 2001/82/EC, Regulation 726/2004 and EMA guidance¹:

In the event that a medicinal product which is the subject of a marketing authorisation issued by an EEA authority, and which is marketed in another third country (or countries) then the marketing authorisation holder shall forthwith inform the relevant EU competent authority of any prohibition or restriction imposed by the competent authorities of any country in which the medicinal product is marketed and of any other new information which might influence the evaluation of the benefits and risks of the medicinal product concerned (e.g recalls or serious GMP issues). This is even if the particular batch subject to the prohibition or restriction is not marketed in the EEA.

In cases where national competent authorities set additional national expectations regarding what quality defects should be reported and the timelines for reporting, these should be complied with.

¹http://www.ema.europa.eu/ema/index.jsp?curl=pages/regulation/document_listing/document_listing_000238.jsp&mid=WC0b01ac0580024593

A batch recall is defined in the Compilation of Community Procedures as "The action of withdrawing a batch from the distribution chain and users. A batch recall may be partial, in that the batch is only withdrawn from selected distributors or users". This definition covers the entire distribution chain from all points following manufacture through to the end user, the patient. Also, it is possible that the MAH or its subsidiaries are actors in the supply chain, acting as the distributor in certain cases. In such cases, the MAH or its subsidiaries should be regarded as also being part of the distribution chain.

A batch of medicinal product is considered to have been 'placed on the market' when one of the following takes place:

• A batch has been Qualified Person (QP) certified and has been made available for sale on the stock management system of the pre-wholesaler/primary wholesaler, etc.
• A batch has been QP certified and supplied to a facility where the manufacturer has no further control over when the product is transferred to saleable stock. This applies even if within the pre-wholesaler/primary wholesaler network.
• In the case of supply chain models where the manufacturer or primary wholesaler supplies direct to the customer (e.g. pharmacy), the batch has been placed on the market from the time of the first customer supply of product from the batch.

National competent authorities should be notified of all recall action proposed after the product has been placed on the market. In situations where the MAH can demonstrate that the batch is reconciled without issuing a recall notice, the national competent authority may agree that public recall communication throughout the distribution network is not necessary.

It is acknowledged that certain short expiry products (e.g. radiopharmaceuticals, advanced therapy medicinal products, etc.) may be shipped under quarantine prior to certification. Retrieval of batches during this quarantine period may be managed within the pharmaceutical quality system.

Directive 2001/83/EC as amended (Directive 2001/82/EC for veterinary medicinal products) states that manufacturing-authorisation holders are obliged to use, as starting materials, only active substances that have been manufactured in accordance with the detailed guidelines on GMP for starting materials. Thus the legislation puts the responsibility on the manufacturing-authorisation holders using the active substance and does not foresee mandatory routine inspections of active-substance manufacturers.

To provide guidance on how GMP compliance of active-substance manufacturers should be established, guidance documents have been published on this website, including the 'guidance on the occasions when it is appropriate for competent authorities to conduct inspections at the premises of manufacturers of active substances used as starting materials' as part of the Community procedures. This document states that it is expected that manufacturing-authorisation holders will normally gain assurance that the active substances it uses are manufactured in accordance with GMP through audit of the active-substance suppliers.

In addition, a number of questions and answers on audits of active-substance manufacturers on this page provide further guidance.

Manufacturing-authorisation holders sometimes confuse the role of inspectorates with their own obligations but nevertheless, when inspection reports or GMP certificates issued by European Economic Area (EEA) mutual-recognition-agreement (MRA) partners or other recognised authorities are available, these can provide useful information to manufacturing-authorisation holders.

However, these alone cannot fulfil the statutory obligations of the manufacturing-authorisation holder or the requirements of section 5.29 of the GMP guideline, but the results of inspections may be used together with other supporting information in a risk-based approach by the manufacturer in establishing priorities for its own audit programme of active-substance suppliers.

The EEA inspectorates are not generally in favour of 'paper-based audits' per se as they do not provide the same level of assurance as on-site assessments, but do accept that they have a part to play in a risk-based strategy.

They may be particularly applicable when recent positive inspection information is available and where satisfactory audits have been concluded in the past. They cannot replace on-site audits of active-substance suppliers but can be a useful interim and temporary measure within the manufacturer's audit programme.

Importers are manufacturing-authorisation holders and so the obligations under Article 46f/50f of Directive 2001/83(2) apply to them. For importers, the possibility of a second-party audit performed by the third-country manufacturer that uses the active substance as a starting material may be a further option.

Importers are already obliged to ensure that the third-country manufacturer complies with standards of GMP equivalent to those of the European Community and should have established arrangements in line with chapter 7 of the GMP guideline. They should therefore be fully satisfied that the third-country manufacturer has adequately demonstrated that the active substances it uses for products destined for the European Community have been manufactured in accordance with GMP.

Importers may of course choose to verify the standards of GMP at the active-substance suppliers themselves or through a third party. Whichever option is chosen, the questions and answers above are also relevant.

First, the responsibility for only using active substances that have been manufactured in accordance with GMPs is placed on the holders of a manufacturing authorisation (MA). An inspection of the active substance manufacturer by an EEA authority does not liberate a MA holder from this responsibility.

Article 111 (1f) of Directive 2001/83/EC and Article 80(1) of Regulation (EU) 2019/6, have provision for the competent authority of the Member State concerned to carry out inspections of starting material manufacturers at the specific request of the manufacturer. The request for the inspection should be made to the EEA competent authority where the site is located or, in case of sites located in third countries, to a competent authority where the starting material is used in the manufacture of medicinal products. If this is not the case, any EEA authority can be approached.

There is no guarantee that such a request will be fulfilled since competent authorities primarily use risk-based principles to plan starting material inspections. Thus, when a starting material manufacturer applies for a voluntary inspection, this does not constitute an obligation for the competent authority to trigger an inspection.

The notice to applicants requires the submission of a declaration signed by the qualified person (QP) that the active substance used is manufactured in accordance with GMP. The active substance in my product is widely used, but not normally as a pharmaceutical active substance, and I am having some difficulty in confirming compliance. What should I do to furnish the required declaration? H+V September 2008

Full compliance with GMP for finished products and active substances is a legal obligation for manufacturing-authorisation holders. It is recognised that for a small number of medicinal products, the primary use of the active substance is not in a medicinal product and the producer may therefore not be aiming to meet the specific requirements of pharmaceutical customers that represent an insignificant volume of business.

Alternative sources should normally be sought, but in exceptional cases the manufacturing-authorisation holder should assess and document to which extent GMP is complied with and provide a risk-based justification for the acceptance of any derogation.

The declaration provided by the QP should set out in detail the basis for declaring that the standards applied provide the same level of assurance as GMP. The European Medicines Agency will collect experience with this approach, which can be used as a basis for discussion on related amendments to guidelines in the future.

Update January 2019: This Q&A has been superseded by the Guideline on the sterilisation of the medicinal product, active substance, excipient and primary container. Please refer to this guideline for further information.

The GMP basic requirements for active substances used as starting materials (EU GMP guideline part II) only applies to the manufacture of sterile active substances up to the point immediately prior to the active substance being rendered sterile. The sterilisation and aseptic processing of sterile active substances are not covered by this guideline and should be performed in accordance with GMP for medicinal products (Commission Directive 2003/94/EC as interpreted in the basic requirements for medicinal products including annex 1 of the EU GMP guideline part I). This implies that for any active-substance manufacturer that performs sterilisation and subsequent aseptic handling of the active substance, a valid manufacturing authorisation or GMP certificate from an EEA authority or from an authority of countries where MRA or other Community arrangements apply has to be submitted.

The active-substance manufacturer also has to submit data on the sterilisation process of the active substance (including validation data) to the marketing-authorisation applicant or holder for inclusion in the dossier submitted for the finished product and approval by the licensing authorities.

Inspectors may need to see audit reports during inspections as part of the assessment of the manufacturing-authorisation holder's systems for confirming GMP compliance of active substance manufacturers or suppliers. Inspectors will expect to see the full details of these reports upon request, including responses received from the audited site, indication of closure of deficiencies raised or commitments made.

As a minimum, the following is expected to be included in the report:

• The full postal address of the site. The auditors must be identified by full name and their employer recorded. If the audit is conducted on behalf of other parties this should be clear in the report. Where an audit report is obtained through a third party, the manufacturing-authorisation holder is responsible for ensuring the validity and impartiality of the audit report. The identity of key staff participating in the audit should be recorded along with their roles.The full contact details of the person through which the audit was arranged should be recorded including contact details (e-mail address, telephone number). The dates of the audit should be recorded, with the full-day equivalents clarified if full days were not spent on site. A justification should be recorded for the duration of the audit. If, in exceptional circumstances, the audit had to be restricted to fewer days on site than required by the scope of the audit, the reasons should be explained and the conclusions with respect to the GMP status of the site should be justified background information on the active substance manufacturer should be recorded; this should include the company ownership, the age of the site, the number of staff employed in total and for the specific products being audited. The role of the site in manufacture of the active substances being audited should also be clarified for each of the active substances being audited, e.g. if the site performs the full manufacture or only part of the manufacture.
• The scope of the audit should be clearly stated e.g. what activities (against European Union GMP part II / International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH) Q7 chapters) were covered. The activities which were not covered by the audit should also be clearly recorded. Auditors should identify the high risk areas for audit specific to the site or products being audited. For example, these could include but not be limited to:
  • process, cleaning or validation;
  • risk of cross-contamination with other active substances or other substances;
  • potential for generation of unknown impurities;
  • risk of mix-up of materials and products through materials handling or packing;
  • change control;
  • deviation recording or management;
  • security sealing of active substance containers and security or temperature control of shipments.
• Subsequent audits conducted as part of the ongoing supplier audit program may have a reduced scope focusing on the highest risk areas. In such cases the highest risk areas should be identified and justified.
• A list should be recorded of all active substances directly included in the audit scope plus other active substances or intermediates (or other products) manufactured at the site.

There should be a clear record of the products, the stages of manufacture and the buildings audited. If access was denied to any relevant areas of the site this should be recorded and explained. The list should clarify which of the active substances in the scope of the audit are manufactured in multi-purpose equipment or buildings as either final product or any of the intermediate stages.

• Dates of any previous audit conducted by or on behalf of the same manufacturing-authorisation holder should be recorded. If any of the audits did not conclude with a positive GMP compliance status, a brief summary of the reasons for this should be recorded.
• Each of the applicable sections of EU GMP part II should form sections of the report with a summary of what was examined, the key findings and compliance with the requirements of each section. The report should clearly state findings against each activity audited with particular focus on the high risk areas. Any GMP deficiency identified during the audit must be clearly recorded with its criticality defined. An explanation should be given, in the report or in a supporting standard operating procedure, of the categorisation system used to classify deficiencies, e.g. critical, major or minor.
• Responses to the audit by the active-substance manufacturer should be reviewed by the auditors. Corrective and preventative actions and timescales for completion should be assessed by the auditors to establish whether these are appropriate to the findings. Further clarification or evidence of completion should be requested, commensurate to the risk.
• A summary assessment of the status of corrective and preventive actions should be recorded by the auditors once these have been received and assessed. An overall recommendation should be made in the final report. The summary should include whether the auditor regards the actions as satisfactory. The responsible QP should ensure that he or she, or someone to whom it is delegated, is in agreement with the overall recommendation of the final report. The QP must not release the relevant medicinal products without knowledge of a positive recommendation from the auditors. This recommendation should include the GMP compliance status of the site and whether any reduced controls on materials receipt at the finished product manufacturing site are supported by the auditors.
• A proposed re-assessment period should be recommended.
• The final report should be signed and dated by, at least, the lead auditor.

Auditors should have sufficient scientific, technical and other experience to enable them to perform an adequate and thorough audit of the active substance manufacturer, as related to the planned scope of the audit. Where a proposed auditor lacks an appropriate level of direct experience in the field of active substance manufacture, he or she should undergo a documented training and assessment programme in the areas that are relevant to the audit, taking into account the auditor's anticipated role in the audit and the technologies that are likely to be encountered during the audit. Auditors must also be trained and assessed in their knowledge and understanding of EU GMP part II and in auditing techniques in general. The training and assessment should be fully documented.

The qualification and experience of contracted auditors are the same as the requirements for the manufacturing-authorisation holder's own auditors.

Article 111 (1b) of Directive 2001/83/EC requires that Member States have a system of supervision including inspections at an appropriate frequency based on risk, at the premises of the manufacturers, importers, or distributors of active substances located on its territory.

In line with the document “Model for Risk Based Planning for Inspections of Pharmaceutical Manufacturers” available in the Compilation of Union Procedures, sterile and biological active substances are considered a relatively higher risk. Consequently, competent authorities may decide to submit these substances to a higher or a set inspection frequency.

The Q&As on Quality Part 1, address the exceptions where the formulation of an active substance can be described under CTD section 3.2.S.

For the manufacture of biological active substances, Part II and Annex 2 of the GMP guidelines apply. While quality risk management principles also apply to the formulation of a biological active substance, some aspects of GMP part 1 as described below are more appropriate and are expected as a minimum:

• Particular emphasis should be put on the management of the constitutive excipients of the formulated active substance. Specifications should be defined for excipients according to GMP Part I., 4.14 and the monographs of the European Pharmacopoeia should be applied. The approval, maintenance and audit of excipient suppliers should be based on quality risk management, in accordance with GMP Part I, 5.29 and the EU guidelines on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients of medicinal products for human use. An agreement between the medicinal product manufacturer and the excipient manufacturer should be established in accordance with GMP Part I, 5.28.

The sampling of excipients used for the formulated active substance should comply with GMP Annex 8 and retention samples of excipients should be kept under the responsibility of the medicinal product manufacturer (in accordance with GMP Part I., 1.9 (viii) and GMP Annex 19).

Excipients used by the manufacturer of the formulated active substance should be included in the Periodic Quality Review (in accordance with GMP Part I., 1.10 (i)).

• Consideration should be given to the inclusion of batches of a finished medicinal product manufactured from formulated active substances, stored for the maximum holding time, in the ongoing stability program of the medicinal product, in accordance with GMP Annex 2, 67 and GMP Part I., 6.28.
• When outsourced, the manufacture of a formulated active substance should be managed in the same way as the outsourcing of the manufacture of an intermediate medicinal product, through full application of the requirements of Chapter 7 of the GMP part I guideline.

Directives 2001/82/EC and 2001/83/EC, as amended, include obligations for manufacturing-authorisation holders only to use active substances that have been manufactured in accordance with GMP. Provision is also made for inspections of active-substance manufacturers but only under certain specified circumstances.

IMPs are unaffected because the obligations of manufacturing-authorisation holders in this case are laid down in Directive 2005/28/EC, which does not contain corresponding requirements for active substances. Furthermore, this is made clear in the introduction to part II of the GMP guideline.

Part II of the GMP guideline does include a short section on new active substances to be used as starting materials for IMPs and these remain as recommendations with no mandatory force. Nevertheless, active substances used in the manufacture of marketed products are already required to comply with GMP irrespective as to whether they may also used in the manufacture of IMPs.

Annex 1, paragraph 85 states, 'the integrity of the sterilised filter should be verified before use and should be confirmed immediately after use by an appropriate method such as a bubble-point, diffusive-flow or pressure-hold test.'

The filter-sterilisation process may be physically stressful for the filter. For example, high temperatures during the process may cause the filter to distort, potentially leading to fluid pathways that allow the passage of particles greater than 0.2 µm in size. The performance of a filter can improve with use, as particles begin to block individual pathways and remove larger pathways that smaller particles could successfully navigate. For these reasons, filters should be tested both before use but after sterilisation and again after use.

Furthermore, testing should be performed in situ in order to verify the integrity of the filter complete with its housing.

The sampling plan for sterility testing should take account of the definition of a batch as stated in the glossary of the GMP guideline together with the recommendations of annex 1 section 93 (section 127 in the February 2008 revision). Each steriliser load is considered to be an independent sub-batch. Consequently, one sterility test should be performed per sub-batch. The number of samples per steriliser load should conform to European Pharmacopoeia requirements, section 2.6.1.3.

Can there be any exceptions to this rule?

For large-volume parenterals where the sterilisation cycle has been qualified with an overkill level, an alternative sampling plan in accordance with a specific internal procedure agreed with the supervisory authority can be accepted (unless already specified in the marketing authorisation).

This procedure should state the need to sample from each steriliser load including the coolest location identified during the steriliser qualification. The number of samples per load should be defined based on a risk-based approach and the overall number of samples per batch should conform to European Pharmacopoeia requirements, section 2.6.1.3. An alternative option, which would require a variation to relevant existing marketing authorisations, would be to introduce a system of parametric release, thereby avoiding the need to carry out the sterility test.

The revision provides updated guidance on:

• classification of the environmental cleanliness of clean rooms;
• guidance on media simulations;
• guidance on capping of vials;
• bioburden monitoring prior to sterilisation.

GMP inspectors from the EU have worked together with inspectors from Swissmedic to prepare harmonised guidance on the interpretation of the revised annex to be used during the inspection of manufacturers by their Inspectors. This document has subsequently been proposed and adopted as draft guidance by the Pharmaceutical Inspection Cooperation Scheme (PIC/S): GMP annex 1 revision 2008: Interpretation of most important changes for the manufacture of sterile medicinal products.

According to the EU GMP guideline (annex 1), the bioburden should be monitored before sterilisation and testing should be performed on each batch.

For routine commercial manufacturing, bioburden testing should be performed on the bulk solution, immediately before its sterile filtration. If a presterilising filter is additionally installed, then sampling for bioburden testing may be performed prior to the prefiltration, provided that no holding time is scheduled for the solution between the two filtration steps.

The specification limits for bioburden should be NMT 10 CFU/100 ml, in line with the human and veterinary notes for guidance on manufacture of the finished dosage form ( CPMP/QWP/486/95 and EMEA/CVMP/126/95 ).

When a prefilter is installed, unless otherwise justified, a bioburden limit of 10 CFUs/100 ml before first filtration is achievable in principle and is strongly recommended from a GMP point of view. Higher bioburden limits should not be justified by the high capacity of two consecutive bacteria retaining filters.

However, when appropriate justification is submitted (processes involving fermentation or other biological or herbal components, use of purified water for ophthalmic preparations, etc.), a bioburden limit of higher than 10 CFUs/100 ml before prefiltration may be acceptable. In such cases, it should be demonstrated that the first filter has the capability to achieve a bioburden prior to the last filtration of NMT 10 CFUs/100 ml, in line with the notes for guidance on manufacture of the finished dosage form (CPMP/QWP/486/95 and EMEA/CVMP/126/95).

Annex 1 of the EU GMP guide is currently under revision and will take account of the updated ISO standard. In the meantime, for qualification or re-qualification of clean room facilities, medicinal product manufacturers may apply the updated ISO standard with reference to Annex C (counting of macroparticles), or may continue to follow the previous ISO standard. Routine monitoring, however, should continue to be carried out in accordance with the existing Annex 1.

• Questions and answers on production of water for injections by non-distillation methods – reverse osmosis and biofilms and control strategies - Final

Traceability is the ability to retrieve the history of the manufacturing and distribution operations of a batch of a medicinal product.

The data recorded through the traceability system should allow efficient investigation in case an incident occurs and should allow recalls of (potentially) defective products.

In the case of packaged medicinal gases, the packaging components (shells and valves) are reusable. It is therefore necessary to record additional information, in particular in relation to the use and maintenance of these components.

Packaging components (shells and valves)

The cylinder is the combination of the shell and its valve.

Shell

For safety reasons, shells are individually identified (specific reference). Individual traceability is therefore possible. The date of the last hydrostatic pressure test (or equivalent test) should be recorded.

Valve

Shells may be fitted with simple valves (e.g. pin-index valves) or integrated valves. Integrated valves are individually identified (individual identification reference). Individual traceability is therefore possible. This is not the case for simple valves, which mostly have only a serial number corresponding to a group of valves.

The design of integrated valves, which are medical devices, is complex. These valves are also subject to periodic preventive maintenance operations. In terms of risk, more serious incidents have been reported with cylinders having this type of valve.

Therefore:

• in the case of simple valves, the type of valve should be recorded, as well as the name of the manufacturer and the serial number, if one is available;
• in the case of integrated valves, traceability should be ensured for each valve. Records should include in particular the type of integrated valve (including the version), the individual identification reference of the valve, the name of the manufacturer, the date of the last (or next) preventive maintenance and details of any preventive maintenance performed on the valve.

Shell and valve

Each shell-and-valve combination should be traceable.

Finished product

The manufacturing batch records should include the individual identification references of the cylinders of each batch of finished product (see EU GMP guideline annex 6, section 17, (g) and (m)).

Distribution

The distribution records should include the individual identification references of the cylinders delivered to each customer.

In practice, depending on the scale of operation, it may be difficult to ensure effective traceability without a computerised system. Use of bar codes or electronic chips on the cylinders may facilitate this. Any computerised system used to ensure traceability should conform to the requirements of annex 11 of the EU GMP guideline.

Should a manufacturer of a medicinal gas receive a serious complaint relating to the quality of the medicinal gas itself or the packaging components, the system in place should allow the identification of the affected cylinders and, where necessary, the recall of any affected cylinders from the market.

A defect relating to packaging components may require identification of specific cylinders within a finished product batch or identification of cylinders present in a number of finished product batches in order to establish the extent of any recall required.

For example, an effective traceability system should allow effective recalls of cylinders fitted with defective valves based on:

• specific type, version or manufacturer's batch for the valves;
• maintenance and calibration operations for the valves during a specific time period.

There is a history of sporadic reports from around the world of supplies of glycerol contaminated with diethylene glycol (DEG) resulting in mortality and serious morbidity in patients receiving contaminated products.

In late 2006, DEG-contaminated glycerol in cough syrup was the cause of about 50 deaths in Panama. DEG-contaminated glycerol in paracetamol syrup was also attributed to at least 80 deaths in a similar incident in Haiti in 1995-1996. Other incidents have been reported in Argentina, Bangladesh, India and Nigeria and attributed to the deaths of hundreds of children. DEG was also responsible for a poisoning incident resulting in the death of 107 people in the United States in 1937, following ingestion of contaminated sulphanilamide elixir.

These incidents were related to both accidental cross-contamination of glycerol with industrial grade materials and, in some cases, to intentional substitution.

Recent cases show the following similarities:

• pharmaceutical manufacturers of products containing contaminated glycerol did not perform full identity testing or tests to determine DEG on the glycerol raw material;
• pharmaceutical manufacturers of contaminated products relied on certificates of analysis (COAs) provided by the supplier;
• the origin of glycerine was not apparent from the COA. The COA provided with the glycerol raw material may have been a copy of the original on a distributor letterhead. The supply chain for glycerol was not readily known by the medicinal-product manufacturer because the glycerol may have been sold several times between its manufacture and the medicinal-product manufacturer.

EU GMP requires all manufacturing companies to confirm that all its raw materials are checked on receipt to confirm their identity and quality. Competent authorities expect product manufacturers to routinely ensure that incoming samples of glycerol are tested according to the European Pharmacopoeia monograph.

The European Pharmacopoeia monograph for glycerol includes a specific limit test for diethylene glycol (0.1%).

It is correct that annex 8 does provide for a relaxation of identity testing of every container, but it also states that this would not normally be possible if brokers or intermediates were involved in the chain of supply.

Glycerol is a commercial article that is widely used in the food and other industries. Generally speaking, the supply chain for glycerol tends to be complex and lengthy. The involvement of brokers is common in the supply chain.

When designing supplier-assurance and incoming-goods-control programmes, companies should consider glycerol a higher-risk material.

Companies should be able to exhibit a good knowledge of starting material supply chains and apply this knowledge and principles of quality risk management to their programmes for supply-chain management. Inspectors will look to ensure that the basis for qualification of the supply chain is demonstrably robust for higher-risk materials such as glycerol. It is expected that identity testing and the European Pharmacopoeia limit test for DEG will be performed on each container as a matter of routine.

This point is acknowledged and currently, alternative tests are under consideration with a view to work up a possible change to the identity tests in the monograph. The European Pharmacopoeia DEG limit test remains the official method for confirmation of compliance with the monograph.

In application dossiers for new marketing authorisations (MAs), or in case of relevant variations for existing MAs (for example, replacement of an excipient with glycerol) for medicinal products containing glycerol, confirmation of the tests applied on receipt of batches of glycerol to control the risk from potential DEG contamination in relation to the specific intended use of the product should be provided. A test for DEG content should be conducted in addition to identity testing for glycerol. A suitable control for DEG is included in the European Pharmacopoeia monograph for glycerol.

Sufficient information regarding satisfactory control of this risk will be required in the dossier before approval of the MA application or variation.

For existing approved medicinal products, no variation application is required, except for those few specific types of variations referred to in the first paragraph. However, as a minimum, the specific European Pharmacopoeia control for DEG should be conducted along with the identity test at receipt of each batch of glycerol. The excipient is required to comply with the current European Pharmacopoeia glycerol monograph, and as the specification approved in the dossier will have been that of the European Pharmacopoeia, the risk of DEG contamination will have been appropriately controlled. Compliance with this requirement will be verified during GMP inspections.

Where a company manufactures products for external use, and when it has justified that the presence of DEG in these products poses a low risk, the omission of the test for DEG on each container may be accepted by the supervisory authority.

Annex 8 of the GMP guideline states that the identity of a complete batch of starting materials can normally only be ensured if individual samples are taken from all the containers and an identity test performed on each sample. It is permissible to sample only a proportion of the containers where a validated procedure has been established to ensure that no single container of starting material has been incorrectly labeled. However, the annex goes on to say that it is improbable that a procedure could be satisfactorily validated for starting materials for use in parenteral products.

Unless variations are submitted for all affected products, the registered method for confirming identity should be performed. However, there is no restriction on the performance of additional testing and the use of NIR to confirm container-wise confirmation of identity can provide useful information. Under these circumstances, the requirements of the marketing authorisation will be deemed to have been met by carrying out the registered method for confirmation of identity on a statistically representative composite sample when this is supplemented with NIR analysis of every container.

The NIR method should be validated in line with the recommendations of the guideline on the use of near infrared spectroscopy by the pharmaceutical industry and the data requirements for new submissions and variations.

Templates of spreadsheets help to avoid erroneous calculations from data remaining from previous calculations. They should be suitably checked for accuracy and reliability (annex 11 p7.1). They should be stored in a manner which ensures appropriate version control (chapter 4 p4.1).

Data integrity should be ensured by suitably implemented and risk-assessed controls. The calculations and the files should be secured in such a way that formulations are not accidentally overwritten. Accidental input of an inappropriate data type should be prevented or result in an error message (e.g. text in a numeric field or a decimal format into an integer field). So-called 'boundary checks' are encouraged.

Validation according to paragraph 4 of annex 11 is required at least for spreadsheets that contain custom code (e.g. Visual Basic for applications). Formulas or other types of algorithm should be verified for correctness.

Data security includes integrity, reliability and availability of data. During validation of a database-based or inclusive system, consideration should be given to:

• implementing procedures and mechanisms to ensure data security and keeping the meaning and logical arrangement of data;
• load-testing, taking into account future growth of the database and tools to monitor the saturation of the database;
• precautions for necessary migration of data (annex 11 p17) at the end of the life-cycle of the system.

Risk management should be applied throughout the whole life-cycle. A first risk assessment should be performed to determine the GMP criticality of the system, i.e. does the system have an impact on patient safety, product quality or data integrity? User-requirement specifications are usually developed with consideration of potential risks and form the basis for the first formal risk assessment.

Complex systems should be evaluated in further more detailed risk assessments to determine critical functions. This will help ensure that validation activities cover all critical functions.

Risk management includes the implementation of appropriate controls and their verification.

The way to check whether a computerised system is fit for its intended purpose is to define user requirements and perform a gap analysis to determine the validation effort for retrospective validation. These user requirements should be verified.

Computerised systems should be reviewed periodically to confirm that they remain in a validated state. Periodic evaluation should include, where applicable, the current range of functionality, deviation records, change records, upgrade history, performance, reliability and security. The time period for revaluation and revalidation should be based on the criticality of the system.

The requirements for storage of electronically data and documents do not differ from paper documents. It should be ensured that electronic signatures applied to electronic records are valid for the entire storage period for documents.

Small devices are usually off-the-shelf pieces of equipment that is widely used. In these cases, the development life-cycle is mainly controlled by the vendor. The pharmaceutical customer should therefore reasonably assess the vendor's capability of developing software according to common standards of quality.

A vendor assessment needs to be performed and the application needs to be verified against the requirements for the intended use. From the perspective of the regulated industry, the implementation of such a device is driven by an implementation life-cycle. At minimum the following items need to be addressed:

• requirement definition for the intended use including process limitations. This should also include a statement indicating whether data are stored or transferred to another system. As per the definition of a small device, data are not stored permanently but temporarily and are not to be modified by a user. Therefore, limited user access handling is acceptable. It needs to be ensured that parameter data influencing the device's behaviour may not be altered without suitable permission;
• risk assessment, taking into consideration the intended use and the risk to patients for associated with the process supported by the small device;
• vendor assessment;
• list of available documentation from the vendor, especially those describing the methodology used and the calculation algorithm, if applicable. A vendor certificate or equivalent detailing the testing performed by the vendor may also be included;
• calibration certificate, if applicable;
• validation plan according to the risk-assessment results;
• verification testing proving that the device fulfills the requirements for the intended use. It may be equivalent to a PQ-phase.

Small manufacturing devices are sometimes only equipped with microprocessors and firmware and are not capable of high-level administration functions. Moreover, data is often transient in nature in these devices. Due to the latter there is no risk of inadvertently modifying data. An audit trail is therefore not necessary and user access may be limited to those functions of parameter control.

As long as this functionality is not supported by the supplier, it may be acceptable to describe in a procedure the fact that a print-out of the related audit trail report must be generated and linked manually to the record supporting batch release.

Commission Directive 2001/20/EC defines an IMP as 'a pharmaceutical form of an active substance or placebo being tested or used as a reference in a clinical trial, including products already with a marketing authorisation but used or assembled (formulated or packaged) in a way different from the authorised form, or when used for an unauthorised indication, or when used to gain further information about the authorised form.'

An active substance would be considered an IMP if presented in a packaged form for use in a clinical trial. Any such packaging operation could only be carried out by a site holding an IMP manufacturing authorisation.

Any form of mixing or processing the active substance with other substances would also result in the need for a manufacturing authorisation for IMPs if the resulting product is to be used in a clinical trial.

Physical processing such as milling of an active pharmaceutical ingredient would not constitute IMP manufacturing.

The above does not refer to reconstitution. Separate guidance on this subject is under development.

The QP of a site that is manufacturing a drug product intermediate should assure that the product is produced and controlled in compliance with the EU GMP guideline, in particular the requirements of annex 13.

A product specification file should be developed with contributions from the QPs and other technical personnel of the sites involved with the other manufacturing activities of the IMP. The sponsor of the clinical trial should also be involved in this process. While this may be in a rudimentary form and contain little detail, it should be developed as knowledge of the product evolves and include specifications for critical parameters and controls. The product specification file should be updated and evolve in line with the product development as envisaged in annex 13.

The development of the product specification file should be managed under a technical agreement or a number of technical agreements between the various manufacturing sites. These should include the QP responsible for the final certification of the product and the sponsor, if the sponsor has already been appointed. In any event, final release of the product to trial sites should take place only when the sponsor has established that the product has been manufactured in compliance with the terms of the approved clinical-trial application (as required by annex 13.44). This is defined in annexes 13.40 and 13.44: 'The sponsor should ensure that the elements taken into account by the QP when certifying are consistent with the information notified pursuant to Article 9(2) of Directive 2001/20/EC.'

This is normally possible only if a manufacturing authorisation has been granted to the site by the national competent authority.

According to Article 9(1) of Directive 2005/28/EC, the “authorisation, as provided for in Article 13(1) of Directive 2001/20/EC, shall be required for both total and partial manufacture of IMPs, and for the various processes of dividing up, packaging or presentation.”

However, an exemption to this obligation is foreseen in Article 9(2) of Directive 2005/28/EC: 'Authorisation, as provided for in Article 13(1) of Directive 2001/20/EC, shall not be required for reconstitution prior to use or packaging, where those processes are carried out in hospitals, health centres or clinics, by pharmacists or other persons legally authorised in the Member States to carry out such processes and if the IMPs are intended to be used exclusively in those institutions.' In addition, reference should be made to section 33 of annex 13 in respect of any re-labelling to extend shelf life.

The sponsor has the ultimate responsibility for all trial activities performed at the investigator site, but should seek the advice of the QP of the IMP manufacturer, if possible, or the clinical-trials pharmacist at the investigator site regarding:

• adequacy of premises and equipment (storage conditions etc.);
• adequacy of written standard operating procedures;
• training of personnel involved, both on GMP requirements and any protocol specific requirements for the IMPs;
• written instructions to perform activities;
• forms to document the activities carried out;
• checks to be done;
• the keeping of retention samples;
• record-keeping.

The sponsor should exercise control over the entire chain of distribution of IMPs, from manufacture or importation into the EEA, through to supply to the investigator sites, so as to guarantee that IMPs are stored, transported, and handled in a suitable manner.

When an IMP originates from a third country, the importer is responsible for verifying that the transportation and storage conditions for the product are suitable. For products originating within the EEA, the manufacturer is responsible for transportation and storage conditions. The respective responsibilities of the sponsor, manufacturer, importer and, where used, distributor should be defined in a technical agreement.

Storage conditions during transportation should be validated or monitored using a suitable temperature-measuring device that is capable of showing fluctuations in temperature e.g. Temperature Logger. The choice of method of transport should be influenced by the nature and sensitivity of the product and should ensure timely delivery of IMPs to the investigator sites.

The outer packaging should be labelled showing the final destination, the name of manufacturer or sponsor and the storage conditions required.

IMPs should be packaged to prevent contamination and unacceptable deterioration during storage. The sponsor should determine acceptable storage temperatures and any other required storage conditions for the IMPs (e.g. protection from light).

The sponsor should ensure that all involved parties (e.g. monitors, investigators, pharmacists, storage managers) are aware of these conditions and the actions to be taken in the event that the conditions are not met.

Where appropriate, there should be a restricted area for the storage of IMPs. The temperature of the areas and equipment used for the storage should be monitored using suitable means, such as a temperature recorder or, as a minimum, a record of the maximum and minimum temperatures, at a suitable frequency (for example, daily).

The sponsor should ensure that written procedures include instructions that the investigator or institution should follow for the handling and storage of IMPs. The procedures should address adequate and safe receipt, handling, storage, where relevant any reconstitution process to be carried out before administration, retrieval of unused product from subjects, and return of unused IMPs to the sponsor (or alternative disposal, if authorised by the sponsor and in compliance with the applicable regulatory requirements).

Procedures should also give instructions on the actions to be taken when defined conditions are not met.

The sponsor should ensure that the documents listed in chapter 8, 'essential documents for the conduct of a clinical trial' of the guideline for good clinical practice are maintained and accessible to those parties authorised to review them.

EU legislation requires a manufacturer to have at least one QP at its disposal but a site may have more than one QP who may certify batches on behalf of the manufacturer.

Annex 16 of the EU GMP guideline gives guidance in relation to situations where different stages of manufacture of a batch take place at different manufacturing sites.

In such cases, the overall responsibility for correct manufacture of the batch lies with the QP performing final certification of the batch before release for sale. It is also possible that, at a single manufacturing site, different QPs could be responsible for certification of different stages of manufacture of the batch. However, as before, the QP performing final certification before release holds overall responsibility for manufacture of the batch in accordance with GMP and the marketing authorisation.

In order to satisfy the criteria in Annex 16 section 3 for handling unexpected deviations, all registered specifications for active substances, excipients, packaging materials and medicinal products must be met.

Registered specifications for medicinal products include in-process, bulk and finished product specifications which have been included in the MA application.

The criticality of registered in-process specifications may vary depending on the quality attribute tested, the impact to subsequent manufacturing processes and ability to test the quality attribute in the finished product. It may therefore be possible to accept deviation from an in-process specification where risk assessment confirms that there is no impact to manufacturing process or product quality.

Non-compliance with registered specifications (except where excursions from in-process specifications can be accepted based on quality risk management principles) therefore fall outside the scope of Annex 16 section 3, and the QP would not be able to certify the affected batches under the Annex 16 provisions for handling unexpected deviations.

What is an 'unexpected' deviation?

The process itself should be designed to comply with the registered requirements (fit for purpose). A deviation can be considered as 'unexpected' until the time of discovery. Where the relevant authorities have confirmed the need to avoid supply disruption, repeat deviations thereafter are no longer 'unexpected' but may be considered for QP certification and accepted while corrective and preventive action is in progress and where the provisions of Annex 16 paragraph 3.1 are met.

Planned deviations or deviations that are caused by incorrect communication between marketing authorisation holder (MAH) and manufacturers (e.g. if the MAH fails to notify the manufacturer of relevant changes to the MA) are outside the scope of the paragraph 3.1. The marketing authorisation holder should submit an application for a variation to the marketing authorisation, if needed.

Does Annex 16 permit QP certification of more than one batch affected by the same unexpected deviation?

If more than one batch has already been manufactured and/or tested at the time of discovery of the unexpected deviation, then it is acceptable to consider QP certification of all these batches under the provisions of Annex 16 section 3.

Following discovery, repeated deviations from the manufacturing process and/or analytical control methods should be considered changes, and variations to the affected marketing authorisations must be submitted. In exceptional circumstances to avoid disruption to supply, it may be possible to continue QP certification while corrective and preventive action is in progress; see Q&A on what is 'unexpected' deviation above.

Remote batch certification / batch confirmation could be allowed if accepted by the national competent authority where the authorised site is located. Some competent authorities may have specific requirements regarding the implementation of remote batch certification / batch confirmation on a routine basis. Manufacturers and QPs should ensure that they comply with any applicable local requirements. In order to determine what requirements apply, manufacturers should consult with their national competent authority.

The following points should be taken into consideration:

• It is a prerequisite that the QP certification/confirmation is carried out in full accordance with EU legislation and EU GMP guidelines
• QP certification / confirmation should take place within the EU/EEA (or Northern Ireland) in all cases. This should be demonstrated by technical means.
• QPs are obliged to maintain their knowledge in relation to the products, manufacturing processes and pharmaceutical quality system. QPs also need to be satisfied that their ongoing reliance on the relevant pharmaceutical quality system is well founded. The QP must be able to demonstrate to the competent authority knowledge of the product and the manufacturing processes for which they are responsible. This should include time spent physically on-site as applicable.
• Where remote QP certification / confirmation is employed on a routine basis, it must be described and controlled within the pharmaceutical quality system and relevant detailed site procedures should be in place. In Member States where use of contract QPs (i.e. a person who is not an employee of the manufacturer but conducting QP activities under the manufacturer’s authorisation) is permitted, the technical agreement between the MIA holder and the QP should also mention remote certification / confirmation, and specify the circumstances under which the QP must attend the site.
• The QP should have access to all information (data and computer system applications) which are necessary according to Annex 16 to make a decision on batch certification / confirmation.
• The MIA holder should provide the required facilities to enable QPs to carry out their functions remotely. This includes the equipment and support required to enable electronic batch certification / confirmation and completion of the batch certification register remotely. IT systems used for remote batch release should comply with requirements of EU GMP Annex 11.
• All actions carried out by the QP electronically at the remote location should be contemporaneously available for inspection by the competent authorities at the authorised batch release site. It is the responsibility of the MIA holder to guarantee that a) only the QP has editing access to the batch certification function, b) that data being transferred are complete and unchanged and c) an electronic signature, reflecting requirements in annex 11, is in place. QPs must be able to demonstrate that they are fulfilling their wider duties in accordance with Annex 16.
• Compliance with the above points should be verified e.g. as part of the self-inspection programme at the authorized batch release site.

The risk with regard to IT-security and data integrity for remote access is higher than for access within the controlled environment at the authorized site. Minimum requirements depend very much on the state of technology employed. The following requirements should be adapted to reflect current technological developments. Technical and organisational solutions which are not listed below but result in an appropriate level of security may also be acceptable:

• Prior to transfer of any hardware off-site it should be identified and inventoried. It should be ensured that the hardware remains complete and up-to-date. The hard disk should be encrypted and any ports that are not required should be disabled.
• For QPs who may be using a virtual private network, security parameters on the network operating system, database and application level should be configured appropriately to avoid unauthorised access.
• Recognised industry standards should be used for authentication and authorisation (e.g. two-factor or multifactor authentication). There should be no use of shared authentication information, and automatic expiry of authentication information should be employed.
• Data in transfer should be secured by strong transport encryption (e.g. TLS 1.2, https)
• The MIA holder is responsible for putting organisational controls (e.g. assignment of individual privileges) and technical controls in place to ensure that only the QP is able to perform remote batch certification / confirmation.

There are currently no harmonized requirements concerning residency of QPs in the EU legislation. However, some Member States may have specific national requirements.

For retention purposes, it is not necessary to keep the full number of samples required in table 2.6.1.3 of the European Pharmacopoeia sterility test monograph to repeat the sterility test performed for release purposes, but only a sufficient quantity to allow the carrying out, on two occasions, of a confirmatory test using the minimum quantities described in table 2.6.1.2 of the monograph.

Firstly, the supervisory authority should grant such an exemption upon request from the manufacturer. The relevant authority may agree to this when one or more of the following criteria are met:

• A batch size of less than 50 units;
• High value/low volume medicinal products and the high value price of the medicinal product as determined by each individual competent authority;
• Large size of one packaged unit e.g. some veterinary pre-mixes or hospital packages.

Parallel imported/distributed medicinal products will not be granted an exemption from keeping a fully packaged unit if the products have been re-packaged.This is because the exemption refers to “duplicate samples”, and in these cases no reference sample is required to be kept by the parallel distributor/importer.

On the other hand, where the secondary packaging of the source product is not opened by the parallel importer/distributor only samples of the additional packaging material used needs to be retained.

The original batch specific primary packaging material with print/imprint, if any, all the original batch specific secondary packaging materials e.g. labels and leaflets with print/imprint including Braille, and dosing aids, if any, must be kept.

The use of photocopies of the fully packaged unit to replace the retention sample are not acceptable as some details e.g. braille and holograms may not show correctly.

The requirements pertaining to retention samples for investigational medicinal products are covered in annex 13. There may be specific national requirements for compassionate use medicinal products, extemporary produced pharmacy products etc.

EU GMP principles and guidelines are laid down in Directive 2003/94/EC (human medicines) and Directive 91/412/EEC (veterinary products). These principles and guidelines are subject to further detailed guidance in the form of the EU GMP guideline with its annexes.

WHO publishes its own GMP guidance documents.

Although EU and WHO GMP guidance documents do differ in some details, the main principles remain the same. EU requirements fulfil all the recommendations of WHO.

Documents appearing in the EudraGMDP database are uploaded by the national competent authorities through a secure network guaranteeing their authenticity.For submissions to EU authorities paper documents are not required as a reference can be made to the EudraGMDP database.

EU authorities are aware that these documents are also used to support regulatory submissions in third countries and that various additional requirements, including apostilled copies are sometimes expected. In view of the integrity of entries in the EudraGMDP database, EU authorities strongly encourage reliance on the database.

Any concerns about a certificate/authorisation in the database should be addressed to the issuing authority.

GMP certificates are site-specific, but can be restricted to particular activities depending on the scope of the inspection (e.g., manufacturing activities related to a specific product). Directives 2001/82/EC and 2001/83/EC, as amended state that after every GMP inspection, and within 90 days of the inspection, a GMP certificate shall be issued to a manufacturer, if the outcome of the inspection shows that the manufacturer complies with GMP.

CMPs are product-specific certificates issued by the competent authority that granted the marketing authorisation. The European Medicines Agency issues CMPs on behalf of the European Commission for centrally authorised products.

CMPs are issued in the context of the World Health Organization certification scheme on the quality of pharmaceutical products moving in international commerce, to confirm the marketing-authorisation status of the products. These certificates also confirm the GMP compliance status of the manufacturing sites. CMPs are mainly used by companies to support applications to export their pharmaceutical products to countries with less-developed regulatory systems.

CEPs are certificates issued by the European Directorate for the Quality of Medicines and Healthcare (EDQM) to confirm that a certain active substance is produced according to the requirements of the relevant monograph of the European Pharmacopoeia or of the monograph on transmission spongiform encephalopathies.

CEPs can be used by companies when submitting an application for marketing authorisation, and replace much of the documentation required for the active substance in the marketing-authorisation dossier. GMP inspections of active-substance manufacturers can be requested by EDQM in the context of the CEP certification scheme.

No, the competent authority responsible for carrying out the inspection issues the GMP certificate, or makes an entry of non-compliance into the EudraGMP database.

All EU and EEA national competent authorities conducting inspections are obliged to enter GMP certificates in the EudraGMP database. Hence, any GMP certificate appearing in the database is mutually recognised and the database authenticates the certificate.

If a certificate cannot be found in the database, the issuing authority should be contacted.

In principle, a GMP non-compliance statement can only be lifted following a new inspection by an EU authority that results in the issue of a GMP certificate. In practice, this can present difficulties for manufacturers located in third countries.

For sites located in third countries the GMP non-compliance statement may mean that the site is no longer listed in marketing authorisations or applications and therefore there will be no reason for a new EU inspection. However, EU inspectorates acknowledge that the manufacturer may subsequently take remedial measures to bring the site into an acceptable level of compliance. As there is no intention to convey that the site continues to operate to an unacceptable level of non-compliance and given the absence of a new inspection trigger, the issuing authority will add a clarifying remark where a non-compliance statement appears in EudraGMDP over a prolonged period of time.

The Agency does not perform inspections. They are carried out on its behalf by the national competent authorities of the member states of the EEA, in connection with products under the centralised marketing-authorisation procedure.

Normally, the need for inspection under these circumstances is triggered by an application for a marketing authorisation. It may be possible to request an inspection on a voluntary basis, but as the competent authorities will have other priorities, there is no guarantee that such a request will be met.

To explore this possibility, the authorities of the Member State into which the product will be imported into the EEA should be approached. In any case, applicants are encouraged to approach the relevant authority in advance of submission in order to facilitate third-country inspection planning.

If the site is located in the EEA, the competent authority of the Member State where the site is located carries out the inspection.

For sites located in countries outside the EEA, the responsible authority for inspection (the 'supervisory authority') is the authority in whose territory the importing site is located. If the supervisory authority is not able to carry out the inspection for any reason, it can be delegated to another EEA competent authority.

If there is a mutual recognition agreement (MRA) in place between the countries where the site is located and the European Community, the results of GMP inspections carried out by the MRA partner authority are normally recognised by the EU authorities.

Data integrity enables good decision-making by pharmaceutical manufacturers and regulatory authorities.It is a fundamental requirement of the pharmaceutical quality system described in EU GMP chapter 1, applying equally to manual (paper) and electronic systems.

Promotion of a quality culture together with implementation of organisational and technical measures which ensure data integrity is the responsibility of senior management. It requires participation and commitment by staff at all levels within the company, by the company's suppliers and by its distributors.

Senior management should ensure that data integrity risk is assessed, mitigated and communicated in accordance with the principles of quality risk management. The effort and resource assigned to data integrity measures should be commensurate with the risk to product quality, and balanced with other quality assurance resource demands. Where long term measures are identified in order to achieve the desired state of control, interim measures should be implemented to mitigate risk, and should be monitored for effectiveness.

The following questions and answers describe foundational principles which facilitate successful implementation of existing guidance published by regulatory authorities participating in the PIC/S scheme. It should be read in conjunction with national guidance, medicines legislation and the GMP standards published in Eudralex volume 4.

The importance of data integrity to quality assurance and public health protection should be included in personnel training programmes.

• WHO - Annex 5: guidance on good data and record management practices

Data risk assessment should consider the vulnerability of data to involuntary or deliberate amendment, deletion or recreation. Control measures which prevent unauthorised activity and increase visibility / detectability can be used as risk mitigating actions.

Examples of factors which can increase risk of data integrity failure include complex, inconsistent processes with open-ended and subjective outcomes. Simple tasks which are consistent, well-defined and objective lead to reduced risk.

Risk assessment should include a business process focus (e.g. production, QC) and not just consider IT system functionality or complexity. Factors to consider include:

• Process complexity
• Process consistency, degree of automation /human interface
• Subjectivity of outcome / result
• Is the process open-ended or well defined

This ensures that manual interfaces with IT systems are considered in the risk assessment process. Computerised system validation in isolation may not result in low data integrity risk, in particular when the user is able to influence the reporting of data from the validated system.

The decision which data influences may differ in importance, and the impact of the data to a decision may also vary. Points to consider regarding data criticality include:

• What decision does the data influence?

For example: when making a batch release decision, data which determines compliance with critical quality attributes is of greater importance than warehouse cleaning records.

• What is the impact of the data to product quality or safety?

For example: for an oral tablet, active substance assay data is of greater impact to product quality and safety than tablet dimensions' data.

'Data lifecycle' refers to how data is generated, processed, reported, checked, used for decision-making, stored and finally discarded at the end of the retention period.

Data relating to a product or process may cross various boundaries within the lifecycle, for example:

• IT systems
  • Quality system applications
  • Production
  • Analytical
  • Stock management systems
  • Data storage (back-up and archival)
• Organisational
  • Internal (e.g. between production, QC and QA)
  • External (e.g. between contract givers and acceptors)
  • Cloud-based applications and storage

Data integrity can be affected at any stage in the lifecycle. It is therefore important to understand the lifecycle elements for each type of data or record, and ensure controls which are proportionate to data criticality and risk at all stages.

The 'Data lifecycle' refers to the:

• Generation and recording of data
• Processing into usable information
• Checking the completeness and accuracy of reported data and processed information
• Data (or results) are used to make a decision
• Retaining and retrieval of data which protects it from loss or unauthorised amendment
• Retiring or disposal of data in a controlled manner at the end of its life

'Data Lifecycle' reviews are applicable to both paper and electronic records, although control measures may be applied differently. In the case of computerised systems, the 'data lifecycle' review should be performed by business process owners (e.g. production, QC) in collaboration with IT personnel who understand the system architecture. The description of computerised systems required by EU GMP Annex 11 paragraph 4.3 can assist this review. The application of critical thinking skills is important to not only identify gaps in data governance, but to also challenge the effectiveness of the procedural and systematic controls in place.

Segregation of duties between data lifecycle stages provides safeguards against data integrity failure by reducing the opportunity for an individual to alter, misrepresent or falsify data without detection.

Data risk should be considered at each stage of the data lifecycle review.

The following aspects should be considered when determining risk and control measures:

• How and where is original data created (i.e. paper or electronic)
• What metadata is associated with the data, to ensure a complete, accurate and traceable record, taking into account ALCOA principles. Does the record permit the reconstruction of the activity
• Where is the data and metadata located
• Does the system require that data is saved to permanent memory at the time of recording, or is it held in a temporary buffer

In the case of some computerised analytical and manufacturing equipment, data may be stored as a temporary local file prior to transfer to a permanent storage location (e.g. server). During the period of 'temporary' storage, there is often limited audit trail provision amending, deleting or recreating data. This is a data integrity risk. Removing the use of temporary memory (or reducing the time period that data is stored in temporary memory) reduces the risk of undetected data manipulation.

• Is it possible to recreate, amend or delete original data and metadata;

Controls over paper records are discussed elsewhere in this guidance.

Computerised system controls may be more complex, including setting of user privileges and system configuration to limit or prevent access to amend data. It is important to review all data access opportunities, including IT helpdesk staff, who may make changes at the request of the data user. These changes should be procedurally controlled, visible and approved within the quality system.

• How data is transferred to other locations or systems for processing or storage;

Data should be protected from possibility of intentional or unintentional loss or amendment during transfer to other systems (e.g. for processing, review or storage). Paper records should be protected from amendment, or substitution. Electronic interfaces should be validated to demonstrate security and no corruption of data, particularly where systems require an interface to present data in a different structure or file format.

Does the person processing the data have the ability to influence what data is reported, or how it is presented.

The following aspects should be considered when determining risk and control measures:

• How is data processed;

Data processing methods should be approved, identifiable and version controlled. In the case of electronic data processing, methods should be locked where appropriate to prevent unauthorised amendment.

• How is data processing recorded;

The processing method should be recorded. In situations where raw data has been processed more than once, each iteration (including method and result) should be available to the data checker for verification.

• Does the person processing the data have the ability to influence what data is reported, or how it is presented;

Even 'validated systems' which do not permit the user to make any changes to data may be at risk if the user can choose what data is printed, reported or transferred for processing. This includes performing the activity multiple times as separate events and reporting a desired outcome from one of these repeats.

Data presentation (e.g. changing scale of graphical reports to enhance or reduce presentation of analytical peaks) can also influence decision making, and therefore impact data integrity.

The following aspects should be considered when determining risk and control measures:

• Is original data (including the original data format) available for checking;

The format of the original data (electronic or paper) should be preserved, and available to the data reviewer in a manner which permits interaction with the data (e.g. search, query). This approach facilitates a risk-based review of the record, and can also reduce administrative burden for instance utilising validated audit trail 'exception reports' instead of an onerous line-by-line review.

• Are there any periods of time when data is not audit trailed;

This may present opportunity for data amendment which is not subsequently visible to the data reviewer. Additional control measures should be implemented to reduce risk of undisclosed data manipulation.

• Does the data reviewer have visibility and access to all data generated;

This should include any data from failed or aborted activities, discrepant or unusual data which has been excluded from processing or the final decision-making process. Visibility of all data provides protection against selective data reporting or 'testing into compliance'.

• Does the data reviewer have visibility and access to all processing of data;

This ensures that the final result obtained from raw data is based on good science, and that any data exclusion or changes to processing method is based on good science. Visibility of all processing information provides protection against undisclosed 'processing into compliance'.

The following aspects should be considered when determining risk and control measures:

• When is the pass / fail decision taken;

If data acceptability decisions are taken before a record (raw data or processed result) is saved to permanent memory, there may be opportunity for the user to manipulate data to provide a satisfactory result, without this change being visible in audit trail. This would not be visible to the data reviewer.

This is a particular consideration where computerised systems alert the user to an out of specification entry before the data entry process is complete (i.e. the user 'saves' the data entry), or saves the record in temporary memory.

The following aspects should be considered when determining risk and control measures:

• How / where is data stored;

Storage of data (paper or electronic) should be at secure locations, with access limited to authorised persons. The storage location must provide adequate protection from damage due to water, fire, etc.

• What are the measures protecting against loss or unauthorised amendment;

Data security measures should be at least equivalent to those applied during the earlier Data lifecycle stages. Retrospective data amendment (e.g. via IT helpdesk or data base amendments) should be controlled by the pharmaceutical quality system, with appropriate segregation of duties and approval processes.

• Is data backed up in a manner permitting reconstruction of the activity;

Back-up arrangements should be validated to demonstrate the ability to restore data following IT system failure. In situations where metadata (including relevant operating system event logs) are stored in different file locations from raw data, the back-up process should be carefully designed to ensure that all data required to reconstruct a record is included.

Similarly, 'true copies' of paper records may be duplicated on paper, microfilm, or electronically, and stored in a separate location.

• What are ownership / retrieval arrangements, particularly considering outsourced activities or data storage;

A technical agreement should be in place which addresses the requirements of Part I Chapter 7 and Part II Section 16 of the GMP guide.

The following aspects should be considered when determining risk and control measures:

• The data retention period

This will be influenced by regulatory requirements and data criticality. When considering data for a single product, there may be different data retention needs for pivotal trial data and manufacturing process / analytical validation data compared to routine commercial batch data.

• How data disposal is authorised

Any disposal of data should be approved within the quality system and be performed in accordance with a procedure to ensure compliance with the required data retention period.

There is no requirement for a specific procedure, however it may be beneficial to provide a summary document which outlines the organisations total approach to data governance.

A compliant pharmaceutical quality system generates and assesses a significant amount of data. While all data has an overall influence on GMP compliance, different data will have different levels of impact to product quality.

A quality-risk management (ICH Q9) approach to data integrity can be achieved by considering data risk and data criticality at each stage in the Data lifecycle. The effort applied to control measures should be commensurate with this data risk and criticality assessment.

The approach to risk identification, mitigation, review and communication should be iterative, and integrated into the pharmaceutical quality system. This should provide senior management supervision and permit a balance between data integrity and general GMP priorities in line with the principles of ICH Q9 & Q10.

The main regulatory expectation for data integrity is to comply with the requirement of ALCOA principles. The table below provide for each ALCOA principle the link to EU GMP references (Part I, Part II and Annex 11):

The template (blank) forms used for manual recordings may be created in an electronic system (Word, Excel, etc.). The corresponding master documents should be approved and controlled electronically or in paper versions. The following expectations should be considered for the template (blank) form:

• have a unique reference number (including version number) and include reference to corresponding SOP number
• should be stored in a manner which ensures appropriate version control
• if signed electronically, should use a secure e-signature

The distribution of template records (e.g. 'blank' forms) should be controlled. The following expectations should be considered where appropriate, based on data risk and criticality:

• enable traceability for issuance of the blank form by using a bound logbook with numbered pages or other appropriate system. For loose leaf template forms, the distribution date, a sequential issuing number, the number of the copies distributed, the department name where the blank forms are distributed, etc. should be known
• Distributed copies should be designed to avoid photocoping either by using a secure stamp, or by the use of paper colour code not available in the working areas or another appropriate system.

Computerised systems should be designed in a way that ensures compliance with the principles of data integrity. The system design should make provisions such that original data cannot be deleted and for the retention of audit trails reflecting changes made to original data.

In the case of data generated from an electronic system, electronic data is the original record which must be reviewed and evaluated prior to making batch release decisions and other decisions relating to GMP related activities (e.g. approval of stability results, analytical method validation etc.). In the event that the review is based solely on printouts there is potential for records to be excluded from the review process which may contain un-investigated out of specification data or other data anomalies. The review of the raw electronic data should mitigate risk and enable detection of data deletion, amendment, duplication, reusing and fabrication which are common data integrity failures.

Example of an inspection citing:

Raw data for HPLC/GC runs which had been invalidated was stored separately to the QC raw data packages and had not been included in the review process.

In the above situation, the procedure for review of chromatographic data packages did not require a review of the electronic raw data or a review of relevant audit trails associated with the analyses. This lead to the exclusion of records from the review process and to lack of visibility of changes made during the processing and reporting of the data. The company was unable to provide any explanation for the data which had been invalidated.

Yes. The principles of quality risk management may be applied during the review of electronic data and review by exception is permitted, when scientifically justified.

Exception Reporting is used commonly as a tool to focus the review of electronic data such as (but not limited to) electronic batch records. Exception reporting rapidly highlights to the reviewer one of the most critical elements of batch review, i.e. the exceptions. The level of review of the full electronic batch record can vary based on the exceptions as well as the level of confidence and experience with a particular process. Appropriate testing and validation must be completed for the automated system and the output Batch Exception Report to ensure its functionality meets the business and regulatory requirements as per GMP.

Ongoing compliance with the company's data governance policy/procedures should be reviewed during self-inspection, to ensure that they remain effective. This may also include elements of the Data lifecycle discussed in Q3-Q9.

Data integrity requirements should be incorporated into the company's contractor/vendor qualification/assurance program and associated procedures.

In addition to having their own data governance systems, companies outsourcing activities should verify the adequacy of comparable systems at the contract acceptor. The contract acceptor should apply equivalent levels of control to those applied by the contract giver.

Formal assessment of the contract acceptors competency and compliance in this regard should be conducted in the first instance prior to the approval of a contractor, and thereafter verified on a periodic basis at an appropriate frequency based on risk.

The recipient should have knowledge of the systems and procedures implemented at the supplier for the generation of the CoA. Arrangements should be in place to ensure that significant changes to systems are notified and the effectiveness of these arrangements should be subjected to periodic review.

Data related to activities which are outsourced are routinely provided as summary data in a report format (e.g. CoA). These summary documents are reviewed on a routine basis by the contract acceptor and therefore the review of data integrity at the contract acceptor site on a regular periodic basis (e.g. during on-site audit) takes on even greater significance, in order to build and maintain confidence in the summary data provided.

Using the principles of QRM to assess data criticality and risk, the company should include assessment of data governance systems implemented by the service provider when making decisions on service contracts. This may be achieved by on-site audit or desk-based assessment of information submitted by the service provider.

It is considered that the company should evaluate the risk to its products manufactured/released using the principles of quality risk management. Risk assessments should be made available to Inspectors, on request.

Depending on the outcome of the risk assessment, appropriate action should be taken which may entail delisting the contractor from the approved contractor list. In the event that abnormal disruption in supply may result from a contractor compliance situation, relevant regulatory authorities should be consulted in this regard.

All actors in the supply chain play an important part in overall data integrity and assurance of product quality.

Data governance systems should be implemented from the manufacture of starting materials right through to the delivery of medicinal products to persons authorised or entitled to supply medicinal products to the public.

Relative responsibilities and boundaries should be documented in the contracts between the relevant parties. Final responsibility of ensuring compliance throughout the supply chain rests with batch certifying QP.

No. According to the Guideline on declaration of storage conditions (CPMP/QWP/609/96 Rev. 2) , marketing authorisation holders have to provide stability data for storage conditions at 25°C / 60% relative humidity (RH), or 30°C / 65% RH (long term) and 40°C / 75% RH (accelerated), in order to justify not including a statement in the medicinal product labelling.

This stability data is generated according to the temperature and humidity conditions of climate zone I (temperate) and II (Mediterranean/subtropical) in Europe. For more information, see the World Health Organization Expert Committee on Specifications for Pharmaceutical Preparations forty-third report, Annex 2: Stability testing of active pharmaceutical ingredients and finished pharmaceutical products.

No labelling statement means that controls should be in place to maintain conditions relevant to climate zones I and II. Consequently, the temperature should be monitored during storage and transport. Appropriate limits should be set for temperature monitoring to ensure that product stability is not adversely affected.

No. The Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use state in paragraph 10.4 v): “procedure for verifying that their supplying wholesale distributors hold a distribution authorisation, their supplying manufacturers or importers hold a manufacturing authorisation and their customers are authorised to supply medicinal products in the Member State concerned”.

That means that both suppliers and customers should be located in the EEA. Brokering activities regarding both supplier and customer located outside the EEA fall outside the scope of the EU legislation (GDP guidelines).

No. The Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use state in paragraph 10.4 iv): “procedure for ensuring that medicinal products brokered have a marketing authorisation”.

That means that the medicinal products must have a marketing authorisation in at least one of the EEA member states.

Wholesalers shall ensure first that all veterinary medicinal products they distribute in the Union are covered by a marketing authorisation, a registration or another kind of authorisation (parallel trade, importation authorisation…). In addition, they shall ensure that veterinary medicinal products intended for the EU and EEA countries should not be transferred to saleable stock before assurance has been obtained that they are authorised for sale.

According to article 97 of Regulation 2019/6, the Qualified person responsible for manufacturing and batch release shall draw up a control report establishing that each batch of the veterinary medicinal products is manufactured in compliance with good manufacturing practice, and tested in compliance with the terms of the marketing authorisation. Such control reports shall be valid throughout the Union.

Batches of veterinary medicinal products which have undergone the controls referred to in Art. 97 of regulation 2019/6 in a Member State are exempt from the controls in another Member State where they will be marketed if they are accompanied by the control reports signed by the qualified person.

In this context, wholesalers shall check that batches of veterinary medicinal products coming from another member state are be accompanied by evidence that the manufacturer’s qualified person has certified the finished product batch. This check could be done by different means : paper based check (copy of controls reports), electronically check or other equivalent system as agreed with the supplier (manufacturer or wholesaler).

The requirements for registration of manufacturers and importers of active substances (and active substance intermediates, i.e crude active substances or other active substance intermediates, the manufacturing of which is described in a regulatory dossier) as required under Article 52a of Directive 2001/83/EC is summarised in the table below.

EMA’s Committee for Advanced Therapies (CAT), together with the GMDP Inspectors Working Group and the Biologics Working Party, have prepared a questions-and answers document on the use of out-of-specification batches of authorised cell or tissue-based ATMPs:

• Questions and answers on the use of out-of-specification batches of authorised cell/tissue-based advanced therapy medicinal products

Refer to Questions and answers on the exemption from batch controls carried out on ATMPs imported into the European Union from a third country

Refer to:  Questions and answers on the principles of GMP for the manufacturing of starting materials of biological origin used to transfer genetic material for the manufacturing of ATMPs

Yes, active substances used as starting materials in veterinary medicinal products imported or manufactured in the Union¹ have to be manufactured in accordance with GMP for active substances.  This obligation, set out in Article 93(1)(j) of the Regulation applies regardless of whether the active substances are manufactured in the Union or in third countries.   This obligation already existed under Directive 2001/82/EC. ²

Until the specific GMP for veterinary medicinal products and active substances used as starting materials referred to in Article 93(2) of the Regulation (EU) 2019/6³ (the Veterinary Medicines Regulation) are adopted, the Part II of the Good Manufacturing Practice Medicinal Products for Human and Veterinary Use on Basic Requirements for Active Substances used as Starting Materials, as well as relevant annexes, applies.⁴

¹ For the purposes of this document, reference to the Union should be understood as including also the EEA countries.

² Directive 2001/82/EC of the European Parliament and of the Council on the Community code relating to veterinary medicinal products (OJ L 311, 28.11.2001, p. 1).

³ Regulation (EU) 2019/6 of the European Parliament and of the Council on veterinary medicinal products and repealing Directive 2001/82/EC, OJ L4, 7..01.2919, p.4.

⁴ https://ec.europa.eu/health/medicinal-products/eudralex/eudralex-volume-4_en.

Yes, the Veterinary Medicines Regulation requires manufacturers and importers of veterinary medicinal products to:

• verify that manufacturers, importers and distributors within the Union from whom they source the active substances have registered their activities in the territory of the Member State where they are established;¹ and
• perform audits based on a risk-assessment on the manufacturers, distributors and importers from whom they source the active substances.²

Manufacturing sites of active substances established outside the Union territory are not required to register their activities in accordance with Article 95 of the Regulation.  However, to the extent that the active substances are used in veterinary medicinal products marketed in the Union, the manufacturer or importer of the relevant veterinary medicinal products is required to audit these sites.  

The existence of valid GMP certificate for a manufacturing site of active substance(s), issued by a Union authority or by the authority of a third country in the context of a valid mutual recognition agreement, can be taken into consideration by manufacturers and importers of veterinary medicinal products, together with other supporting information in a risk-based approach, to determine the extent of the auditing obligations of manufacturers of finished medicinal products foreseen in Article 93(1)(l) of the Regulation (i.e. to establish priorities for its own audit programme of suppliers of active substances).³

While manufacturing sites of active substances used as starting materials in veterinary medicinal products may, therefore, have an interest to obtain a GMP certificate from a Union competent authority, reference is made to question 5, in connection with the requests for voluntary inspections.

¹ Article 93(1)(k) and Article 95 of the Veterinary Medicines Regulation.

² Article 93(1)(l). It is noted that the conduct of audits was already foreseen as part of the recommendations in the Good Manufacturing Guidelines (e.g. Section 5.29 of the Chapter 5, Part I of the EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use).

³ Article 93(1)(l) and Article 95 of the Veterinary Medicines Regulation.

⁴ Reference is also made to EMA Q&A on EU GMP guide part II: Basic requirements for active substances used as starting materials: GMP compliance for active substances, question n°2.

Article 94(1) to (3) of the Veterinary Medicines Regulation describes the procedure to issue a GMP certificate, after a successful inspection has been conducted. If the outcome of the inspection is that the site does not comply with EU GMP, this information shall be entered into the manufacturing and wholesale distribution database. 

Pursuant to Article 2(2) of the Regulation, the same procedure applies for certificates for manufacturing sites of veterinary medicinal products and for certificates for manufacturing sites of active substances used as starting materials, regardless whether they are established in the Union or outside.

For aspects relevant to requests of voluntary inspections, reference is made to question 5.

Manufacturing sites of veterinary medicinal products must have an EU GMP certificate, regardless of whether they are located in the Union or outside.  Specifically, Article 94(5) of the Veterinary Medicines Regulation requires that importers of veterinary medicinal products ensure that any manufacturing site of such products established outside the Union has a GMP certificate issued by Union competent authorities, unless a mutual recognition agreement between the Union and the third country applies.¹

However, manufacturing sites that only produce active substances used as starting materials in veterinary medicinal products are not required to have a GMP certificate.² Compliance with EU GMP for active substances must however be ensured as explained in questions 1 and 2. 

¹ Reference is also made to the Compilation of Union Procedures on Inspections and Exchange of Information: https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/compilation-union-procedures-inspections-exchange-information_en.pdf

² Article 2(2) provides that Articles 94 and 95 apply also to active substances used as starting materials.  This cross-reference should be read in conjunction with the specific wording of the cross-referred provisions.  To this effect, it is noted that Article 95 specifically deals with active substances used as starting materials, while paragraphs (1) to (4) of Article 94 are neutrally worded and apply therefore to both finished products and active substances.  In contrast, paragraph (5) of Article 94 explicitly refers to veterinary medicinal products and not to active substances.

Furthermore, to consider that manufacturing sites of active substances established outside the Union should have a GMP certificate would contradict the general scheme of the Regulation, including the requirement for audits (new obligation for importers and manufacturers of veterinary medicinal products to guarantee that active substances have been manufactured in accordance with GMP) and would run against one of the main objectives of the legislation; namely, to increase the availability of veterinary medicinal products.

Yes.  The request for the inspection should be made to the EEA competent authority where the site is located or, in case of sites located in third countries, to a competent authority where the active substance used as starting material is used in the manufacture of veterinary medicinal products, or the Member State where the importer is established. If this is not the case, any EEA authority can be approached.

There is no guarantee that such a request will be fulfilled since competent authorities primarily use risk-based principles to plan inspections. Thus, when a manufacturer of active substance(s) used as starting material in veterinary medicinal products applies for a voluntary inspection, this does not constitute an obligation for the competent authority to trigger an inspection.

The procedure for issuing an EU GMP certificate under paragraphs (1) to (3) of Article 94 is applicable to manufacturers of active substances used as starting materials (see also question 3).

Finally, it is stressed that manufacturers/importers are required to ensure that only active substances manufactured in accordance with applicable GMPs are used.¹ An inspection of the active substance manufacturer by an EEA authority does not exempt a manufacturing authorisation holder from this responsibility but, as explained in question 2, may be relevant to determine the extent of the audits.

¹ Article 93(1)(j).

Yes. Article 94(4) of the Veterinary Medicines Regulation (in conjunction with Article 2(2) thereof) encompasses both manufacturing sites of finished veterinary medicinal products and manufacturing sites of active substances used in veterinary medicinal products.  It follows that national competent authorities, the Agency, or the European Commission can request an inspection of a manufacturer of active substance used as a starting material, including third country manufacturers.

These inspections may be carried out:

1. As part of the registration of manufacturers of active substances established in the Union (Article 95);
2. In the scope of the regular risk based verifications to manufacturers/importers of veterinary medicinal products and manufacturers/importers of active substances.  Article 123(1) of the Regulation requires competent authorities to carry out controls of both importers of manufacturers/importers of veterinary medicinal products and manufacturers/importers of active substances.   Those controls should be carried out regularly, in accordance with a risk-based approach, taking into account at least:

• the intrinsic risks associated with the activities of the site and the location thereof;
• the past record as regards the results of controls performed on the sites and previous compliance;
• any information that might indicate non-compliance;
• the potential impact of non-compliance on public health, animal health, animal welfare and the environment.

3. In order to verify whether the data submitted for obtaining a certificate of suitability complies with the monographs of the European Pharmacopoeia when the starting material concerned is subject to a European Pharmacopoeia monograph (Article 125).
4. At the request of a third country competent authority in the context of a mutual recognition agreement (“MRA”).

Yes, when there is a MRA is in place covering GMP for active substances, the outcome of inspections performed by the MRA partner authority will be taken into consideration when deciding whether an inspection of a manufacturing site of active substances used as starting materials is necessary.