What makes a requirement binding here
Directive 2001/83/EC, the Community code relating to medicinal products for human use, is the framework instrument; Commission Directive (EU) 2017/1572 of 15 September 2017 supplements it as regards the principles and guidelines of good manufacturing practice and replaced Commission Directive 2003/94/EC. Investigational medicinal products are covered separately by Commission Delegated Regulation (EU) 2017/1569. The detailed expectations practitioners actually work to are the EudraLex Volume 4 guidelines and their annexes. Clinical trials moved to Regulation (EU) No 536/2014, and devices to Regulation (EU) 2017/745 with in vitro diagnostics under Regulation (EU) 2017/746.
Through a manufacturing authorisation granted by the competent authority of a Member State — Article 40 of Directive 2001/83/EC — and through the qualified person who certifies each batch before release. Note where the authority sits: the European Medicines Agency assesses medicines and runs the centralised marketing-authorisation procedure under Regulation (EC) No 726/2004, but it does not grant manufacturing authorisations and does not inspect in its own name; national competent authorities do both, and record the outcome in EudraGMDP. The Directive/Regulation distinction is the other half of the answer — a Regulation applies directly in every Member State, while a Directive must be transposed into national law, which is why manufacturing requirements can differ in detail between Member States and clinical-trial requirements now do not.