GxP Standards Library
102 regulatory standards decoded for practitioners across GMP, GCP, GLP, validation, quality systems, data integrity, lab systems, manufacturing, and inspection readiness.
Current Good Manufacturing Practice for Finished Pharmaceuticals
The foundational cGMP regulation governing finished pharmaceutical manufacturing in the US market. Establishes minimum quality standards for organization, buildings, equipment, production, packaging, and records.
§211.68 (electronic records) and §211.192 (production record review) are the most commonly cited sections during FDA inspections. Recent 483s focus heavily on data integrity in LIMS and batch record systems.
Electronic Records; Electronic Signatures
Sets the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and equivalent to paper records and handwritten signatures executed on paper.
Computer system validation (CSV) must explicitly address Part 11 requirements. Audit trail completeness and data integrity are top citation areas in recent FDA 483s. Retrospective validation of legacy systems is increasingly scrutinised.
Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs — General
Establishes the minimum current good manufacturing practice for methods to be used in, and the facilities or controls to be used for, the manufacture, processing, packing, or holding of a drug to assure that such drug meets the requirements of the Act.
Part 210 is short (definitions only) but defines what constitutes a "drug" and therefore triggers cGMP obligations. Scope determinations — particularly for excipients and combination products — are increasingly scrutinised.
Quality System Regulation (QSR) for Medical Devices
Quality System Regulation governing the methods and facilities used in the design, manufacture, packaging, labelling, storage, installation, and servicing of all finished medical devices for human use. Now harmonised with ISO 13485:2016.
FDA has harmonised QSR with ISO 13485:2016 (effective 2026). Corrective action (CAPA) subsystem and design controls are the most common 483 observation areas. Design history file (DHF) completeness is a top inspection focus.
Guidance for Industry — Sterile Drug Products Produced by Aseptic Processing
Provides comprehensive guidance on FDA expectations for aseptic processing operations including facility design, personnel gowning, media fills, environmental monitoring, sterilization processes, and parametric release.
Media fill acceptance criteria and frequency are frequently cited when deviations occur. Personnel gowning qualification documentation and aseptic technique observation records remain persistent inspection findings. FDA expects gowning qualification to be risk-based.
Guidance for Industry — Process Validation: General Principles and Practices
Revises FDA's process validation framework from a three-batch endpoint approach to a lifecycle-based model with three stages: Process Design, Process Qualification, and Continued Process Verification.
Stage 3 (Continued Process Verification) is the most commonly under-executed stage — inspectors increasingly ask for statistical trending data and CPV dashboard evidence during inspections.
Manufacture of Sterile Medicinal Products
Revised Annex 1 introduces the mandatory Contamination Control Strategy (CCS) as a holistic document integrating all contamination prevention measures across site, facility, equipment, personnel, and processes. It is among the most comprehensive revisions in the document's history.
Inspectors now request the CCS as a standalone document from day one of inspection. Absence of a formal CCS is an immediate critical finding. The CCS must show the linkage between all individual controls — not just list them.
Computerised Systems
Establishes requirements for computerised systems used in GxP-regulated activities. Covers validation, data integrity, access control, audit trails, and disaster recovery. The EU counterpart to FDA 21 CFR Part 11.
Annex 11 inspections focus on three areas: (1) validation evidence for legacy systems, (2) audit trail review procedures, and (3) data backup and restoration testing. Supplier audits are increasingly expected for cloud-hosted systems.
Qualification and Validation
Sets out the principles of qualification and validation applicable to facilities, equipment, utilities, and processes used in the manufacture of medicinal products. Introduces the lifecycle approach and continued process verification concept.
Retrospective validation is explicitly not acceptable for new products under Annex 15. Process Performance Qualification (PPQ) at commercial scale must demonstrate reproducibility. Change control triggers for re-qualification are frequently discussed in inspections.
Manufacture of Biological Active Substances and Medicinal Products for Human Use
Provides GMP requirements specific to biological active substances and medicinal products, covering cell banking, seed lot systems, containment of adventitious agents, and the additional controls required for biological processes.
Cell bank characterisation and the two-tier cell banking system (master and working cell banks) are primary inspection focus areas. Adventitious agent testing programmes are expected to be risk-based and comprehensive.
Viral Safety Evaluation of Biotechnology Products Derived from Cell Lines of Human or Animal Origin
The ICH guideline for assuring the viral safety of biotechnology products derived from human or animal cell lines. It sets a three-pronged strategy: characterise and test cell lines and raw materials for viral contaminants, evaluate the manufacturing process for its capacity to clear or inactivate virus, and test the product at appropriate stages — so viral safety is designed and demonstrated, not assumed.
Viral clearance validation is the highest-effort area: small-scale spiking studies must credibly model the commercial process, and clearance is claimed across complementary, orthogonal steps (e.g. low-pH inactivation plus nanofiltration) rather than any single step. Master and working cell bank characterisation and raw-material controls are the upstream half; both are recurring inspection and submission focal points for biologics.
Quality Risk Management
ICH Q9(R1) updates the quality risk management framework with clearer guidance on formality, subjectivity, and the role of QRM in regulatory decision-making. Introduces risk review, risk communication, and guidance on appropriate formality levels.
Regulators now expect documented risk management rationale in all major change controls, deviations, and validation protocols. Lack of formal risk methodology is increasingly cited. Q9(R1) explicitly states that risk management should not be used to justify inaction.
Pharmaceutical Quality System
ICH Q10 describes a model for an effective pharmaceutical quality system (PQS) that facilitates innovation and continual improvement throughout the product lifecycle — covering pharmaceutical development through product discontinuation.
Inspectors assess the PQS holistically — not whether SOPs exist, but whether the system drives performance improvement. CAPA effectiveness is a key audit focus. Management review frequency and quality is increasingly scrutinised.
Pharmaceutical Development
Provides guidance on the contents of the pharmaceutical development section of a marketing application and introduces Quality by Design (QbD) concepts including Critical Quality Attributes, Critical Process Parameters, and Design Space.
CQA and CPP identification in development has direct manufacturing and validation implications — inspectors verify that commercial process controls align with the development risk assessment and design space.
Development and Manufacture of Drug Substances (Chemical and Biotechnological/Biological Entities)
Provides guidance on the application of QbD concepts to the development and manufacture of drug substances, covering selection of starting materials, control of critical quality attributes, and design space for API processes.
Starting material justification is one of the highest-risk areas in API inspection. The position of the proposed starting material in the synthesis must be scientifically justified and consistent with the submission.
Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management
Provides tools and enablers to facilitate post-approval chemistry, manufacturing, and controls (CMC) changes. Introduces Established Conditions (ECs), Product Lifecycle Management Document (PLCM), and Post-Approval Change Management Protocols (PACMPs).
PACMP is the key enabler — allows pre-approved changes to be implemented without prior regulatory approval if conditions are met. Companies that have established PACMPs have significantly faster time-to-implementation for changes.
Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients
ICH Q7 provides guidance on the GMP requirements for manufacturing of APIs to assure that APIs meet the requirements for quality and purity. It is jointly enforced by FDA, EMA, and all ICH member health authorities.
Impurity profile documentation and starting material justification are high-inspection-risk areas. ICH Q7 is jointly enforced by FDA, EMA, and other ICH members, making it the most universally applicable API GMP standard.
Microbiological Control and Monitoring of Aseptic Processing Environments
Provides guidance on microbial environmental monitoring programs for aseptic manufacturing environments. Establishes principles for alert and action levels, program design, sampling methods, trending, and exceedance investigation.
USP <1116> is informational but frequently cited alongside Annex 1 by FDA and EMA inspectors when assessing EM programme robustness. Trending and investigation procedures are scrutinised. Environmental isolate identification to genus/species is now expected.
Microbiological Best Laboratory Practices
Provides guidance on best practices for microbiological testing laboratories in pharmaceutical manufacturing environments, covering growth promotion, media preparation, incubation conditions, and analyst qualification.
Growth promotion testing failures are a persistent inspection issue. Analyst qualification programmes for microbiological methods are increasingly reviewed alongside EM programme audits.
Analytical Instrument Qualification
Provides a framework for the qualification of analytical instruments used in pharmaceutical testing, covering Design Qualification (DQ), Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) with an additional specification for computerised instruments.
Instrument qualification is the bridge between equipment validation and analytical method validation. Inspectors check that the IQ/OQ/PQ timeline predates the method validation work that relied on the instrument.
Microbiological Examination of Nonsterile Products
USP <61> covers microbiological examination of nonsterile products for total aerobic microbial count (TAMC) and total yeast and mold count (TYMC). USP <62> covers tests for specified microorganisms. Both are compendial standards required for product release.
Method suitability testing (formerly method validation) is required for every product/method combination and must be documented. Failure to maintain method suitability records is a common 483 observation.
Cleanrooms and Associated Controlled Environments — Classification of Air Cleanliness by Particle Concentration
Establishes the classification of air cleanliness in terms of concentration of airborne particles in cleanrooms and clean zones. Defines ISO Classes 1–9 with associated particle concentration limits and classification testing protocols.
EU GMP Grade A/B/C/D maps to ISO 5/5/7/8 at rest. Inspectors verify classification protocols are current, sampling locations/volumes meet the standard, and reclassification is triggered by facility changes.
Cleanrooms and Associated Controlled Environments — Monitoring to Provide Evidence of Cleanroom Performance
Specifies the requirements for monitoring cleanroom performance to demonstrate ongoing compliance with ISO 14644-1 classifications. Covers monitoring plan design, testing intervals, equipment requirements, and data analysis.
Monitoring frequency must be scientifically justified and documented. Inspectors request rationale for particle counter placement and sampling frequency. Deviation trending is closely reviewed during inspections.
Quality Management Systems — Requirements
Specifies requirements for a quality management system for organisations that need to demonstrate the ability to consistently provide products and services that meet customer and applicable statutory/regulatory requirements.
ISO 9001 certification is not a regulatory requirement in pharma but increasingly required by pharmaceutical company customers for suppliers (excipients, packaging, contract services). Auditors assess context, risk-based thinking, and process approach.
Medical Devices — Quality Management Systems — Requirements for Regulatory Purposes
Specifies requirements for a quality management system for organisations involved in the design, development, production, installation, and servicing of medical devices. Emphasises safety and effectiveness requirements distinct from general ISO 9001.
Post-market surveillance system and complaint handling are the most frequently cited non-conformities in ISO 13485 audits. Risk management file completeness and integration with design history file is a key audit area.
Good Practice Guide: Compliant GxP Computerised Systems
The ISPE GAMP 5 Second Edition provides a risk-based approach for the validation of computerised systems used in pharmaceutical manufacturing. Updates the original 2008 guide to reflect cloud computing, modern software development, and agile methodologies.
GAMP 5 2022 is now the primary reference for CSV globally — cited by FDA, EMA, and PIC/S inspectors. The risk-based approach replaces prescriptive testing requirements. Category 5 (configurable software) is the most complex validation challenge for most sites.
Guide to Good Manufacturing Practice for Medicinal Products
The PIC/S GMP Guide is harmonised with EU GMP and serves as the reference GMP standard for all PIC/S participating authorities. Forms the basis for mutual recognition agreements between regulatory authorities globally.
For sites supplying multiple global markets, PIC/S harmonisation means a single GMP standard effectively covers most regulated markets. Divergence from EU GMP is minimal — focus on any national annexes from the receiving country.
Good Clinical Practice (GCP)
The international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials involving human subjects. E6(R3) restructures GCP around a set of overarching Principles plus Annex 1 (interventional trials), replacing the prescriptive E6(R2) checklist model with a risk-proportionate, quality-by-design approach that is media-agnostic across paper and electronic systems.
The overarching Principles and Annex 1 came into effect 23 July 2025. The biggest operational shift from R2 is the explicit focus on "factors critical to quality" and proportionate sponsor oversight — regulators now expect a documented, risk-based rationale rather than uniform 100% source data verification. Data governance across the full data lifecycle (Annex 1 §4) and computerised-system validation are the most-cited inspection themes.
General Considerations for Clinical Studies
The foundational ICH efficacy guideline describing the general principles for the design and conduct of clinical studies across a drug development programme. The R1 revision introduces "quality by design" and the concept of identifying factors critical to the quality of a study early, aligning E8 with the risk-proportionate philosophy later embedded in E6(R3).
E8(R1) is where "critical to quality (CtQ) factors" originate — practitioners should treat CtQ identification as an upstream design activity that feeds directly into the E6(R3) risk-based monitoring approach. Meaningful stakeholder engagement (including patients) in protocol design is an explicit expectation.
Investigational New Drug Application (IND)
The US regulation governing the investigational use of drugs and biologics in human clinical trials. Part 312 establishes when an IND is required, its content and format, sponsor and investigator responsibilities, IND safety reporting, and recordkeeping — the operational backbone of US clinical research.
IND safety reporting under §312.32 is the most enforcement-sensitive area — the 2010 final rule requires expedited reporting of serious and unexpected suspected adverse reactions (SUSARs) as 15-day, or 7-day for fatal/life-threatening, reports. Investigator recordkeeping (§312.62) and drug accountability are common inspection findings.
Protection of Human Subjects (Informed Consent)
The US regulation setting the requirements for informed consent of human subjects in FDA-regulated clinical investigations, including the elements of consent, its documentation, and additional safeguards for vulnerable populations such as children (Subpart D).
Consent-process deficiencies — using an unapproved consent version, missing required elements, or consent obtained after a trial procedure — are among the most frequent FDA BIMO inspection findings. Harmonisation with the revised Common Rule added a concise "key information" summary expectation.
Institutional Review Boards (IRBs)
The US regulation governing the composition, functions, and operations of Institutional Review Boards (IRBs) that review FDA-regulated clinical investigations to protect the rights and welfare of human subjects.
Continuing-review timelines and the completeness of IRB records (§56.115) are common findings. Sponsors should confirm the reviewing IRB is properly constituted and that initial and continuing approvals cover the exact protocol and consent versions in use at each site.
Clinical Trials Regulation (CTR)
The EU Clinical Trials Regulation, which replaced Directive 2001/20/EC and harmonised the assessment and supervision of clinical trials across the EU/EEA through a single application submitted via the Clinical Trials Information System (CTIS). It introduces a coordinated assessment led by a Reporting Member State and increased transparency of trial information.
CTIS is now the single entry point — sponsors must manage the application dossier, safety reporting, and transparency obligations within the portal. Common pain points are the structured transparency/deferral rules and coordinating responses to Reporting Member State questions within tight timelines.
Good Laboratory Practice for Nonclinical Laboratory Studies
The US regulation prescribing good laboratory practices for nonclinical (animal and in-vitro) safety studies that support applications for FDA-regulated products. Part 58 establishes the roles of the study director and Quality Assurance Unit, protocol and SOP control, specimen and data archiving, and the reconstructability of study conduct.
GLP hinges on the study director as the single point of study control and an independent QAU that inspects each study and maintains the master schedule. The most common findings are protocol-deviation documentation, incomplete raw-data capture, and archive integrity. FDA proposed a "GLP quality system" modernization aligning Part 58 more closely with OECD — track its final-rule status.
OECD Principles of Good Laboratory Practice
The internationally harmonised GLP principles (OECD Series on Principles of GLP and Compliance Monitoring, No. 1) that underpin the Mutual Acceptance of Data (MAD) system — nonclinical safety data generated under GLP in one OECD member country is accepted by regulators in others, avoiding duplicative testing.
OECD GLP is the reference most non-US regulators adopt. It is closely aligned with 21 CFR Part 58 but differs in some terminology and in the emphasis on the multi-site "principal investigator" role. MAD is the practical payoff — a GLP-compliant study travels across borders.
Harmonisation of Laws Relating to the Application of GLP
The EU Directive requiring Member States to apply the OECD Principles of GLP when conducting nonclinical safety tests on chemical products, and to verify compliance. Together with Directive 2004/9/EC (inspection and verification) it embeds GLP and Mutual Acceptance of Data into EU law.
For EU submissions the operative GLP text is the OECD Principles as given legal force by 2004/10/EC; national GLP monitoring authorities run the inspection programmes under 2004/9/EC. Practically identical expectations to OECD GLP.
EU Guidelines on Good Distribution Practice of Medicinal Products
The EU good distribution practice guidelines governing the procurement, holding, storage, and supply of medicinal products for human use. Issued under Directive 2001/83/EC (Articles 84 and 85b) and updated for the Falsified Medicines Directive (2011/62/EU), they set requirements for the quality system, the Responsible Person, temperature control, and supplier/customer qualification.
The Responsible Person (RP) and end-to-end temperature control are the enforcement hotspots. Qualification of suppliers and customers (to block falsified-medicine entry) and last-mile / transportation temperature excursions during shipment are the most common findings. Mean Kinetic Temperature is the accepted basis for evaluating excursions.
WHO Good Distribution Practices for Pharmaceutical Products
WHO good distribution practices for pharmaceutical products (Technical Report Series No. 957, Annex 5), the reference GDP standard widely adopted by regulators in emerging markets. Covers the quality system, storage and warehousing, transportation, and the controls needed to preserve product integrity across the supply chain.
For companies distributing into WHO-reliant markets, TRS 957 Annex 5 is the practical benchmark and aligns closely with EU GDP. Cold-chain and storage qualification expectations are essentially equivalent; documentation and self-inspection are recurrent audit themes.
UK Good Distribution Practice (Rules & Guidance for Distributors)
The UK good distribution practice requirements administered by the MHRA (consolidated in the "Green Guide", Rules and Guidance for Pharmaceutical Manufacturers and Distributors). Post-Brexit UK GDP mirrors the EU 2013/C 343/01 guidelines, with a Wholesale Dealer's Licence and a named Responsible Person.
The named RP and RPi (for imports) roles carry personal accountability. Post-Brexit divergence is currently minimal, but import routes and the Windsor Framework arrangements for Northern Ireland require attention when supplying across GB/NI.
EU Good Pharmacovigilance Practices (GVP)
The EU good pharmacovigilance practices — a modular set of guidelines (Modules I-XVI plus product/population-specific considerations) governing the safety surveillance of medicines across their lifecycle: the pharmacovigilance system and its master file, risk management plans, ICSR management, signal management, and post-authorisation safety studies.
The Qualified Person for Pharmacovigilance (QPPV) and the Pharmacovigilance System Master File (PSMF, Module II) are the backbone. Signal management (Module IX) and Risk Management Plans (Module V) attract the most scrutiny; ICSR quality and timeliness through EudraVigilance (Module VI) is a perennial inspection focus.
Postmarketing Reporting of Adverse Drug Experiences
The US regulation requiring applicants to report postmarketing adverse drug experiences to the FDA — serious and unexpected reports as expedited 15-day "Alert Reports", plus periodic safety reporting — feeding the FDA Adverse Event Reporting System (FAERS).
The 15-day Alert Report clock and the completeness of case follow-up are the enforcement pressure points. Sponsors increasingly submit ICSRs electronically to FAERS in the E2B(R3) format; reconciliation between safety database and submissions is a common finding.
Electronic Transmission of Individual Case Safety Reports (ICSRs)
The ICH standard defining the data elements and message specification for the electronic transmission of individual case safety reports (ICSRs). E2B(R3) is built on the ISO/HL7 ICSR standard and underpins ICSR exchange in EudraVigilance and FDA FAERS.
Migration from E2B(R2) to E2B(R3) expanded the data model (nullFlavors, richer structured fields). Data-quality and mapping errors between the safety database export and the E2B(R3) message are the main practical risk; validate against the regional business rules, not just the schema.
Clinical Safety Data Management: Definitions and Standards for Expedited Reporting
The ICH guideline establishing the definitions (serious, unexpected, adverse reaction) and standards for expedited safety reporting during clinical development. E2A defines the SUSAR concept and the 7-day (fatal/life-threatening) and 15-day expedited reporting timelines that regulators worldwide adopted.
E2A is the conceptual source of the SUSAR reporting logic embedded in 21 CFR 312.32 and the EU CTR. Correct causality and expectedness assessment against the reference safety information (RSI) is where most reporting errors originate.
Japan GMP for Drugs and Quasi-drugs
Japan's GMP requirements, set out in MHLW Ministerial Ordinance No. 179 and administered by the PMDA and prefectural authorities under the Pharmaceuticals and Medical Devices (PMD) Act. A 2021 revision strengthened the pharmaceutical quality system, cross-contamination controls, and data integrity to align with ICH and PIC/S expectations.
The 2021 revision introduced explicit PQS, supplier control, and data-integrity expectations, narrowing the gap with EU/PIC/S GMP. Foreign sites should map their PQS documentation to the Ordinance and be ready for MHLW/PMDA GMP conformity assessments tied to marketing authorisation.
Brazilian Good Manufacturing Practices for Medicines
Brazil's general GMP requirements for medicines (Collegiate Board Resolution RDC 658/2022), which replaced RDC 301/2019 and is closely harmonised with PIC/S GMP. ANVISA became a PIC/S member in 2021, driving convergence with international GMP.
RDC 658/2022 aligns Brazilian GMP with PIC/S, so EU/PIC-S-compliant sites are largely aligned. Portuguese-language documentation expectations still require attention.
Mexican Good Manufacturing Practices for Medicines
Mexico's official standard for GMP of medicines for human use (NORMA Oficial Mexicana NOM-059-SSA1-2015, "Buenas prácticas de fabricación de medicamentos"), published in the Diario Oficial de la Federación on 5 February 2016. It is the fundamental GMP requirement enforced by COFEPRIS across manufacturing, quality control, storage, and distribution.
NOM-059-SSA1-2015 is broadly aligned with WHO GMP; COFEPRIS increasingly recognises GMP certificates from PIC/S members and WHO-Listed Authorities, easing dossiers for sites already EU/PIC-S compliant. Spanish-language documentation is expected.
Argentine GMP Guide for Medicines
Argentina's current Good Manufacturing Practices guide for manufacturers and importers/exporters of human-use medicines (Disposición ANMAT 4159/2023). It consolidates and replaces the earlier dispositions (2819/04, 3602/18, 3827/18, 1281/19) and is built on WHO, PIC/S, ICH, and ISO guidance. Argentina has been a PIC/S member since 2008.
Disposición 4159/2023 explicitly aligns with PIC/S and ICH, so EU/PIC-S-compliant sites map closely. Confirm the effective date and any transitional provisions; Spanish-language documentation is expected.
Colombian Good Manufacturing Practices for Medicines
Colombia's GMP manuals and inspection guides for medicine manufacturers (Resolución 1160 de 2016 of the Ministerio de Salud y Protección Social). It adopts manuals based on WHO Technical Report Series (Report 37 Annex 4 and Report 45 Annex 6), and INVIMA issues the GMP compliance certificate. Colombia joined PIC/S in 2021.
The manuals track WHO GMP; with Colombia now in PIC/S, expect continuing convergence with international inspection standards. INVIMA certification is mandatory for products marketed in Colombia; Spanish-language documentation is expected.
Peruvian GMP Manual for Pharmaceutical Products
Peru's Manual of Good Manufacturing Practices for pharmaceutical products, approved by Decreto Supremo N° 021-2018-SA, which also amends the regulation for registration, control, and sanitary surveillance of pharmaceutical products and medical devices. GMP is enforced by DIGEMID and is grounded in WHO GMP guidance.
The manual is WHO-GMP-based; sites already compliant with WHO/PIC-S GMP align closely. Confirm the current consolidated text and any subsequent amendments; Spanish-language documentation is expected.
Chilean Good Manufacturing Practices
Chile's technical standard on Good Manufacturing Practices for human-use medicines (Norma Técnica N° 127), originally approved by Decreto Exento N° 28 of 2012 and updated by Decreto Exento N° 159 of 2013, under the pharmaceutical control regulation (DS N° 3 of 2010). It is grounded in WHO GMP (Reports 32/33, updated per Report 37) and enforced by the Instituto de Salud Pública (ANAMED).
Norma Técnica N° 127 follows WHO GMP; sites compliant with WHO/PIC-S GMP align closely. ISP certification follows on-site inspection; Spanish-language documentation is expected.
Good Manufacturing Practice for Drugs (China)
China's GMP for drugs (2010 Revision), administered by the NMPA under the Drug Administration Law. Structured similarly to EU GMP with a main text and appendices (e.g. sterile products), it raised Chinese GMP substantially toward international norms.
The sterile appendix parallels EU GMP Annex 1 concepts. NMPA has continued to modernise following the 2019 Drug Administration Law (marketing authorisation holder system). Chinese-language documentation and NMPA inspection specifics require in-country expertise.
India GMP — Schedule M, Drugs and Cosmetics Rules
India's GMP requirements under the revised Schedule M of the Drugs and Cosmetics Rules, notified in December 2023. The revision introduces a formal pharmaceutical quality system, quality risk management, and computerised-system / data-integrity expectations, moving Indian GMP toward WHO/PIC-S norms.
The revised Schedule M adds PQS, QRM, and data-integrity concepts previously absent. The staggered deadlines mean site maturity varies — verify each site's compliance status against the phased timeline.
Good Manufacturing Practices Guide for Drug Products
Health Canada's GMP guidelines (GUI-0001) interpreting the GMP requirements of Part C, Division 2 of the Food and Drug Regulations. Canada is a PIC/S member, so GUI-0001 aligns closely with PIC/S and EU GMP while reflecting Canadian establishment-licensing requirements.
GUI-0001 is interpretive guidance for the Food and Drug Regulations; the legal requirements sit in Division 2. Alignment with PIC/S means EU-compliant sites are largely aligned, but the DEL and Canadian-specific reporting differ.
Australian GMP — Manufacturing Principles (PIC/S Guide)
Australia adopts the PIC/S Guide to GMP (PE 009) as its legally-binding Manufacturing Principles, determined under the Therapeutic Goods Act. TGA licensing and GMP clearance for overseas manufacturers are built on this PIC/S baseline.
Because the Manufacturing Principles are the PIC/S Guide, EU/PIC-S-compliant sites meet the technical bar; the TGA-specific layer is licensing and GMP clearance. Track which PE 009 version the current Manufacturing Principles determination adopts.
Process Simulation for Aseptically Filled Products
A widely-used PDA Technical Report providing detailed industry guidance on designing, executing, and evaluating aseptic process simulations (media fills). TR 22 operationalises the media-fill expectations of EU GMP Annex 1 and FDA aseptic guidance.
TR 22 is the go-to execution reference when building or defending a media-fill programme — worst-case interventions, run size, incubation, and acceptance criteria. Regulators expect media fills consistent with Annex 1; TR 22 provides the practical how-to.
Guideline for Elemental Impurities
The ICH quality guideline establishing permitted daily exposures (PDEs) and a risk-based approach for controlling elemental impurities in drug products. Q3D(R2) updated PDEs and added cutaneous and transcutaneous routes of administration.
The elemental-impurities risk assessment (identify, analyse, control) is the practical deliverable; many findings stem from incomplete component/route consideration or missing analytical justification. Q3D pairs with USP <232>/<233> for compendial compliance.
Medical Devices — Application of Risk Management to Medical Devices
The international standard specifying a process for medical-device manufacturers to identify hazards, estimate and evaluate risks, control them, and monitor the effectiveness of controls across the device lifecycle. The 2019 edition strengthened benefit-risk analysis and production/post-production feedback.
ISO 14971 risk management files are central to MDR/IVDR technical documentation. Common gaps are weak post-production surveillance feedback loops and benefit-risk determination. Pair with ISO/TR 24971 for practical guidance.
Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment
The consensus standard that established the risk- and science-based approach to specifying, designing, and verifying manufacturing systems and equipment. It replaces prescriptive, document-driven qualification with verification focused on the critical aspects that affect product quality and patient safety, leveraging Good Engineering Practice and subject-matter-expert judgement.
E2500 is the foundation of the modern commissioning & qualification (C&Q) model operationalised by ISPE Baseline Guide Vol. 5. Verification can leverage commissioning and vendor documentation (FAT/SAT) to avoid duplicative IQ/OQ/PQ, provided quality risk management (ICH Q9) identifies the Critical Aspects and SME approval is documented. Inspectors accept science/risk-based C&Q when the linkage from product/process requirements to verified controls is clear.
Commissioning and Qualification (Second Edition)
The industry guide that operationalises ASTM E2500’s risk- and science-based approach into an integrated commissioning and qualification lifecycle. It introduces the System Risk Assessment, Critical Aspects, and Critical Design Elements (CDEs), and folds commissioning and qualification into a single verification effort.
The Second Edition (2019) aligns fully with ASTM E2500 and supersedes the 2001 first edition’s system-impact / IQ-OQ-PQ model. Critical Design Elements (CDEs) and Critical Aspects focus verification where it protects the patient. Integrated C&Q reduces duplication between engineering commissioning and GMP qualification — but the risk assessments and SME approvals must be documented to hold up in an inspection.
Bioprocessing Equipment
The engineering standard for hygienic (sanitary) design of equipment and systems with product-contact surfaces in bioprocessing. It sets requirements for materials of construction, surface finishes, dimensions and tolerances, weld quality, drainability, and examination — the design characteristics that make a system cleanable and controllable.
ASME BPE is the de-facto reference for sanitary design in biopharma and is routinely specified in the URS. Surface finish (SF) designations and slope/drainability requirements directly drive cleanability and the success of CIP/SIP validation. Weld quality and examination records (including borescope documentation) are common audit topics. It is a voluntary standard, not a regulation, but Annex 1’s contamination-control expectations lean on this kind of hygienic design.
MHRA 'GxP' Data Integrity Guidance and Definitions
The MHRA’s cross-GxP data integrity guidance (Revision 1, March 2018). Defines the ALCOA+ attributes — attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, and available — and sets expectations for data governance across the whole data lifecycle, for paper, electronic, and hybrid records alike.
This is the reference document most inspectors reach for when defining data integrity terms — "true copy", "raw data", "audit trail", "data lifecycle" all carry MHRA definitions. Expectations scale with data criticality and inherent risk: the guidance explicitly asks for a data governance system proportionate to risk, not a uniform maximum. Blank-form control, shared logins, and unreviewed audit trails remain the classic findings it was written against.
Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments
The PIC/S data integrity guidance (adopted 1 July 2021), written for inspectorates — which makes it the closest public view of how data integrity is actually inspected. Covers data governance, paper-based and computerised systems, hybrid situations, outsourced activities, and how deficiencies should be classified and remediated.
Because PI 041 is the inspectors’ own aide-memoire, mapping your data governance programme against its section structure is the fastest defensibility check available. It grades data integrity maturity from basic compliance to embedded quality culture, and its deficiency-classification examples show which findings inspectors treat as critical (e.g. deliberate falsification, disabled audit trails) versus major or other. The outsourcing section extends expectations to contract givers — your suppliers’ data integrity is your finding.
Good Clinical Laboratory Practice (GCLP)
The WHO/TDR standard for laboratories analysing specimens from clinical trials. GCLP bridges GCP and GLP: it applies GLP-style organisation, quality assurance, and record-keeping to trial-sample analysis so that laboratory data supporting clinical decisions is reliable, reconstructable, and protects trial subjects.
Sponsors audit trial labs against GCLP because neither GCP (written for sites and sponsors) nor GLP (written for nonclinical studies) fits the trial-laboratory reality on its own. Chain of custody from collection to result, analytical method validation, and contemporaneous raw-data capture are the recurring audit themes. If a lab result drives a dosing or eligibility decision, expect the audit trail for that result to be walked end-to-end.
Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
The FSMA rule that modernised US food GMP — it pairs baseline current good manufacturing practice (Subpart B) with a risk-based preventive-controls system (HARPC): a written Food Safety Plan, hazard analysis, and preventive controls with monitoring, corrective actions, and verification. It shifted food safety from reacting to contamination to preventing it.
Allergen cross-contact and sanitation are the most-cited cGMP areas, and a missing or inadequate hazard analysis is the classic preventive-controls finding. The Food Safety Plan must be prepared or overseen by a Preventive Controls Qualified Individual (PCQI). The Supply-Chain Program (Subpart G) extends control to hazards a supplier is relied on to manage.
Current Good Manufacturing Practice for Dietary Supplements
The cGMP regulation for manufacturing, packaging, labeling, and holding dietary supplements. It requires identity testing of incoming dietary ingredients, established specifications, quality-control oversight, and full batch documentation — bringing pharmaceutical-style controls to the supplement industry.
Identity testing of incoming dietary ingredients (§111.75) is the single most-cited area in warning letters — failing to confirm what you received is a recurring finding. Specifications (§111.70) must exist and be met at defined points, and the Master Manufacturing Record and Batch Production Record must be complete and reconcilable.
General Principles of Food Hygiene
The foundational Codex Alimentarius code underpinning food-safety systems worldwide. The 2020 revision restructured it into Chapter One (Good Hygiene Practices) and Chapter Two (the HACCP system and its seven principles), making the prerequisite-programme + HACCP model the international baseline national food laws build on.
The 2020 revision moved HACCP from an annex into the main body and clarified the relationship between Good Hygiene Practices (as prerequisites) and HACCP (for significant hazards). Codex is not directly enforceable, but WTO agreements make it the reference standard in trade disputes, so exporters are effectively held to it.
Food safety management systems — Requirements for any organization in the food chain
The international food-safety management-system standard for any organisation in the food chain. It combines interactive communication, system management, prerequisite programmes, and Codex HACCP within the ISO high-level structure, and introduces two levels of risk — organisational (strategic) and operational (HACCP/OPRP).
Clause 8 (Operation) is where audits concentrate: PRPs (8.2), the hazard-control plan combining HACCP and operational PRPs (8.5), and control of nonconformity (8.9). The 2018 edition added organisational context (Clause 4) and risk-based planning (Clause 6). ISO 22000 is the backbone of GFSI-recognised schemes such as FSSC 22000, which layers sector PRPs on top.
Current Good Manufacturing Practice for Type A Medicated Articles
The FDA (Center for Veterinary Medicine) cGMP for Type A medicated articles — the concentrated drug premixes used to manufacture medicated feeds. It sets controls on components, potency/assay, equipment, and records so the active drug is present at the correct concentration and free of unintended carryover.
Assay/potency verification and control of drug carryover between products are the core concerns — an under- or over-potent premix propagates into every downstream medicated feed. Component control and complete manufacturing records are the recurring documentation themes.
Current Good Manufacturing Practice for Medicated Feeds
The FDA CVM cGMP for medicated feeds — feeds, supplements, and premixes containing approved new animal drugs. It controls drug carryover between batches (flushing and sequencing), correct drug concentration, periodic potency assays, equipment, and labeling, structured differently for licensed and non-licensed facilities.
Drug carryover is the defining risk: residue of one medicated feed in the next can harm non-target species or create violative residues in food-producing animals, so validated flushing and production sequencing are central. Correct concentration, periodic assays, and accurate medicated-feed labeling round out the common findings.
Good Clinical Practice (Veterinary)
The veterinary Good Clinical Practice standard from VICH (the veterinary analogue of ICH). GL9 sets the design, conduct, monitoring, recording, and reporting expectations for clinical studies that support the safety and efficacy of veterinary medicinal products, adopted by the EU, Japan, and the US (FDA GFI #85).
GL9 is the veterinary counterpart to ICH E6 — investigator responsibilities, study protocol control, informed owner consent, animal welfare, and data integrity are the pillars. Sponsors audit study sites against it; contemporaneous raw-data capture and traceability of results are the recurring themes.
Veterinary Medicinal Products
The EU regulation governing the authorisation, manufacture, import, distribution, and pharmacovigilance of veterinary medicinal products. Applying since January 2022, it replaced Directive 2001/82/EC, expanded scope (including euthanasia substances), and substantially strengthened provisions to combat antimicrobial resistance.
The regulation modernised the EU veterinary framework and put antimicrobial-resistance controls (restrictions on prophylactic and metaphylactic use, reserved antimicrobials for human use) at its centre. Manufacturing authorisation, a pharmacovigilance system, and product-database obligations are the operational pillars.
Cosmetics — Good Manufacturing Practices (GMP): Guidelines on Good Manufacturing Practices
The international Good Manufacturing Practices standard for cosmetics — guidelines on the production, control, storage, and shipment of cosmetic products. It is the global cosmetics-GMP baseline (referenced by the EU Cosmetics Regulation and endorsed via ICCR), and in the US it is expected to inform the mandatory GMP regulations FDA must establish under MoCRA.
ISO 22716 reads as a right-sized GMP: personnel, premises, equipment, raw materials, production, finished product, quality control, out-of-spec handling, and documentation. MoCRA (2022) added US facility registration, product listing, safety substantiation, adverse-event reporting, and FDA mandatory-recall authority — and directs FDA to set cosmetic GMP regulations expected to draw on this standard.
Human Cells, Tissues, and Cellular and Tissue-Based Products (HCT/Ps)
The FDA (CBER) regulation for human cells, tissues, and cellular and tissue-based products. It covers establishment registration, donor eligibility, and Current Good Tissue Practice (CGTP) — the controls that prevent the introduction, transmission, or spread of communicable disease through HCT/Ps.
Donor eligibility (Subpart C) — screening and testing for relevant communicable diseases — and Current Good Tissue Practice (Subpart D) are the inspection core. CGTP centres on preventing contamination and cross-contamination and on the recordkeeping that makes each product traceable to its donor. Some HCT/Ps are also regulated as drugs/biologics/devices, adding those GMP layers.
Current Good Manufacturing Practice for Blood and Blood Components
The FDA (CBER) cGMP for blood and blood components — the organisation, facilities, equipment, production and process controls, labeling, laboratory controls, and records that ensure collected blood and its components are safe, pure, and potent.
Standard operating procedures (§606.100) and records (§606.160) anchor the system — an SOP gap or an incomplete record is a classic finding. Production and process controls (Subpart F) and laboratory controls (Subpart H) cover the testing and control steps that keep components safe; look-back and error/accident reporting obligations run throughout.
Medical Device Regulation (MDR)
The EU regulation governing the placing on the market of medical devices, applying since May 2021 in place of the Medical Devices Directive. It raises the bar on clinical evidence, post-market surveillance, unique device identification (UDI), and the role of notified bodies, and requires a compliant quality management system throughout the device lifecycle.
MDR expanded scope (including certain products without a medical purpose in Annex XVI), tightened clinical-evidence and equivalence rules, and made post-market surveillance and vigilance far more demanding than the old Directive. A conformity-assessment route via a notified body, a UDI system, and EUDAMED registration are the operational pillars; ISO 13485 is the practical route to the required QMS.
Medical Device Reporting (MDR)
FDA’s Medical Device Reporting regulation — the mandatory post-market reporting system for device-related deaths, serious injuries, and malfunctions. Manufacturers, importers, and device user facilities must report qualifying events to FDA within defined timeframes, feeding the MAUDE database that surfaces device safety signals.
MDR is the device analogue of pharmacovigilance: complaint handling under 21 CFR 820.198 feeds reportability decisions under Part 803. Timeliness (5-day and 30-day reports), a defensible reportability decision tree, and MAUDE-consistent coding are the recurring inspection themes; late or missed reports are a common enforcement trigger.
Medical Device Software — Software Life Cycle Processes
The international standard defining life-cycle requirements for medical device software — development, maintenance, risk management, configuration management, and problem resolution. It classifies software into safety classes A, B, and C by the severity of harm a failure could cause and scales the required rigour accordingly.
IEC 62304 is the backbone standard for device software and the natural bridge from CSV/GAMP thinking into the device world. Safety classification (A/B/C) drives how much process is required; a clear software safety class, a maintained software architecture, and a linked risk-management file (with ISO 14971) are what auditors and notified bodies look for.
Medical Electrical Equipment — General Requirements for Basic Safety and Essential Performance
The foundational safety standard for medical electrical equipment — the requirements for basic safety and essential performance, including electrical, mechanical, thermal, and radiation hazards, supported by a large family of collateral (60601-1-x) and particular (60601-2-x) standards. It underpins market access for powered medical devices worldwide.
IEC 60601-1 is the safety-testing gateway for powered devices; the third edition made a risk-management process (per ISO 14971) integral to demonstrating essential performance. Test-house evidence, a maintained essential-performance definition, and alignment with the relevant particular standard for the device type are the practical deliverables.
Foreign Supplier Verification Programs (FSVP)
An FSMA rule requiring US importers of food for humans and animals to verify that their foreign suppliers produce food meeting US safety standards. Importers must conduct hazard analysis, evaluate supplier performance and risk, and perform supplier verification activities — extending preventive-controls thinking across the border.
FSVP puts the burden of supply-chain food safety on the importer of record. A documented hazard analysis, a risk-based supplier evaluation, and verification activities (often supplier audits for high-risk hazards) are what FDA reviews; "no FSVP" is a common import-alert and inspection finding.
Mitigation Strategies to Protect Food Against Intentional Adulteration
The FSMA "food defense" rule requiring registered food facilities to protect against intentional adulteration aimed at causing wide-scale public-health harm. Facilities must conduct a vulnerability assessment, identify actionable process steps, implement mitigation strategies, and maintain a written food-defense plan.
Distinct from unintentional-hazard controls (21 CFR 117), Part 121 addresses deliberate contamination. A vulnerability assessment (e.g. the key-activity-types approach), identified actionable process steps, mitigation strategies with monitoring, and trained food-defense personnel are the deliverables inspectors expect.
Current Good Manufacturing Practice and Preventive Controls for Food for Animals
The FSMA rule establishing cGMP and hazard-analysis / risk-based preventive controls for animal food (feed and pet food). It parallels the human-food preventive-controls rule (21 CFR 117), requiring a food-safety plan, preventive controls, monitoring, corrective actions, and verification for animal-food facilities.
Part 507 brought animal-food manufacturing under a modern preventive-controls framework for the first time. A qualified individual, a written food-safety plan with hazard analysis, and preventive controls with monitoring and verification are the pillars; cross-contamination (e.g. medicated feed carryover, nutrient toxicity) is a recurring hazard focus.
Stability Testing of New Veterinary Drug Substances and Medicinal Products
The VICH stability-testing guideline for veterinary drug substances and products — the veterinary analogue of ICH Q1A. It defines the storage conditions, testing frequency, and study design used to establish re-test periods and shelf lives for veterinary medicines across the VICH regions (EU, Japan, US).
GL3 mirrors ICH Q1A(R2): defined long-term, intermediate, and accelerated storage conditions, a bracketing/matrixing option, and the data expectations that justify a shelf life. Where a company runs both human and veterinary lines, the stability program can largely be shared, with veterinary-specific climatic-zone and species-use considerations.
Modernization of Cosmetics Regulation Act of 2022
The most significant expansion of FDA authority over cosmetics since 1938. MoCRA requires facility registration and product listing, safety substantiation for cosmetic products, serious adverse-event reporting and recordkeeping, and gives FDA mandatory-recall authority — and directs FDA to establish good manufacturing practice regulations for cosmetics.
MoCRA moved cosmetics from a largely self-policed regime toward a registration-and-accountability model. Facility registration, product listing, a responsible person, safety substantiation records, and serious-adverse-event reporting (within 15 business days) are immediate obligations; the mandated cosmetic GMP rule is expected to draw on ISO 22716.
EU Cosmetic Products Regulation
The EU regulation governing cosmetic products placed on the EU market. It requires a designated Responsible Person, a Product Information File with a Cosmetic Product Safety Report, notification via the CPNP portal, GMP compliance (aligned to ISO 22716), ingredient restrictions, and cosmetovigilance for undesirable effects.
The EU regime is the global reference for cosmetics regulation. A Responsible Person, a complete Product Information File including a two-part Cosmetic Product Safety Report signed by a qualified safety assessor, CPNP notification, and ISO 22716 GMP are the operational pillars; restricted/prohibited substances (Annexes) drive reformulation work.
Cosmetics — General
FDA’s general cosmetics regulations — including specific prohibitions and restrictions on certain ingredients (e.g. bithionol, mercury compounds, certain color additives) and general provisions on cosmetic products. Together with the FD&C Act’s adulteration and misbranding provisions and MoCRA, it forms the US cosmetics regulatory baseline.
Part 700 is the long-standing US cosmetics rule set — narrow ingredient prohibitions plus general provisions — historically light-touch and reliant on the FD&C Act’s adulteration/misbranding standards. MoCRA (2022) is now layering registration, safety substantiation, and forthcoming GMP on top, so Part 700 should be read alongside the new obligations.
Pharmacy Compounding — Conditions for Exemption
Exempts drugs compounded by a licensed pharmacist or physician for an identified individual patient from new-drug approval, adequate-directions-for-use labelling, and cGMP — provided a set of conditions is met. Added to the FD&C Act in its current form by the Drug Quality and Security Act of 2013.
The exemption is conditional, and each condition is a place to fail: compounding must follow a patient-specific prescription (or limited anticipatory compounding), bulk substances must meet the statutory sourcing conditions, and the preparation must not be essentially a copy of a commercially available drug. Lose a condition and the product is an unapproved new drug made outside cGMP — which is a far worse position than being a 503B facility. Practitioners frequently assume "503A means FDA is not involved"; FDA inspects 503A pharmacies and issues 483s and warning letters where insanitary conditions or adulteration are found.
Outsourcing Facilities — Registration and cGMP
Creates the outsourcing-facility category: a compounder that registers with FDA, complies with cGMP, reports adverse events, and is inspected on a risk-based schedule, in exchange for being able to compound without patient-specific prescriptions. Added by the Drug Quality and Security Act of 2013 following the 2012 fungal-meningitis outbreak.
The critical asymmetry: a 503B facility is exempt from new-drug approval and adequate-directions-for-use labelling but is NOT exempt from cGMP. That means 21 CFR 210/211 applies in full — process validation, environmental monitoring, stability, qualified personnel — and FDA inspects against it. Many 503B facilities were built as pharmacies and inherited pharmacy-grade quality systems, which is the single most common source of 483 observations in this sector. Treat a 503B as a sterile manufacturer that happens to compound, not as a pharmacy that happens to scale.
Pharmaceutical Compounding — Nonsterile Preparations
The compendial standard for compounding nonsterile preparations: personnel training and evaluation, facilities and equipment, component selection, master formulation and compounding records, beyond-use dating, and quality assurance. The revised chapter became official 1 November 2023.
USP chapters are compendial rather than statutory, but most state boards adopt them by reference, which converts them into enforceable state law. That is the mechanism practitioners most often misunderstand — the obligation arrives through the state, not through USP. The 2023 revision tightened documentation expectations around master formulation and compounding records, and BUD assignment is where inspection findings concentrate: a BUD must rest on the chapter default or on a documented stability basis, not on convenience.
Pharmaceutical Compounding — Sterile Preparations
The compendial standard for compounding sterile preparations: facility design and air quality, personnel garbing and competency including gloved-fingertip and media-fill testing, environmental monitoring, sterilisation and depyrogenation, and beyond-use dating by preparation category. The revised chapter became official 1 November 2023.
The 2023 revision restructured CSPs into Category 1, 2 and 3, with BUD limits tied to category and to the sterility-assurance measures actually in place — Category 3 permits the longest dating but demands substantially more, including sterility testing and more rigorous personnel qualification. The most common gap is treating the category as a labelling decision rather than a system decision: claiming Category 3 dating obliges you to run the Category 3 programme. Note also that <797> is not cGMP; a 503B facility must satisfy 21 CFR 211 as well, and <797> alone is not a defence.
Hazardous Drugs — Handling in Healthcare Settings
Requirements for handling hazardous drugs across receipt, storage, compounding, transport, administration and disposal, to protect personnel, patients and the environment. Official 1 December 2019, and applicable to any entity handling drugs on the NIOSH hazardous-drug list.
This is the chapter that crosses out of GxP into worker protection, and it is enforced from two directions: state boards adopting the chapter, and OSHA under its general-duty and hazard-communication obligations. Containment is the organising idea — negative-pressure containment primary engineering controls, externally vented rooms, closed-system transfer devices, and documented surface-wipe sampling. Assessment of risk is permitted for some dosage forms in place of full containment, but it must be documented and periodically reviewed; using it as a blanket exemption is a finding.
State Pharmacy Practice Acts and Compounding Regulations
The state-level statutes and board regulations that license pharmacies and pharmacists and govern compounding practice. Most states adopt the USP compounding chapters by reference, which is the mechanism that turns a compendial chapter into enforceable law for a 503A compounder.
This is the layer most GxP resources omit, and it is the primary regulator for 503A compounding. Requirements genuinely differ by state: which USP version is adopted, whether adoption is automatic or requires rulemaking, inspection frequency, and what must be reported. A multi-state compounder is subject to the union of every state it ships into, not the intersection. Board disciplinary actions are generally public and are the closest state-level analogue to an FDA warning letter — worth monitoring as intelligence.
Registration of Manufacturers, Distributors and Dispensers of Controlled Substances
DEA registration requirements for every person manufacturing, distributing, dispensing, importing or exporting controlled substances, including the physical-security and employee-screening obligations that attach to registration.
DEA obligations run alongside cGMP and are enforced independently: a site can be in good GMP standing and still lose its ability to operate through a DEA action. The security requirements are physical and prescriptive — vaults and cages, alarm systems, controlled access — and are assessed against the schedule and quantity handled, so a change in either can move you into a higher requirement without any change to the product. Registration is also activity-specific: a manufacturer that begins distributing needs the distribution activity registered.
Records and Reports of Registrants
The recordkeeping and reporting obligations of DEA registrants: inventories, receipt and distribution records, retention periods, and the reporting of losses and thefts.
Accountability here is quantitative and unforgiving: DEA expects a complete audit trail from receipt to disposition, and an unreconciled discrepancy is a reportable event rather than a deviation to investigate at leisure. The overlap with GMP recordkeeping is partial, not total — GMP batch records rarely satisfy DEA inventory requirements on their own, and sites that assume one system covers both usually discover the gap during an inspection. Biennial inventory and readily-retrievable retrieval expectations are the specifics most often missed.
European Pharmacopoeia
The legally binding compendium for medicines and their components in the states party to the Convention on the Elaboration of a European Pharmacopoeia. Comprises general chapters, general monographs and specific monographs, and is maintained by EDQM under the Council of Europe with periodic supplements.
The most consequential difference from USP is legal status: Ph. Eur. monographs are binding in signatory states, so a product failing its monograph is non-compliant regardless of any other justification. Supplements are published several times a year and revise monographs and general chapters on a rolling basis, which makes version control a real obligation — testing against a superseded monograph is a finding. General chapters and general monographs apply even where no specific monograph exists, which practitioners routinely overlook. Ph. Eur. and USP are only partially harmonised through the Pharmacopoeial Discussion Group; assume a method or limit differs until you have checked.
Certificate of Suitability to the Monographs of the European Pharmacopoeia
A certification issued by EDQM confirming that an active substance from a named manufacturing route complies with the relevant Ph. Eur. monograph. A CEP can be referenced in a marketing-authorisation application in place of a full active-substance master file, across the signatory states.
The CEP is the practical reason EDQM matters commercially: one assessment referenced by many applications, instead of an ASMF filed and assessed per market. It is route-specific and site-specific, so a change of synthesis route or manufacturing site requires a CEP revision — a point at which finished-product manufacturers discover their supplier changed something. EDQM also inspects CEP holders, and a CEP can be suspended or withdrawn, which propagates immediately to every product referencing it. Supplier qualification for a European supply chain should therefore include monitoring CEP status, not just holding a copy of the certificate.
Software as a Medical Device (SaMD): Key Definitions
Establishes the term "Software as a Medical Device" and the vocabulary regulators now share for it — what counts as SaMD, how it differs from software embedded in a device, and the concepts subsequent SaMD guidance builds on.
This document matters less for its requirements than for its definitions: it is the reason regulators in different jurisdictions now describe software products in compatible terms, and it is the vocabulary that later frameworks — including risk categorisation and clinical evaluation — assume. The distinction it draws between SaMD and software in a medical device determines which regulatory pathway a product follows, and getting it wrong at the concept stage is expensive to unwind. IMDRF documents are not law anywhere; they acquire force when a regulator adopts or references them, which most major jurisdictions have done in some form.
SaMD: Possible Framework for Risk Categorization and Corresponding Considerations
Proposes the risk-categorisation framework for Software as a Medical Device: category is driven by the significance of the information the software provides to a healthcare decision and by the state of the healthcare situation or condition it addresses.
The insight worth internalising is that SaMD risk is not a property of the code — it is a property of what the output is used for and how serious the condition is. A simple algorithm informing a critical decision carries more regulatory weight than a complex one supporting an administrative task. That reframing is what makes the framework durable, and it is also where teams argue: engineering complexity feels like it should drive rigour, and it does not. The framework is a proposal, not a binding classification rule, so always reconcile it with the actual classification rules of each target market.
Joint IPEC-PQG Good Manufacturing Practices Guide for Pharmaceutical Excipients
The joint IPEC Federation and Pharmaceutical Quality Group guide setting GMP expectations for excipient manufacture. Version 5 (2022) is structured on ISO 9001:2015 with excipient-specific GMP requirements layered on top, and it is the reference an excipient supplier is realistically audited against.
The structural point is that excipients are frequently made on multi-purpose plant serving food, cosmetic and industrial customers, so full pharmaceutical GMP is neither proportionate nor achievable — the guide sets what is. Version 5 rebuilt the document on the ISO 9001:2015 clause structure and added worked examples for interpretation without adding requirements, and IPEC has stated that earlier versions are obsolete, so an audit programme still working from the 2017 text is auditing against a superseded document. The guide is voluntary and IPEC certifies nobody; its force comes through the purchaser, which is why excipient GMP is enforced in the quality agreement and the supplier audit rather than by any inspector. Where an excipient is high-risk — parenteral use, or a known adulteration target such as glycerin and propylene glycol — the guide is a floor, not a ceiling.
General requirements for the competence of testing and calibration laboratories
The international standard for laboratory competence, impartiality and consistent operation. Published November 2017 as the third edition, replacing ISO/IEC 17025:2005, it is the standard against which testing and calibration laboratories are accredited worldwide.
Accreditation to 17025 and GMP compliance answer different questions and neither substitutes for the other: 17025 demonstrates technical competence for a defined scope of methods, while GMP governs whether the laboratory operates inside a compliant quality system. A contract laboratory can hold impeccable accreditation and still be a GMP finding waiting to happen, and the reverse is equally true. The 2017 edition moved the standard onto risk-based thinking, strengthened metrological traceability, and modernised its treatment of electronic records — which is where it converges with data-integrity expectations. The detail that decides whether an accreditation is useful to you is the scope: accreditation is granted per method and per matrix, so the certificate means nothing until you have read the schedule and confirmed your test is on it.
ILAC Mutual Recognition Arrangement
The arrangement through which signatory accreditation bodies mutually recognise each other's accreditations, so that a test or calibration result issued under an accredited scope in one economy is accepted in another. It is what turns a national accreditation into an internationally portable one.
The MRA is the answer to a question most quality organisations never articulate: why should a result from a laboratory you have never audited, accredited by a body in another country, mean anything? Recognition rests on peer evaluation between accreditation bodies rather than on any single authority, which is a different mechanism from the regulator-to-regulator mutual recognition agreements that govern GMP inspection. The practical failure mode is treating "ILAC-accredited" as a property of the laboratory: it is a property of the accreditation body, and it applies only within that body's recognised scope. Verify the signatory status and the scope through ILAC's published signatory search rather than accepting a claim on a report footer or a website.
Drug Supply Chain Security Act
Title II of the Drug Quality and Security Act (Pub. L. 113-54, 2013), codified at FD&C Act §§581–585. It builds an interoperable, electronic, package-level system for tracing prescription drugs through the US supply chain, and defines who may be a trading partner at all.
DSCSA is where distribution stops being a logistics function and becomes a regulated one. The statute set a ten-year phase-in ending 27 November 2023 for enhanced drug distribution security under §582(g) — interoperable, electronic, package-level tracing — which FDA then softened with a one-year stabilisation policy and, after that, exemptions staggered by trading-partner type: manufacturers and repackagers to 27 May 2025, wholesale distributors to 27 August 2025, and dispensers to 27 November 2025, with small dispensers of 25 or fewer full-time licensed pharmacists or qualified pharmacy technicians exempt until 27 November 2026. Confirm the date that applies to your own category before assuming the regime is fully in force. The requirement practitioners underestimate is verification: a trading partner must be authorised, suspect and illegitimate product must be investigated and notified, and the tracing data must be electronically interoperable rather than merely electronic — a PDF of a transaction history does not satisfy §582(g).
GS1 General Specifications — identification keys, data attributes and barcodes
The foundational GS1 standard defining how identification keys, data attributes and barcodes are constructed and used — GTIN, SSCC, SGTIN, GS1 Application Identifiers, GS1-128 and GS1 DataMatrix. Released annually each January; Release 26.0 was published in January 2026.
GS1 is not a regulator and issues no requirement, yet it is impossible to comply with DSCSA, the EU Falsified Medicines Directive or medical device UDI without it, because those regimes specify the outcome and leave the identifier syntax to GS1. That makes the General Specifications an unusual entry in a GxP catalogue: a voluntary standard with effectively mandatory reach. Two consequences matter operationally. First, the specifications are revised on an annual January cycle, so a serialisation system built to an older release and never revisited will drift out of alignment with its trading partners. Second, the errors that surface in practice are syntactic — a malformed Application Identifier string or a GS1 DataMatrix that fails to grade — and they present as a rejected shipment rather than as a compliance finding, which is why they tend to be diagnosed late and by the wrong team.