Excipient GMP
Excipients make up the bulk of most dosage forms by weight, yet unlike active pharmaceutical ingredients they have no dedicated GMP regulation comparable to ICH Q7 in most jurisdictions — although the EU makes the medicinal product manufacturer legally responsible for deciding what GMP each excipient needs. The gap is filled largely by industry-developed consensus guidance and by the finished-product manufacturer’s own supplier-qualification obligations under its own GMP regulation.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 21 LINKSExcipients are the majority of most formulations and the minority of most quality systems: with no single binding global GMP, control is bought through supplier qualification or it is not bought at all.
06 · QUALITY MATURITY — EXCIPIENT GMP, REACTIVE TO ADAPTIVE
Excipients are purchased against a compendial specification and accepted on the certificate that arrives with them.
Suppliers are approved and certificates are reviewed, but the approval rested on a questionnaire and the distributor between the maker and the site is invisible.
The supply chain is mapped to the actual manufacturer, qualification is risk-scaled to what the excipient does in the formulation, and change notification is contractually bound.
Supplier performance is monitored rather than periodically re-approved, and the risk ranking is revisited when the formulation or the excipient’s function changes.
Excipient variability is understood as a formulation input, so specifications constrain the attributes that actually drive performance rather than the ones the monograph happens to list.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 4
Derived from the 4 standards SPEQ maps to this subject, across 4 regulatory bodies: FDA, ICH, ISO, IPEC.
RECORDS & OBJECTIVE EVIDENCE
- The supply chain map from the site back to the actual excipient manufacturer
- Risk-scaled supplier qualification records, including audit reports where the risk warranted one
- The quality or technical agreement, with its change-notification obligations
- Incoming acceptance approach, and the justification for relying on a certificate where one is relied upon
- Functional attribute specifications beyond the compendial identity and purity limits
COMMON INSPECTION FINDINGS
- A distributor qualified as the manufacturer, leaving the actual maker unassessed
- Certificates accepted without periodic verification testing to establish they can be relied upon
- Qualification rigour identical across excipients of very different criticality to the product
- No contractual change notification, so a supplier process change reaches the site as a performance surprise
- Functional attributes that drive formulation performance absent from the purchase specification
The Regulatory Gap
Excipients are components of the finished drug product and fall within the scope of the finished-dosage manufacturer’s obligations under regulations such as 21 CFR Part 211 — including the duty to qualify component suppliers and test incoming materials — but there is no equivalent of ICH Q7 written specifically for excipient manufacturers themselves in most major markets. An excipient producer making, for example, a cellulose derivative used across food, cosmetic, and pharmaceutical applications is not automatically bound by pharmaceutical GMP the way an API producer is.
The IPEC-PQG Joint GMP Guide
The gap is filled by the Joint IPEC-PQG Good Manufacturing Practices Guide for Pharmaceutical Excipients (current edition v5, 2022) — a voluntary, industry-consensus standard developed by the International Pharmaceutical Excipients Council and the Pharmaceutical Quality Group. It is not a regulatory requirement in itself, but it functions as the de facto reference finished-dosage manufacturers audit excipient suppliers against, and many excipient producers seek third-party certification to it.
Risk-Based, Function-Scaled Rigor
SPEQ interpretation: because excipients range from bulk commodity chemicals to highly purified, pharmaceutical-grade materials, the appropriate GMP rigor scales with the excipient’s function and the risk of its intended use — an excipient destined for a high-risk parenteral formulation warrants a materially different qualification and testing burden than the same chemical class used in an oral tablet coating, even where the underlying manufacturing process is similar.
Supplier Qualification as the Practical Control Point
Because there is no independent excipient-GMP inspection regime comparable to an API or finished-product inspection in most jurisdictions, the finished-dosage manufacturer’s own supplier-qualification program — audits, quality agreements, incoming material testing, and change-notification requirements — is where excipient GMP expectations are actually enforced in practice.
The EU Risk-Assessment Duty and the US Testing Rule
In the EU, Article 46(f) of Directive 2001/83/EC requires the manufacturing authorisation holder to ensure that excipients are suitable by ascertaining the appropriate GMP, and the Commission’s Guidelines of 19 March 2015 (2015/C 95/02) require that this be done through a formalised risk assessment, documented and available on site for GMP inspectors. For each excipient from each manufacturer, the assessment considers risks from source to dosage form — including TSE, viral and microbial or endotoxin contamination, impurities from raw materials or carried over from shared equipment, supply-chain complexity and stability — and the excipient’s use: dosage form, function, proportion, daily intake, known quality defects or fraudulent adulteration, and impact on the product’s critical quality attributes. A gap analysis against the excipient manufacturer, supported by audit or information from the manufacturer, sets that supplier’s risk profile and the control strategy, which is then reviewed on defect trends, loss of certification and changes at the supplier.
In the US, 21 CFR 211.84 treats excipients as components: each lot is withheld from use until sampled, tested or examined and released by the quality control unit, and at least one identity test is performed on each component. A supplier’s report of analysis may be accepted in place of full testing only if the manufacturer performs at least one specific identity test and establishes the reliability of the supplier’s results through validation at appropriate intervals. The IPEC-PQG Good Manufacturing Practices Guide (version 5, 2022) is the industry reference for what excipient GMP looks like at the supplier; the regulations above are what make the finished-product manufacturer accountable for it.
FREQUENTLY ASKED
Is the IPEC-PQG GMP Guide legally binding on excipient manufacturers?
No — it is a voluntary, industry-consensus guide. It becomes practically binding through customer contracts, quality agreements, and audit expectations, not through direct regulatory mandate on the excipient manufacturer.
Does every excipient need the same level of GMP rigor?
No. The appropriate rigor generally scales with the excipient’s function and the risk profile of the dosage form it goes into — a risk-based judgment, not a fixed universal standard.
Who is responsible for qualifying an excipient supplier?
The finished-dosage manufacturer, as part of its own GMP obligations under regulations governing the finished product, is responsible for qualifying and monitoring its excipient suppliers.
Does ICH Q7 apply to excipient manufacturing?
No — ICH Q7 is scoped to active pharmaceutical ingredients. Excipients are addressed through separate, largely voluntary industry guidance such as the IPEC-PQG GMP Guide.
Is an excipient risk assessment legally required in the EU?
Yes. Under Article 46(f) of Directive 2001/83/EC the manufacturing authorisation holder must ascertain the appropriate GMP for excipients, and the Commission Guidelines of 19 March 2015 (2015/C 95/02) require this through a formalised risk assessment, documented and available on site for inspectors.
Can a US manufacturer rely on an excipient supplier’s certificate of analysis?
Partly. 21 CFR 211.84(d)(2) allows a supplier’s report of analysis in lieu of full testing only if the manufacturer conducts at least one specific identity test on the component and establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s results at appropriate intervals.
The inspection-readiness playbook for this topic
PUT THIS PLAYBOOK TO WORK
- HOW-TO GUIDEHow to Qualify a Supplier →Bring a supplier onto the approved list — and keep them worthy of it.
- TEMPLATESupplier Qualification Questionnaire →
A free account keeps what you save, remembers where you are across devices, and can send you the weekly regulatory briefing. Create a free account