EU GMP Certification Explained: A Guide for Manufacturers

EU GMP Certification Explained: A Guide for Manufacturers

EU GMP certification is the official confirmation, issued by a national competent authority (NCA), that a manufacturing site meets the European Union's Good Manufacturing Practice standards for medicines and related products. That confirmation gets recorded in the EudraGMDP database, the EU's public register of GMP certificates, manufacturing authorizations, and non-compliance statements. It applies to every manufacturer supplying the EU market, regardless of where the facility sits geographically — a plant in New Jersey faces the same standard as one in Germany.

For U.S. manufacturers, three actions matter most right now:

  • Verify your EudraGMDP entry. If your site has been inspected before, confirm the certificate is current, correctly scoped, and not flagged with a non-compliance statement.
  • Assess gaps in your Quality Management System (QMS) against the EU GMP Guide and its Annexes. U.S. cGMP and EU GMP overlap substantially but diverge in ways that routinely catch American facilities off guard, particularly around Qualified Person (QP) responsibilities and Annex-specific documentation.
  • Appoint or brief a QP or EU regulatory contact who can coordinate with the issuing NCA, manage batch release, and serve as the point of contact for inspection scheduling.

Pro Tip: During pre-inspection preparation, prioritize Chapter 4 (documentation and QMS) and Chapter 7 (contract manufacturing and transport) evidence first. Inspectors consistently probe these chapters early, and gaps there tend to cascade into broader observations.

Table of Contents

Who enforces EU GMP, and where are certificates recorded?

The institutional structure has three layers, and understanding which authority does what prevents wasted effort when preparing for inspection.

National Competent Authorities (NCAs) are the primary inspecting bodies. Each EU member state has one — the MHRA in the UK (now post-Brexit), ANSM in France, BfArM in Germany, AIFA in Italy, and so on. For a U.S. manufacturer, the relevant NCA is typically the one in the member state where the EU importer or Marketing Authorization Holder (MAH) is located. NCAs conduct on-site inspections, issue GMP certificates, and record non-compliance statements.

The European Medicines Agency (EMA) coordinates inspections for centrally authorized products and hosts the procedural guidance that NCAs follow. EMA does not itself issue certificates for most products, but its GMP oversight role means its guidance directly shapes what inspectors expect to see.

EudraGMDP is the public database where all of this becomes visible. You can search by site name, address, or authorization number to find current certificates, their scope, and any non-compliance entries. Checking a supplier's EudraGMDP listing is standard practice before batch release and during supplier qualification.

PIC/S (Pharmaceutical Inspection Co-operation Scheme) is a multilateral arrangement that harmonizes GMP standards across more than 50 participating authorities, including the U.S. FDA. PIC/S membership means inspection reports and findings are more readily shared, and in some cases, mutual reliance reduces the need for duplicate inspections of the same site.

Regulator / Body Primary Function What They Issue or Record
National Competent Authority (NCA) Conducts GMP inspections; issues certificates GMP certificates, non-compliance statements, manufacturing authorizations
European Medicines Agency (EMA) Coordinates inspections for centrally authorized products; publishes guidance Procedural guidelines, Q&As, inspection coordination
EudraGMDP EU public database GMP certificate listings, non-compliance entries, MIA records
PIC/S Harmonizes standards; facilitates inspection reliance Shared inspection reports, mutual-reliance frameworks

What does a GMP certificate actually mean?

A GMP certificate is the inspector's written conclusion that a manufacturing site was found compliant with EU GMP at the time of inspection. It is sometimes called a "Certificate of GMP Compliance" and is distinct from a manufacturing authorization (MIA), which is the legal permit to manufacture within the EEA.

Certificates come in a few forms. A full-scope certificate covers all dosage forms and operations at the site. A restricted-scope certificate covers only specific product types, manufacturing steps, or buildings — common for contract testing laboratories or sites with limited operations. A non-compliance statement is the inverse: a formal record that the site failed to meet EU GMP standards, which can block batch release and trigger regulatory action.

The procedural guideline on issuing and updating GMP certificates specifies that a certificate should be issued within 90 days of the inspection, provided the manufacturer is found compliant. Details must be entered into EudraGMDP within the same 90-day period. In practice, CAPA closure timelines can extend the process if critical or major observations require resolution before the certificate is issued.

A certificate is evidence, not a guarantee. QPs treat it as one input among several — alongside their own supplier audits, batch documentation review, and contractual arrangements — when making batch release decisions. For U.S. exporters, a current EU GMP certificate also supports WHO GMP certificate requests, which NCAs can issue separately when a manufacturing authorization exists.

How do you get EU GMP certified? Steps, timeline, and cost factors

The path from a U.S. cGMP-compliant facility to an EU GMP certificate is sequential. Skipping steps tends to surface as inspection observations.

Preparation steps

  1. Supplier qualification: — Compile qualification evidence and written contracts for all contract manufacturers and key suppliers per Chapter 7. EMA Q&As clarify that the MIA holder must have access to the full chain of contracts and accept those arrangements in writing.

Typical timeline

Phase Typical Duration
Gap assessment 4 weeks
Remediation and documentation Several months (scope-dependent)
Inspection scheduling 2–6 months (NCA backlog varies)
On-site inspection 2–5 days
CAPA closure (if observations) 4–12 weeks
Certificate issuance and EudraGMDP entry Up to 90 days post-inspection

Total elapsed time from gap assessment to certificate in hand for a U.S. site with meaningful remediation needs varies widely depending on the scope of work and scheduling circumstances. Scheduling backlogs built up during 2021–2024 due to pandemic-era inspection pauses, but returning to on-site inspections has normalized throughput since 2025.

Cost factors

Internal resource hours for documentation and training are usually the largest cost, followed by consultant or third-party audit fees for gap assessment and mock inspections. Facility or equipment remediation (CAPEX) varies enormously by site condition. Validation and analytical method documentation can add significant cost for complex products. Regulatory project management — coordinating between the site, the EU MAH, the QP, and the NCA — is a soft cost that many manufacturers underestimate.

Pro Tip: Engage your EU QP or regulatory consultant before the gap assessment, not after. A QP who knows the issuing NCA's inspection focus areas can calibrate your remediation priorities and prevent over-investment in areas inspectors rarely probe.

How does EU GMP differ from U.S. cGMP?

Both systems share the same underlying goal — consistent, safe, quality-assured manufacturing — but they diverge in structure, enforcement, and documentation expectations in ways that matter practically for U.S. firms. For a deeper look at how compliant hemp manufacturing intersects with these standards, Kingbuddha's regulatory guide covers the U.S. side in detail.

Dimension EU GMP U.S. cGMP (FDA)
Jurisdiction / applicability Any site supplying the EU market, regardless of location U.S. facilities and importers supplying the U.S. market
Documentary requirements EU GMP Guide + Annexes; PQS per Chapter 4; Chapter 7 contracts mandatory 21 CFR parts; QS regulation; less prescriptive on contract structure
Inspection scope / frequency NCA-led; risk-based frequency; EMA coordinates for centrally authorized products FDA-led; risk-based; foreign inspections conducted by CDER/CBER
Certificate meaning / legal effect GMP certificate = evidence of compliance at time of inspection; recorded in EudraGMDP No equivalent standalone certificate; FDA issues observations and warning letters
Recognition / mutual agreements PIC/S harmonization; bilateral MRAs with select countries; inspection reliance possible PIC/S member; MRAs with EU (limited scope); FDA may rely on EU inspection reports

The most common friction points for U.S. manufacturers are QP responsibilities (EU requires a named, qualified individual to certify every batch before EU release — FDA has no direct equivalent), Annex 1 sterile product expectations (more prescriptive than FDA guidance for many operations), and Chapter 7 contract documentation (EU inspectors expect written contracts with specific content that FDA does not mandate in the same form).

PIC/S membership by both the FDA and most EU NCAs means inspection reports can be shared, reducing the likelihood of a full re-inspection for a site already inspected by FDA. However, reliance is discretionary, and NCAs retain the right to inspect independently.

How do you maintain EU GMP status after certification?

Certification is a point-in-time conclusion. Maintaining it requires ongoing activity, and NCAs expect to see evidence of a living quality system, not a static one.

  • Chain-of-contracts management: — The MAH, MIA holder, and any contract manufacturers must maintain current written arrangements. EMA Q&A guidance is explicit that the MIA holder must assess and accept these arrangements in writing, and the QP must have access to the full contract chain.

The temporary certificate extensions granted during the COVID-19 public health emergency ended. The GMP/GDP Inspectors Working Group confirmed that automatic extensions were not continued beyond the end of 2024, so any site relying on an extended certificate should have already scheduled re-inspection.

Pre-inspection checklist: what to review in the final week

The week before an EU GMP inspection is not the time for remediation. It's the time to confirm that everything is accessible, current, and organized. Run through these checks by category.

Documentation

  • Batch records for the last 12 months are complete, filed, and retrievable within minutes.
  • Validation summary reports (process, cleaning, analytical methods) are current and indexed.
  • Deviation and CAPA logs are up to date, with closure dates and effectiveness checks documented.
  • Environmental monitoring reports are current, with trend summaries available.
  • Supplier qualification files, audit reports, and quality agreements are compiled and accessible.

Personnel

  • The QP is available on-site for the full inspection duration.
  • Training matrices are current for all staff in GMP-relevant roles.
  • SOPs are signed off and version-controlled; no staff are operating under superseded versions.
  • Key role responsibilities (QP, QA Manager, Production Manager) are documented and current.

Facilities

  • Equipment calibration certificates are current and on file.
  • Cleaning records for production areas are complete and within schedule.
  • Controlled area gowning procedures and signage are in place and current.
  • Environmental monitoring equipment is calibrated and operational.

Communication

  • Confirm the inspection schedule, scope, and inspector names with the NCA contact.
  • Brief all department heads on the inspection scope and their documentation responsibilities.
  • Designate a single point of contact to escort inspectors and manage document requests.

Pro Tip: Assign one person as the sole document runner during the inspection. When inspectors request a record, that person retrieves it. Multiple people pulling documents simultaneously creates confusion, delays, and the appearance of disorganization — none of which helps your case.

Key Takeaways

EU GMP certification is a regulator-issued confirmation of manufacturing site compliance, recorded in EudraGMDP, and required for any manufacturer supplying the EU market regardless of location.

Point Details
What EU GMP certification is An NCA-issued confirmation of GMP compliance at a manufacturing site, recorded in EudraGMDP within 90 days of inspection, with certificate details entered by the authority within the same timeframe.
Who issues and records it National competent authorities issue certificates; EMA coordinates for centrally authorized products; all entries are public in EudraGMDP.
Three immediate steps for U.S. manufacturers Verify EudraGMDP entries, conduct a gap assessment against the EU GMP Guide and Annexes, and appoint or brief a QP or EU regulatory contact.
Biggest pre-inspection risk Weak change control and incomplete batch records are the most frequently cited deficiencies — address these before scheduling an inspection.
Post-certification obligations Maintain internal audits, annual PQRs, current supplier agreements, and change control discipline; certificate extensions ended after 2024.

Why EU GMP compliance is worth the investment

The compliance burden is real. Gap assessments, remediation, validation updates, QP coordination — none of it is cheap or fast. But the framing of EU GMP as a cost center misses what it actually buys.

A current GMP certificate is market access. Without it, your EU importer cannot release batches, your MAH cannot fulfill supply obligations, and your product cannot legally reach patients. For U.S. manufacturers exporting to the EU, a non-compliance statement in EudraGMDP is not a paperwork problem — it's a supply chain event that can trigger product recalls, contract terminations, and reputational damage that takes years to repair.

The manufacturers who treat EU GMP as a quality investment rather than a regulatory hurdle tend to build systems that also reduce internal waste, batch failures, and customer complaints. That's not a coincidence. The documentation discipline that satisfies an EU inspector is the same discipline that catches a process drift before it becomes an OOS result.

For CBD and hemp-derived product manufacturers navigating compliance in the CBD space, the logic is identical: third-party testing, traceability, and documented quality systems aren't just regulatory checkboxes. They're the foundation of a product that consumers and regulators can trust. Kingbuddha's own approach — lab-tested, U.S.-sourced, transparently documented — reflects that same principle at the consumer product level.

Invest in the system once, maintain it consistently, and the certificate follows. Treat it as a one-time exercise, and you'll be back in remediation mode before the re-inspection arrives.

Useful sources and primary references

These are the primary authority sources for EU GMP rules, certificate procedures, and database verification. Each serves a distinct purpose.

Back to blog