The EU GMP certification process is the practical journey from defining the correct regulatory pathway to demonstrating that a pharmaceutical site, its systems, people, and quality controls can consistently support compliant manufacture. This guide is for regulatory affairs professionals, QA managers, engineering teams, and project owners preparing human medicinal product facilities for EU inspections. It explains ten connected steps, from gap analysis and remediation to inspection findings, CAPA closure, and certificate scope.
What is an EU GMP certificate?
An EU GMP certificate is a document issued by an EEA competent authority that records its conclusion that an inspected manufacturer complied with EU GMP requirements for the specific activities assessed during the inspection. It is not a quality award, a marketing authorization, or an approval of everything the site does. For manufacturers inside the EEA, it does not replace the manufacturing authorization that permits the operations themselves.
The certificate is a statement about a moment in time. EMA’s procedure on the issue and update of GMP certificates states that a certificate reflects the site’s status at the time of that inspection and should not be relied on once more than 3 years have elapsed, unless the issuing authority extends it. A certificate is not renewed. A new one is issued after the next inspection, if appropriate.
One practical consequence is often missed. The GMP/GDP Inspectors Working Group’s temporary COVID-era extension of certificate validity was prolonged to the end of 2024 and, per EMA, no longer applies from 2025. Any extension is now a case-by-case decision by the issuing authority. Certificates that sat comfortably during the backlog years are back on a normal re-inspection clock.
How does an EU GMP certificate differ from an authorization or a marketing authorization?
These five instruments are routinely conflated in supplier qualification and tender documents. They answer different questions.
| Instrument | What it is | What it answers | Where it lives |
|---|---|---|---|
| EU GMP requirements | The expected state of control, set out in EudraLex Volume 4 | What must the site achieve? | EudraLex Volume 4 |
| GMP inspection | An authority’s assessment of practice against those requirements | Does the site actually achieve it? | Inspection report |
| EU GMP certificate | The authority’s compliant conclusion for the inspected scope | Was this site compliant for these activities at that inspection? | EudraGMDP |
| Manufacturing/import authorization (MIA) | Permission to perform specified regulated operations in the EEA | May this site legally manufacture or import? | EudraGMDP |
| Marketing authorization (MA) | Approval of a medicinal product | May this product be placed on the market? | Product dossier |
A site can hold a valid certificate and still be the wrong site for a given product, because the certificate covers an inspected scope, not a catalog.
How do you verify an EU GMP certificate?
Verify it in EudraGMDP, the public EU database, rather than accepting a PDF supplied by a third party. Check site identity and address, issuing authority, inspection dates, certified manufacturing operations, dosage forms, testing activities, and the Restrictions field.
Then search the non-compliance module as well. EudraGMDP publishes statements of non-compliance alongside certificates, and a certificate record read without the current compliance picture is only half the file. Several authorities, including the Danish Medicines Agency, no longer issue paper certificates and instead point verifiers to the database as the authoritative record.
Which Requirements Does an EU GMP Certificate Confirm Compliance With?
An EU GMP certificate certifies against EudraLex Volume 4, the EU GMP guidelines, with the applicable chapters and annexes determined by product, process, facility, and operation. Two annexes carry most of the engineering weight.
Annex 15: Qualification and Validation
Annex 15 sets the lifecycle principles for qualifying and validating facilities, equipment, utilities, and processes. It requires that any planned change to facilities that may affect product quality be documented and assessed for impact on validated status.
Annex 1: Manufacture of Sterile Medicinal Products
Annex 1 (2022) governs sterile medicinal products and came into operation on 25 August 2023, except point 8.123, which applied from 25 August 2024. It requires a Contamination Control Strategy across the facility (clause 2.3) that defines all critical control points and assesses the effectiveness of the combined design, procedural, technical, and organizational controls.
One sentence in Annex 1 clause 2.2 determines more certification outcomes than any other line in Volume 4. It sets the order of priority for quality risk management: appropriate design of facility, equipment, and processes first, then well-designed procedures, and finally monitoring as the element that demonstrates the first two work. The clause closes with a statement inspectors quote back to sites regularly:
“Monitoring or testing alone does not give assurance of sterility.”
This hierarchy has a direct practical implication for EU GMP readiness: procedures and monitoring cannot compensate for a facility or system that is physically incapable of achieving the required state of control. A design-based deficiency requires an engineering response, followed by commissioning, qualification, and evidence that the corrected system performs consistently.
That principle guides the ten-step EU GMP certification process described below.
The EU GMP certification process in 10 steps
The EU GMP certification process is the sequence of regulatory, engineering, quality, and operational activities that takes a manufacturing site from pathway definition to a competent authority’s compliance conclusion for the inspected scope.
A GMP certificate is generally the outcome of an inspection rather than a document obtained through a standalone certification application. The process therefore begins by establishing why the site requires EU GMP verification, which authority may be responsible for oversight, and which products, facilities, and manufacturing activities may fall within the inspection scope.
Step 1: Define the regulatory pathway and inspection scope
Start by defining the product, dosage form, manufacturing activities, site location, intended EU market-access route, importer arrangements, and existing authorizations. These factors determine which GMP requirements apply and what the inspection is likely to cover.
There is no single certification application process for every non-EU manufacturer. A third-country site should establish how it connects to the relevant EU product application and manufacturing/import authorization holder. It should also identify the responsible supervisory authority, Qualified Person, and importer interfaces, as well as available inspection history, in line with EMA procedures for verifying the GMP status of third-country manufacturers.
Mutual recognition agreements may allow an EU authority to rely on another regulator’s inspection outcome. However, coverage varies by country, product, and activity. Where the relevant manufacturing operation falls outside that scope, the authority may still require an on-site inspection.
Step 2: Run a gap analysis against physical capability, not paperwork
An effective EU GMP gap analysis compares what the facility can physically achieve with what the intended operation requires. A document review can confirm that records exist, but it cannot show whether installed systems maintain the control strategy during routine production, full staffing, seasonal conditions, or foreseeable interventions.
Assess room adjacencies, zoning, airlocks, personnel and material flows, waste routes, maintenance access, and separation of incompatible activities against as-built conditions—not approved drawings alone. Trace how operators, components, samples, tools, waste, and maintenance personnel actually move through the facility.
A May 7, 2025, FDA warning letter to Excelvision Fareva illustrates this principle. Airflow visualization studies on an ISO 5 aseptic filling line failed to demonstrate unidirectional airflow. FDA requested an independent contamination-hazard assessment covering facility layout, personnel and material flows, equipment placement, ergonomics, and building-management-system deficiencies, followed by improvements to the aseptic lines and cleanroom design.
However, not every gap requires engineering remediation. Where the facility was designed to a current control strategy and the weakness is genuinely evident, a design-led response may over-scope the program and create unnecessary cost. A sound gap analysis must also be able to conclude that the physical facility is adequate.
Step 3: Classify each gap by the remediation it actually requires
Classify gaps before prioritizing them. A common and costly EU GMP readiness error is treating a physical capability failure as a procedural CAPA. This consumes time without correcting the underlying problem and can lead to the same finding at re-inspection.
| Gap type | Root cause | Correct remedy | Closure evidence |
|---|---|---|---|
| Procedural | Control is capable but poorly defined | SOP revision, training | Approved procedure, training records, and practice observation |
| Evidentiary | The system is capable, but evidence is missing or stale | Requalification | Executed protocol, data against predefined criteria |
| Physical | The installed design cannot achieve the intended performance | Engineering modification | Design change, commissioning, requalification, routine data |
| Systemic | PQS fails to detect or correct recurrence | Quality system remediation | Effectiveness data over time |
An FDA warning letter dated May 27, 2026, to Pharmathen International S.A. illustrates the risk of misclassification. After an inspection conducted from November 10 to 21, 2025, the site proposed additional training, procedure updates, and a gap assessment. FDA found the response inadequate because it did not address the root cause, the full scope of the deficiencies, or the required remediation of the aseptic processing operation.
The issue was not the wording of the response. Training and procedures were proposed for a facility unable to maintain its pressure cascade. Annex 1 clause 2.2 makes the principle clear: procedural controls cannot compensate for an inadequate facility or process design.
Step 4: Execute engineering modifications inside an operating facility
Physical remediation in a brownfield facility is not construction with a GMP checklist attached. It is a controlled change to a validated environment, often executed alongside ongoing operations. The regulatory obligations, therefore, extend beyond the build itself to include controlled reinstatement and return to service.
Annex 1 clause 4.32 requires requalification after remedial action is taken to correct an out-of-compliance facility condition. At a minimum, this may include cleanroom classification, final filter integrity testing, airflow volume measurement, verification of room pressure differences, and air velocity testing. The clause also identifies common requalification triggers, including interruptions to air movement, changes to cleanroom design or HVAC operating parameters, and major maintenance such as final filter replacement.
Annex 15 clauses 11.2 and 11.4 require changes to premises to be managed through written change control, with quality risk management used to determine the necessary requalification and validation effort before approval.
Annex 1 clause 5.3 also affects retrofit sequencing. Equipment, fittings, and services should be designed so that maintenance and repairs can be performed outside the cleanroom wherever practicable. Where work must occur inside and cleanliness cannot be maintained, restricted access, defined work procedures, and additional cleaning, disinfection, and environmental monitoring are required.
In practice, the shutdown window is often the binding constraint. Isolation boundaries, construction segregation, dust control, protected material routes, permits, contractor gowning, reinstatement, and post-work verification must all align with the return-to-service date. Modified systems cannot return to GMP use until recommissioning and requalification are complete. A retrofit that finishes construction on time but completes qualification late has not finished on time.
Step 5: Commission, qualify, and validate the remediated facility
Construction completion confirms that the system has been installed. It does not demonstrate that the system is fit for its intended GMP use.
Annex 15 defines the qualification sequence: the user requirements specification establishes the intended use (3.2); design qualification confirms that the design meets GMP requirements (3.3); installation qualification verifies the installation against approved drawings and specifications (3.9); operational qualification tests operating limits and worst-case conditions (3.11); and performance qualification demonstrates consistent performance under normal operating conditions, using production materials or suitable equivalents and relevant worst-case batch sizes (3.14).
For cleanrooms, Annex 1 clause 4.25 identifies qualification tests that may include filter integrity, airflow volume and velocity, pressure differentials, airflow direction and visualization, microbial contamination, temperature, humidity, recovery, and containment leak testing.
Two Annex 15 provisions are often misapplied. Clause 2.10 allows conditional progression to the next qualification stage when certain deviations or acceptance criteria remain unresolved, but only where a documented assessment confirms no significant impact on the next activity. It is not a mechanism for carrying unresolved punch-list items forward.
Clause 2.8 also requires that any result that fails the predefined acceptance criteria be recorded as a deviation and fully investigated. Revising the acceptance criterion after a failed test does not resolve the failure; it creates an inspection risk.
Step 6: Prove routine control, not project intent
A qualified facility must still demonstrate that it remains under control during routine operation. Inspectors assess what the site consistently does, not what the project documents intended it to do.
Annex 1 clause 4.16 requires critical air pressure differences to be continuously monitored and recorded. A warning system must immediately indicate any air-supply failure or reduction below established limits, while alarm delays must be assessed and justified within the Contamination Control Strategy.
A 2026 FDA warning letter to Pharmathen illustrates the consequences of inadequate monitoring. FDA found that aseptic filling rooms had lower pressure than adjacent rooms. The site also failed to routinely record differential pressure, temperature, and humidity because its monitoring devices displayed real-time values but could not store them. Without recorded data or alarm history, excursions occurring when operators were not watching the displays could not be detected or investigated.
This creates a significant evidence gap. The site cannot demonstrate the environmental conditions under which affected batches were manufactured, nor can it investigate excursions that were never recorded. A facility monitoring system is, therefore, essential evidence that the cleanroom maintained its required state of control.
Design weaknesses may also appear as operator behavior. In a February 24, 202,5 warning letter to Aspen Pharmacare Holdings Limited, the FDA described a large door to an ISO 7 area remaining open during operations, creating a risk that lower-quality air could enter the ISO 5 zone. It also found that non-viable particle-monitoring probes were not positioned in representative ISO 5 locations where products and primary components were exposed.
Although these findings appeared operational, both were linked to facility layout, monitoring design, and intervention planning. Routine behavior cannot compensate for controls that were not adequately designed.
Step 7: Run a Mock Inspection That Can Fail
A mock inspection should test the site’s actual state of control, not rehearse prepared answers. Apply four questions to each system:
- What does the procedure require?
- What do personnel actually do?
- What does the record show?
- What does the physical system demonstrate?
Any inconsistency between these four areas is a potential inspection thread. Follow it through supporting data, investigations, change control, training, and management oversight rather than treating it as an isolated issue.
Aseptic behavior should also be evaluated against airflow patterns, not only against SOP wording. In a September 17, 2025, warning letter to BRS Analytical Services, LLC, the FDA observed that operators were blocking unidirectional airflow by placing gloved hands and hooded heads directly over open, sterilized bottles. Although the operators had completed training, their behavior still created a contamination risk.
Annex 1 clause 7.18 recommends using airflow visualization studies in personnel training for this reason. Operators must understand how their movements affect first air and product protection, not simply memorize procedural instructions.
Inspection preparation time is limited. HPRA notes that manufacturers are generally notified four to six weeks before a planned inspection, with shorter notice possible for cause. That period may be enough to close minor procedural gaps, but it is not enough to correct significant facility or engineering deficiencies. This is why the physical capability assessment in Step 2 must be realistic.
Step 8: The inspection
An EU GMP inspection may assess the Pharmaceutical Quality System, premises, equipment, utilities, production, quality control, qualification, validation, documentation, data integrity, deviations, CAPA, change control, outsourced activities, personnel, and training. The scope depends on the purpose of the inspection, site history, product risk, and information already available to the authority. The applicable requirements across these areas are set out in EudraLex Volume 4.
The pre-inspection request list usually arrives with the notification. Before submitting it, reconcile layouts, equipment lists, process descriptions, validation status, major changes, and open quality events. Any contradiction between the submitted package and actual site conditions can shape the inspection agenda. HPRA confirms that the notification includes an initial list of pre-inspection requests for information and documentation, which must be provided in advance.
Inspectors follow evidence across systems. They may move from a physical condition to the related procedure, record, deviation, CAPA, and management decision. Manufacturers should therefore align responsibilities and facts across the site, the importer, the marketing authorization holder, and the Qualified Person. Conflicting accounts can create avoidable questions and weaken confidence in the site’s state of control.
Step 9: Close CAPAs with effectiveness evidence, not implementation evidence
Implementation evidence shows that an action was completed. Evidence of effectiveness shows that the action reduced recurrence risk during routine operation. Regulators evaluate whether the CAPA worked, not simply whether it was closed.
FDA cited Pharmathen under 21 CFR 211.192 for ineffective CAPA related to recurring sterility and media-fill failures over 5 years. The agency found that investigations attributed failures to operator error without examining the conditions that enabled those errors. It requested an independent review of CAPA adequacy across sterility failures, media-fill failures, and microbial deviations, including whether facility or process redesign was required.
The lesson is clear: repeated investigations that continue to blame operators may indicate a deeper failure in design, process, or quality system. A CAPA can be complete on paper and still fail to address the true root cause.
When the root cause is physical capability, an SOP-only CAPA is insufficient. Annex 1, clause 4.15, states that where airflow poses a contamination risk, corrective actions, such as design improvements, should be implemented.
Step 10: The outcome and the certificate
The competent authority evaluates the inspection record and the manufacturer’s responses before reaching a compliance conclusion. Where the inspected operations comply with EU GMP, the authority issues a certificate for the assessed scope and enters it in EudraGMDP. Where the manufacturer does not comply, the relevant non-compliance information may be entered instead.
EMA’s certificate procedure states that, where compliance is confirmed, the certificate should be issued within 90 days of the last day of the inspection. If an inspection is divided into several visits within a short period, the 90-day period begins after the final visit, and the manufacturer should be informed of this arrangement in advance.
Not every regulatory visit is intended to produce a GMP certificate. The 90-day period relates to the completion of the relevant inspection—not the date on which the manufacturer submits its CAPA plan or response.
How long does EU GMP certification take?
There is no standard timeline for EU GMP certification. The duration depends on regulatory pathway clarity, facility condition, remediation type, design and procurement lead times, shutdown availability, construction, qualification, validation, routine operating evidence, inspection scheduling, findings, and CAPA closure.
The gap classification established in Step 3 usually determines the critical path:
| Program type | Dominant constraint |
|---|---|
| Documentation and PQS improvement | Evidence generation and review cycles |
| Targeted requalification | Protocol execution and seasonal coverage |
| Limited engineering retrofit | Shutdown window availability |
| Major brownfield remediation | Design, long-lead procurement, shutdown sequencing, requalification |
| Greenfield development | Full design-to-qualification chain |
Two constraints are structural and cannot be compressed by adding people. Routine operating evidence accrues in calendar time because an inspector needs trends, not a first data point. And requalification after remedial action is not optional, so every physical fix carries a requalification tail that has to sit inside the schedule rather than after it.
Where certification programs lose time
EU GMP readiness programs commonly lose time when construction begins before user requirements are finalized, assessments focus on documentation rather than physical capability, qualification planning starts after design is frozen, long-lead items are ordered late, brownfield controls are inadequate, or inspection preparation begins before routine control can be demonstrated.
Many delays occur at the interfaces between engineering, QA, validation, regulatory, procurement, and operations. Engineering decisions affect qualification scope, while construction changes affect drawings, procedures, training, and validated status.
Common handoff failures include unapproved design changes, incomplete turnover packages, unclear system boundaries, unresolved punch items, late SOP development, missing training records, qualification protocols that do not reflect the final installation, and operational release before data review.
A shared document register, dependency plan, and closure standard can help identify these gaps earlier, when correction is less disruptive and less likely to affect the shutdown schedule.
How Pharmaco Global Supports EU GMP Readiness
EU GMP readiness programs often fail at the interfaces between engineering, validation, quality, and operations. A facility gap may be corrected, but the qualification package may not reflect the final design. A system may be requalified, but routine operating data may still be insufficient to demonstrate sustained control.
Pharmaco Global manages these interfaces through one coordinated readiness program, treating EudraLex Volume 4, Annex 1, and Annex 15 as execution requirements throughout the project.
What Pharmaco Global Delivers
Pharmaco Global supports EU GMP readiness through a coordinated set of services that align facility design, remediation, qualification, and inspection preparation into a single, controlled program.
Facility-led gap analysis:
Site walkdowns assess layout, segregation, personnel and material flows, HVAC, pressure relationships, and critical utilities against actual operating conditions. Gaps are classified by the remediation they require so that physical failures are not treated as procedural issues.
Engineering and brownfield remediation:
GMP risks are converted into user requirements, design criteria, specifications, and testing plans. Live-site modifications are planned around production windows, controlled isolation, construction segregation, and safe return to service.
Commissioning, qualification, and validation:
With validation partner Iqteran, the evidence chain is maintained from user requirements and design review through commissioning, IQ, OQ, PQ, and process or cleaning validation. Qualification records reflect the final as-built facility.
Mock inspection and readiness review:
The site’s actual state of control is tested by tracing observations through procedures, records, deviations, CAPA, change control, training, and management oversight.
This coordinated approach helps ensure that each design change is reflected consistently across drawings, qualification protocols, procedures, training records, and operating evidence.
Discuss Your Site’s Readiness Program
Pharmaco Global designs, remediates, and qualifies pharmaceutical facilities to EU GMP, FDA, and WHO requirements across greenfield developments and live-site retrofits.
To discuss a facility gap analysis, brownfield remediation program, or qualification-led inspection readiness, contact our team at Pharmaco Global.
FAQs
Is EU GMP certification required for manufacturers outside the EU?
Manufacturers outside the EU or EEA may need to demonstrate compliance with EU GMP when supplying medicinal products or active substances to the European market. The applicable pathway depends on the product, manufacturing activity, importer arrangements, inspection history, and mutual-recognition provisions.
Can a manufacturer apply directly for an EU GMP certificate?
Not usually through a standalone application. An EU or EEA competent authority issues a GMP certificate following an inspection conducted through the relevant regulatory pathway. The process is generally connected to manufacturing authorization, importation, marketing authorization, or supervisory-authority requirements.
Does an EU GMP certificate cover every activity at a site?
No. An EU GMP certificate covers only the manufacturing, packaging, testing, importation, dosage form, product, or site activities included within the inspected scope. Companies should review the certificate details rather than treating its existence as approval of every operation at the facility.
How long does EU GMP inspection readiness take?
There is no fixed timeline. Readiness depends on the facility’s condition, remediation complexity, design and procurement lead times, shutdown availability, qualification and validation requirements, routine operating evidence, inspection scheduling, and the time required to respond to findings and close CAPAs.
Does EU GMP Annex 1 apply to every pharmaceutical facility?
No. Annex 1 applies specifically to the manufacture of sterile medicinal products, although some contamination-control principles may be relevant to other operations. Each facility should determine which chapters and annexes of EudraLex Volume 4 apply to its products and activities.
Can SOP updates close facility and engineering GMP gaps?
Not when the underlying problem is physical or engineering-based. Procedures can clarify a suitable control, but they cannot correct inadequate segregation, unsuitable airflow, deficient utilities, inaccessible equipment, or a design that cannot consistently achieve its intended performance. Those gaps require technical remediation.
When should a manufacturer bring in an external engineering partner?
An external engineering partner should be engaged when gaps require facility modifications, utility upgrades, brownfield execution, qualification impact assessment, or multidisciplinary coordination. Early involvement helps translate GMP risks into controlled design requirements before procurement, construction, or validation decisions become difficult to reverse.
Where can an EU GMP certificate be verified?
EU GMP certificates can be verified through the public EudraGMDP database maintained by the European Medicines Agency. Review the manufacturer, site address, issuing authority, inspection dates, authorized activities, dosage forms, testing scope, restrictions, and any available statement of non-compliance.
