Qualifying API Suppliers

For any licensed manufacturer or importer, robust API supplier qualification is the foundation of a defensible supply chain and a recurring focus of MHRA inspection. The active substance sets the quality, safety and efficacy ceiling for the finished product, so a weak or undocumented qualification process is one of the fastest ways to put a marketing authorisation, and patients, at risk. This guide sets out how a UK Qualified Person approaches qualifying active substance suppliers, from initial risk assessment through to ongoing oversight.

Why API supplier qualification matters

Under EU GMP Part II, the manufacturer of the medicinal product is responsible for ensuring active substances are produced in accordance with GMP for active substances, and the QP certifying the batch relies on that assurance every time they sign. The legal hooks are clear: EU GMP Chapter 5 requires the qualification and approval of suppliers of starting materials, and Chapter 7 governs how you manage and contract out activities. For importers, the picture also includes the written confirmation regime for active substances imported from third countries.

The practical consequence is that an API supplier is never simply "approved" because a sales team likes the price or the lead time. Approval must rest on documented evidence that the manufacturer can consistently produce material to the agreed specification under a credible quality system. If you cannot show an inspector that evidence, the supplier is not qualified, whatever your purchasing records say.

Start with a risk assessment under ICH Q9

A proportionate programme begins with quality risk management. ICH Q9 should drive how much scrutiny each active substance and each supplier receives, so that effort is concentrated where the patient risk is greatest rather than spread evenly across the vendor list.

When ranking active substances and their suppliers, weigh factors such as:

• The criticality of the active substance and its route of administration, for example a sterile injectable API versus a stable oral compound.
• The complexity of the synthesis and the number of steps performed by, or subcontracted from, the named manufacturer.
• The supplier's regulatory history, including any MHRA or comparable inspection outcomes, warning letters or recalls.
• Whether you are dealing with the original manufacturer, a different site, or a broker or distributor in the chain.

This ranking determines the depth of assessment and the audit frequency you can justify. It should be formally recorded and revisited, because risk is not static. A clear, defensible risk model is something our supplier management service helps quality teams build and maintain.

The core steps of API supplier qualification

A complete qualification dossier tells a coherent story: who makes the material, where, to what standard, and how you have verified it. The following steps form the backbone of a credible API supplier qualification process.

1. Map the supply chain to the real manufacturer

Establish exactly who manufactures the active substance and at which site, not merely who invoices you. Identify any brokers, traders or repackers in the chain and confirm each link, because the qualification obligation attaches to the actual manufacturing site, and distributors of active substances carry their own GDP responsibilities under the active substance guidelines.

2. Gather and assess documented evidence

Request and review the supplier's quality documentation before approval. Typically this includes the site's GMP certification or inspection status, the active substance specification and a representative certificate of analysis, the regulatory support file or relevant quality information, and a completed quality questionnaire. Compare the certificate of analysis against your own incoming testing to confirm the data can be trusted.

3. Audit on a risk basis

For higher-risk active substances, an on-site GMP audit of the manufacturer against EU GMP Part II is the expected standard, examining the quality system, data integrity to ALCOA+ principles, change control and the actual process flow. Lower-risk cases may justify a remote or paper assessment, but the rationale must be documented. Where audits reveal real-world improvement, our case studies illustrate how findings translate into stronger supply chains.

4. Put a quality or technical agreement in place

Under EU GMP Chapter 7, responsibilities between you and the supplier must be defined in a written agreement. This should cover specifications, change notification, deviation and out-of-specification handling, the right to audit, and how regulatory commitments are kept current.

Maintaining qualification: oversight, not a one-off event

Qualification is a lifecycle, not a certificate you file and forget. Once a supplier is approved, your quality management system under ICH Q10 must keep that status under continuous review. Change notifications need to be assessed for impact, incoming results trended, deviations and complaints fed back, and periodic re-audits scheduled on a risk basis.

An approved supplier list is only as good as the monitoring behind it. Status should change when the evidence changes, not stay fixed because a form was signed three years ago.

Tie supplier performance into your wider quality reviews, including the product quality review, so that adverse trends surface early. A supplier with an unresolved critical finding, repeated specification failures or undeclared manufacturing changes should have its approved status suspended until the issues are genuinely closed. This disciplined, closed-loop oversight is precisely what an MHRA inspector looks for when reviewing how you control outsourced activities and starting materials.

Key takeaways

Effective API supplier qualification is risk-based, evidence-led and continuously maintained. Anchor it in ICH Q9 and ICH Q10, hold suppliers to EU GMP Part II, verify rather than assume, and keep the approved list honest through ongoing oversight.

• Rank active substances and suppliers by patient risk before deciding how deeply to assess them.
• Trace the chain to the actual manufacturing site, not just the invoicing party.
• Base approval on documented evidence and, for higher-risk material, an on-site GMP audit.
• Define responsibilities in a written quality agreement and review status whenever the evidence shifts.

If you need experienced QPs to design your supplier qualification programme, audit active substance manufacturers, or strengthen your oversight ahead of inspection, explore our full range of consultancy services or get in touch with our team to discuss your requirements.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Part II — Active Substances (APIs)
• EU GMP Chapter 7 — Outsourced Activities
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.