Verifying GMP Certificates and EudraGMDP

For any quality team relying on a third-party manufacturer, importer or active substance supplier, GMP certificate verification is one of the most basic yet frequently mishandled controls. A certificate that looks impeccable on paper can be expired, withdrawn, or simply unrelated to the dosage form you are buying. Treating EudraGMDP as the authoritative source, rather than the PDF a supplier emails you, is the difference between a defensible supplier file and a finding waiting to happen.

Why a supplier's PDF is not evidence

It is still common for a contract giver to accept a scanned GMP certificate at face value and file it as qualification evidence. Under EU GMP Chapter 5 and the principles of ICH Q10, the contract giver remains accountable for the quality of materials and services it outsources, regardless of what the contract acceptor provides. A PDF tells you what the supplier wants you to see; it does not confirm the certificate is current, that the scope covers your product, or that no restrictions have since been imposed.

The practical risks are concrete. Certificates are routinely reissued after inspections, scopes are narrowed when a line is decommissioned, and statements of non-compliance can be published between your last audit and your next order. None of that is visible on a static document. The only reliable approach is to confirm the entry independently against the source database every time it matters.

What EudraGMDP actually holds

EudraGMDP is the European database of manufacturing and import authorisations, GMP and GDP certificates, and statements of non-compliance, maintained under the European Medicines Agency on behalf of the national competent authorities. For UK quality teams operating post-Brexit, it remains a primary reference for EU/EEA sites, while MHRA holds equivalent UK data; both should be used according to where the site sits and where the product is placed on the market.

The records you will rely on

• Manufacturing and Importation Authorisations (MIAs) — confirming a site is authorised for the relevant activities and dosage forms.
• GMP certificates — issued following a satisfactory inspection, with a defined scope and validity.
• GDP certificates — for wholesale distribution activities, underpinning your distribution chain assurance.
• Statements of Non-Compliance (SNC) — the records that should stop a qualification decision in its tracks.
• API registrations — for importers and distributors of active substances under the registration regime.

A practical GMP certificate verification workflow

Robust GMP certificate verification is a defined, repeatable procedure, not an ad hoc lookup. The following sequence works for incoming qualification and for periodic re-confirmation alike.

1. Locate the site, not just the company. Search by the exact manufacturing site address and authorisation number. Corporate groups operate multiple sites, and only the inspected site is covered by a given certificate.
2. Match the scope to your product. Confirm the certificate covers your specific dosage form, activity (manufacture, packaging, batch release, importation) and, where listed, the relevant operations. A sterile-product scope does not validate a solid-dose line.
3. Check validity and inspection dates. Note the inspection date and any stated validity. A certificate older than the usual inspection cycle, with no follow-up entry, warrants a question.
4. Search for statements of non-compliance. Always check the SNC records separately. A current SNC against a site is a clear stop signal pending qualified-person assessment.
5. Cross-reference against the manufacturing authorisation. The MIA should align with the certificate scope; mismatches are a meaningful red flag.
6. Record the evidence. Capture the database entry, the date checked and the name of the reviewer, in line with ALCOA+ expectations for the supplier file.

For active substances, remember that an EU GMP certificate for a finished-product manufacturer does not extend to its API suppliers. Each step in the chain is verified on its own merits, and importers carry specific written-confirmation and registration obligations.

Reading a certificate critically

Verification is judgement, not box-ticking. The most damaging errors are the plausible-looking ones, where a valid certificate is simply the wrong evidence for the decision in front of you.

Common pitfalls

• Scope drift. The certificate is genuine but covers a different dosage form or activity than the one you are sourcing.
• Site versus group confusion. A certificate for one plant in a multi-site organisation is filed against the wrong manufacturing location.
• Stale evidence. A certificate verified at onboarding is never re-checked, so a later restriction or SNC goes unnoticed.
• Translation and transcription. Authorisation numbers and addresses copied by hand introduce errors that break traceability.

If the certificate does not unambiguously cover the site, the activity and the product you are buying, it is not yet evidence — it is a question to resolve before approval.

Apply ICH Q9 quality risk management to weight your checks. A new sterile manufacturer or an unfamiliar API broker justifies deeper scrutiny and an on-site audit; a long-qualified, low-risk excipient supplier may need lighter periodic confirmation. The discipline is to document the rationale, so the level of assurance is defensible.

Embedding verification in your QMS

One-off checks do not survive audit. EudraGMDP verification belongs inside your supplier qualification and re-qualification procedures, with defined triggers, ownership and records, so that assurance is maintained across the lifecycle rather than captured once and forgotten.

• Define verification triggers: initial qualification, contract renewal, change notifications, adverse intelligence and a fixed periodic interval.
• Assign clear ownership between quality, procurement and the responsible QP, RP or RPi.
• Keep contemporaneous records of each check, aligned to ALCOA+, within the supplier file.
• Feed outcomes into your approved supplier list and your audit programme, so distribution and GDP controls stay connected to manufacturing assurance.

Done well, this turns a reactive scramble during inspection into a quietly reliable control. Our supplier and vendor management service helps quality teams build exactly this kind of risk-based qualification framework, and you can see how that works in practice across our case studies and wider consultancy services.

Key takeaways

Effective GMP certificate verification is independent, scoped to the product and site, and repeated across the relationship — never a single PDF filed and forgotten. Confirm every certificate against EudraGMDP or MHRA at source, check for statements of non-compliance, match scope to your activity and dosage form, and record each check in line with ALCOA+. Build those steps into your QMS so the assurance holds up under inspection rather than collapsing under it.

If you would like a senior QP to review or strengthen your supplier qualification and verification procedures, get in touch with our team for a practical, risk-based assessment.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Part II — Active Substances (APIs)
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.