Who controls the specification for a generic active ingredient—API manufacturer or the drug manufacturer?
For a generic medicine, the legal and quality responsibility for meeting the approved specification is shared, but it is not “owned” by only one party.
The drug (finished product) manufacturer is responsible for releasing a finished generic product that complies with the approved product specification and applicable Good Manufacturing Practice (GMP) requirements. That includes ensuring the active pharmaceutical ingredient (API) used in the drug is suitable and consistently meets its quality attributes.
The API manufacturer is responsible for producing the API to its own GMP-standard manufacturing and for ensuring the API meets the API specification (identity, purity, assay, impurities, physical/chemical characteristics, etc.) that the finished-product manufacturer relies on. This is typically controlled through a formal quality system (approved supplier qualification, quality agreements, testing/CoA review, change control, and audit/oversight).
In practice, the finished-product manufacturer is the one that must prove the finished product complies with its approval, while the API manufacturer must supply an API that meets the agreed specifications and GMP obligations.
What does the “quality agreement” usually require between API makers and drug makers?
Most supply chains rely on a quality agreement that defines responsibilities such as:
- Which tests are performed by the API manufacturer vs. the drug manufacturer (and how often).
- How certificates of analysis (CoAs) are reviewed and verified.
- How deviations and out-of-specification (OOS) results are investigated.
- How changes to the API manufacturing process are assessed and communicated (change control).
- Who handles regulatory documentation and how batches are released/verified.
Even if the API supplier tests more, the drug manufacturer still needs a robust system to ensure the incoming material consistently meets the agreed requirements.
Does a generic company have to test the API themselves?
Sometimes they do, sometimes they do not fully replicate testing. Typically, the finished-product manufacturer:
- Reviews the API manufacturer’s CoA and testing data.
- Performs at least some incoming testing and/or identity verification based on risk.
- Uses validation/verification strategies aligned to GMP and the approved quality approach.
The key point is that the finished-product manufacturer cannot “delegate away” responsibility for compliance and release decisions.
What regulators generally expect for API specification control
Regulators expect that:
- The API specification used in the approved dossier is met.
- The finished-product manufacturer has an effective pharmaceutical quality system that covers supplier qualification and ongoing control of incoming materials.
- Contracting and outsourcing do not remove the finished-product manufacturer’s accountability for product quality.
So, the API manufacturer controls API production quality; the drug manufacturer controls finished product compliance and release, using supplier controls to ensure API specs are met.
Is there a specific rule or standard you’re referring to?
Responsibilities depend on the jurisdiction and framework (for example, FDA vs. EMA/EEA rules, and whether the product is approved via ANDA, EU generic pathways, etc.). If you tell me the country/region and whether you mean specification in the regulatory dossier or GMP control of manufacturing batches, I can map the responsibility more precisely.