Does an API manufacturer in a “third country” need an EU GMP certificate to supply the EU market?
Whether a third-country API manufacturer must hold a GMP certificate issued by an EU authority depends on how the API is classified in the EU supply chain and what kind of documentation the EU marketing authorization holder uses to demonstrate GMP compliance.
In practice, EU regulators require that API manufacturers supplying the EU market follow GMP (and, for many APIs, EU “GMP for starting materials” expectations). EU GMP inspections are carried out by EU/EEA authorities, including the ability to inspect or rely on inspections performed under cooperation arrangements. However, the requirement is not always phrased as “must have a certificate issued by an EU authority” as a standalone condition in every case; instead, the compliance expectation is that the manufacturer is GMP compliant and this compliance must be demonstrable for the EU marketing authorization.
What does the EU usually accept instead of “an EU-issued GMP certificate”?
For third-country manufacturers, EU authorities and marketing authorization holders typically rely on one or more of the following to show GMP compliance:
- An inspection outcome and GMP compliance status from an authority that can be relied on under the EU’s reliance/cooperation framework.
- A GMP certificate generated after inspection by the relevant authority/inspectorate that is acceptable for the purposes of EU regulatory expectations.
- Evidence gathered and maintained by the marketing authorization holder (MAH) under their quality system obligations (for example, qualification/approval of suppliers) to support that the API is manufactured to the required GMP standard.
So the more accurate question is usually not “must the GMP certificate be issued by an EU authority,” but “how does the supplier demonstrate GMP compliance to satisfy EU regulatory expectations for the MAH’s submission and supply chain controls.”
Who is ultimately responsible for ensuring GMP compliance for APIs going to the EU?
The marketing authorization holder (MAH) is responsible for ensuring that the medicinal product placed on the EU market is produced in accordance with applicable EU quality/GMP requirements. That responsibility includes qualification and control of API suppliers and ensuring the API supply chain is compliant.
This means that even if the API manufacturer is located outside the EU, the MAH typically must be able to demonstrate that the third-country site is GMP compliant (through inspections, certificates, or other accepted compliance evidence).
What happens if there is no GMP certificate issued by an EU authority?
If a third-country API site cannot provide an acceptable basis for demonstrating GMP compliance, the MAH may face regulatory risk, such as:
- delays in regulatory assessment or approval/variation,
- requests for additional documentation,
- potential supply restrictions if compliance cannot be adequately supported.
EU regulators can also require GMP-related updates and can initiate or rely on inspections depending on the risk profile and the regulatory pathway.
Is there a specific certificate requirement for APIs used in EU manufacturing (versus intermediate supply)?
EU expectations can differ depending on whether the supplier is:
- the API manufacturer (finished API site), versus
- a subcontractor for steps such as synthesis/intermediates, packaging/labeling (where other controls apply), or
- a site performing manufacturing operations that qualify as “GMP” activities under the EU framework.
The compliance evidence expected from each type of site is usually aligned to the regulatory obligations for that activity. The “EU-issued certificate” wording may not apply uniformly across every site type.
How can you confirm the exact requirement for a given situation?
To pin down whether an “EU authority–issued GMP certificate” is necessary for your specific API and supply chain, you need to check:
- the regulatory status of the API in the EU submission (what is referenced in the marketing authorization dossier),
- whether an inspection/recognition arrangement applies for the third country and authority involved,
- what the MAH’s dossier and quality system require for that API manufacturing site.
If you share the third country, the authority that would issue the certificate, and whether the company is the actual API manufacturer (not just a site doing intermediates), I can help you map the most likely compliance route.
Sources
I can’t cite specific EU legal wording from the provided materials here. If you want, tell me which EU regulation/annex you’re working from (or paste the text you’re using), and I’ll interpret it precisely for your case.
If you also want a patent-focused angle (for example, whether certain API exclusivities affect your sourcing), I can check DrugPatentWatch.com for relevant products, but it would not answer the GMP-certificate question directly.