cGMP Contract Manufacturing Requirements: A Pharma Buyer's Guide

When a contract manufacturer claims to be “cGMP compliant,” what does that actually mean for you as a buyer? cGMP contract manufacturing requirements are not a single document or a single inspection — they’re a layered set of US regulations, international guidelines, facility controls, documentation standards, and verification practices that together determine whether the API or intermediate sitting in your warehouse is fit for human use. This guide is built for procurement managers, quality directors, and regulatory affairs professionals who need to understand exactly what they’re buying and how to confirm it before the contract is signed.

We’ll walk through the regulatory framework, the eight operational requirements every buyer should verify on a site visit, the public records you can pull before you ever leave your desk, and the qualifying conversation that should happen before any cGMP manufacturing agreement is finalized.

What ‘cGMP’ Actually Means (and What It Doesn’t)

The “c” in cGMP stands for “current.” It’s not a brand or a tier — it’s the FDA’s signal that good manufacturing practice is a moving target, and that what was acceptable in 2008 may not be acceptable today. A facility that hasn’t updated its data integrity controls since the FDA’s 2018 guidance is, by definition, no longer current.

21 CFR Parts 210 and 211: The US Framework

The foundational US cGMP regulations live in 21 CFR Part 210 (general scope) and 21 CFR Part 211 (finished pharmaceuticals). Part 211 covers the operational reality: organization and personnel (Subpart B), buildings and facilities (Subpart C), equipment (Subpart D), control of components and product containers (Subpart E), production and process controls (Subpart F), packaging and labeling (Subpart G), holding and distribution (Subpart H), laboratory controls (Subpart I), records and reports (Subpart J), and returned and salvaged drug products (Subpart K).

If a contract manufacturer is producing a finished drug product or a critical drug substance for the US market, Parts 210 and 211 apply. Period. The FDA does not certify facilities under cGMP — there is no certificate. Compliance is demonstrated through inspection outcomes, internal records, and the absence of unresolved Form 483 observations.

ICH Q7: The International API GMP Standard

For active pharmaceutical ingredients specifically, the controlling document worldwide is ICH Q7, “Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients.” The FDA adopted ICH Q7 as guidance in 2001, and it’s the de facto API GMP standard for the US, EU, Japan, China, India, and most other regulated markets. ICH Q7 is more permissive than Part 211 in some respects (it allows graduated controls based on how close the step is to the final API) and stricter in others (it has explicit requirements for impurity profiling and reference standards).

A buyer purchasing API for a US-marketed drug should expect both Part 211 and ICH Q7 to be referenced in the quality agreement — Part 211 for the finished-dosage manufacturer, ICH Q7 for the API supplier. The intersection between them is where most quality agreement disputes happen.

Common Misconceptions: ISO 9001 Is Not GMP

The single most common buyer mistake we see is treating ISO 9001 certification as evidence of cGMP compliance. It isn’t. ISO 9001 is a quality management system standard — it tells you the facility has documented procedures and follows them. cGMP is a regulatory standard with specific technical requirements (environmental monitoring, validation, batch release, recall capability) that ISO 9001 does not address. A facility can be ISO 9001 certified and have never been inspected by the FDA. For pharmaceutical purchases, ISO 9001 is a hygiene factor; it is not a substitute for GMP. Our deeper take on the boundary line lives in our GMP vs Non-GMP chemical manufacturing comparison.

The Eight Core cGMP Requirements Buyers Must Verify

These are the operational pillars of cGMP contract manufacturing requirements. On a site visit, ask to see the artifact in parentheses — if the supplier can’t produce it within fifteen minutes, treat that as a finding.

1. Facility Design and Environmental Controls

cGMP-compliant facilities are designed for cleanability, separation of activities, and environmental control. Expect classified manufacturing areas (typically ISO 7 or ISO 8 for non-sterile API processing, ISO 5 for sterile fill-finish), unidirectional material and personnel flow, and HVAC systems that maintain pressure cascades to prevent cross-contamination. (Artifact: facility classification certificate, HVAC qualification protocol, last environmental monitoring trend report.)

2. Equipment Qualification (IQ/OQ/PQ)

Every piece of GMP equipment — reactors, dryers, mills, HPLC systems — must be qualified through Installation Qualification (does it match the design spec?), Operational Qualification (does it perform within parameters across its full operating range?), and Performance Qualification (does it consistently produce the intended output under real production conditions?). Without IQ/OQ/PQ documentation, the equipment cannot legally be used for GMP production. (Artifact: qualification protocols and reports for any equipment that will touch your batch.)

3. Raw Material Testing and Release

Incoming materials must be quarantined, sampled, tested against specifications, and formally released by Quality before use. The CoA from the supplier is not sufficient on its own — the receiving site must perform identity testing at minimum (typically by IR or NMR), and full testing for any material flagged in the supplier qualification program. This connects directly to the broader supplier qualification process you should be running on your own vendors.

4. Batch Records and Documentation Standards

The Master Batch Record is the manufacturing recipe. The Executed Batch Record is the live evidence of what actually happened during a specific production run — every weight, every time stamp, every signature, every deviation. Under cGMP, executed batch records must be reviewed and signed by Quality before release, and must be retained for at least one year past the product’s expiration date (or longer per local regulation). (Artifact: a redacted executed batch record from a recent campaign of similar chemistry.)

5. In-Process Controls and Sampling

Critical process parameters (CPPs) must be monitored during production, not just verified after. Expect in-process sampling at defined hold points, with acceptance criteria written into the batch record. If a buyer asks “what if the reaction stalls at 80% conversion?” and the answer is “we’d just hold and consult QA,” that’s a real cGMP answer. If the answer is “we push through to the next step,” that’s a finding waiting to happen.

6. Final Product Testing and CoA

Final release testing must follow validated analytical methods against approved specifications. The Certificate of Analysis you receive should reference the method (ideally USP, EP, JP, or an in-house method with a method validation report on file), report all results with units, and be signed by an authorized Quality representative. Any out-of-specification result must trigger an OOS investigation under 21 CFR 211.192. Our deep-dive on analytical testing methods for pharma buyers covers what each technique on a CoA actually proves.

7. Deviation and CAPA Systems

Deviations are inevitable. The cGMP question is not “do you have deviations?” — it’s “how do you handle them?” Expect a documented deviation system with categorization (minor, major, critical), root cause analysis for major/critical events, corrective and preventive actions (CAPA), and effectiveness checks. A supplier who claims zero deviations in the past year is not a careful operator — they’re a supplier with a paperwork problem.

8. Data Integrity and 21 CFR Part 11

Electronic records and signatures must comply with 21 CFR Part 11: audit trails enabled and reviewed, user-level access controls, no shared logins, no editable spreadsheets used for GMP-critical calculations, and validated systems for any software involved in batch release. Data integrity has been the single most-cited area in FDA warning letters since 2017. If the supplier’s HPLC software shows audit trails turned off, walk away.

How to Verify a Contract Manufacturer’s cGMP Status

Most cGMP verification work happens before you ever set foot in the facility. Public records and structured questionnaires will eliminate roughly half of the candidates on your shortlist.

FDA Inspection Database: How to Read Warning Letters

The FDA publishes inspection outcomes through three searchable databases that every buyer should bookmark. The Warning Letters database covers serious GMP failures with public correspondence. The Form 483 observation database covers inspection findings that did not escalate to a warning letter. The Drug Establishment Current Registration Site confirms a facility is registered with the FDA for the specific dosage form or API category you’re sourcing.

Reading a warning letter productively means looking past the headline. A 2022 warning for inadequate environmental monitoring at a sterile fill site is more relevant to a sterile injectable buyer than a 2019 warning for batch record review timing at the same site. Look at what was cited, when, whether the response was accepted, and whether subsequent inspections were clean.

Supplier Audit Checklist for cGMP Facilities

A practical on-site cGMP audit covers four blocks across one to two days: Quality Systems (procedures, change control, deviation handling, training), Manufacturing (facility tour, equipment, batch record walk-through), Laboratory (analytical method validation, OOS handling, reference standards), and Materials (warehouse, vendor management, sampling, retains). The output is a written report scored against your firm’s audit standard. Our pharmaceutical supplier qualification checklist for 2026 walks through the full evaluation framework if you’re building one from scratch.

Third-Party Audit Services vs. Internal Audit Teams

If your firm doesn’t have a qualified GMP audit team, third-party providers (Rephine, NSF, SGS, Eurofins) will run audits on your behalf and produce shared audit reports. Shared audits cost less than dedicated audits but give you less control over scope. For high-stakes API sourcing, a dedicated audit by your own team — supplemented by a third-party expert if needed — is the gold standard.

cGMP vs. Research-Grade: When Each Is Appropriate

Not every chemical needs to be made under cGMP. For early discovery, target identification, and pre-IND tox studies in non-regulatory species, research-grade material is appropriate and dramatically cheaper. cGMP becomes mandatory when material will be administered to humans (IND-enabling tox studies in regulatory species, Phase 1 onwards), used in a registered drug product, or supplied as a reference standard for a regulated method. The transition usually happens at the IND-enabling tox campaign — and that’s the inflection point where most procurement teams underestimate timeline and cost. Our look at scale-up challenges in custom synthesis covers the specific friction at this handoff.

Questions to Ask Before Signing a cGMP Manufacturing Agreement

Before the contract goes to legal, run a structured technical conversation with the supplier’s Head of Quality. The right answers sound boring; the wrong answers sound like sales pitches.

• “Can I see your last FDA inspection EIR or, if non-US, your last EMA / PMDA inspection report?” — They should provide a redacted version under NDA.
• “What is your current Quality Council escalation path for major deviations?” — Listen for a specific named role (VP Quality, not “the team”).
• “How do you handle technology transfer documentation for a new product?” — Expect a defined TT package: process description, analytical methods, validation status, equipment fit-gap analysis.
• “What is your release testing turnaround, and what slows it down?” — A vague answer (“usually a couple weeks”) signals an immature lab; a specific answer with bottlenecks named (“12 business days, mainly stability initiation”) signals an honest operator.
• “What’s your data integrity remediation history since the FDA’s 2018 guidance?” — They should be able to walk you through specific system upgrades and audit-trail policy changes.
• “Who signs the quality agreement on your side, and what’s their role?” — The QA signatory should not also be the commercial relationship owner.

If the supplier handles these well, move to a quality agreement, then a tech transfer kickoff. If they fumble, find another supplier. The cost of switching during qualification is small compared to the cost of switching after a regulatory finding.

When you’re ready to scope a project against these requirements, our team handles cGMP and non-cGMP work side-by-side and can match scope to phase — request a quote through our contact form and we’ll respond within 24 hours, or read more about our custom synthesis services for milligram-to-multi-ton cGMP capability.

Frequently Asked Questions

1. Does cGMP apply to API intermediates, or only the final API? ICH Q7 applies graduated cGMP controls starting from the introduction of the API starting material. Earlier intermediates are not strictly under GMP, but the supplier still needs documented controls for any step that could affect the final API quality. A clear “GMP starts here” line should be defined in the quality agreement.

2. What’s the difference between cGMP and GLP? GLP (Good Laboratory Practice, 21 CFR Part 58) governs nonclinical laboratory studies that support regulatory submissions — toxicology, pharmacokinetics, safety pharmacology. cGMP governs the manufacture of drug substances and drug products. They’re separate frameworks. A contract lab can be GLP-certified for tox studies and not GMP-capable for production.

3. How long does cGMP audit qualification typically take? For a new contract manufacturer, expect 8–16 weeks from the audit kickoff to a signed quality agreement, assuming a reasonably clean audit. Add another 6–12 weeks for tech transfer of a non-trivial process. Suppliers who promise faster timelines on a first qualification are usually skipping steps.

4. Can a non-US facility produce cGMP material for US-marketed drugs? Yes — most APIs for US-marketed drugs are made outside the US. The FDA inspects foreign facilities directly, and the requirements are identical. What changes is timing: foreign inspections happen on a different cadence, and a foreign inspection finding can take longer to resolve than a domestic one.

5. How do tariffs and supply chain disruption affect cGMP sourcing? Tariffs don’t change cGMP requirements, but they do change supplier economics — and a margin-squeezed supplier is a supplier with rising deviation rates. Our analysis of the tariff trap in global chemical sourcing digs into the second-order effects on quality.

6. What’s a Form 483 versus a warning letter? A Form 483 is the inspector’s list of observations issued at the close of an inspection — it’s not a final regulatory action. A warning letter is issued by FDA leadership after reviewing the 483 response and concluding that the issues are serious or unaddressed. Suppliers will sometimes describe a 483 as “no big deal” — that’s accurate only if the response was accepted and no warning letter followed.