GMP, WHO-GMP, EU GMP, and US FDA Explained

Ask ten suppliers for proof of GMP Certification and you will get ten different documents back. One sends a state-issued certificate, another a database printout, a third a letter that expired two years ago.

None of them is necessarily wrong. GMP is not one certificate from one global body, but a set of manufacturing principles that different regulators enforce under different names.

That difference costs money. A certificate that satisfies a tender in Kenya can be useless for a filing in Germany. This guide covers what GMP requires, how WHO-GMP, EU GMP, US FDA cGMP, PIC/S and Schedule M relate, what document to ask for, and how to check it is real.

Quick answer: GMP (Good Manufacturing Practice) is a system of rules covering premises, equipment, personnel, documentation, validation and quality control that a pharmaceutical site must follow. There is no single global GMP certificate. WHO-aligned national authorities, EU inspectorates and the US FDA each assess sites under their own framework, site by site.

Table of Contents

• What GMP Certification Actually Means
• The Seven Principles Behind Every GMP System
• WHO-GMP: The Baseline for Many Import Markets
• EU GMP and EudraLex Volume 4
• US FDA cGMP: 21 CFR Parts 210 and 211
• PIC/S and India’s Schedule M
• GMP Certification Frameworks Compared
• What Document a Buyer Actually Receives
• How to Verify a GMP Certificate
• What a GMP Inspection Involves
• Observations, 483s and Non-Compliance Reports
• Which Standard Should You Ask For?
• Expert Tips
• Common Mistakes
• Frequently Asked Questions

What GMP Certification Actually Means

Good Manufacturing Practice is the set of rules that makes sure a medicine is produced consistently, to the quality its specification claims, in every batch.

You cannot test quality into a product. Twenty samples from a batch of two million tablets tell you about twenty samples, so GMP moves control upstream — building design, training, cleaning, recording, deviation handling.

There is no global GMP certificate

No worldwide authority issues a universal GMP Certification that every country recognises. What exists is a family of national and regional frameworks, built on the same principles but enforced by different inspectorates.

GMP status is site-and-scope specific

An approval covers a named site, at a named address, for named dosage forms or activities. A certificate covering oral solids at one plant says nothing about the sterile line at a second plant.

The Seven Principles Behind Every GMP System

Whichever framework you read, the same building blocks appear. The wording changes; the substance does not.

1. Pharmaceutical quality system. Named people responsible for change control, deviations, CAPA, risk management and product quality reviews — where quality assurance and quality control split into separate functions.

2. Premises. Layout that prevents mix-ups and cross-contamination: logical material flows, defined cleanliness grades, controlled air handling, segregation for beta-lactams or hormones.

3. Equipment. Qualified before use, cleaned to a validated procedure, calibrated on schedule, logged.

4. Documentation. If it is not written down, it did not happen. Batch records, SOPs and analytical records must be complete, contemporaneous, attributable and unaltered.

5. Personnel. Enough trained staff, written job descriptions, documented training, and hygiene rules people actually follow.

6. Validation and qualification. Process, cleaning, analytical method and computerised system validation, plus qualification of water and air systems.

7. Complaints, recalls and self-inspection. A complaint file, a tested recall procedure, and internal audits that find problems before an inspector does.

Data integrity is not a separate standard. It is documentation done properly, and it is now the most common source of serious findings.

WHO-GMP: The Baseline for Many Import Markets

WHO publishes GMP guidance for pharmaceutical products, and many national regulators adopt it more or less directly into their own rules. WHO itself does not inspect commercial factories or certify them.

The certificate comes from the national or state authority of the manufacturing country, confirming the site was inspected against WHO GMP requirements.

How it works in India

For an Indian plant, the State Licensing Authority usually issues the WHO-GMP certificate after a joint inspection, with a validity period printed on it.

CDSCO separately issues the Certificate of Pharmaceutical Product (CoPP) in WHO format. The CoPP is product-specific rather than site-wide, and it is what most import authorities in Africa, Asia, Latin America and the CIS actually ask for.

Registration dossiers in semi-regulated markets commonly require a CoPP plus a Free Sale Certificate. A WHO-GMP certificate alone is often not enough: it proves site status, while the CoPP ties a specific product to that site.

EU GMP and EudraLex Volume 4

EU requirements sit in EudraLex Volume 4, the European Commission’s GMP guidelines and the most precisely structured of the four frameworks.

Volume 4 has three parts plus annexes. Part I covers medicinal products, Part II covers active substances and follows ICH Q7, and Part III holds supporting documents such as the Site Master File.

The annexes carry much of the practical weight: Annex 1 for sterile manufacture, Annex 11 for computerised systems, Annex 15 for qualification and validation, Annex 16 for batch certification.

Who issues the certificate

Inspections are run by the national competent authority of an EEA member state, not by the EMA. After a satisfactory inspection, that authority issues a GMP certificate and uploads it to EudraGMDP, the European public database.

The Qualified Person requirement

No batch reaches the EU market without certification by a Qualified Person established in the EEA, who takes personal legal responsibility for it.

So your customer’s QP will scrutinise batch documentation closely and may audit your site before the first shipment. Our guide on how to import pharmaceuticals into Europe covers the wider process.

US FDA cGMP: 21 CFR Parts 210 and 211

The United States takes a different approach, and it confuses buyers more than any other framework, because its requirements are law rather than guidance.

21 CFR Part 210 sets general current Good Manufacturing Practice for manufacturing, processing, packing and holding drugs. 21 CFR Part 211 carries the detailed requirements for finished pharmaceuticals.

The “c” stands for current. Expectations move with the state of the art, so a control accepted a decade ago may be cited today with no change to the regulation text.

APIs are handled separately

For active substances, FDA applies ICH Q7 as guidance rather than Part 211 — the same technical baseline EU GMP Part II uses. An API site running a proper ICH Q7 system speaks a language both inspectorates understand.

FDA does not issue GMP certificates

This is the critical practical point. FDA does not hand out a certificate declaring a foreign site cGMP compliant.

What exists is establishment registration with an FEI number, the inspection itself, and the classification assigned afterwards. If a supplier sends a glossy “FDA GMP certificate”, ask what it actually is.

PIC/S and India’s Schedule M

Two more names appear constantly in supplier documentation, and neither certifies manufacturers.

PIC/S

The Pharmaceutical Inspection Co-operation Scheme is a network of national inspectorates, its members including EU authorities and the US FDA. It publishes the PIC/S GMP Guide, which closely mirrors EudraLex Volume 4.

Membership supports mutual reliance, so one member’s inspection report can reduce duplicate inspections elsewhere. But a site cannot be “PIC/S certified” — it can only be inspected by a member authority against the PIC/S guide, which is a different claim.

Schedule M

Schedule M of India’s Drugs and Cosmetics Rules sets the GMP requirements for premises and plant that every Indian manufacturing licence depends on.

The revised Schedule M moves closer to WHO GMP expectations, adding an explicit pharmaceutical quality system, quality risk management, product quality review and computerised system validation.

For a buyer, Schedule M is the licence-level floor for an Indian site. WHO-GMP, EU GMP or a successful FDA inspection sit above it.

GMP Certification Frameworks Compared

	WHO-GMP	EU GMP	US FDA cGMP	Schedule M (India)
Legal basis	WHO guidance adopted into national law	EudraLex Volume 4	21 CFR Parts 210 and 211	Drugs and Cosmetics Rules
Who inspects and issues	National or state authority; CoPP from the central authority	The inspecting EEA competent authority	FDA investigators; no certificate issued	State Licensing Authority / CDSCO
What the buyer receives	WHO-GMP certificate and product-specific CoPP	EU GMP certificate plus EudraGMDP entry	Registration, FEI number, EIR	Manufacturing licence
Scope	Site plus listed dosage forms	Site plus listed activities and dosage forms	Site plus registered products inspected	Site plus licensed categories
Typical validity	Often two to three years; read the printed dates	Commonly three years, tied to last inspection	No expiry; registration renewed annually	Licence renewal cycle
Public database	None global; verify with the issuer	EudraGMDP	FDA registration, classifications, warning letters, import alerts	None public
Generally accepted in	Africa, much of Asia, Latin America, CIS, tender markets	EEA and markets recognising EU inspections	United States; strong evidence elsewhere	India only; a prerequisite, not an export credential

These frameworks are not rungs on a single ladder. They answer different questions, and buyers in different markets need different answers.

What Document a Buyer Actually Receives

Here is what should land in your inbox, and what each item proves.

WHO-GMP certificate. Names the site, issuing authority, dosage form categories, inspection date and validity. Proves site status only.

Certificate of Pharmaceutical Product. Product-specific. States whether the product is authorised in the exporting country and whether the site complies with GMP.

EU GMP certificate. Carries a certificate number and scope of activities, and should be findable in EudraGMDP.

FDA establishment registration and FEI number. Confirms the site is registered. Registration is not approval, and claiming otherwise is a common exaggeration.

Establishment Inspection Report. Issued after an FDA inspection closes out. Suppliers often share the closeout letter instead, which is fine if the classification is clear.

Site Master File. Not a certificate, but the document that tells you most about a plant.

For the wider shipment paperwork, see our guide to pharmaceutical export documentation.

How to Verify a GMP Certificate

Never accept a certificate at face value. Verification takes minutes and prevents expensive problems later.

Step 1 — Read the four facts on its face. Site address, issuing authority, scope, and the issue and expiry dates. An address mismatch between certificate and invoice is the most common problem you will find.

Step 2 — Check the public database. For EU GMP, search EudraGMDP by manufacturer name, address or certificate number; non-compliance statements appear there too. For the US, use FDA’s registration, inspection classification, warning letter and import alert listings.

Step 3 — Go to the issuer when there is no database. WHO-GMP certificates and CoPPs cannot be checked globally. Contact the issuing authority, or ask for a recently issued original.

Step 4 — Match scope to product. A certificate listing “oral solid dosage forms” does not cover your ophthalmic solution. Compare line by line.

Step 5 — Confirm who manufactures. Traders sometimes present a certificate belonging to a plant they buy from. The site named on the certificate must match the certificate of analysis and the invoice. Our article on how to verify a pharmaceutical manufacturer goes deeper.

What a GMP Inspection Involves

Inspections may be pre-approval, routine surveillance, for-cause after a complaint, or triggered by a product application. Some are announced weeks ahead; others are not.

After an opening meeting that sets scope, inspectors walk the plant, following a product from goods-in through dispensing, manufacture, packing, QC and release.

They pull records and follow threads. One deviation report leads to the investigation, the CAPA, the operator’s training record, and the instrument audit trail behind the result. The QC laboratory draws heavy attention, because data integrity problems surface there first.

At the closing meeting findings are presented, and the site responds with a corrective action plan. What those findings are called depends on who inspected.

Observations, 483s and Non-Compliance Reports

These terms get used loosely in supplier conversations, and the differences matter.

Observations. Findings from any inspectorate, usually graded critical, major or other. A few “other” findings with a solid response is normal. Critical findings are not.

Form FDA 483. A list of objectionable conditions an investigator observed. Not a verdict and not a sanction. Most inspected sites receive observations eventually; severity and response quality are what count.

Inspection classification. FDA classifies an inspection as No Action Indicated, Voluntary Action Indicated or Official Action Indicated. OAI is the one that should stop a buyer.

Warning letter. Issued when FDA considers violations significant and the response inadequate. Public, site-specific, and often a precursor to import restrictions.

Import alert. Allows detention at the US border without physical examination. If your supplier’s site is listed for your product, US shipments are effectively blocked.

Statement of non-compliance with GMP. The EU equivalent, published in EudraGMDP. It can lead to withdrawal of the GMP certificate.

A 483 with routine observations is no reason to drop a supplier — ask for the response and evidence of closure. The other four belong on your supply risk register.

Which Standard Should You Ask For?

The useful question is not which GMP is best, but which one your destination market requires.

The EEA. EU GMP status verifiable in EudraGMDP, or an equivalent recognised under a mutual recognition arrangement, plus QP arrangements on the customer side.

The United States. A registered establishment, an acceptable inspection history, and a product covered by an approved application or an appropriate Drug Master File reference. Check import alerts first.

Africa, much of Asia, Latin America and the CIS. WHO-GMP plus a product-specific CoPP, often with a Free Sale Certificate and document legalisation.

Tenders and institutional buyers. Many specify WHO prequalification or a stringent regulatory authority. Read the tender text before assuming a WHO-GMP certificate is enough.

Supplying several regions? Choose sites whose GMP Certification scope already matches your largest markets rather than upgrading mid-contract. For who regulates what, see pharmaceutical regulatory authorities around the world.

Expert Tips

1. Ask for the Site Master File before the certificate. It tells you what the plant actually does, so you can judge whether the certified scope is realistic for your product.

1. Compare three documents side by side. GMP certificate, manufacturing licence and CoA should name the same site address. Mismatches usually mean an undisclosed third-party manufacturer.

1. Note the inspection date, not just the expiry date. A certificate valid until next year but based on a four-year-old inspection carries less assurance than it appears to.

1. Search your supplier in EudraGMDP even if they never claimed EU GMP. Non-compliance statements are published there too, and the search costs nothing.

1. Ask what changed since the last inspection. New lines or a change of ownership can push activities outside the certified scope without the certificate being withdrawn.

1. Request the response, not just the finding. A supplier who shares their 483 response and closure evidence usually has a functioning quality system.

Common Mistakes

1. Treating GMP Certification as one universal approval. The destination authority rejects the certificate mid-registration, and the dossier stalls for months.

1. Confusing FDA registration with FDA approval. Registration is a filing, not an endorsement. Marketing a product as “FDA approved” on that basis creates real regulatory exposure.

1. Ignoring the scope line. A tablet certificate is submitted as cover for an injectable, and the importing authority rejects the file on first review.

1. Accepting a scan without verification. Altered dates and edited scopes do circulate, and an unverified certificate can put a shipment on hold at the border.

1. Ordering a WHO-GMP certificate when the market needs a CoPP. The file still lacks the product-specific document, and the filing window closes.

1. Forgetting that GMP applies to the API too. The API site carries most of the quality risk, yet often goes unaudited. See what buyers should check before choosing an API supplier.

Frequently Asked Questions

Is there a single global GMP certificate?

No. No authority issues a universal GMP certificate that every country recognises. GMP is a set of principles each regulator writes into its own law and enforces through its own inspectorate. An EEA authority issues an EU GMP certificate. An Indian state authority may issue a WHO-GMP certificate. The US FDA issues none at all. An “international GMP certificate” from a private body has no regulatory standing.

What is the difference between GMP and cGMP?

They describe the same discipline. cGMP means current Good Manufacturing Practice, the term used in US regulation under 21 CFR Parts 210 and 211. The word “current” matters: compliance is judged against present-day technology and expectations, not against what was acceptable when the rule was written. A control considered adequate a decade ago can be cited as a deficiency today with no change to the regulatory text.

Who issues a WHO-GMP certificate?

WHO does not issue it. It comes from the national or state drug authority of the country where the site sits, confirming inspection against WHO GMP requirements. In India the State Licensing Authority typically issues it after a joint inspection, while CDSCO issues the product-specific Certificate of Pharmaceutical Product. With no global database available, verification means contacting the issuing authority or requesting a recently issued original.

How long is a GMP certificate valid?

It depends on the framework and the issuer. EU GMP certificates commonly run around three years and are tied to the last inspection date. WHO-GMP certificates carry a term printed on the document, often two to three years. FDA issues no certificate, so validity is the wrong concept there; establishment registration and the most recent inspection classification are what matter. Always read the dates printed on the document itself.

Does an FDA Form 483 mean the supplier is unsafe?

Not by itself. A Form 483 lists conditions an FDA investigator considered objectionable at the close of an inspection. It is an observation list, not a legal finding or a sanction, and most inspected sites receive observations eventually. Severity, pattern and response matter more. Ask for the written response and proof of closure. Warning letters, Official Action Indicated classifications and import alerts are the serious signals.

What is a CoPP and when do I need one?

A Certificate of Pharmaceutical Product is a WHO-format document issued by the regulatory authority of the exporting country. It is product-specific, and states whether the product is authorised for sale there and whether the manufacturing site complies with GMP. Many import authorities across Africa, Asia, Latin America and the CIS require it for registration. A site-level WHO-GMP certificate does not replace it.

Does GMP Certification apply to APIs as well as finished products?

Yes, under a different chapter. EU GMP covers active substances in Part II of EudraLex Volume 4, which follows ICH Q7. FDA applies ICH Q7 as guidance for APIs rather than 21 CFR Part 211, which addresses finished pharmaceuticals. A well-run API site therefore faces essentially the same technical expectations from either inspectorate. Evaluate the API site separately, because the formulation plant’s certification does not extend to it.

Which GMP standard should I ask my supplier for?

Ask for the one your destination market accepts. For the EEA, EU GMP status verifiable in EudraGMDP. For the United States, establishment registration, a clean recent inspection history, and no import alert covering your product. For much of Africa, Asia, Latin America and the CIS, WHO-GMP plus a product-specific CoPP. For tenders, read the document, since many specify WHO prequalification or a stringent regulatory authority.

Final Thoughts

GMP Certification is a question about a specific site, a specific scope and a specific date — not a badge a company either has or does not have.

Buyers who get this right match certificate scope to the product, verify in a public database where one exists, and check inspection outcomes rather than stopping at the certificate. That takes minutes per supplier and removes most of the surprises that stall shipments later.

Speak With Our Pharmaceutical Experts

Every destination market asks for a slightly different combination of certificates, and getting that combination wrong is what delays registrations.

If you want help identifying which GMP documentation your target market will require, contact our team to discuss your sourcing requirements.