By the PharmaTradz BD Team. Updated October 2026.
Almost every contract development and manufacturing organisation (CDMO) says it meets US FDA, EU-GMP and WHO-GMP standards. Some do. Some met them once, at a single site, for a single product line. A few are relying on certificates that have expired or never applied to the plant you are being offered.
This guide explains what each standard requires, who enforces it, what a compliant CDMO can actually show you, and how to check the claims yourself before you sign a supply or development agreement.
Three standards, one goal
All three frameworks share the same aim: every batch should be made the same way, to the same quality, with records that prove it. The differences lie in who inspects, how often, what happens when things go wrong, and which markets accept the result.
US FDA cGMP
The legal basis for finished drugs is 21 CFR Parts 210 and 211, with ICH Q7 applied to active pharmaceutical ingredients. The FDA inspects sites in the United States and abroad.
- Pre-approval inspections check that a site can make the product described in a new drug application or abbreviated application, and that the data submitted are genuine.
- Surveillance inspections check ongoing compliance at sites already supplying the US market.
- Form FDA 483 lists the investigator's observations at the end of an inspection. It is not a final finding, but a buyer should always ask to see it and the firm's response.
- Warning letters follow when the agency considers violations significant. They are published.
- Import alerts allow the FDA to detain products from a site without physical examination. A site on an import alert cannot reliably ship to the US.
Each inspection is classified as No Action Indicated (NAI), Voluntary Action Indicated (VAI) or Official Action Indicated (OAI). OAI is the one to worry about.
EU-GMP
EU-GMP is set out in EudraLex Volume 4: Part I for medicinal products, Part II for active substances, and a set of annexes covering topics such as sterile manufacture, computerised systems and qualification. There is no single EU inspector. National competent authorities inspect on behalf of the whole network, and their findings are shared.
- A site making or importing medicines in the EU needs a manufacturing and importation authorisation (MIA).
- Every batch released to the EU market must be certified by a Qualified Person (QP), who is personally accountable.
- Sites outside the EU are inspected by an EU authority, or covered by a mutual recognition agreement, before their products can be released.
- GMP certificates and statements of non-compliance are published in EudraGMDP, the EU's public database.
The revised Annex 1 on sterile manufacture has applied since August 2023. Revised drafts of Chapter 4 (documentation) and Annex 11 (computerised systems), together with a new Annex 22 on artificial intelligence, were published for consultation in 2025. Check the European Commission's GMP pages for their current status before you build them into a quality agreement.
WHO-GMP
The WHO publishes GMP guidelines in its Technical Report Series, but it does not license factories. National regulators adopt the guidelines and issue WHO-GMP certificates under their own law. Quality therefore depends heavily on the issuing authority.
The exception is WHO prequalification. Here, WHO assesses product dossiers and inspects manufacturing sites itself, mainly for medicines and vaccines bought by UN agencies and global health programmes. Prequalified products and inspected sites are listed publicly.
Where PIC/S fits
The Pharmaceutical Inspection Co-operation Scheme (PIC/S) is a network of regulators that use a GMP guide closely aligned with EU-GMP and train inspectors to a common standard. A certificate from a PIC/S member authority usually carries more weight than one from a non-member. Membership is listed on the PIC/S website.
Side-by-side comparison
| Point | US FDA cGMP | EU-GMP | WHO-GMP |
|---|---|---|---|
| Legal basis | 21 CFR 210/211; ICH Q7 for APIs | EudraLex Volume 4 and annexes | WHO Technical Report Series, adopted by national law |
| Who inspects | FDA investigators | National competent authorities of EU and EEA states | National regulator; WHO itself for prequalification |
| Key outputs | Form 483, classification, warning letter, import alert | MIA, GMP certificate, non-compliance statement | WHO-GMP certificate or CoPP from national authority |
| Batch release | Manufacturer's quality unit | Qualified Person certification | Per national rules |
| Public check | FDA Data Dashboard, warning letter and import alert pages | EudraGMDP | Issuing authority; WHO prequalification lists |
| Main markets | United States | EU, EEA and many reliance markets | Tenders, emerging markets, global health supply |
For a wider view of which certificates matter in which situations, see our guide to supplier certifications that actually matter.
What a compliant CDMO actually shows you
A certificate tells you a site passed an inspection on a given date. The quality system tells you whether it still works. Ask to see evidence in these areas.
Data integrity
Records should meet ALCOA+: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. Ask how audit trails are reviewed, who holds administrator rights on laboratory systems, and how deleted or reprocessed chromatography data are handled.
Quality system and validation
- A pharmaceutical quality system aligned with ICH Q10, with regular management review.
- Process validation for each commercial product, and a lifecycle approach to keeping it current.
- Qualified equipment, utilities and cleaning procedures, with cleaning limits based on toxicology.
- A stability programme run to ICH Q1 conditions, including ongoing stability for marketed batches.
Change control, deviations and CAPA
Ask for a sample of recent deviations and the corrective and preventive actions (CAPA) that followed. Good sites close actions on time and check that they worked. Repeat deviations on the same step suggest the root cause was never found.
Supplier qualification
A CDMO is only as reliable as its own suppliers. Ask how API and excipient vendors are approved, audited and re-evaluated, and whether any are single-source.
Sterile products and nitrosamines
For injectables, ask for the site's contamination control strategy under Annex 1, recent media fill results and environmental monitoring trends. Our guide to sterile injectable CDMOs covers this in more depth.
For every product, ask for the nitrosamine risk assessment and any confirmatory testing. Regulators in the US and EU expect these to be in place, and gaps can hold up approvals.
How to verify a CDMO's claims
Do not rely on a PDF sent by email. Check primary sources.
- FDA Data Dashboard. Search the site name for inspection classifications and compliance actions. The FDA's Inspection Classification Database is accessed through it.
- FDA warning letters page. Search by firm name and look at the date and subject.
- FDA import alerts. Check whether the site appears on a drug-related import alert, including the red list attached to each alert.
- EudraGMDP. Confirm the GMP certificate number, the site address, the dosage forms covered and the date. Search for non-compliance statements as well.
- WHO prequalification lists. For tender products, confirm the product and site appear on the current list.
- Issuing authority. For national WHO-GMP certificates, contact the authority or check its online register to confirm the certificate is genuine.
Always match the exact site address, not just the company name. Many groups run several plants with very different inspection histories. Our article on checking whether a WHO-GMP certificate is genuine walks through the steps.
Red flags
- The certificate covers a different site, address or dosage form from the one quoted.
- The certificate has expired, or the last inspection was many years ago.
- The CDMO will not share its most recent Form 483 or inspection report summary.
- An OAI classification, a recent warning letter or an import alert, with no clear remediation story.
- Audit trails switched off, shared logins or a reluctance to show raw data.
- A prospective client is not allowed to audit before signing.
- Prices well below the market with no clear explanation of where the savings come from.
How to run a remote and on-site audit
Remote audit
A remote audit is a useful first filter. It costs less and can be arranged quickly.
- Send a detailed questionnaire and request the site master file in advance.
- Ask for live screen sharing of the document management and laboratory systems, not just exported reports.
- Use a camera walk-through of the warehouse, production and quality control areas.
- Review recent deviations, CAPA, change controls and complaints.
On-site audit
For a commercial supply relationship, an on-site audit remains the stronger option.
- Follow one batch from material receipt to release and check that the records match.
- Talk to operators and analysts, not just quality managers.
- Look at what is not on the agenda: stores, waste handling, maintenance logs.
- Agree findings in writing and set dates for the response.
After a successful audit, put the expectations into a written quality agreement that sets out who is responsible for what, including release, change notification and audit rights. If you are still choosing between service models, our explainer on CRO, CDMO and CMO differences may help.
How we can help
Our marketplace connects buyers with contract manufacturers across many markets. You can submit a single request and compare responses from sites that have shared their regulatory status, dosage forms and capacity.
Our supplier verification service checks certificates against public databases and flags gaps before you commit. When you are ready, send an RFQ with your product, target market and volume.
Frequently Asked Questions(FAQs)
Is an FDA-inspected site automatically EU-GMP compliant?
No. The two systems overlap a great deal, but the EU requires its own GMP certificate or coverage under a mutual recognition agreement, and every batch must be certified by a Qualified Person. Check EudraGMDP for the specific site.
What does a Form 483 mean for a buyer?
It lists observations an FDA investigator made during an inspection. It is not a final ruling, but it shows where the site had problems. Ask for the 483 and the firm's response, then check whether a warning letter followed.
Is a WHO-GMP certificate the same in every country?
No. National regulators issue WHO-GMP certificates under their own law, so the strength of the inspection behind them varies. Certificates from PIC/S member authorities, or sites inspected for WHO prequalification, generally carry more weight.
How do I check whether a CDMO is on an FDA import alert?
Search the FDA import alerts pages by firm name and review the red list attached to each drug-related alert. Match the exact site address, as groups often run several plants.
Does the revised Annex 1 apply to non-sterile products?
Annex 1 covers sterile products. Some of its principles, such as contamination control, are used as good practice elsewhere, but the formal requirements apply to sterile manufacture.
Should I always do an on-site audit?
For commercial supply, yes, where possible. A remote audit is a sensible first step to shortlist sites, but walking the floor and tracing a full batch record gives a much clearer picture.
