Changing a Supplier Under GMP: What Chapters 5 and 7 Require Before the First Order

In purchasing, a supplier change looks like a question of terms. In the inspection report it appears later under different headings: supplier qualification, change management, testing of starting materials. The EU GMP Guide barely knows the word purchasing; it knows procurement as part of the pharmaceutical quality system.

This article reads the provisions that apply, at the text: Chapter 1.4 and Chapter 5 of the Guide in the version in operation since March 1, 2015, Chapter 7 in the version of January 31, 2013, Article 46 of Directive 2001/83/EC and Article 12 of Directive (EU) 2017/1572, plus ICH Q10 and the US parallel in 21 CFR 211.84.

Where procurement sits in the Guide

Chapter 1 describes what a pharmaceutical quality system has to ensure, and it names procurement twice. Under 1.4 (vi), arrangements have to be made "for the manufacture, supply and use of the correct starting and packaging materials, the selection and monitoring of suppliers and for verifying that each delivery is from the approved supply chain". Under 1.4 (vii), processes have to assure the management of outsourced activities.

Two more items on the same list carry the supplier change. 1.4 (xii) requires the prospective evaluation of planned changes and their approval before implementation, "taking into account regulatory notification and approval where required". 1.4 (xiii) requires an evaluation after implementation to confirm that the quality objectives were achieved and that there was no unintended effect on product quality.

The detail is in Chapter 5 under the heading "Starting materials", paragraphs 5.27 to 5.36. The cover sheet of the version in operation since March 1, 2015 gives the reason for the change: sections 27 to 30 were extended to reflect the legal obligation of holders of a manufacturing license to ensure that active substances are produced in accordance with GMP, including supply chain traceability.

The legal obligation behind it is Article 46(f) of Directive 2001/83/EC. The holder of the manufacturing license may only use active substances manufactured under GMP and distributed under GDP, and has to verify this by conducting audits at the manufacturing and distribution sites of the manufacturers and distributors of active substances. The audit there is the prescribed method of verification, not a recommendation.

The same point requires a formalized risk assessment for excipients, through which the manufacturer ascertains which good manufacturing practice is appropriate for the excipient in question. Point (h) obliges the holder to check that active substance manufacturers, importers and distributors are registered; point (i), to verify the authenticity and quality of active substances and excipients.

What 5.27 to 5.30 require of the supplier base

5.27 puts the obligation in one sentence: "The selection, qualification, approval and maintenance of suppliers of starting materials, together with their purchase and acceptance, should be documented as part of the pharmaceutical quality system." The level of supervision follows the risk of the individual material, measured by source, manufacturing process, supply chain complexity and final use in the medicinal product.

Two clauses of 5.27 are overlooked in daily work. The supporting evidence for each approval of a supplier and material has to be maintained, and the staff involved need "a current knowledge of the suppliers, the supply chain and the associated risks". A supplier base whose assessments are older than the last restructuring at the supplier no longer meets the second criterion.

The last sentence of 5.27 sets the direction for purchasing: "Where possible, starting materials should be purchased directly from the manufacturer of the starting material." Whoever buys through a distributor needs a reason that is recorded in the quality system and a supply chain documented back to the manufacturer.

5.28 requires the quality requirements to be discussed and agreed with the supplier. Production, testing and control, handling, labeling, packaging, distribution, complaints, recalls and rejection "should be documented in a formal quality agreement or specification". The text allows either instrument, quality agreement or specification; which one is appropriate follows from the risk ranking under 5.27.

For active substances, 5.29 writes the audits from Article 46(f) into the Guide. The supply chain has to be made traceable from the active substance starting materials to the finished medicinal product, its risks formally assessed and periodically verified. Audits take place at manufacturers and distributors; the report "should fully reflect what was done and seen on the audit with any deficiencies clearly identified".

Follow-up audits run "at intervals defined by the quality risk management process". The Guide names no cycle; it requires that the cycle follow from the risk assessment and be justified. An audit plan that visits every supplier at the same interval lacks exactly that justification.

For excipients, 5.29 refers to the Commission Guidelines 2015/C 95/02 of March 19, 2015. They require a risk assessment per excipient and manufacturer that classifies the substance, for example as low, medium or high risk, anchors the assessment in the quality system and keeps the documentation on site for review by GMP inspectors. For authorized medicinal products it had to be carried out by March 21, 2016.

5.30 closes the chain at goods receipt. Each delivery is checked for the integrity of the containers and for "correspondence between the delivery note, the purchase order, the supplier's labels and approved manufacturer and supplier information maintained by the medicinal product manufacturer". A supplier change decided in purchasing and not carried into the quality system shows up here, provided the list of approved manufacturers is maintained. If it is not, the change does not show up.

Reduced testing: why the change resets the history

5.35 states the responsibility: the manufacturer of the finished product is responsible for testing starting materials as described in the authorization dossier. It may use partial or full test results from the approved starting material manufacturer, "but must, as a minimum, perform identification testing of each batch according to Annex 8". Identity testing of every batch therefore stays with the medicinal product manufacturer in every case.

5.36 names five conditions under which the remaining testing may rely on the supplier. Distribution controls have to ensure that the test results still apply to the material delivered. The testing site has to be audited at risk-based intervals. The certificate of analysis has to be signed by a designated person with appropriate qualifications and experience.

The fourth condition carries the core of this article. The medicinal product manufacturer needs "appropriate experience in dealing with the starting material manufacturer (including experience via a supplier) including assessment of batches previously received and the history of compliance before reducing in-house testing". Experience and history refer to the specific manufacturer. A new supplier does not bring them along, even if the old one had them.

The fifth condition runs for as long as testing is reduced: at risk-based intervals, a full analysis is performed and compared with the supplier's certificate. If it shows a discrepancy, an investigation follows, and "the acceptance of certificates of analysis from the material manufacturer or supplier should be discontinued until these measures are completed".

For the supplier change this means: with the new supplier, testing starts at the scope of the dossier, and reduced testing becomes possible again only once audit, certificate practice and batch history exist for that supplier. The same paragraph requires that "any significant change in the manufacturing or testing processes" be considered. A manufacturer who changes its process is, for 5.36 (iv), to some extent a new manufacturer.

The US rule runs in parallel. Under 21 CFR 211.84(d)(2), a report of analysis from the supplier may be accepted in place of the manufacturer's own testing, "provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier's analyses through appropriate validation of the supplier's test results at appropriate intervals". 211.84(b) also sizes the sample by "the past quality history of the supplier".

Chapter 7: the contract before anything is outsourced

Since January 31, 2013, Chapter 7 has carried the title "Outsourced Activities" because, according to its cover sheet, it is meant to cover all outsourced GMP activities beyond contract manufacture and contract analysis. The principle requires every such activity to be "appropriately defined, agreed and controlled", and: "There must be a written Contract between the Contract Giver and the Contract Acceptor which clearly establishes the duties of each party."

The duties of the contract giver are in 7.4 to 7.8. Its quality system covers the control and review of all outsourced activities; it is "ultimately responsible". Before outsourcing, it assesses "the legality, suitability and the competence of the Contract Acceptor". Afterwards it monitors performance, reviews records and results, and makes sure that products and materials delivered were processed in accordance with GMP and the marketing authorization.

7.9 to 7.13 apply to the contract acceptor. It may not pass the work on to a third party "without the Contract Giver's prior evaluation and approval of the arrangements", and it may not make "unauthorized changes, outside the terms of the Contract" that could affect the quality of the outsourced activity. It has to understand that outsourced activities may be inspected.

7.14 and 7.15 describe the contract itself. Technical parts are to be drawn up by people who know the outsourced activity and GMP. The contract should describe clearly who undertakes each step; the list names knowledge management, technology transfer, supply chain, subcontracting, "quality and purchasing of materials", testing and release of materials, production and quality controls. The purchasing of materials is therefore expressly part of the required content of a contract on outsourced activities.

7.16 and 7.17 secure access. All records relating to the outsourced activity, including reference samples, remain with the contract giver or available to it. The contract has to allow the contract giver to audit the outsourced activities, "performed by the Contract Acceptor or his mutually agreed subcontractors". The wording goes no further; other subcontractors do not enter the chain at all without the contract giver's prior evaluation and approval under 7.11.

Directive (EU) 2017/1572 of September 15, 2017 addresses the same requirement to the Member States as a legal provision; it governs contract manufacture, not the purchase of materials. Under Article 12(1), the Member States have to ensure that a written contract is concluded for every manufacturing or import operation carried out under contract and every operation linked to it.

Under Article 12(3), the contract acceptor may not subcontract any of the work entrusted to it without the written consent of the contract giver. Article 12(4) subjects it to inspections under Article 111 of Directive 2001/83/EC.

ICH Q10 condenses the same logic in section 2.7 for outsourcing and purchased materials. The quality system "extends to the control and review of any outsourced activities and quality of purchased materials", and the company remains "ultimately responsible". Four elements: assess suitability before selection, define responsibilities and communication processes and, for outsourced activities, put them in a written agreement, monitor performance and material quality, and check incoming materials to ensure they are "from approved sources using the agreed supply chain".

The supplier change as a change

The Guide does not know the supplier change as a term of its own; it breaks down into three operations found in three places. The first is the qualification of the new supplier under 5.27 to 5.29, with risk ranking, audit or excipient risk assessment, quality agreement or specification, and with entry on the list of approved manufacturers against which goods receipt checks under 5.30.

The second is the change itself. Under 1.4 (xii) it is evaluated and approved before implementation, under 1.4 (xiii) checked for its effect afterwards. Annex 15 section 11.2 expressly names changes to starting materials among the cases for which written change control procedures have to exist, and 5.25 requires validation of significant amendments "including any change in equipment or materials, which may affect product quality and/or the reproducibility of the process".

The third operation concerns the dossier. If the manufacturer of the active substance or another starting material is named in the authorization documents, its change is a variation to the marketing authorization under Regulation (EC) No 1234/2008, and 1.4 (xii) requires the regulatory notification or approval to be part of the evaluation. Which category the variation has depends on the case and has to be settled before the change, not after the first delivery.

What tears in practice is the order between these three operations and the commercial contract. If the supply contract is signed before audit and quality agreement exist, purchasing negotiates terms for a supplier whose quality obligations nobody has yet defined. Chapter 7.5 places the assessment expressly before outsourcing, and 5.28 places the agreement on quality requirements before delivery.

Medical devices and IVDs: clause 7.4 and MDR Article 10(9)

The EU GMP Guide does not apply to medical device and IVD manufacturers. Procurement there sits in clause 7.4 of ISO 13485:2016, officially titled "Purchasing", and in Regulation (EU) 2017/745. Its Article 10(9)(d) lists resource management, including the selection and control of suppliers and subcontractors, among the elements the QMS has to cover.

In the United States, 21 CFR Part 820 has referred to ISO 13485:2016 since February 2, 2026; the former section 820.50 on purchasing controls is thereby replaced by clause 7.4. Whoever manufactures for both markets runs supplier control under one standard, and the text of that standard was not read for this article; the statements here rest on the regulation and the clause titles.

One search query that led to these pages in September 2026 asked which raw material supplier is best qualified for a new medical device production line. The regulation gives no ranking in answer; Article 10(9)(d) requires the selection and control of suppliers and subcontractors as part of the QMS and names no criterion.

That the depth of this control follows the supplier's influence on the conformity of the device is, in our reading, the logic of 5.27 of the GMP Guide: supervision proportionate to the risk of the material.

For a new line that means: first determine which materials govern the safety and performance of the device, then choose the deepest level of qualification for those suppliers, with audit and quality agreement, and a justified lighter level for the rest. The supplier with the best price or the shortest lead time is a candidate like any other in that exercise.

What has to be in place before the first order

From the provisions read, a sequence follows that has to be completed before the first order with the new supplier. First, the risk ranking of the material under 5.27 and, for excipients, the formalized risk assessment under 2015/C 95/02; from both follows whether a quality agreement or a specification is enough and how often audits take place.

Second, for active substances, the audit at the manufacturing and distribution site under Article 46(f) and 5.29, with a report that shows what was seen and with implemented actions on the findings. Third, the agreement under 5.28, a quality agreement or a specification depending on the risk ranking.

If the supplier also carries out a GMP activity under contract, such as testing or manufacture, the contract under Chapter 7 and Article 12 of Directive (EU) 2017/1572 is added, assigning every step, prohibiting subcontracting without written consent and granting an audit right at the mutually agreed subcontractors.

Fourth, change control under 1.4 (xii) and Annex 15 section 11, including the question whether the dossier has to be varied. Fifth, the update of the list of approved manufacturers and suppliers against which goods receipt checks under 5.30. Sixth, the testing plan: with the new supplier the full scope of the dossier applies until audit, certificate practice and batch history under 5.36 support reduced testing.

Only then is price on the agenda. That sounds like a reversal of the usual procurement, and it is one: the Guide places the agreement on quality requirements in 5.28 and the assessment of the contract acceptor in 7.5 ahead of delivery and outsourcing. A purchasing function that adopts this order in its process description turns the supplier change into a documented path instead of a finding.