Every analytical result that ends up in a regulatory dossier makes an implicit promise. It says the result was generated by qualified people, on qualified instruments, using validated methods, within a quality system an inspector can reconstruct. When drug developers outsource testing, that promise depends on their contract laboratory. A Good Manufacturing Practice (GMP) certified lab is more than a laboratory with good habits: a competent authority has inspected the site and confirmed its compliance in a certificate. Knowing what GMP certification covers, and what it does not, helps sponsors choose partners whose data will hold up from first-in-human studies to marketing authorization.
GMP certification scope in analytical CROs: what EU GMP Part II covers beyond manufacturing
EU GMP Part II, the European counterpart of ICH Q7 guideline, defines “manufacturing” broadly. It covers material receipt, production, packaging, quality control, release, storage and distribution, so analytical testing is a GMP activity in its own right. For an analytical Contract Research Organization (CRO), several sections set the core EU GMP guidelines analytical testing requirements:
- Laboratory controls (Section 11): scientifically sound specifications and test procedures, an impurity profile for each Active Pharmaceutical Ingredient (API), documented out-of-specification investigations, and stability programs that use validated, stability-indicating methods.
- Analytical method validation (Section 12.8): methods are validated against ICH criteria unless they are pharmacopoeial. Even then, their suitability must be verified under actual conditions of use.
- Contract laboratories (Section 16): contract laboratories must meet the same GMP standard. They are evaluated by the contract giver, work under a written agreement that allows audits, and cannot subcontract without prior approval.
Under EU legislation, the competent authority issues a GMP certificate within 90 days of an inspection if the site is found compliant. Certificates are site-specific, can be restricted to the activities inspected, and are entered into the EudraGMDP database, which authenticates them across the EU. An analytical laboratory GMP certification therefore tells a sponsor which activities an inspector has verified.
Personnel qualification, equipment validation, and quality management: the compliance architecture behind GMP analytical testing
Personnel qualification GMP requirements come first. A laboratory needs enough staff with the education, training and experience for their tasks, written responsibilities, and regular training that is documented and periodically assessed.
Analytical instruments must be qualified before methods are validated on them. Equipment validation in GMP laboratory practice follows the lifecycle described in Annex 15, from user requirements through design, installation, operational and performance qualification. Calibration must be traceable to certified standards, and an instrument that fails calibration is taken out of use. Computerized systems are validated, and their audit trails record who changed what, and when. Annex 15 also requires validating every analytical method used in qualification, validation, or cleaning studies, with appropriate detection and quantification limits where necessary.
The GMP quality management system analytical layer ties these elements together. It rests on a quality unit that is independent of production, records kept at the time each activity is performed, and second-person review of complete raw data. European Medicines Agency (EMA) guidance adds that electronic data is the original record and must be reviewed, audit trails included, before any decision is made. Reviewing printouts alone can hide discarded or reprocessed results. This architecture is what makes a certificate of analysis trustworthy evidence rather than a summary that must be taken on faith.
GMP versus ISO 17025: accreditation frameworks and what each guarantees when outsourcing analytical services
The GMP vs ISO 17025 question comes up often during vendor qualification, and the two frameworks answer different questions. ISO/IEC 17025 is the main international standard against which testing and calibration laboratories demonstrate their technical competence. It requires certified calibration materials, trending of instrument data, demonstrated analyst competency, and an evaluation of measurement uncertainty for each accredited technique.
GMP certification is a regulatory status. A competent authority issues it after inspecting the site against GMP requirements, and its scope may cover the whole site or only specific activities. When results determine the uniformity, strength, or potency of an API or drug product, whether in-process or for lot release, the GMP framework is the one that applies. An ISO 17025 pharmaceutical laboratory therefore offers valuable metrological assurance that complements regulatory frameworks, but ISO 17025 accreditation is not equivalent to a GMP certificate.
Regulatory trigger points for GMP-compliant outsourcing: which testing activities require a GMP-certified CRO
Is GMP legally required for contract testing? It depends less on who performs the analysis than on how the result is used. Any laboratory whose data supports batch release, shelf-life assignment, or process and method validation falls within the GMP perimeter. EU GMP requires contract laboratories to meet the same standards as the manufacturer, under written agreements and audits. In the US, a drug controlled under conditions that do not meet current GMP (cGMP) is considered adulterated. In short, who needs GMP certification is answered by following the data.
Typical trigger points include:
- Release and specification testing of APIs, intermediates, and finished products.
- Stability studies that support retest or expiry dates.
- Validation of analytical methods intended for QC transfer or cited in a dossier.
- Analytical testing within process and cleaning validation.
- Testing of investigational medicinal products and their APIs, where GMP expectations apply in a phase-appropriate way.
The level of GMP expected rises, on a risk basis, as a program moves from early research to late development. For APIs used in clinical trials, Part II accepts methods that are not yet validated, provided they are scientifically sound. Outsourcing analytical testing under GMP also involves the sponsor’s own diligence. EMA normally expects a direct written contract between the batch-certifying manufacturer and each testing site. It also expects the contract giver to verify the laboratory’s data governance before approving it and at intervals afterwards. This is why a GMP certification audit analytical lab program remains essential even when a valid certificate exists: the certificate reflects the authority’s findings, while the audit fulfils the sponsor’s own oversight duty. On GMP certificate validity, EU authorities recommend relying on the EudraGMDP database, where competent authorities record both GMP certificates and statements of non-compliance.
How your CRO’s GMP certification impacts IND, MAA, and BLA submission readiness
For a Marketing Authorization Application (MAA) in Europe, EMA checks the GMP compliance of every site in the supply chain at submission, including testing and release arrangements. Pre-approval inspections can start as early as day 80 and usually take place during the clock stop. Late changes to manufacturing, testing, and release arrangements can delay the assessment, and once an application is validated, changing manufacturing sites normally requires a variation.
Earlier in development, the investigational medicinal product dossier (IMPD) required for EU clinical trials must describe analytical method validation and stability testing. For Phase I, it must show that an ongoing stability program has started under accelerated and long-term conditions. Effective IND-GMP analytical support means phase-appropriate methods that can mature into fully validated QC procedures without being redeveloped.
For a Biologics License Application (BLA), the Chemistry, Manufacturing, and Controls (CMC) section must document method validation, stability, and quality control procedures, and the Food and Drug Administration (FDA) conducts pre-approval cGMP inspections. Across regions, MAA and BLA GMP testing requirements converge on the same point: data generated under GMP that is traceable and defensible. Partnering with a GMP method validation CRO whose compliance is already verified avoids costly remediation at the most critical stage of a program.
At AMSbiopharma, our GMP-certified analytical laboratory, authorized by the Spanish Agency for Medicines and Medical Devices (AEMPS), supports development programs from early characterization to regulatory submission. We combine advanced UPLC-MS/MS platforms with ICH-aligned method development and validation, stability studies, and impurity profiling under a quality system built for inspection.
References
ECA Academy. What are the GMP requirements for drug development? [Internet]. Heidelberg: ECA Academy; [cited 2026 Oct 8]. Available from: https://www.gmp-compliance.org/gmp-news/what-are-the-gmp-requirements-for-drug-development
European Commission. EudraLex Volume 4: EU guidelines for good manufacturing practice for medicinal products for human and veterinary use. Part II: basic requirements for active substances used as starting materials [Internet]. Brussels: European Commission; 2014 Aug 13 [cited 2026 Oct 8]. Available from: https://health.ec.europa.eu/system/files/2016-11/2014-08_gmp_part1_0.pdf
European Commission. EudraLex Volume 4: EU guidelines for good manufacturing practice for medicinal products for human and veterinary use. Annex 15: qualification and validation [Internet]. Brussels: European Commission; 2015 Mar 30 [cited 2026 Oct 8]. Available from: https://health.ec.europa.eu/document/download/7c6c5b3c-4902-46ea-b7ab-7608682fb68d_en
European Medicines Agency. Guidance on good manufacturing practice and good distribution practice: questions and answers [Internet]. Amsterdam: EMA; 2009 [updated 2026 Jul 13; cited 2026 Oct 8]. Available from: https://www.ema.europa.eu/en/human-regulatory-overview/research-development/compliance-research-development/good-manufacturing-practice/guidance-good-manufacturing-practice-good-distribution-practice-questions-answers
Spinei A. GMP inspections MAA submission preparedness [Internet]. 12th Industry Stakeholder Platform Meeting on the Centralised Procedure; 2024 Jun 19; Amsterdam. Amsterdam: European Medicines Agency; 2024 [cited 2026 Oct 8]. Available from: https://www.ema.europa.eu/system/files/documents/presentation/topic-71-gmp-inspections-maa-submission-preparedness-spinei-ema-pdf_en.pdf
The FDA Group. The biologics license application (BLA) process explained [Internet]. Boston: The FDA Group; 2024 Sep 10 [cited 2026 Oct 12]. Available from: https://www.thefdagroup.com/blog/2014/07/test-the-biologics-license-application-bla-process/
