FDA GMP is codified as binding regulation in 21 CFR Parts 210 and 211 — it carries direct legal force and non-compliance can result in enforcement action without further notice. EU GMP, published as EudraLex Volume 4, is a guideline document implementing EU Directives, with the same practical enforcement weight through national competent authorities. The key structural difference is that EU GMP organises requirements into Parts and Annexes that address specific topics such as sterile manufacturing (Annex 1) and computerised systems (Annex 11), while FDA requirements appear as a single integrated set of regulations.
The FDA–EU Mutual Recognition Agreement allows both regulatory authorities to rely on each other's pharmaceutical GMP inspections rather than duplicating them. As of 29 May 2026, the Sectoral Annex was fully operationalised for veterinary products after FDA completed its assessments of all EU Member State competent authorities — meaning qualified EU national authority inspections of veterinary manufacturing sites are now accepted by FDA, and vice versa, reducing inspection duplication and lowering the cost of bringing veterinary medicines to market.
Both regulate computerised systems and electronic records in regulated environments, but their scope and structure differ. 21 CFR Part 11 is a US federal regulation specifically covering electronic records and electronic signatures used in place of paper records, with defined technical requirements around audit trails, access controls, and signature meaning. EU Annex 11 is broader, covering the entire lifecycle of computerised systems in GMP environments including validation, supplier assessment, data integrity, and business continuity — not only electronic records and signatures.
The 2022 revision of Annex 1 (effective August 2023 for most provisions) introduces a mandatory Contamination Control Strategy as a holistic, risk-based document linking all contamination controls together, strengthens requirements for RABS and isolator technology in sterile manufacturing, and expands environmental monitoring expectations. Manufacturers must now demonstrate a documented, site-wide CCS that shows how individual controls work together — moving away from checking individual requirements in isolation toward demonstrating overall contamination control effectiveness.
A Form 483 is issued at the end of an inspection and lists observations where an investigator found conditions that may constitute a regulatory violation — it is not a final agency determination and provides the company an opportunity to respond. A Warning Letter is a more serious, formal agency communication issued when FDA determines a firm's response to a 483 was inadequate or violations are significant enough to require public notice and an explicit corrective response. Warning Letters are published publicly and can restrict a firm's products.
EudraLex is the European Commission's compilation of pharmaceutical legislation, guidelines, and regulatory documents, organised into ten volumes. Volume 4 is the operative document for GMP — it contains the core GMP guidelines for medicinal products for human and veterinary use, structured into three Parts covering basic requirements, biological medicines, and investigational products respectively, plus a series of Annexes addressing specific manufacturing processes, systems, and environments that require additional or alternative GMP standards.
The Pharmaceutical Inspection Co-operation Scheme is an international body whose member authorities — including EMA, MHRA, and TGA — harmonise GMP standards and inspection practices. PIC/S Guide PE 009 is the core GMP reference closely aligned with EU GMP Volume 4 and adopted by most member states. While FDA is not a formal PIC/S member, it participates as an observer and aligns its expectations through bilateral agreements and the MRA. PIC/S membership signals that an authority's inspections are internationally recognised as equivalent.
ICH Q10 describes the Pharmaceutical Quality System model — the overarching quality management framework within which GMP operates. It is jointly adopted by FDA and EMA and elaborates what a modern pharmaceutical quality system should look like across the product lifecycle, covering management responsibility, process performance monitoring, change management, and CAPA. Both FDA and EU GMP inspectors reference ICH Q10 expectations when assessing whether a company's quality system reflects current good practice, particularly during data-driven or systems-focused inspections.
Remote Regulatory Assessments are a complementary FDA oversight tool — not a formal inspection — where FDA requests records, documents, and information electronically from regulated facilities without an on-site visit. FDA finalised its RRA guidance in 2025, confirming RRAs are a permanent tool alongside traditional inspections. They do not replace physical inspections for surveillance or pre-approval purposes but allow FDA to gather real-time information about facility operations, particularly from sites where a physical inspection cannot be promptly scheduled.
The Quality Management Maturity programme is a voluntary FDA CDER initiative assessing whether a drug manufacturer's quality practices go beyond minimum cGMP compliance toward sustained, metric-driven reliability. Building on earlier pilot years, the 2026 prototype focuses on supply planning, data management, and continual improvement. Participation is voluntary and does not substitute for cGMP compliance, but provides an opportunity for manufacturers to receive structured FDA feedback on quality system maturity and signal proactive quality investment to the agency.
Annex 15 is the EU GMP guideline governing qualification and validation — last substantially updated in 2015. A joint EMA/PIC/S concept paper opened for public consultation in February 2026, outlining planned updates to align with the revised Annex 11, ASTM E2500-25, and modern risk-based qualification practices. The revision will directly affect qualification documentation expectations across EU and PIC/S member states and is expected to progress toward a draft guideline through 2026–2027.
FDA expects all GMP records to comply with ALCOA+ principles — Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. During inspections, investigators review audit trail completeness, check for deleted or overwritten data, assess whether blank or template entries were used improperly, and look for evidence of shared login credentials. Data integrity failures have become the single largest driver of FDA warning letters in recent years, overtaking deviation management and process validation findings.
Annex 22 is a new proposed EU GMP annex — released in draft alongside the revised Annex 11 for public consultation closing in October 2025 — specifically addressing artificial intelligence and machine learning in GxP environments. It introduces expectations for AI model validation, performance monitoring, explainability, and human oversight in GMP applications. Organisations using AI for deviation triage, automated data review, or predictive process control should begin gap assessments against the draft now, as the final text is expected to inform regulatory expectations before the annex is formally published.
For pharmaceutical manufacturers in EU and US territories, the MRA significantly reduces duplicate inspections for human medicines — a site inspected in good standing by an EU national authority will generally be accepted by FDA, and vice versa, without separate FDA inspection. However, the MRA applies only to manufacturing sites located on the parties' respective territories. Non-EU, non-US manufacturing sites — for example, an Indian or Chinese API manufacturer — are not covered by the MRA and remain subject to independent inspection by both FDA and EU authorities.
21 CFR Parts 210 and 211 govern cGMP for finished pharmaceuticals and active pharmaceutical ingredients. 21 CFR Part 820 (the Quality System Regulation for medical devices, substantially updated and aligned with ISO 13485 in 2024) governs design controls, production and process controls, and quality system requirements for medical device manufacturers. The fundamental difference is that Part 820 includes explicit design control requirements covering the entire device development lifecycle, reflecting the engineering-intensive nature of devices, while Parts 210/211 focus on manufacturing and testing control.
For NDA, BLA, and MAA submissions, regulators expect a Validation Master Plan or equivalent describing the overall approach, process validation reports for commercial manufacturing processes, analytical method validation data, cleaning validation evidence, and for computerised systems, a summary of validation status for critical systems supporting the submission data. The actual protocol-level documentation is typically not submitted but must be available on-site for inspection — the submission summarises conclusions while site files hold the detailed evidence.
Since the end of the Brexit transition period, the MHRA operates as a fully independent regulatory authority, no longer part of the EMA network. MHRA has maintained its own GMP framework closely aligned with EU GMP but issues separate UK Marketing Authorisations and conducts its own inspections. Manufacturers supplying both UK and EU markets must comply with both MHRA and EU GMP requirements, obtain both UK and EU batch release where applicable, and treat MHRA and EMA as separate regulatory relationships, including separate manufacturing site authorisations.
FDA uses a risk-based site selection model and targets biennial inspections for high-risk domestic sites, though actual intervals vary based on inspection history, product risk, and resource availability. EU member state authorities under EMA oversight conduct inspections on a risk-based frequency, typically ranging from two to three years for active manufacturing sites, with more frequent inspections following findings or for high-risk product types. Post-MRA, sites covered by the agreement are inspected by one authority, with the results shared rather than duplicated.
Yes. CAPA is a core quality system requirement under both frameworks — FDA requires it under 21 CFR 211.192 and the broader cGMP framework, and EU GMP Chapter 1 (Pharmaceutical Quality System) requires a CAPA system as part of an ICH Q10-aligned quality system. During inspections, both FDA and EU investigators evaluate whether CAPA investigations identify genuine root causes rather than immediate corrections, whether actions are completed on schedule, and whether effectiveness checks confirm the problem did not recur after the CAPA was closed.
EU GMP Annex 15 explicitly requires a Validation Master Plan as the document describing all planned validation activities, scope, responsibilities, and acceptance criteria across a site. FDA does not specifically mandate a VMP by name, but its process validation guidance and cGMP regulations effectively require the equivalent — a documented, controlled plan covering what systems and processes require validation, the methodologies to be used, and the organisational accountability for each. Both agencies expect the VMP to be a living document updated as the site's validated state evolves.