GMP for APIs

ICH Q7 is the internationally recognized Good Manufacturing Practice (GMP) guideline for Active Pharmaceutical Ingredients (APIs) — the substances that give a medicine its therapeutic effect. It was developed by the International Council for Harmonisation (ICH), the body that brings together regulators and industry from around the world to align pharmaceutical requirements. Its full title is often given as ‘Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients’.

Here is an important distinction to be clear about from the start: ICH Q7 is a GMP guideline, not a classic ISO-style management-system standard. You do not earn a certificate the way you would with ISO 9001. Instead, ICH Q7 sets out what regulators expect an API manufacturer to do, and compliance is demonstrated through regulatory inspection and customer audits. Health authorities such as the FDA and EMA have adopted ICH Q7 as their expectation for API GMP, so it functions as the global baseline for how APIs must be made.

In short, ICH Q7 defines the manufacturing controls, quality systems, and documentation an API maker needs so that every batch is produced consistently, to the right quality, and is safe for use in a finished drug product.

ICH Q7 applies to organizations involved in the manufacture of active pharmaceutical ingredients, whether by chemical synthesis, fermentation, extraction, recovery from natural sources, or a combination of methods. If your product ends up in a medicine, ICH Q7 is the expectation your regulators and customers will hold you to. Typical candidates include:

• API manufacturers producing active ingredients by synthesis or fermentation
• Contract manufacturers (CMOs/CDMOs) making APIs or intermediates for others
• Manufacturers of API intermediates that feed into later API steps
• Producers of APIs from biological or natural sources, and by extraction or recovery
• Sites performing key steps such as blending, milling, or sterile API operations

Compliance is regulatory and customer driven. Health authorities inspect API sites against ICH Q7, and finished-drug manufacturers audit their API suppliers against it before they will buy. So while there is no certificate to hang on the wall, meeting ICH Q7 is effectively mandatory if you want to sell APIs into regulated markets. One useful note on scope: ICH Q7 defines where API GMP begins in the process, and the level of control increases as you move closer to the final API. We help you determine exactly where those GMP requirements apply to your process.

ICH Q7 is organized into sections that together describe a complete API quality operation. At its core is an independent quality unit — quality assurance and quality control — with the authority to approve or reject materials, procedures, and batches. Beyond that, the guideline sets expectations across areas including:

• Personnel — qualified, trained people with clear responsibilities and good hygiene practices
• Buildings and facilities — suitable design, controlled environments, and proper utilities to prevent contamination and mix-ups
• Process equipment — appropriate, clean, calibrated, and maintained, with documented cleaning
• Documentation and records — controlled procedures, complete batch records, and reliable data
• Materials management — control of incoming materials, storage, and traceability
• Production and in-process controls — defined processes, monitoring, and control of critical steps
• Packaging, labeling, storage, and distribution — with controls to prevent errors
• Laboratory controls — testing, specifications, stability, and out-of-specification handling
• Validation — process validation, cleaning validation, and change control
• Change control, deviations, complaints, recalls, and returns — managed and documented
• Contract manufacturers and agents — controlled and audited across the supply chain

Compliance is confirmed not by a certification audit but by regulatory inspection and customer audits, where inspectors examine your systems, records, and practices against these expectations. Getting the documentation and data integrity right is often where sites are most exposed.

A quick clarification on wording: with ICH Q7 you are not chasing a certificate — you are getting your site compliant and inspection-ready. But the reason to do it is just as clear as any certification. Without demonstrable ICH Q7 compliance, you cannot sell APIs into regulated markets, and a poor inspection outcome can halt shipments, trigger warning letters, or close the door on a customer entirely.

The value runs deeper than passing an inspection. A well-built API quality system means fewer deviations, fewer out-of-specification results, and fewer batch rejections — all of which quietly drain margin. Strong documentation and data integrity mean that when an inspector or a customer auditor arrives, your evidence tells a clean, consistent story. That reliability is exactly what finished-drug manufacturers look for when they choose an API supplier, and it is what wins and keeps long-term supply contracts.

There is a reputational reality too. In the pharmaceutical world, an inspection history is public and durable. A site with a clean ICH Q7 record is a trusted supplier; one with repeated findings becomes a liability. Building genuine compliance is one of the most reliable ways to protect both your market access and your name.

We have spent more than 30 years helping companies build quality systems, and we have guided 900+ organizations to successful outcomes with a 100% first-time pass rate across the audits and assessments we prepare them for. With ICH Q7 the goal is a little different — there is no certificate, so what we build toward is a site that is genuinely compliant and ready to stand up to a regulatory inspection or a demanding customer audit.

Our proven 10-Step Approach adapts cleanly to this. We start with a gap assessment against ICH Q7, determine exactly where API GMP applies in your process, and then build the quality system with your team — the quality unit, procedures, batch records, validation, change control, and the data-integrity practices inspectors focus on. Because we do the work alongside your people, the system reflects how you actually operate and belongs to them long after we leave.

A hallmark of our work is documentation you will actually use — single-level documents, typically under 200 pages for the core system, instead of the bloated multi-tier manuals that gather dust and confuse inspectors. We train your team, run internal audits and mock inspections so there are no surprises, and stand with you through the real inspection or customer audit. For most sites the readiness journey runs about 5 to 9 months, depending on your starting point and how mature your existing GMP practices are.

• Data integrity gaps — incomplete records, uncontrolled data, or practices that cannot survive an inspector's scrutiny. This is the single most common source of serious findings, and we build it in from the start.
• Treating ICH Q7 as paperwork rather than practice, so the written procedures and what actually happens on the floor drift apart
• A quality unit without real independence or authority to reject batches
• Getting the GMP starting point wrong — applying too little control near the final API, or too much too early
• Weak validation and change control, so process changes happen without proper assessment or documentation
• Poor oversight of contract manufacturers and suppliers across the API supply chain
• Writing heavy, multi-tier documentation that people ignore and inspectors find contradictory
• Waiting until an inspection is scheduled to get ready, instead of building durable compliance in advance