Pharmaceutical Compliance Documentation in Australia: TGA, GMP and GxP Requirements

The Therapeutic Goods Administration (TGA) is Australia's regulatory authority for therapeutic goods, enforcing Good Manufacturing Practice (GMP) standards aligned with international PIC/S (Pharmaceutical Inspection Co-operation Scheme) guidelines. The TGA operates under the Therapeutic Goods Act 1989 (Cth), the primary federal legislation governing the regulation, manufacture, supply and export of therapeutic goods in Australia. All pharmaceutical drugs must be entered on the Australian Register of Therapeutic Goods (ARTG) before they may be supplied in, or exported from, Australia — without exception.

The TGA's GMP framework is set out in the Therapeutic Goods (Manufacturing Principles) Determination 2023 and the Australian Code of Good Manufacturing Practice for Medicinal Products, which incorporates by reference the PIC/S Guide to GMP (PE 009-16). Australia adopted PIC/S membership in 1992, meaning that Australian GMP standards are internationally recognised. Australian manufacturers holding a TGA GMP licence are generally accepted by other PIC/S member authorities without re-inspection under mutual recognition arrangements. This has significant practical implications for exporters: a manufacturing site that has successfully passed a TGA GMP inspection is well-positioned for regulatory acceptance in the EU, Canada, Singapore and other PIC/S member jurisdictions.

Two questions are frequently raised in Australian pharmaceutical compliance forums. First: what is the difference between TGA GMP and FDA cGMP? Both frameworks are risk-based and derive from common ICH Q-series guidance, but the TGA GMP Code is aligned with PIC/S PE 009-16 (which closely mirrors EU GMP EudraLex Volume 4), while FDA cGMP is codified in 21 CFR Part 211 — a separate regulatory tradition with some substantive differences in batch record requirements, personnel qualifications and computerised system expectations. Second: does Australia use EU GMP or US GMP standards? Australia primarily uses the PIC/S standard, which is structurally and substantively equivalent to EU GMP — not US FDA cGMP. Australian manufacturers exporting to the US must therefore manage a dual compliance posture, maintaining TGA/PIC/S GMP for the Australian and EU markets and separately demonstrating cGMP compliance for FDA-regulated activities.

TGA GMP Requirements for Australian Drug Manufacturers

The TGA GMP Code imposes requirements across all aspects of pharmaceutical manufacturing. The following table summarises the key GMP elements and their Australian regulatory basis:

The TGA inspects manufacturing sites on a risk-based cycle, typically every three years for routine inspections, with triggered inspections following recalls, serious complaints or licence amendments. Inspection findings are classified as Critical, Major and Other, consistent with PIC/S inspection classification. Sites with unresolved Critical or Major deficiencies may have their manufacturing licence suspended or face ARTG cancellation for affected products.

Overseas manufacturers supplying therapeutic goods to Australia must hold a Overseas GMP Clearance issued by the TGA, or their manufacturing site must be covered by a mutual recognition arrangement between the TGA and the relevant overseas regulatory authority. GMP clearance is renewed periodically and must remain current for continued ARTG registration.

Required Documentation Under the TGA GMP Code

Under the TGA GMP Code (aligned with PIC/S PE 009-16, Chapter 4 and associated Annexes), Australian pharmaceutical manufacturers must maintain a comprehensive, controlled documentation system covering all aspects of GMP activity.

Standard Operating Procedures (SOPs) must cover every critical operation including manufacturing, packaging, labelling, testing, cleaning, validation and quality assurance activities. SOPs must carry approval signatures, effective dates, version numbers and review dates. Superseded versions must be archived with their complete revision history and withdrawn from operational use.

Batch Manufacturing Records (BMRs) are the primary evidentiary record demonstrating that each production batch was manufactured, packaged and tested in accordance with its ARTG-registered specifications. A compliant Australian batch record includes: the product name, ARTG number and batch number; references and lot numbers for all starting materials and packaging components; real-time production parameters recorded contemporaneously; in-process control (IPC) results; analytical results from quality control testing; yield and reconciliation data; records of deviations with investigation outcomes and dispositions; and release signatures from authorised personnel.

Specifications and Analytical Methods — Documented and approved specifications for APIs, excipients, intermediates, packaging materials and finished products. Analytical methods must be validated in accordance with ICH Q2 (R1) principles.

Validation Documentation — Validation master plans, user requirements specifications, design qualification (DQ), installation qualification (IQ), operational qualification (OQ), performance qualification (PQ) protocols and reports for processes, equipment, cleaning procedures and computerised systems. Computerised system validation must align with ISPE GAMP 5 risk categories.

Annual Product Quality Reviews (APQRs) — Annual consolidated reviews of batch data, OOS results, deviations, complaints, regulatory changes and stability trending, consistent with TGA GMP Code Chapter 1 and ICH Q10 requirements.

For a cross-sector view of healthcare document compliance, see our article on healthcare credential verification and accreditation.

ARTG Registration and CTD Submissions

All prescription drugs, over-the-counter medicines and biologicals must be registered on the Australian Register of Therapeutic Goods (ARTG) before supply in Australia. The TGA evaluates the safety, efficacy and quality of prescription and higher-risk medicines through a full regulatory review, while lower-risk listed medicines are assessed through an audited self-certification process.

ARTG registration applications for prescription drugs follow the Common Technical Document (CTD) format, and the TGA requires electronic CTD (eCTD) submissions for all new prescription medicine applications. The standard CTD structure applies:

• Module 1: Australian-specific administrative and prescribing information (Product Information and Consumer Medicine Information)
• Module 2: Quality, non-clinical and clinical summaries and overviews
• Module 3: Quality data (active substance and finished product)
• Module 4: Non-clinical study reports
• Module 5: Clinical study reports

The Australian Specific Annex (ASA) is a critical Australian-market requirement within Module 1. The ASA documents Australian-specific manufacturing information, particularly for products manufactured at multiple sites or where the Australian supply chain differs from the global CTD submission. The ASA must accurately describe the Australian manufacturing and testing sites and the batch release arrangements that apply specifically to Australian supply.

TGA Manufacturing Licences are site-specific and product-category-specific. A licence to manufacture sterile injectable products is separate from a licence to manufacture oral solid dosage forms. Changes to manufacturing activities, sites or dosage form categories require prior TGA approval through a licence amendment process. Manufacturers must notify the TGA of significant changes to their GMP systems between scheduled inspections.

The TGA maintains public ARTG summaries accessible through its online register. Marketing without ARTG registration — except under specific exemptions such as clinical trial authorisations or Special Access Scheme approvals — constitutes a criminal offence under the Therapeutic Goods Act 1989.

Electronic Records and Privacy Act 1988 Compliance

Australian pharmaceutical GMP electronic record requirements are set out in the TGA GMP Code Annex 11 (Computerised Systems), aligned with PIC/S Annex 11. Unlike the European GDPR framework, Australian data protection obligations for pharmaceutical companies are governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) — a distinct framework that differs substantially from EU GDPR in scope, consent requirements and breach notification timelines.

The TGA GMP Code Annex 11 requirements for electronic records include: validated computerised systems with documented change control; audit trails recording user identity, timestamps and original and modified values for all GxP records; access controls ensuring individual user authentication and role-based access rights; and disaster recovery arrangements maintaining data availability throughout the required retention period. ALCOA+ data integrity principles apply to all electronic GxP records.

The Office of the Australian Information Commissioner (OAIC) administers the Privacy Act 1988. Under the APPs, pharmaceutical companies collecting personal health information — including clinical trial participant data, adverse event reports and pharmacovigilance data — must: collect only the minimum necessary information; obtain valid consent; implement appropriate technical and organisational safeguards; and notify the OAIC and affected individuals of eligible data breaches under the Notifiable Data Breaches (NDB) scheme. The NDB scheme requires notification within 30 days of determining that a data breach has occurred that is likely to result in serious harm.

Unlike GDPR, the Privacy Act 1988 does not impose explicit data residency requirements, but cross-border data transfers require that the overseas recipient handles data consistently with the APPs, or that the individual has consented to the transfer with awareness of the risk. Pharmaceutical sponsors sharing clinical trial data with FDA or EMA under ICH E6(R2) GCP requirements must comply with APP 8 cross-border disclosure obligations.

AUSTRAC obligations apply to pharmaceutical companies involved in the handling of controlled substances or cash-intensive transactions above reporting thresholds under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act 2006).

Document Retention Requirements Under TGA Regulations

Retention periods for GMP documents in Australia are set out in the TGA GMP Code and associated guidance. The following table summarises the principal requirements:

Electronic archives must maintain data integrity, readability and retrievability for the full retention period, including through system migrations. The TGA has issued specific guidance confirming that migration of archived electronic records must be validated, with post-migration data integrity verification. Legacy format data — including data generated on obsolete LIMS or MES platforms — must remain accessible without requiring original hardware or software.

For a cross-jurisdictional comparison of document retention obligations, see our guide on document retention requirements by country and industry.

Automating Pharmaceutical Document Verification in Australia

Australian pharmaceutical document management is resource-intensive and time-critical: batch record completeness reviews, certificate of analysis extraction, qualification cross-referencing and TGA submission pre-checks all generate high volumes of repetitive document review work where manual processes introduce inconsistency and compress batch release timelines.

CheckFile's automated document verification platform is designed for regulated industry workflows. CheckFile's platform has verified over 2.4 million documents with 98.7% OCR accuracy — benchmarks suited to TGA's strict document integrity requirements for pharmaceutical manufacturers. Pharmaceutical customers report an average 83% reduction in document processing time compared to manual review workflows.

Typical Australian pharmaceutical use cases include:

• Batch record completeness verification: automated detection of missing fields, unsigned steps or incomplete deviation references before submission to quality assurance, reducing back-and-forth at batch release.
• Certificate of analysis extraction and cross-checking: automated reading of supplier CoA documents against approved specifications, flagging discrepancies for pharmacist or QP review before material release.
• Manufacturing licence activity verification: systematic confirmation that manufacturing activities are within the scope of the authorised TGA Manufacturing Licence and current GMP clearance.
• eCTD submission document pre-review: automated checks of CTD modules for formatting compliance, cross-reference consistency and completeness against TGA submission requirements including ASA accuracy.

Our document verification solutions integrate with existing document management workflows and ERP systems via API, without replacing validated GMP systems. The security architecture meets pharmaceutical data confidentiality requirements including end-to-end encryption, role-based access controls and audit trail generation compliant with TGA Annex 11 expectations. View our pricing or the industry verification guide to assess fit for your compliance programme.

Frequently Asked Questions

What is the difference between PIC/S GMP and ICH Q guidelines, and which applies in Australia?

PIC/S (Pharmaceutical Inspection Co-operation Scheme) and ICH (International Council for Harmonisation) address different aspects of pharmaceutical regulation. ICH Q guidelines — including Q7 (API GMP), Q8 (pharmaceutical development), Q9 (quality risk management) and Q10 (pharmaceutical quality system) — set out scientific and technical standards for pharmaceutical development and manufacture. PIC/S PE 009-16 is the GMP inspection standard adopted by 55 regulatory member authorities, including the TGA, that defines what inspectors assess during GMP compliance inspections. The Australian TGA GMP Code incorporates PIC/S PE 009-16 and adopts ICH Q7, Q8, Q9 and Q10 as integral elements of the GMP framework. In practice, Australian manufacturers must satisfy both: the ICH Q standards define the quality system requirements, and PIC/S PE 009-16 defines how compliance is evaluated during TGA inspections.

How does ARTG registration differ from other international marketing authorisations?

ARTG registration is Australia's national market authorisation for therapeutic goods, administered by the TGA. It differs from the FDA NDA/BLA (United States), EMA Marketing Authorisation Application (EU) and Health Canada NDS (Canada) in several respects: the TGA conducts its own independent evaluation and may reach different conclusions on the same CTD data package; Australian product labelling must comply with TGA Product Information (PI) and Consumer Medicine Information (CMI) requirements specific to Australia; and Australia uses a tiered registration pathway — prescription medicines undergo full evaluation review, while listed complementary medicines use an audited self-certification process. The Australian Specific Annex (ASA) is a unique Australian-market requirement with no direct equivalent in FDA or EMA submissions.

What TGA licences does an Australian pharmaceutical manufacturer need?

Australian pharmaceutical manufacturers must hold a TGA Manufacturing Licence under Section 37 of the Therapeutic Goods Act 1989. The licence is site-specific and product-category-specific: separate licence conditions apply to sterile and non-sterile manufacturing, biologicals, OTC medicines and prescription medicines. Changes to manufacturing activities require prior TGA approval via licence amendment. Overseas manufacturers supplying to Australia must hold an Overseas GMP Clearance or be covered by a mutual recognition arrangement. Wholesalers distributing therapeutic goods must hold a separate Wholesale Distribution Authority. A manufacturer that also distributes must hold both a Manufacturing Licence and a Wholesale Distribution Authority for those activities.

Does Australia's Privacy Act 1988 apply the same way as GDPR to pharmaceutical clinical trial data?

No. The Privacy Act 1988 and the Australian Privacy Principles (APPs) govern personal data protection in Australia, but they differ significantly from EU GDPR. Key differences: the Privacy Act currently applies only to organisations with annual turnover above AUD 3 million (though this threshold is under review), whereas GDPR applies regardless of size; the Privacy Act does not include a general right to data portability; breach notification timelines under the NDB scheme require notification "as soon as practicable" but within 30 days of determining an eligible breach has occurred, compared to GDPR's 72 hours for supervisory authority notification; and GDPR imposes strict data residency and adequacy requirements for cross-border transfers that have no direct APPs equivalent. Australian clinical trial sponsors should note that the Privacy Act includes specific health information provisions, and the OAIC has published guidance for health research activities at oaic.gov.au.

What does a TGA GMP inspection involve and how often do they occur?

TGA GMP inspections occur on a risk-based cycle, typically every three years for standard-risk licensed sites. Inspections may be triggered outside the standard cycle by product recalls, serious quality defect reports, licence amendment applications, complaints or whistleblower reports. During an inspection, TGA inspectors review documentation systems, batch records, SOPs, validation packages, training records, deviation and CAPA management, and data integrity controls — consistent with PIC/S inspection methodology. Findings are classified as Critical (immediate patient risk), Major (significant GMP failure), or Other (minor improvement observations). Sites must provide a written CAPA response within a defined timeframe. Unresolved Major or Critical findings can result in manufacturing licence suspension, ARTG cancellation for affected products, or public recall. The TGA publishes GMP inspection outcomes, and significant deficiencies may result in regulatory action notices on the TGA website.

---

This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Australian pharmaceutical regulatory requirements are subject to change; always refer directly to current TGA guidance at tga.gov.au and seek qualified regulatory counsel before making compliance decisions.