Pharmaceutical Compliance Documentation: FDA, EMA and GxP Requirements

Pharmaceutical compliance documentation refers to the body of records, procedures and submissions that drug manufacturers must maintain to satisfy Good Practice (GxP) regulatory requirements imposed by authorities including the MHRA, EMA and FDA. In the UK, manufacturers are principally governed by the Human Medicines Regulations 2012 (SI 2012/1916) and the UK GMP Guidelines retained post-Brexit, while sites exporting to the United States must additionally meet FDA 21 CFR Part 211 standards. Failure to maintain complete and accurate GxP documentation can result in batch recalls, manufacturing licence suspension and, in serious cases, criminal prosecution.

What Is GxP Compliance?

GxP is a collective term for a family of quality and regulatory standards applied across the pharmaceutical and life sciences industries, where the "x" is replaced by the relevant activity — Manufacturing (GMP), Distribution (GDP), Laboratory (GLP), Clinical (GCP) and so on.

All GxP frameworks share three core principles: data integrity, traceability and process reproducibility. Any documentary deficiency — a missing signature, an unsigned deviation, an unapproved procedure — constitutes a GxP observation that can trigger a regulatory action or a corrective and preventive action (CAPA) requirement.

The MHRA is the primary UK regulatory authority for medicines, medical devices and clinical trials. Following Brexit, the UK GMP Guidelines were largely retained from EU GMP and are published at gov.uk. Sites holding a Manufacturer's Licence (ManL) are subject to MHRA inspection and must comply with UK GMP requirements as a condition of licence.

A common question in pharmaceutical forums is the distinction between GMP and GDP: GMP governs the manufacture of medicinal products (synthesis, packaging, quality control, batch release), while GDP governs wholesale distribution (storage, transport, returns management). A wholesale dealer licence holder is not subject to GMP but must meet GDP requirements in full.

Required GMP Documentation for Drug Manufacturers

Under the UK GMP Guidelines (equivalent to EudraLex Volume 4, Part I, Chapter 4) and FDA 21 CFR Part 211 Subpart J, pharmaceutical manufacturers must maintain a comprehensive document management system covering written procedures, production records and quality control data.

The principal categories of GMP documentation are as follows:

Standard Operating Procedures (SOPs) — Every critical operation must be governed by an approved, dated and signed procedure. SOPs must be reviewed at defined intervals (typically every two years), and superseded versions must be withdrawn from use and archived with their full approval history.

Batch Manufacturing Records (BMRs) — The batch record is the primary evidence that each production batch was manufactured, tested and released in accordance with its marketing authorisation specifications. A compliant batch record contains: real-time production parameters, in-process control (IPC) results, analytical test results, operator signatures, material reconciliations, and any deviation records with their associated investigations and dispositions.

Specifications and Analytical Methods — Documented specifications for starting materials, packaging components, intermediates and finished products, aligned with applicable pharmacopoeias (British Pharmacopoeia, European Pharmacopoeia, USP).

Validation Documentation — Validation master plans, protocols, reports and periodic reviews for manufacturing processes, cleaning procedures, equipment and computerised systems.

Annual Product Quality Reviews (APQRs) — A systematic annual review consolidating batch data, out-of-specification (OOS) results, deviations, CAPA status, regulatory changes and trend analysis.

The Human Medicines Regulations 2012 (SI 2012/1916) provides the statutory framework for manufacturing authorisations in the UK. Any significant change to a process, specification or critical document must be managed through a formal change control procedure, with risk assessment and regulatory assessment where applicable.

For broader context on credential verification in the healthcare sector, see our article on healthcare credential verification and accreditation.

Regulatory Submissions: FDA and EMA Requirements

The Common Technical Document (CTD) format, developed by the International Council for Harmonisation (ICH), is the globally accepted structure for marketing authorisation applications submitted to the EMA, MHRA and FDA, comprising five standardised modules.

The CTD modules are:

• Module 1: Regional administrative information (not harmonised; UK-specific for MHRA submissions)
• Module 2: Summaries — quality overall summary, non-clinical overview, clinical overview
• Module 3: Quality data (active substance and finished product)
• Module 4: Non-clinical study reports
• Module 5: Clinical study reports

Electronic CTD (eCTD) submission is mandatory for centralised EMA procedures and for new drug applications (NDAs) and biologics licence applications (BLAs) to the FDA. The MHRA also requires eCTD format for most new licence applications. The EudraLex Volume 4 guidelines and associated ICH Q documents govern content requirements.

Drug Master Files (DMFs) allow active substance or excipient manufacturers to submit manufacturing data confidentially to the FDA for cross-reference in customers' marketing applications. The European equivalent is the Active Substance Master File (ASMF), submitted to the EMA or national competent authorities.

For MHRA submissions, the UK's post-Brexit framework introduced specific national procedures alongside recognition of EMA and FDA approvals under certain pathways. Manufacturers should consult the MHRA guidance on applying for a marketing authorisation for current submission requirements.

Electronic Records: 21 CFR Part 11 and EU GMP Annex 11

FDA 21 CFR Part 11 and EU GMP Annex 11 (retained in UK GMP post-Brexit) set out the requirements for electronic records and electronic signatures used in pharmaceutical computerised systems, including requirements for audit trails, access controls and data integrity.

Both frameworks share convergent principles:

• Audit trails: Any modification to an electronic record must automatically generate a timestamped log entry recording the user's identity, the original value and the new value. Audit trails must be protected against modification or deactivation.
• Access controls: Systems must implement individual user authentication and role-based access rights. Shared login credentials are prohibited.
• Electronic signatures: Signatures must be permanently linked to the record they authenticate and must display the signatory's full name, the date and time, and the meaning of the signature act (approval, review, verification, etc.).
• Data integrity — ALCOA+: All GxP data must be Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available.

Annex 11 additionally specifies requirements for computerised system validation, supplier qualification, disaster recovery and business continuity planning. Enterprise systems used in regulated environments — including ERP, LIMS, DMS and MES platforms — must be validated in accordance with a documented validation lifecycle, typically aligned with ISPE GAMP 5 risk categories.

21 CFR Part 11 applies to any manufacturer that submits data electronically to the FDA, regardless of their geographic location. UK manufacturers exporting to the US or participating in FDA-regulated clinical trials must therefore ensure that systems used in that context comply with both Part 11 and Annex 11.

Document Retention Requirements

Retention periods differ according to document type and the applicable regulatory framework. The following table summarises the principal requirements:

The general UK/EU GMP rule for batch records requires retention for at least one year beyond the product expiry date, subject to a five-year minimum from the date of batch release — whichever period is longer governs. This question is one of the most frequently raised in pharmaceutical compliance forums, and inspectors routinely verify that archiving systems can guarantee readability and accessibility throughout the full required period.

For a cross-sector view of document retention obligations in other industries and jurisdictions, see our article on document retention requirements by country and industry.

Electronic archives must maintain data integrity, readability and retrievability across the full retention period, including through system migrations and technology changes. Legacy data migration projects require formal validation to demonstrate that no data has been corrupted or lost.

Automating Pharmaceutical Document Verification

Pharmaceutical document management is among the most resource-intensive activities on a manufacturing site: batch record reviews, completeness checks, signature and date verification, cross-system reconciliation — all high-volume, repetitive tasks with significant consequences for error. Manual review cycles slow batch release timelines and introduce human inconsistency into a process where regulators expect systematic controls.

CheckFile's automated document verification platform is designed for regulated industry workflows. CheckFile's platform has verified over 2.4 million documents with 98.7% OCR accuracy and an average verification time of 4.2 seconds — performance benchmarks well-suited to pharmaceutical document control requirements. Customers in regulated environments report an average 83% reduction in document processing time compared to manual review workflows.

Typical pharmaceutical use cases include:

• Batch record completeness verification: automated detection of missing fields, absent signatures or incomplete sections before submission to quality assurance, reducing back-and-forth review cycles.
• Supplier certificate of analysis (CoA) extraction and validation: automated reading of CoA documents from raw material and API suppliers, with cross-checking against approved specifications.
• Personnel qualification cross-referencing: verification that operators who signed critical batch record steps hold current documented qualifications for those tasks.
• Regulatory submission document checking: pre-submission review of CTD modules for formatting compliance, cross-reference consistency and completeness against regulatory checklists.

Our document verification solutions integrate with existing document management workflows via API, without requiring replacement of validated systems. The security architecture of the platform meets pharmaceutical data confidentiality requirements, including encryption at rest and in transit, access logging and audit trail generation. View our pricing or the industry verification guide to assess fit for your compliance programme.

Frequently Asked Questions

What documents need to be in a batch record?

A complete batch manufacturing record must include: the product name, strength and batch number; references and batch numbers for all starting materials and packaging components used; dated production parameters recorded in real time at each manufacturing step; in-process control (IPC) results; analytical test results from quality control; yield and reconciliation calculations for each stage; records of any deviations with their investigation, disposition and CAPA references; and signed approvals from operators and the qualified person (QP) responsible for batch release. The specific content requirements are set out in UK GMP Chapter 4 (equivalent to EudraLex Volume 4, Chapter 4) and FDA 21 CFR Part 211.188.

How long do pharmaceutical companies need to keep GMP records?

Under UK and EU GMP, batch records for finished products must be retained for at least one year after the product's expiry date, with a minimum of five years from the batch release date — whichever period is longer. For active pharmaceutical ingredients (APIs), the retention period is one year after the expiry of the finished product batch that used the API. FDA 21 CFR Part 211 requires a minimum of three years after the distribution date. Validation records and system qualification documents should be retained for the lifetime of the validated system or process, plus a minimum of five years thereafter.

Does 21 CFR Part 11 apply to manufacturers based outside the United States?

Yes. FDA 21 CFR Part 11 applies to any organisation that creates, modifies, maintains, archives or retrieves electronic records that are submitted to the FDA or used to support FDA-regulated activity. A UK or EU manufacturer that exports products to the US market, participates in FDA-regulated clinical trials, or holds a US drug establishment registration is subject to Part 11 for the systems used in those activities. Practically, most sites active on both markets align their computerised system validation to both Part 11 and EU/UK GMP Annex 11 simultaneously to avoid maintaining duplicate compliance programmes.

What is the difference between a deviation and an out-of-specification (OOS) result in GMP?

A deviation is any departure from an approved procedure, specification or standard that occurs during manufacturing or quality control operations — regardless of whether the final batch result is within specification. An out-of-specification (OOS) result is a specific category of deviation where an analytical test result falls outside the acceptance criteria in the registered specification. Every OOS result triggers a formal investigation under FDA guidance (2006 OOS Guidance) and UK/EU GMP requirements, comprising a Phase I laboratory investigation and, if required, a Phase II manufacturing investigation. Both deviations and OOS results must be documented, investigated, closed with appropriate CAPA and retained in the batch record.

What triggers an MHRA GMP inspection, and what happens if deficiencies are found?

MHRA GMP inspections occur on a risk-based cycle — typically every two to three years for licensed sites — and may also be triggered by product recalls, serious complaints, whistleblower reports or applications for new activities. Inspection findings are classified as: Critical (direct patient risk or fundamental GMP failure, requiring immediate action and potentially licence suspension), Major (significant GMP failure without immediate patient risk, requiring a CAPA response within a defined timeframe) and Other (improvements recommended). Manufacturers with unresolved Major or Critical findings may have their manufacturing licence suspended or revoked, and MHRA publishes inspection action notices publicly. Sites subject to FDA Warning Letters may face import alert, which can effectively bar their products from the US market regardless of MHRA status.

---

This article is provided for informational purposes only and does not constitute legal, financial or regulatory advice. Pharmaceutical regulatory requirements are subject to change; always refer directly to the current published guidance from the MHRA, EMA and FDA and seek specialist regulatory counsel before making compliance decisions.