CDMO Quality Certifications for API Manufacturing

By riya October 09, 2026

CDMO Quality Certifications for API Manufacturing

What Quality Certifications Should a CDMO Hold for API Manufacturing? A Buyer's Verification Guide

A contract development and manufacturing organisation (CDMO) that produces active pharmaceutical ingredients (APIs) becomes an extension of your own quality system. If its certificates are out of date, its audit history is thin or its data controls are weak, your regulatory filings and your supply chain inherit that risk.

Certifications are not a guarantee of quality. They are a fast, verifiable first filter that shows whether a CDMO operates a controlled, auditable system. This guide explains which certifications and compliance standards matter for an API CDMO, what each one proves, and how procurement teams can verify them before shortlisting a partner.

A note on scope: this guide covers CDMOs that manufacture APIs and intermediates. CDMOs that produce finished dosage forms (FDF), such as tablets or injectables, follow different rules, for example Parts 210 and 211 of Title 21 of the US Code of Federal Regulations (21 CFR) and Part I of European Union (EU) Good Manufacturing Practice (GMP), so their checklist differs.

What quality certifications should a CDMO hold for API manufacturing?

An API CDMO should be able to show a current GMP certificate from a recognised regulatory authority (or, for United States supply, a satisfactory US Food and Drug Administration (FDA) inspection record). It should demonstrate compliance with the International Council for Harmonisation (ICH) Q7 guideline and hold International Organization for Standardization (ISO) 9001 certification for its quality management system. ISO 9001 is not a legal requirement, but buyers widely expect it. For regulated markets, the CDMO should also support product-specific filings such as a Drug Master File (DMF) or a Certificate of Suitability (CEP), backed by strong data integrity controls.

Item	What it shows	What to request
World Health Organization (WHO) GMP certificate	A government authority has found the site compliant with WHO GMP standards	Current certificate, issuing authority, validity date, product scope
EU-GMP certificate or FDA inspection history	The site has been inspected by a stringent regulator, with an acceptable outcome	Certificate or inspection outcome, not a marketing claim
ICH Q7 compliance	A GMP system designed specifically for APIs	Recent audit reports and closed corrective actions
ISO 9001:2015	Documented quality management system	Certificate with scope covering the site and activity
ISO 14001 and ISO 45001	Environmental and occupational health and safety management	Certificates, if your vendor policy requires them
ISO/IEC 17025	Testing laboratory competence	Accreditation scope covering the methods you need
Data integrity controls (21 CFR Part 11, EU Annex 11)	Trustworthy electronic records	Data integrity policy and audit trail evidence
DMF, CEP, Written Confirmation	Regulatory support for your filings and exports	Product-specific status and documents

The therapeutic activity is the same. The practical differences sit in handling, documentation and calculation.

The core certifications and standards, explained

GMP certification: WHO-GMP, EU-GMP and US FDA status

GMP certification is the foundation. The wording matters here, because suppliers often use these terms loosely.

• WHO-GMP: this is the term most commonly used in India for a GMP certificate showing that a site complies with WHO GMP standards. WHO does not itself issue these certificates to manufacturers. They come from a national or state regulator, such as the Central Drugs Standard Control Organisation (CDSCO) or a state licensing authority. Check who issued the certificate, its validity date and its product scope, and be cautious of certificates issued by private bodies.
• EU-GMP: a GMP certificate issued by an EU member state authority after inspection. These are recorded in EudraGMDP, the EU database of manufacturing authorisations and GMP certificates, which lets you verify them independently.
• US FDA: there is no such thing as “FDA certified”. A site is registered with the FDA and may be inspected. Ask for inspection history and outcomes, such as whether the site has received a Form 483 (a list of inspection observations) or a Warning Letter, rather than accepting a claim that a site is “FDA approved”.

ICH Q7 compliance

ICH Q7 is the international GMP guideline written specifically for APIs. It covers quality management, personnel, buildings and facilities, equipment, documentation, materials management, production and in-process controls, laboratory controls, validation, change control, complaints and recalls, and the responsibilities of contract manufacturers. A CDMO should be able to show how its procedures map to ICH Q7. ICH Q9 (quality risk management) and ICH Q10 (pharmaceutical quality system) usually sit alongside it.

ICH Q7 is a standard to comply with, not a certificate to hang on a wall. The evidence is in audit reports from customers and regulators.

ISO 9001 quality management

ISO 9001:2015 certifies that a company runs a documented quality management system. It is valuable, but it is generic and applies to every industry. It does not replace GMP, so a CDMO that holds ISO 9001 but no GMP certificate should not be considered qualified for regulated API supply on that basis. Check that the certificate was issued by an accredited certification body, that the scope includes the site and activity you are buying, and that it has not expired.

ISO 14001 and ISO 45001

ISO 14001 covers environmental management and ISO 45001 covers occupational health and safety. They are relevant to API CDMOs because synthesis can involve hazardous reagents, solvents and exothermic reactions such as nitration or oxidation. Some buyers also ask for them to support their own environmental, social and governance (ESG) requirements.

ISO/IEC 17025 for laboratories

ISO/IEC 17025 sets competence requirements for testing and calibration laboratories. If a CDMO’s laboratory is accredited to it (in India, typically through the National Accreditation Board for Testing and Calibration Laboratories, NABL), that shows technical competence for the accredited methods. It is not mandatory for GMP, but it is a useful signal of analytical rigour.

Data integrity: 21 CFR Part 11 and EU Annex 11

Regulators treat data integrity as a core GMP issue. 21 CFR Part 11 sets FDA expectations for electronic records and electronic signatures, and Annex 11 of EU GMP does the same for computerised systems. Neither is a certification. Ask for the data integrity policy, how audit trails are reviewed, and how laboratory instruments such as high-performance liquid chromatography (HPLC) and gas chromatography (GC) systems are controlled.

Market-specific registrations and approvals

If you supply specific markets, ask which registrations, clearances or inspections the CDMO holds with the relevant authorities. Examples include the Pharmaceuticals and Medical Devices Agency (PMDA) in Japan, the Therapeutic Goods Administration (TGA) in Australia, the National Medical Products Administration (NMPA) in China, the Ministry of Food and Drug Safety (MFDS) in South Korea and the Italian Medicines Agency (AIFA). The mechanism differs by country and may be a registration, a GMP clearance or an inspection, so ask for the document and the products it covers rather than accepting a logo or a general claim.

Certifications versus regulatory filings: DMF, CEP and Written Confirmation

Procurement teams often group these together, but they answer different questions. Certifications and GMP certificates describe the site. Regulatory filings describe a specific product made at that site.

• Drug Master File (DMF): a confidential submission about an API, most commonly made to the FDA. The FDA does not “approve” a DMF. It is reviewed only when a customer’s application refers to it, and the customer needs a Letter of Authorization from the DMF holder to do so.
• Certificate of Suitability (CEP): issued by the European Directorate for the Quality of Medicines & HealthCare (EDQM) when the quality of a substance is suitably controlled by the relevant European Pharmacopoeia monograph. It is substance-specific.
• Active Substance Master File (ASMF): formerly known as the European Drug Master File (EDMF), this is the EU route for protecting confidential manufacturing detail, submitted to the relevant authority as part of a marketing authorisation application.
• Written Confirmation: for APIs exported to the EU from most non-EU countries, the exporting country’s regulator confirms that the manufacturing standards are at least equivalent to EU GMP.

The key buying rule is that these are product-specific. A CDMO may hold a CEP for one molecule and nothing for another. For a deeper comparison, see our guide to DMF vs CEP and which one your target market actually requires.

Regulatory submission support for naturally derived APIs

Buyers sometimes ask which CDMOs can support regulatory submissions for naturally derived APIs, meaning those sourced from plant, animal or fermentation starting materials. These products raise extra questions beyond a standard synthetic API. When evaluating a CDMO, ask about:

• Source traceability: documented origin of the natural starting material, supplier qualification and batch-to-batch consistency.
• Starting material justification: how the regulatory starting material is defined and defended, following ICH Q11.
• Animal-derived material risk: where relevant, evidence addressing transmissible spongiform encephalopathy (TSE) and bovine spongiform encephalopathy (BSE) risk, which is often handled through a TSE-specific CEP.
• Impurity and residual control: impurity profiling aligned with ICH Q3A, residual solvents under ICH Q3C, elemental impurities under ICH Q3D and mutagenic impurity assessment under ICH M7.
• Stability and analytical validation: stability programmes aligned with the ICH Q1 stability guidelines and validated analytical methods under ICH Q2(R2).
• Filing experience: previous DMF, ASMF or CEP submissions, and how the team handled deficiency letters from regulators.

These expectations apply to your own filing, so raise them early. Ask for examples of prior submissions, discussed under confidentiality.

How to verify what a CDMO tells you

Certificates are only useful if they are real, current and relevant. A practical verification routine:

1. Check the issuer. Is the certificate issued by a regulator or an accredited certification body?
2. Check the scope. Does it cover the specific site, legal entity, product category and reaction types you need?
3. Check the dates. Look at the issue and expiry dates, and ask what happens at renewal.
4. Cross-check public sources. Use EudraGMDP for EU certificates, the EDQM certification database for CEPs and the FDA’s public inspection data where applicable.
5. Request recent audit outcomes. Ask for a summary of customer and regulatory audit findings and how they were closed.
6. Audit the site. Nothing replaces an on-site or remote audit.
7. Agree a quality agreement. It should define responsibilities for change control, deviations, batch release and notification of regulatory inspections.

If you need a broader supplier checklist beyond certifications, our guide on how to qualify an API manufacturer covers sourcing criteria in more depth.

How to shortlist API CDMO partners using certifications

When comparing pharma CDMO companies, a simple three-tier approach keeps shortlists objective.

Tier	Criteria	Action
Gate (must have)	Valid GMP certificate or satisfactory inspection record, ICH Q7 compliance, ISO 9001 (if your policy requires it), no unresolved critical regulatory findings	Remove any CDMO that fails
Verify (should have)	Data integrity controls, in-house analytical validation, product-specific DMF or CEP support, registrations for your target region	Score and request documents
Differentiate (nice to have)	ISO 14001 and 45001, ISO/IEC 17025, backward integration, specialised reaction capability, long-term client relationships	Use to break ties

Use the same scorecard for every CDMO company you evaluate, and weight the gate criteria so that no strong commercial offer can outweigh a failed quality check. In-house analytical capability deserves particular attention, and we explain why in how in-house analytical validations reduce supply chain risks in contract manufacturing

Red flags to watch for

• Certificates that are expired, unreadable or issued to a different legal entity or site
• “FDA approved” or “FDA certified” language without inspection evidence
• Blanket claims of DMF or CEP coverage that are not product-specific
• ISO certificates presented as proof of GMP compliance
• A GMP certificate issued by a private body rather than a regulator
• Group-company capabilities described as if every site holds the same certificates
• Reluctance to allow audits or share audit summaries
• Inconsistent details across the website, brochures and certificates, such as different ISO versions

How DK PharmaChem measures against this checklist

DK PharmaChem was founded in 1980 and today manufactures APIs, intermediates and specialty fine chemicals. Against the criteria above, its CDMO offering includes:

• WHO-GMP certified production streams and ISO 9001:2015 certification
• Quality systems built around ICH guidelines, with quality control systems that are compliant with 21 CFR Part 11
• In-house analytical method validation, process validation and stability studies, with DMF support
• CEPs filed with EDQM and EU Written Confirmation for a number of products
• Registrations, accreditations or clearances with authorities in markets including Japan, Australia, China, South Korea and Italy
• In-house capability for reactions such as nitration, oxidation and hydrogenation

Certificates and regulatory documents are held by specific legal entities and sites, so ask the team which entity and site each document covers, and for which products. You can review the full set of capabilities on the CDMO services page, the quality management system page and the manufacturing facility page.

Frequently asked questions

What quality certifications should a CDMO hold for API manufacturing?

A CDMO should hold a current GMP certificate from a recognised authority, such as a WHO-GMP or EU-GMP certificate, or a satisfactory FDA inspection record for US supply. It should also demonstrate compliance with ICH Q7 and, as buyers widely expect, hold ISO 9001 certification. For regulated markets, it should support product-specific DMF or CEP filings and operate data integrity controls aligned with 21 CFR Part 11 or EU Annex 11.

What criteria should a procurement team use to shortlist API CDMO partners?

Start with pass or fail quality criteria: valid GMP certification or a satisfactory inspection record, ICH Q7 compliance, ISO 9001 where your policy requires it and a clean regulatory record. Then score regulatory support, analytical capability, data integrity, reaction and scale-up capability, supply chain integration and audit history. Finally, verify with documents and an audit.

Is WHO-GMP enough for a CDMO supplying regulated markets?

It is a strong baseline, but it may not be enough on its own. Depending on your market, you may also need EU-GMP status, FDA inspection history, a CEP or DMF, or Written Confirmation for EU supply. Check what your regulatory team requires for the specific product.

Is there an FDA certification for CDMOs?

No. The FDA does not certify facilities. A site registers with the FDA and may be inspected, and the outcome of those inspections is what buyers should review.

What is the difference between a DMF and a CEP?

A DMF is a confidential submission, most commonly made to the FDA, which reviews it only when a customer’s application refers to it. A CEP is a certificate issued by EDQM confirming that the quality of a substance is suitably controlled by a European Pharmacopoeia monograph. Both are product-specific.

What should buyers check when a CDMO supports regulatory submissions for naturally derived APIs?

Ask about source traceability, starting material justification, TSE and BSE risk where relevant, impurity and residual solvent control, stability data and the CDMO’s previous filing experience. Request examples of past submissions, discussed under confidentiality.

How do I verify a CDMO’s certificates?

Check the issuer, scope and validity dates, cross-check public sources such as EudraGMDP where applicable, request recent audit outcomes and conduct an on-site or remote audit. Always confirm that the certificate covers the specific legal entity, site and product category.

Do API CDMOs and FDF CDMOs need the same certifications?

Not exactly. Both need GMP compliance, but API CDMOs follow ICH Q7 (Part II of EU GMP), while FDF CDMOs follow finished-product GMP such as 21 CFR Parts 210 and 211 and Part I of EU GMP. Confirm which type of CDMO you need before comparing certificates.

What should I consider when choosing a CDMO in Mumbai or elsewhere in India?

Apply the same certification checks, then consider audit logistics, export experience, regulatory support for your target market and the CDMO’s ability to handle the chemistry you need. A company’s sales office and its manufacturing site are often in different places, so confirm where your product would actually be made and audited. For example, DK PharmaChem’s sales office is in Powai, Mumbai, and its manufacturing unit is in the Maharashtra Industrial Development Corporation (MIDC) area of Badlapur, Thane.

Get in touch: to discuss certificates, regulatory documents or CDMO requirements, contact the DK PharmaChem team at dkc@dkpharmachem.com.