GMP

What is GMP?

GMP (Good Manufacturing Practice) is the body of legal requirements and guidelines that ensures medicines and other sensitive products are consistently produced and controlled to defined quality standards, so that every batch is safe, effective and traceable. GMP does not look at the finished product alone but at the entire production process: personnel, premises, equipment, raw materials, documentation and release. Its principle is prevention rather than correction: you cannot test quality into a product, you have to build it in during production. Because more and more of that process now runs in MES, SCADA, DCS and LIMS, GMP is one of the most important points where quality regulation meets operational technology.

🧱 Is GMP a guideline or a legal requirement?

For medicinal products, GMP in the EU and the US is not an optional guideline but law. GMP belongs to the wider family of GxP rules, alongside Good Laboratory Practice and Good Distribution Practice, among others.

The FDA published the first cGMP regulations in 1963; today’s drug rules in 21 CFR 211 go back to a major revision in 1978. The “c” for current means the FDA expects you to apply up-to-date technology and knowledge, not just the letter of the rule. In the EU, Directive 2017/1572 requires every manufacturer to run a pharmaceutical quality system in which senior management is actively involved.

Outside pharma, the term is used more broadly. Under the EU Cosmetics Regulation (EC) 1223/2009, cosmetics must be manufactured under GMP, with the standard ISO 22716 giving a presumption of conformity. In the food industry, GMP programmes form the foundation beneath HACCP and Regulation (EC) 2023/2006 makes GMP a legal requirement for packaging and other materials that come into contact with food, and medical devices fall under a quality system based on ISO 13485, which the FDA has also adopted in the US through the QMSR since 2 February 2026.

🔧 What does GMP regulate specifically?

The EU GMP Guide consists of nine chapters in Part I, supplemented by Part II for active substances (equivalent to ICH Q7) and a series of annexes. The core elements:

• Quality system - a pharmaceutical quality management system based on ICH Q10, with quality risk management based on ICH Q9(R1) from 2023
• Personnel - training, hygiene and clear responsibilities; production and quality control are separate functions
• Premises and equipment - suitable, clean, qualified and calibrated
• Documentation - specifications, instructions and batch records; if it is not written down, it did not happen
• Production - validated processes following approved instructions, with every batch traceable through a batch number
• Quality control - sampling and testing of raw materials, intermediates and finished products
• Outsourcing, complaints and recalls - agreements with contract partners and procedures to recall a product quickly
• Self-inspection - internal audits to find deviations yourself before an inspector does

For OT, four annexes are particularly relevant:

🔄 How does GMP affect automation and OT?

Every system that supports a GMP decision must demonstrably do what it is supposed to do. That applies to the controller running a sterilisation cycle just as much as to the software that releases a batch.

Two sets of rules determine how these systems must be set up. In Europe this is Annex 11; in the US it is 21 CFR Part 11 for electronic records and signatures. How you validate is described in GAMP 5 from ISPE, whose second edition appeared in July 2022. GAMP classifies software by category (from infrastructure and standard software to custom code) and scales the validation effort to the risk to patient, product and data.

🔐 What does data integrity mean under GMP?

Inspectors check not only whether a process ran correctly, but also whether the recorded data can be trusted. Data integrity is assessed against the ALCOA+ principles:

• Attributable - traceable to a person or system
• Legible - readable and permanent
• Contemporaneous - recorded at the time of the action
• Original - the original data or a certified true copy
• Accurate - correct and free of errors
• + Complete, Consistent, Enduring, Available - complete, consistent, durably stored and available

Classic OT findings are shared accounts on an HMI, a disabled audit trail, operators with administrator rights and system clocks that are not synchronised via NTP. Cybersecurity also affects GMP directly: in 2017 the NotPetya wiper disrupted Merck’s medicine and vaccine production. The draft revision of Annex 11 published in July 2025 would make security, identity and access management and patching explicit requirements; until the final version takes effect, the 2011 text of Annex 11 remains in force.

🧭 How do you set up an OT system to be GMP-compliant?

A new MES, SCADA or historian system in a pharmaceutical plant roughly goes through these steps:

1. Determine GMP relevance - does the system affect product quality, patient safety or data used for batch release? If not, good engineering practice is sufficient.
2. Write a User Requirements Specification (URS) - including requirements for audit trail, roles, electronic signatures and retention periods.
3. Carry out a risk assessment - based on ICH Q9(R1) and GAMP 5; test thoroughly where the risk is high and keep evidence lean where it is low.
4. Qualify and test - make use of supplier documentation and the FAT and SAT, followed by installation, operational and performance qualification (IQ, OQ, PQ).
5. Secure and separate - network segmentation based on IEC 62443, personal accounts, synchronised time and a tested backup.
6. Maintain the validated state - every change through change management, tested in an OTAP (DTAP) environment, plus periodic review of audit trails and access rights.

In the EU, batch documentation must typically be kept for at least one year after the batch’s expiry date or at least five years after certification by the QP, whichever is longer. For a historian that means years of process data that must remain readable and unaltered, even after a migration to new software.

🏭 Where is GMP applied?

In the Netherlands, the Health and Youth Care Inspectorate (IGJ) periodically carries out GMP inspections at every medicine manufacturer, usually combined with an inspection for Good Distribution Practice. You apply for a manufacturing licence through Farmatec; after a positive inspection the IGJ issues a GMP certificate, which is published in the European EudraGMDP database. If you export to the US, the FDA inspects your plant as well, often in addition to the European inspection.

❓ Frequently asked questions

What is the difference between GMP and cGMP?

cGMP stands for current Good Manufacturing Practice and is the US term used in 21 CFR 210 and 211. The “c” stresses that manufacturers must apply up-to-date technology and knowledge. In substance, GMP and cGMP pursue the same goal: consistent product quality that is demonstrably documented.

Is GMP an ISO standard?

GMP is not an ISO standard but legislation and government guidance, such as the EU GMP Guide and 21 CFR 211. ISO 9001 is a general quality management standard and is not sufficient for GMP. For cosmetics and medical devices, however, ISO standards (ISO 22716 and ISO 13485) do implement GMP requirements.

Who checks whether a company complies with GMP?

In the Netherlands, the Health and Youth Care Inspectorate (IGJ) checks whether medicine manufacturers comply with GMP and issues GMP certificates. In the US the FDA does this, including at foreign plants that export to the American market. Within the EU, GMP inspections are generally repeated at least once every three years.

Does a SCADA or MES system need to be validated under GMP?

A SCADA or MES system must be validated under GMP as soon as it affects product quality or records data used for batch release. Validation is risk-based, following Annex 11 and GAMP 5. Systems without GMP impact, such as an energy dashboard, usually fall outside its scope.

What is a Qualified Person under GMP?

A Qualified Person (QP) is the legally designated expert who certifies every batch of medicines in the EU before it may be released. The QP declares that the batch was manufactured and tested in line with the marketing authorisation and GMP. Every holder of a manufacturing licence must have at least one QP at its disposal.

What role does cybersecurity play in GMP?

Within GMP, cybersecurity is a precondition for reliable and available production data and therefore for data integrity. Annex 11 already requires access control and backups, and the 2025 draft revision proposes explicit requirements for security and patching. A cyberattack that makes batch records unreadable can mean that batches can no longer be released.

📌 In summary

GMP is the legal quality framework that requires manufacturers of medicines and other sensitive products to use validated processes, keep complete documentation and maintain demonstrable control over every batch. For OT this means that systems such as MES, LIMS, SCADA and the historian must be validated, secured and ALCOA+-proof, so that compliance with EU GMP, Annex 11 and 21 CFR Part 11 remains demonstrable.