How to Qualify an API Supplier Before Signing an Import Contract

The samples looked good. The price was right. The contract is ready to be signed.

But one critical question remains unanswered: would this supplier pass a regulatory inspection?, How to Qualify an API Supplier ?

This is where most sourcing decisions fail quietly. When it comes to API supplier qualification, filling out documents after you sign the contract is not enough.

It is a formal, evidence-based gate that must be closed before signing, as GMP places accountability for what you buy on you, not your supplier.

If you are a QA lead, an RA professional, or a procurement manager signing off on an active pharmaceutical ingredient import, this determines if you are covered or if you will be accountable when things go wrong.

This guide will explain what API supplier qualification is and what steps are involved in completing the process so you are able to explain the contract on your desk to an inspector.

The Accountability You Cannot Outsource

Regulators will not allow suppliers to shoulder the burden of quality accountability. A contract that’s been signed does not transfer that risk.

What the GMP framework actually requires

Chapter 5 of the EU GMP states^[1] that the selection, qualification, approval, and maintenance of suppliers of starting materials must be recorded in the pharmaceutical quality system and confirms compliance with GMP and GDP through auditing at active substance manufacturers and distributors.

ICH Q7^[2] defines GMP for APIs. ICH Q9 gives the risk-management framework that adjusts the scope of assessment in accordance with the supplier’s criticality, and ICH Q10 assigns liability for the quality of purchased material and contracted services to the product owner.

Why a contract cannot move the risk

A supply agreement defines how costs, indemnity, and liability are distributed between two parties.

This is commercial risk, and it is negotiable. Reassigning regulatory accountability is not.

If a material supplied by your provider fails, it is your batch, your recall, your finding during an inspection, and your marketing authorisation that is potentially affected.

The reason API supplier qualification exists is that this cannot be fulfilled by a signature; it can only be fulfilled by providing evidence.

This distinction is crucial to understanding what qualification is and why it is important to complete qualification before signing. Also see here: how to source bulk APIs from India and Actiza’s APIs page.

What “Qualification” Means and Why It Must Finish Before You Sign

Qualification is a required part of each contract that must be completed before signing the contract.

It stands on its own from the evaluation of the business and its commercial aspects.

API Supplier qualification is the process of proving that a supplier meets your quality, regulatory, and supply requirements before that supplier is admitted to your quality system.

It is a full-fledged gate and not a formality, and it is separate from the commercial evaluation that identified the supplier.

The FDA’s contract-manufacturing guidance provides a sequence for this: a quality agreement defining each party’s cGMP responsibilities must be signed as part of the agreement and before the manufacture of any GMP commercial material.

Commercial logic merges with regulatory logic. Before signing, you can demand anything and everything. You have:

After signing, you have the same liability and the least amount of leverage.

All the hours you spend to know API supplier qualification using the AIPS Pre-Contract Qualification Tool before signing are worth infinitely more than the hours you spend negotiating around an issue after signing.

The next question after we’ve settled the timing aspect is what unqualified suppliers have really cost buyers who skipped this step.

What Unqualified Suppliers Have Actually Cost

Failure to qualify has been lethal to patients and has now resulted in documented enforcement action against buyers. The mechanism of failure is the same in both cases.

When upstream material was never properly qualified

In 2008, patients died in the U.S. due to oversulfated chondroitin sulfate being added to heparin as an adulterant.

This incident is an example the API industry uses to demonstrate the importance of supplier qualification failure.

In 2006, 78 deaths were reported in Panama.^[3] Diethylene glycol that was fraudulently marked as glycerin passed through brokers in China and Europe.

The labels on the diethylene glycol were changed numerous times, and the broker’s tests, if any, were either inadequate or non-existent.

From June 2022 to August 2023, the WHO issued eight alerts covering 22 contaminated syrup products containing diethylene or ethylene glycol, resulting in more than 300 child deaths^[4] in The Gambia, Indonesia and Uzbekistan.

The single common failure in these incidents, where a material was added to a medicine without verifying the source, is believing unverified documents.

The enforcement now lands on the buyer

In 2025, the Food and Drug Administration (FDA) sent a higher-than-average percentage of CGMP warning letters to pharmaceutical firms.^[5]

Different letters cited a deficiency in identity component testing of components under 21 CFR 211.84(d)(1),^[6] primarily because firms accepted Certificates of Analysis from suppliers with no supporting verification.

The FDA has stated that comparing certificate-of-analysis data against a pre-approved specification does not satisfy a firm’s obligation to assess, determine, audit and continually oversee their contract facilities.

The resolution is the same regardless of whether we look back in time or at present enforcement. It is about the risk-tiering of suppliers before determining the level of supplier examination.

Start by Risk-Tiering the Supplier

All API manufacturers fall under the highest level of assessment required in accordance with ICH Q9 risk logic.

In a risk approach consistent with ICH Q9, assessment of criticality can be impacted by product impact, supplier process, how substitutable the material is, exposure to sole sourcing, and the supplier’s regulatory status.

This classification will dictate the depth of assessment, the necessity of an on-site audit, and the requalification interval. For critical suppliers, including manufacturers of active substances, a site audit is almost always required.

Risk Tier	Typical Supplier/Material	Qualification Depth Expected
Critical	API/Active-substance manufacturer, sterile manufacturer, contract (test) lab	Review all documents + on-site audit + independent sample test + quality agreement; most frequent requalification
Major	Key excipients, primary (product-contact) packaging, critical services	Review documents + audit (on-site or qualified third-party) + incoming test
Minor	Secondary packaging, non-contact materials and services	Review documents and questionnaire; audit by exception or trigger

By definition, an API supplier sits in the critical tier.

The reason I am showing this work is to show that this effort is commensurate, not to provide a quicker approach for API sourcing.

Once a tier is established, the next phase is a seven-step process which converts the tier into a documented decision for qualification.

The Seven-Stage Qualification Process

A sequence of rules, 7 in total, makes risk-tiering provision a documented case of defensible qualification. The order is the value.

Stage 1: Define the requirement and the acceptance criteria.

Document your definition of ‘qualified’ before assessing anyone, and if possible, provide Pharmacopoeial Grade, specification limits and impurity levels, targeted markets and their regulatory privileges, volumes, packaging, etc.

API supplier qualification without agreed acceptance criteria is an opinion, not a fact.

Stage 2: Screen and verify the regulatory record independently

Independent verification of the regulatory record. Obtain the credential pack, and verify every number by checking the source.

GMP certificates issued by the authority, US establishment registration and FDA database inspection history, EU-GMP status on EudraGMDP, CEPs located on the EDQM database, and any DMF/ASMF number with a currently valid Letter of Authorization.

Stage 3: Run and document the risk assessment.

Carry out and document the risk assessment. Assign the tier of criticality using ICH Q9 principles and describe the rationale.

Inspectors will not accept or support an undocumented claim that a supplier is of low risk.

Stage 4: Audit the manufacturing site

Audit the manufacturing site. For an API supplier, audit the real manufacturing site and QC laboratory against ICH Q7 facility, quality unit, change control, deviations and CAPA, and data integrity.

It is important to utilise your qualified auditors; even if a third-party or shared audit augments the program, they cannot replace your judgement.

Stage 5: Test independently before you trust the paperwork

Obtain samples and have your tests performed by an accredited lab on identity, purity, potency and the profile of expected or specified impurities.

As one of the most common GMP infractions in enforcement today is accepting a supplier CoA without confirming it independently, it is prudent to incorporate procedures for routine incoming verification.

Stage 6: Close findings before approval, not after

Each observation requires a documented CAPA. All critical findings remain open on a supplier, and that supplier is unequivocally unqualified, regardless of price.

Approval tied to conditions and with a firm deadline should be extended.

Stage 7: Approve formally, then execute both agreements.

Record the approval on the supplier approved list together with the date of approval and the approving authority.

Both quality and supply agreements must be executed before the commencement of any commercial production.

Once all stages have been articulated, the next section dictates what documents are required and how they should be verified.

Documents to Demand and Where to Verify Them

Anyone can send a PDF. The Verification column below shows that a claim is legitimate.

Document / Credential	Reason	Verify Separately At
WHO-GMP / National GMP Certificate	GMP compliance of the manufacturing site	Issuing authority or national regulator register
US FDA Establishment Registration	Confirms the site is registered for US-bound supply	FDA foreign-establishment database; check 483s, warning letters, and import alerts
EU-GMP Certificate	Confirms GMP compliance with EU standards	EudraGMDP database
EDQM Certificate of Suitability (CEP)	Confirms the API complies with the European Pharmacopoeia	EDQM CEP database
DMF / ASMF Number + Letter of Authorization	Supports your dossier and registration	Regulator DMF list; confirm the LoA is current and names your company
Written Confirmation (EU-bound APIs)	Confirms the API is manufactured according to GMP standards for EU import	Competent authority of the exporting country
Batch CoA, Validated Methods, Stability Data	Provides evidence that the material meets the required specification	Independent accredited-laboratory testing of samples
Site Master File / QMS Documentation	Demonstrates the maturity of the supplier’s quality system	Reviewed and challenged during the audit

Documentation verifies the authenticity of the paperwork and confirms the two agreements below establish an enforceable relationship.

The Two Agreements You Must Execute

Many confuse the quality agreement and the supply agreement.

The quality agreement and supply agreement serve different functions, and both require a signature.

The FDA encourages the quality agreement to be written as a separate agreement from the commercial supply agreement, but it can be incorporated by reference.

The quality agreement should cover scope and definitions, resolution of ambiguity, the manufacturing and quality unit responsibilities of each party, the agreement’s own lifecycle, and how it will be revised.

Belongs in the QUALITY agreement	Belongs in the SUPPLY agreement
Specifications, test methods, and sampling	Price, payment terms, and currency
Batch release authority and documents	Volumes, forecasts, and minimum order quantities
Change control and prior notification of any change	Delivery, Incoterms, and transfer of risk
Deviation, out-of-specification, and complaint handling	Lead times and failure-to-supply remedies
Recall obligations and regulatory reports	Liability, indemnity, and insurance
Audit rights and assistance during inspections	Term, termination, and assistance for ease of transition
Subcontracting, site changes, and data integrity	Governing law, jurisdiction, and dispute resolution

The clauses not to concede

Both agreements are required before we can start any commercial supply.

Without the agreements, either your quality system or your commercial position will be unprotected.

These agreements must be signed before the relationship is formed.

Signing the agreements does not conclude the qualification effort.

Qualification Does Not End at Signature

Approval does not automatically change a closed file to an open file; KPIs, requalification cycles, and override triggers ensure it remains closed.

USP <1083>^[7] defines qualification as a lifecycle.

An approved supplier list will carry qualification, requalification, monitoring, and disqualification dates, together with KPIs describing key quality parameters of the supplied material.

In practice, monitor the following: incoming rejections, out-of-specification results, the reliability of CoAs, the trend of complaints and deviations, and how quickly the customer notifies changes.

Requalify on an appropriate risk basis, traditionally every one to three years, with critical API suppliers reviewed most frequently, and consider the following as overriding the calendar.

Trigger	Typical Response
Site relocation, ownership change, or new manufacturing site	Perform an immediate audit. Supply will be held until the review is complete.
Inspection resulted in 483, warning letter, or import alert	Review and request CAPA. Consider suspension.
Unapproved change made without prior notification	Review as a breach of the quality agreement. Investigate.
Contaminated material or confirmed data integrity breach	Suspend supply, quarantine stock, and consider disqualification.
Repeated batches found to be out-of-specification	Initiate a formal disqualification process with justification.
Increasing rejections, late submissions, or complaints	Implement additional CAPA actions and increase the frequency of audits.

What makes a qualification decision defensible is the ability to monitor a supplier’s performance and ensure they continue to meet expectations.

What a Fully Qualifiable Supplier Looks Like

The ideal supplier is the one who embraces the whole process.

A buyer should expect that from every supplier they engage with.

Here are some traits of the supplier who embraces the process.

It involves verifiable WHO-GMP and regulatory credentials which pass database checks.

They have a manufacturing site and an on-site QC laboratory that is open to an audit.

There are complete COAs, method validation documentation, and stability data.

There are DMF/CEP to support the buyer’s own filings.

The supplier is also willing to sign a quality agreement and has a provision for prior notice for any changes.

This is not a ‘buy from us’ offer. This should be the standard that API suppliers are held to.

It shows Actiza’s commitment to quality assurance APIs.

This is the standard that Actiza’s certifications, quality assurance and APIs pages are showing.

For those suppliers that you are qualifying for, Actiza’s contact page is the place to initiate the audit or the start of a qualification pack discussion.

This is basically the summation of the FAQs.

It shows what the FAQs distil into direct responses of verifiable, auditable and signing-quality agreements.

FAQ SECTION

Conclusion

Signing an import contract does not mean you begin doing business. An import contract is a deadline.

Once you sign an import contract, you retain the same obligations and limitations as you did before, but you have less ability to demand an audit, document, or term be included in the contract.

The work that protects you is the work done before: tier the risk, verify every credential at its source, audit the site, test the material yourself, close the findings.

Both a quality agreement and supply agreement must be executed prior to the first commercial batch being manufactured.

The order of steps shows API supplier qualification, and this makes the signature safe to do.

Suppliers that can be signed tend to make this process easy.

The suppliers that do not make this process easy have told you everything you need to know.

If you want to see what this process is like, go to Actiza Pharma‘s pages, APIs and contacts, and begin the process of an audit or qualification pack.