On this page
Why no equipment is GMP or Part 11 on its own
GMP rules bind medicine manufacturers. The European Medicines Agency explains that authorities inspect manufacturing sites and then issue either a GMP certificate or a non-compliance statement. The certificate therefore belongs to the customer's site, not to the bioreactor or TFF system installed there.
Part 11 works the same way. Section 11.10 of the FDA rule is addressed to people who use systems to create, modify or maintain electronic records, and it asks them for controls such as validation, training of users and written policies. Some of those controls depend on the software, and others depend on the customer's own procedures.
Risky phrases and better ways to say them
Some websites in this sector repeat short phrases that sound good but that a QA team will not accept. The risk goes beyond the legal side. An expert buyer reads them as a sign of shallow regulatory knowledge and starts doubting the rest of the page. The table lists the most common ones with a more precise alternative.
| Risky phrase | Why it is a problem | More precise alternative |
|---|---|---|
| GMP certified equipment | GMP certificates are issued to manufacturing sites after an inspection | Equipment designed for GMP environments, with documentation to support qualification |
| Part 11 compliant software | Part 11 also requires procedures and training that depend on the customer | Software with features that help customers comply with Part 11 |
| Validated equipment | Qualification is the customer's responsibility and is approved at their site | FAT and SAT protocols and support for the customer's IQ and OQ |
| Annex 1 compliant | Annex 1 requires a site-wide contamination control strategy | Data and documents for the customer's contamination control strategy |
Can we call our software Part 11 ready?
If you do, explain what it means. A label like that without detail will not convince QA. Back it with a list of features, such as audit trail, user management and electronic signatures, and a matrix showing which requirements the software covers and which depend on the customer's procedures.
How to describe IQ, OQ and PQ support
Annex 15 of the EU GMP guidelines describes the qualification path, from the URS and design qualification through FAT, SAT, IQ, OQ and PQ. Point 2.6 says that when protocols come from a third party, site personnel must confirm they are suitable before approving them. The supplier supports and the customer decides.
On the website, explain what you deliver and who does what. For example, what the documentation package contains, whether you offer protocol templates for the customer to review and who runs the tests at FAT and on site. Also say which part stays with the customer, such as PQ, which under point 3.14 uses production materials or an equivalent substitute.
If a customer has qualified our equipment, can we say so?
Only with written permission, and precisely. The qualification belongs to the customer and their site, not to the equipment. You could say, for example, that the equipment runs in GMP plants for a given modality or country, as long as it is true and the customer agrees.
Want to know whether your website promises more than your equipment can prove? Leave your details and we will review the most sensitive claims.
Review my claimsHow to talk about audit trails and software
Describe concrete features. Sections 11.10 and 11.300 of Part 11 call for secure, computer-generated, time-stamped audit trails, authority checks so only authorised people can use the system, and controls over user IDs and passwords. Point 9 of EU Annex 11 adds that the reason for any change or deletion of GMP data should be documented and that audit trails should be reviewed regularly.
In points 3.3 and 3.4, Annex 11 also says that regulated users should review the documentation supplied with commercial products, and that information on the supplier's quality system should be available to inspectors on request. A matrix that maps each requirement to a software feature or a customer procedure answers many questions before the audit even starts.
What if a competitor says GMP certified on their website?
Do not copy it. Customers' QA teams know the difference, and an overstated claim can make them doubt all your documentation. A precise explanation of what you deliver makes you look more expert, and that counts in a purchase where regulatory risk is the main concern.
What to say about Annex 1 if you make single-use equipment or consumables
The revised Annex 1 on the manufacture of sterile medicinal products came into operation on 25 August 2023 and has been fully applicable since 25 August 2024. It asks each site for a contamination control strategy, and point 2.5 lists vendor approval among its elements, including suppliers of single-use systems. Point 8.134 states that assessing suppliers of disposable systems is critical to selecting them.
So what helps the customer is data. Points 8.134 to 8.137 of Annex 1 call for evaluating extractables and leachables profiles, system integrity during processing and evidence of sterilisation for each unit on receipt. If you can supply that information, say so and explain how it is delivered. It is far more useful than a general line about Annex 1.
Do we need a lawyer to review these claims?
For everyday wording, a QA or regulatory affairs person who knows the rules and the product is usually enough. Terms of sale, warranties and contracts should go through a lawyer. What matters most is that no claim goes live without someone qualified having seen the evidence behind it.
Who should review these claims before they go live
Every regulatory claim on the website, in catalogues and in sales decks needs evidence behind it and a QA person who has reviewed it. A simple register with the claim, the evidence and the review date stops each document from saying something different.
Review that register whenever a standard or a product changes, and share it with distributors so they do not turn a careful sentence into a bolder one when translating it. Marketing writes and structures, while QA and regulatory affairs have the final say on what gets promised.
