Quality Certifications for Pharma: What Buyers Should Actually Check

A manufacturer shows you a certificate with a fancy logo and the words "GMP Certified" in bold type. Do you trust it? Most buyers do. Most buyers shouldn't -- at least not without checking.

Pharma quality certifications are confusing by design. There are dozens of them, issued by different authorities in different countries, with different scopes and different levels of rigor. Some are genuinely hard to get and mean something. Others are barely worth the paper they're printed on. And a few that people think exist -- like an "FDA GMP Certificate" -- don't actually exist at all.

This guide breaks down what each certification actually means, how much it costs to get, how to verify it's real, and what it tells you (and doesn't tell you) about a manufacturer's quality.

The Certification Hierarchy: Not All GMP Is Equal

There's a rough hierarchy of pharmaceutical manufacturing certifications, from most stringent to least. This ranking reflects the difficulty of obtaining the certification and the rigor of the inspection process.

The cost ranges are wide because they depend on facility size, dosage form complexity, and starting condition. A small oral solid dosage plant that already has Schedule M compliance will spend far less getting to EU-GMP than a large sterile injectable facility starting from scratch.

Let's go through each one in detail.

US FDA: What People Get Wrong

The FDA does not issue GMP certificates. Full stop. This is the single biggest misconception in Indian pharma, and it catches buyers all the time.

Here's what actually happens. When the FDA inspects a manufacturing facility, the inspection results in one of three classifications:

• NAI (No Action Indicated): No significant deviations found. This is the best outcome.
• VAI (Voluntary Action Indicated): Some deviations found, but not serious enough to require regulatory action. The manufacturer should address them voluntarily.
• OAI (Official Action Indicated): Serious deviations found. This can lead to warning letters, import alerts, or consent decrees.

That's it. There's no certificate. There's no "FDA GMP Approved" document. If a manufacturer shows you a document that says "FDA GMP Certified," it's either a self-created marketing document or an outright fabrication. Either way, it's a red flag.

What manufacturers legitimately have is an FDA Establishment Identifier (FEI number) and a track record of inspections. You can check both on the FDA's public database at datadashboard.fda.gov. Look up the facility, check the inspection history, and see the classification for each inspection.

The cost of achieving FDA compliance is high because it's not just about the facility -- it's about the entire product approval pathway. Each ANDA (Abbreviated New Drug Application) costs $1 million to $5 million or more to prepare, including bioequivalence studies, stability data, and the manufacturing validation. The facility investment is on top of that.

India has over 1,300 FDA-registered facilities. But registered and inspected are different things. A facility can be registered without ever having been inspected. Check the inspection history, not just the registration.

EU-GMP: The Qualified Person Requirement

EU-GMP certification is issued by national competent authorities of EU member states (like MHRA in the UK, BfArM in Germany, or ANSM in France). For non-EU manufacturers wanting to export to Europe, the inspection is conducted by the EU authority, often at the request of a European importer who holds a Manufacturing Importation Authorisation (MIA).

The distinctive feature of EU-GMP is the Qualified Person (QP) requirement. Every batch released for the EU market must be certified by a QP -- an individual with specific qualifications who takes personal legal responsibility for the batch. There's nothing quite like this in the FDA system.

EU-GMP certificates are searchable on the EudraGMP database. This is your primary verification tool. If a manufacturer claims EU-GMP certification and doesn't appear in EudraGMP, either the claim is false or the certificate has expired. There's no third option.

Cost ranges from $300,000 to $2.5 million, and the timeline runs 12-24 months. The cost is driven largely by facility upgrades (if needed) and the extensive documentation requirements. EU inspectors are thorough with documentation review and will spend significant time on your Pharmaceutical Quality System.

WHO-GMP vs. WHO Prequalification: Two Very Different Things

This confusion causes real problems, so let's be precise.

WHO-GMP (Certificate of Pharmaceutical Product / COPP)

WHO-GMP is a certification issued by your national regulatory authority -- in India's case, CDSCO. It says: "This facility has been inspected and found to comply with WHO Good Manufacturing Practices." The inspection is conducted by CDSCO and state inspectors, not by WHO directly.

WHO-GMP is the baseline certification for exporting to most developing countries. African nations, Southeast Asian countries, and Latin American regulators typically require a COPP as part of their import registration requirements. Over 2,000 Indian facilities hold WHO-GMP certificates.

It costs $70,000-$650,000 depending on your starting point, and takes 8-16 months.

WHO Prequalification

WHO Prequalification is something entirely different. Here, the World Health Organization itself -- through its Prequalification Team based in Geneva -- directly assesses and inspects the manufacturer. It's not a national authority acting on WHO's behalf. WHO's own inspectors visit your facility.

WHO Prequalification is required for products procured by UN agencies (UNICEF, UNDP), the Global Fund to Fight AIDS, Tuberculosis and Malaria, and similar international procurement bodies. If you want to sell antiretrovirals, antimalarials, or vaccines through these channels, you need WHO Prequalification. A WHO-GMP certificate alone won't do it.

The program has been remarkably cost-effective for global health. Studies have found it saved $30-40 for every $1 spent on the program, primarily through enabling competition from qualified generic manufacturers that drove prices down.

WHO Prequalification costs $200,000 to $1 million and takes 12-24 months. The assessment includes a detailed dossier review (product-by-product, not just facility-level) and a GMP inspection by WHO inspectors against WHO standards. The bar is high. Failure rates on first inspection are significant.

PMDA (Japan): The Hardest Ticket

Japan's PMDA is widely considered the most stringent pharmaceutical regulatory authority in the world. Even stricter than the FDA in several respects. PMDA inspections are exacting, with particular attention to process validation, cleaning validation, and manufacturing consistency.

Very few Indian manufacturers have successfully passed PMDA inspections. Those that have -- companies like Divi's Laboratories, Lupin, and a handful of others -- view it as a competitive moat. If you can pass a PMDA inspection, you can pass any inspection in the world.

Cost: $500,000 to $3 million or more. Timeline: 24-36 months. And that's assuming your facility is already at a high baseline when you start.

Schedule M: India's Domestic Standard

Schedule M of the Drugs & Cosmetics Rules is the minimum legal requirement for any pharmaceutical manufacturer in India. The 2024 revision significantly raised the bar, aligning Schedule M more closely with WHO-GMP and PIC/S standards.

The revised Schedule M introduced requirements for Quality Risk Management, Pharmaceutical Quality Systems, and Product Quality Reviews that weren't explicitly mandated before. It also tightened HVAC requirements, water system standards, and validation expectations.

Compliance deadlines were set at June 28, 2024 for large manufacturers and January 1, 2026 for MSMEs. No further extensions have been announced.

Cost of compliance ranges from $65,000 to $620,000. For a facility that was already operating under the old Schedule M, the upgrade cost is primarily in documentation, system upgrades, and training. For a new facility, it's built into the capital cost.

Schedule M is the entry-level certification. It tells you a facility meets India's domestic regulatory requirements. For export-oriented manufacturing, you'll need WHO-GMP at minimum.

PIC/S: The Mutual Recognition Club

The Pharmaceutical Inspection Co-operation Scheme (PIC/S) is not a certification per se. It's a cooperative arrangement among 56 regulatory authorities worldwide that aims to harmonize GMP inspection practices. PIC/S members include the FDA, MHRA, TGA, Health Canada, and most European regulators.

When a regulatory authority is a PIC/S member, its inspections are more likely to be recognized by other PIC/S members. This reduces duplicate inspections and makes regulatory approvals faster across member countries.

India is currently an observer to PIC/S, not a full member. CDSCO has been working toward full membership for years, and the revised Schedule M was partly designed to align with PIC/S standards. Full PIC/S membership for India would be significant -- it would mean CDSCO inspections could be more readily accepted by other PIC/S members, reducing the inspection burden on Indian manufacturers.

For buyers, PIC/S membership of a manufacturer's national authority adds a layer of confidence. It means the inspections follow internationally harmonized standards.

ISO Certifications: Complementary, Not a Replacement

ISO certifications show up on a lot of manufacturer profiles. Let's clarify what they mean in pharma.

• ISO 9001 (Quality Management System): A general quality management standard. Useful, but it's not pharma-specific. A company can be ISO 9001 certified and still fail a GMP inspection badly. ISO 9001 doesn't cover pharma-specific requirements like process validation, stability testing, or contamination control.
• ISO 14001 (Environmental Management System): Covers environmental management. Important for sustainability reporting but tells you nothing about product quality.
• ISO 22000 (Food Safety Management System): Relevant if the manufacturer produces nutraceuticals or dietary supplements. It covers food safety hazards through HACCP principles. Not relevant for pharma products.

ISO certifications are issued by accredited certification bodies, not by regulatory authorities. A manufacturer with ISO 9001 but no GMP certification is like a restaurant with a business license but no food safety permit. One doesn't replace the other.

That said, ISO 9001 on top of GMP certification shows that a manufacturer takes quality management seriously beyond the minimum regulatory requirement. It's a positive signal, just not sufficient on its own.

NAFDAC and African Markets

Nigeria's NAFDAC (National Agency for Food and Drug Administration and Control) deserves specific mention because Nigeria is the largest pharmaceutical market in Africa, and many Indian manufacturers target it.

NAFDAC's GMP guidelines are aligned with PIC/S standards. The agency issues GMP certificates with a 3-year validity period. NAFDAC conducts its own facility inspections, including overseas inspections of manufacturing plants in India and China.

The broader African story is the African Medicines Agency (AMA). The AMA treaty became effective in November 2021 after the required number of African Union member states ratified it. The first Director General was appointed in June 2025. AMA aims to harmonize pharmaceutical regulation across the African Union -- if it succeeds, it could eventually mean a single regulatory pathway for 55 countries instead of 55 separate ones.

That's still years away from practical reality. But for manufacturers thinking long-term about African markets, tracking AMA's development is worth your time.

How to Verify Certifications: A Practical Checklist

Verification is where most buyers fall short. Here's exactly what to check and where.

Red Flags for Fake or Misleading Certifications

Counterfeiting of quality certificates is a real problem. Research shows 73% of counterfeit detection failures happen because the buyer relied on just one verification method. Always cross-check.

Here's what should raise your alarm:

• Certificate not in any verifiable database. If an EU-GMP certificate doesn't show up in EudraGMP, it's not real. Period.
• Wrong format. Official certificates from regulatory authorities follow specific formats. If the document doesn't match the format of known authentic certificates from the same authority, question it.
• Misspelled authority name. This happens more often than you'd think. "Unitd States Food and Drug Adminstration" on a header should end the conversation immediately.
• Scope mismatch. A manufacturer shows you an EU-GMP certificate for oral solid dosages, but they're quoting you on sterile injectables. The certificate doesn't cover the product you need. Certificates are scope-specific.
• "FDA GMP Certified" anywhere on the document. As discussed, the FDA doesn't issue GMP certificates. Any document claiming this is fabricated or, at best, deeply misleading.
• Expired certificates presented without context. Certifications expire. A WHO-GMP certificate from 2021 is no longer valid. Always check the validity dates.

When evaluating manufacturers on GMP Finder, we verify certifications against public databases where possible. But you should still conduct your own verification for any manufacturer you're seriously considering.

How Certifications Affect Pricing

This is where certifications stop being abstract and start hitting your margin calculations.

A manufacturer with WHO-GMP certification can typically command 15-30% higher pricing compared to a facility with only domestic Schedule M compliance. The premium reflects both the cost of maintaining certification and the access to export markets that WHO-GMP provides.

FDA and EU-GMP approval enables a far larger premium: 2-5 times the price of domestically certified products for the same molecule and dosage form. This isn't just about quality perception. FDA-approved facilities have genuinely higher operating costs -- more extensive testing, larger QA teams, more rigorous validation, and the overhead of maintaining readiness for unannounced FDA inspections.

A study of Nigerian pharmaceutical manufacturers found that achieving WHO-GMP certification had a cost-benefit ratio of 5.3x -- meaning the additional revenue from export market access was 5.3 times the investment required to achieve and maintain the certification. That's a compelling ROI, and it explains why so many Indian manufacturers invest in WHO-GMP even when their domestic business doesn't require it.

If you're a buyer, these premiums are what you're paying for. A WHO-GMP facility charges more than a Schedule M facility because it genuinely costs more to operate. The question is whether the certification matches what you actually need. If you're distributing only in India, paying a premium for an EU-GMP facility doesn't make sense unless you're specifically buying quality assurance that goes beyond domestic requirements.

What Certification to Require, Based on Your Situation

Let's get practical. Here's what you should require from a manufacturer based on where you plan to sell.

Selling in India only

Schedule M compliance is the legal minimum. Any facility with an active Form 25 or 28 license meets this. If you want higher quality assurance, look for manufacturers that also hold WHO-GMP or, better yet, have passed EU or FDA inspections for other products even if you don't need those certifications for your specific product. A facility that maintains FDA standards across the board will apply those standards to your products too.

Exporting to Africa, Southeast Asia, or Latin America

WHO-GMP (COPP) is effectively mandatory. Many importing countries won't register your product without it. Some markets -- Nigeria, South Africa, Kenya -- may also require their own inspections on top of the COPP.

Exporting to the EU

EU-GMP certificate required. No exceptions. The certificate must cover the specific dosage form and product type you're manufacturing. A general EU-GMP certificate for oral solids doesn't cover sterile injectables.

Exporting to the US

FDA compliance required, demonstrated through inspection history (NAI or VAI classification). Plus your product-specific ANDA or NDA approval. Remember: the facility compliance and the product approval are two separate things. You need both.

Exporting to Japan

PMDA compliance required. This is the highest bar and the smallest number of Indian manufacturers meet it. If you're targeting Japan, your shortlist of potential manufacturers is very short.

Due Diligence Beyond Certifications

Certifications tell you that a facility met standards at the time of inspection. They don't tell you what's happening today. Here's what else you should check.

Recent batch rejection rates. Ask for the last 12 months of batch disposition data. What percentage of batches were rejected? What were the reasons? A manufacturer that won't share this is either hiding something or doesn't track it -- both are problems.

CAPA closure rates. How quickly does the manufacturer close Corrective and Preventive Actions? A facility with 50 open CAPAs older than 90 days has a systemic problem regardless of what their certificate says.

Customer audit reports. Ask if other customers have audited them recently and if they'll share redacted findings. A facility that regularly hosts customer audits is generally more comfortable with scrutiny.

Staff turnover in QA/QC. High turnover in quality roles is a warning sign. It often means the quality culture is poor, pay is below market, or management overrides quality decisions. Any of those should concern you.

Supply chain for raw materials. Where do they source APIs (if they're a formulator) or KSMs (if they're an API manufacturer)? Do they qualify their suppliers? How do they handle supplier changes? A facility with great GMP but a weak incoming materials program is a ticking time bomb.

If you're evaluating multiple manufacturers simultaneously, submit a quote request through GMP Finder. We can help you identify manufacturers that match your certification requirements, so you can focus your due diligence on a qualified shortlist instead of starting from scratch.

The Bottom Line

Quality certifications are necessary but not sufficient. A WHO-GMP certificate tells you a facility passed an inspection on a specific date against specific criteria. It doesn't guarantee every batch will be perfect. It doesn't mean the facility has a strong quality culture. And it definitely doesn't mean you can skip your own due diligence.

Use certifications as a filter, not as a final answer. Start by requiring the certification that matches your target market. Verify it against the official database. Then go deeper -- audit the facility, review their data, talk to their quality team, check their regulatory history.

The manufacturers who are genuinely good at quality will welcome your scrutiny. The ones who resist it are telling you something important.