What EU GMP is
Good Manufacturing Practice is the set of regulations, guidelines and principles that define how medicinal products must be manufactured, controlled, tested and documented in order to be consistently safe, effective and fit for their intended purpose. In the European Union, GMP is not a voluntary quality programme or a commercial differentiator. It is a legal requirement embedded in pharmaceutical legislation, and it governs every stage of the manufacturing process from receipt of starting materials through to release of finished product.
For medical cannabis, EU GMP is the standard against which all facilities manufacturing, processing or importing cannabis products for pharmaceutical markets in Europe are assessed. A facility without EU GMP certification cannot legally supply cannabis medicines to EU pharmaceutical markets. The GMP certificate is issued at site level by the national competent authority of the country where the facility is located — INFARMED in Portugal, BfArM in Germany, IGJ in the Netherlands — and the certificate is recorded in the EMA's EudraGMDP database, which is publicly searchable by any supply chain partner, regulator or auditor.
The detailed requirements for EU GMP are published in EudraLex Volume 4: EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use. This document, maintained by the European Medicines Agency and regularly updated, is the primary reference source for all GMP compliance work in the European Union.
The legal basis
EU GMP is grounded in European pharmaceutical legislation. The foundational directives are Directive 2001/83/EC (medicinal products for human use) and Directive 2003/94/EC (principles and guidelines of GMP). These directives establish GMP as a legal obligation for all manufacturers of medicinal products for human use in the EU and for all importers of medicinal products from third countries.
Cannabis is classified by the European Medicines Agency as a medicinal product when intended for therapeutic use. This classification is the trigger for GMP applicability. It means that from the moment a cannabis product is positioned as a medicine — prescribed by a physician, dispensed by a pharmacy, used in a clinical context — the manufacturer of that product is operating under the full scope of EU pharmaceutical law, including GMP.
This classification also means that national cannabis laws do not substitute for pharmaceutical GMP requirements. A cannabis operator may hold a valid cultivation or processing licence under national legislation and still lack the EU GMP certification required for pharmaceutical supply. Both licences are necessary. They are not interchangeable.
Cannabis cultivators operating under Good Agricultural and Collection Practice (GACP) — the standard governing primary production of herbal medicinal plant materials under the EMA's 2006 GACP guideline — are not yet within the scope of EU GMP. The boundary between GACP and GMP is defined in EU GMP Annex 7 (Manufacture of Herbal Medicinal Products) and Part II of the EU GMP Guide. GACP governs the cultivation and primary processing steps up to and including drying and initial size reduction. EU GMP applies from the point at which the plant material enters manufacturing — typically when it is received by a licensed pharmaceutical manufacturer as a starting material. The interface between these two standards is one of the most practically significant areas for cannabis operators to understand and document correctly.
Who EU GMP applies to
EU GMP applies to every organisation in the pharmaceutical cannabis supply chain whose activities fall within the manufacturing or importation of medicinal products. In practice, for cannabis operations, this includes:
- Manufacturers and processors — companies that receive cannabis plant material and perform extraction, purification, formulation, packaging or any other manufacturing step on it. These facilities require a Manufacturing Authorisation (MA) from their national competent authority and must hold an EU GMP certificate covering the specific manufacturing operations they perform.
- Importers — companies that import finished or semi-finished cannabis products from third countries (Canada, Australia, Israel, Colombia, for example) into the EU for further processing or distribution. Importers require a Manufacturing Authorisation that includes importation as a licensed activity, and they are responsible for confirming that the manufacturing site in the exporting country meets EU GMP standards equivalent to those required in the EU. This confirmation is typically achieved through documentary review of the foreign site's GMP certificate and, where required, physical audit.
- Distributors involved in certain repackaging or relabelling activities — where distribution operations include repackaging or relabelling of medicinal products, these activities typically fall within the scope of manufacturing and require a Manufacturing Authorisation and GMP compliance.
Cannabis cultivators operating purely at the GACP level — growing, harvesting, drying, and supplying dried cannabis flower as a pharmaceutical starting material — are not within the scope of EU GMP for those activities. However, when the same organisation both cultivates and performs manufacturing operations (extraction, for example, or packaging into final dosage form), both GACP and GMP standards apply to the relevant stages of their process.
Core requirements of EU GMP
EU GMP is structured around the concept of the Pharmaceutical Quality System (PQS), as defined in EU GMP Part I Chapter 1 and ICH Q10. The PQS is the overarching management system that encompasses all elements of GMP and provides the framework within which they operate. Understanding GMP means understanding how these elements interconnect, not treating them as isolated compliance checkboxes.
1. Pharmaceutical Quality System
The PQS defines the quality objectives of the organisation, the processes needed to achieve them, the people responsible for operating them, and the mechanisms used to monitor, measure and improve performance. Under ICH Q10, the PQS is expected to be lifecycle-oriented — meaning it applies not just to routine manufacture but to product and process development, technology transfer and discontinuation as well. For cannabis operators, implementing a credible PQS typically requires building from scratch, since most have grown from agricultural or food-industry origins where quality management concepts are structured differently.
2. Personnel
EU GMP Part I Chapter 2 requires that manufacturing operations are carried out by a sufficient number of qualified people with the appropriate education, training and experience. The standard distinguishes between the Authorised Person (or Qualified Person in UK terminology) — who carries personal legal responsibility for batch certification and release — and the wider personnel structure covering production, quality control, quality assurance and management functions.
In cannabis operations, personnel GMP capability is consistently one of the highest-risk areas. Many staff have backgrounds in horticulture, food science or general manufacturing, where quality management concepts are structurally different from pharmaceutical GMP. Training programmes must be role-specific, demonstrably effective, and maintained through ongoing retraining. Training records must clearly link the individual, the training content, the date, the assessment result and the trainer or training source.
3. Premises and Equipment
Chapter 3 of Part I covers the physical environment within which manufacturing takes place. Premises must be designed, constructed, maintained and controlled so as to minimise the risk of error, cross-contamination and mix-up. Equipment must be designed, installed, maintained and qualified for its intended purpose.
For cannabis manufacturers, premises requirements frequently present practical challenges. Facilities that have been converted from non-pharmaceutical use — agricultural buildings, food processing facilities, industrial units — often require significant investment to achieve GMP-compliant standards. Specific requirements include controlled access, environmental monitoring, defined manufacturing zones with appropriate cleanliness standards, and separation of different product streams to prevent cross-contamination.
4. Documentation
Chapter 4 of Part I covers documentation and records — arguably the most culturally demanding aspect of GMP for organisations new to pharmaceutical standards. The documentation system must provide complete traceability of every material, every operation and every decision from receipt of starting material through to release of finished product.
Good Documentation Practice (GDP — not to be confused with Good Distribution Practice, which shares the same abbreviation) is the set of principles that govern how GMP records are created and maintained. Records must be made at the time of performance, not retrospectively. Errors must be corrected by crossing out the error with a single line, initialling, dating and writing the correct entry — never by overwriting or using correction fluid. For electronic records, the principles are equivalent, governed by EU GMP Annex 11 on Computerised Systems.
5. Production
Chapter 5 covers manufacturing operations themselves — the processes, procedures and controls that govern how product is made. Production operations must follow approved, validated manufacturing processes. Batch records must be completed in real time by the people performing operations. Process deviations must be formally recorded and investigated.
For cannabis manufacturers, process validation — the formal demonstration that a manufacturing process consistently produces a product meeting its specification — is an area of frequent weakness. Many operators have defined processes and perform routine production without having formally validated that the process is under control. This creates an inspection risk and, more practically, a quality risk: if the process has not been validated, there is no documented evidence that product quality is consistently achieved.
6. Quality Control
Chapter 6 covers the laboratory activities associated with testing materials and products to confirm that they meet their defined specifications. Quality Control (QC) must be independent of production — meaning the QC function reports through a different management line than the manufacturing function, so that quality decisions are made without production pressure influencing the outcome.
For cannabis products, QC testing includes identity testing (confirming the material is what it is claimed to be), potency testing (cannabinoid profile and quantification), microbial quality testing, heavy metals, pesticide residues, solvent residues and, where applicable, stability testing. The German Pharmacopoeia (DAB) and the European Pharmacopoeia now include specific cannabis flower monographs that define the testing requirements for cannabis medicines supplied to German and EU markets.
7. Quality Assurance and the Qualified Person
Quality Assurance (QA) is the overarching function responsible for ensuring that the entire quality system is operating as intended. The Qualified Person (QP) — a legally defined role under EU pharmaceutical legislation — is the individual with personal responsibility for certifying that each batch of medicinal product has been manufactured and controlled in accordance with the relevant requirements before it can be released for sale. In the EU, every manufacturing authorisation holder must have a named QP. The QP is named on the manufacturing authorisation and is personally liable for batch certification decisions.
8. Deviations, CAPA and Change Control
A functioning quality system must have formal mechanisms for managing events that deviate from approved procedures, for investigating root causes and implementing corrective and preventive actions (CAPA), and for controlling changes to processes, equipment, materials or procedures in a systematic way. These three elements — deviations, CAPA and change control — form the engine of continuous improvement in a pharmaceutical quality system. Their absence or weakness is consistently identified in regulatory inspection findings across the cannabis sector.
Common gaps in cannabis GMP operations
Based on inspection trends, audit findings and the known maturity profile of the European cannabis sector, the following gaps appear most frequently in cannabis manufacturing operations attempting to build or demonstrate GMP compliance.
Documentation culture
The most pervasive and most damaging gap is cultural rather than technical. Teams that come from agricultural or food industry backgrounds are accustomed to doing things and then recording what was done, often from memory, at a convenient time. In pharmaceutical GMP, this is not acceptable. Records must be made contemporaneously — at the time of performance, by the person performing the task. Retrospective documentation, estimated timings and copied entries are all inspection findings. Building the documentation discipline into an organisation requires sustained leadership commitment, not just procedural instruction.
Deviation management
Many cannabis operations raise deviations when something goes obviously wrong — a batch is out of specification, an equipment failure occurs. What they rarely do is raise deviations for procedural non-conformances, near-misses or minor process variations that fall within specification but outside the approved process description. A mature pharmaceutical quality system treats every departure from approved procedure as a deviation requiring investigation, regardless of whether the product was affected. This is not bureaucracy for its own sake — it is the mechanism by which systemic issues are identified before they cause product failures.
Supplier qualification
Cannabis manufacturers frequently receive starting materials — cultivation-stage cannabis, solvents, excipients, packaging components — from suppliers that have not been formally qualified. Supplier qualification under GMP requires assessment of the supplier's quality systems, review of relevant certificates and test data, and, for critical materials, audit of the supplier's facility. When a manufacturer cannot demonstrate that its suppliers have been qualified, there is no credible quality assurance for the starting materials entering its process.
Validation
Process validation, cleaning validation and equipment qualification are consistently underperforming areas in early-stage cannabis GMP operations. Facilities often have equipment that has been installed and is being used in routine production without formal Installation Qualification, Operational Qualification or Performance Qualification having been completed. Without qualification data, the facility cannot demonstrate that its equipment is performing as required and that the performance is stable over time.
The GACP-GMP interface
For vertically integrated cannabis operations — those that both cultivate and manufacture — the interface between GACP and GMP is rarely well documented. Annex 7 of the EU GMP Guide provides guidance on the transition point, but many operators have not formally defined where in their process GACP ends and GMP begins, have not documented this clearly in their quality system, and have not ensured that the material transfer between the two standards is formally controlled. Inspectors regularly ask to see the documented demarcation and the process controls at the handover point.
The GMP maturity journey
GMP compliance is not a binary state — a facility does not simply pass or fail GMP. It exists on a maturity continuum, and understanding where on that continuum a facility currently sits is the essential first step in planning credible improvement.
A useful framework for understanding GMP maturity in cannabis operations has five levels:
- Emerging (Level 1) — basic processes exist but are informal, undocumented or inconsistently applied. Quality management concepts are understood in principle but not systematically implemented. High variability in process outputs. Significant compliance gaps across most GMP elements.
- Developing (Level 2) — core documentation exists. SOPs are in place for major activities. Training programmes are initiated. Deviations are sometimes recorded. Quality management is reactive rather than proactive. Compliance achieved in some areas but significant gaps in others.
- Controlled (Level 3) — systems are established and consistently applied. Deviation management is functioning. CAPA is tracked. Change control is in place. Supplier qualification is partially implemented. The facility can demonstrate control of its manufacturing process, though some validation and documentation gaps remain.
- GMP Ready (Level 4) — robust systems and complete qualification and validation data. Deviation, CAPA and change control systems are mature and effective. QP function is in place or contracted. The facility can credibly support a GMP inspection and demonstrate pharmaceutical-grade manufacturing. This is the minimum standard for EU GMP certification and commercial pharmaceutical supply.
- Pharmaceutical Grade (Level 5) — continuous improvement is embedded in the quality culture. Risk-based thinking is applied proactively. Management reviews are meaningful and drive improvement. The quality system is a business tool, not a compliance exercise. This is the standard of a well-established pharmaceutical manufacturer.
Most early-stage cannabis operators entering pharmaceutical markets sit at Level 1 or Level 2. The journey to Level 4 — the threshold for EU GMP certification — typically requires 12 to 36 months of sustained effort, depending on starting point, available resources and the quality of implementation support.
Commercial consequences of GMP status
EU GMP certification has direct commercial consequences that go beyond regulatory compliance. Understanding these consequences helps operators prioritise GMP investment appropriately, particularly when capital and management bandwidth are constrained.
Market access
Without EU GMP certification, a cannabis manufacturer cannot supply pharmaceutical markets in Germany, Portugal, the Netherlands, the United Kingdom, France or any other European country that requires pharmaceutical-grade cannabis. Germany — the largest medical cannabis market in Europe, representing the majority of EU import volumes — requires EU GMP certification for all cannabis medicines. The same is true of the UK, which operates independently of EU regulation post-Brexit but accepts EU GMP as the quality standard for cannabis imports. Market access is the most immediate commercial consequence of GMP status.
Supply chain positioning
EU GMP certification changes the conversations available to a cannabis manufacturer. Certified facilities can enter into pharmaceutical supply agreements, be listed on approved supplier lists, and participate in pharmaceutical tender processes. Uncertified facilities cannot. In a market that is consolidating around a smaller number of large pharmaceutical-grade operators, GMP certification is increasingly the threshold requirement for commercial relevance.
Inspection confidence
Pharmaceutical buyers, distributors and retail pharmacy chains increasingly conduct their own supplier audits as part of supply chain qualification. A facility with a mature GMP system can approach these audits with confidence. A facility that is compliant on paper but has not embedded GMP culture will be exposed during a competent audit. Audit findings circulate within pharmaceutical supply chains and can affect commercial relationships beyond the immediate buyer.
Price and margin
EU GMP certified cannabis commands a significant price premium over non-certified product. The certification is not just a compliance label — it represents a quality assurance that pharmaceutical buyers are willing to pay for. Operators who invest in genuine GMP capability, rather than minimum compliance, are positioned to sustain margins in a market that is otherwise subject to commodity price pressure.
Frequently asked questions
Does GACP certification automatically lead to EU GMP?
No. GACP and EU GMP are separate standards with different scopes. GACP applies to cultivation and primary processing. EU GMP applies to manufacturing operations. An operator with GACP certification has demonstrated compliance with the agricultural quality standard but has not demonstrated pharmaceutical manufacturing capability. The GMP journey begins where GACP ends.
Can a cannabis company obtain EU GMP certification for cultivation?
EU GMP certification is not typically issued for cultivation activities. GACP is the applicable standard for cultivation. EU GMP applies to manufacturing operations — extraction, formulation, packaging, testing and related activities. Some operators have obtained manufacturing authorisations that cover both the post-cultivation manufacturing steps and the primary processing steps immediately following harvest, but cultivation itself is governed by GACP, not GMP.
How long does EU GMP certification take?
The timeline varies significantly depending on the starting state of the facility, the complexity of the manufacturing process, and the efficiency of implementation. From a standing start — where little quality infrastructure exists — a realistic timeline to GMP certification readiness is 18 to 36 months. Facilities with existing pharmaceutical quality infrastructure from other sectors (food, nutraceuticals, cosmetics) that are converting to cannabis manufacturing may be able to achieve readiness more quickly, but the pharmaceutical-specific requirements — particularly validation and qualified person function — should not be underestimated.
What happens during a GMP inspection?
A GMP inspection by the national competent authority involves a physical inspection of the manufacturing site, interviews with key personnel, and review of quality system documentation. Inspectors assess compliance against the requirements of EU GMP Part I (for finished product manufacturers) and EU GMP Part II (for active substance manufacturers). Findings are classified by severity — critical, major and other — and the facility is expected to respond with a CAPA plan addressing each finding within defined timeframes. Certification is typically issued once critical and major findings have been satisfactorily resolved.
Is EU GMP required for CBD products?
CBD products regulated as cosmetics, food supplements or novel foods in the EU are not subject to EU GMP as pharmaceutical products. However, CBD products positioned as medicinal products — either through marketing claims or formal medicine status — are subject to the full pharmaceutical GMP framework. The regulatory classification of the product, not its cannabinoid content, determines whether GMP applies.
Key takeaways
- EU GMP is a legal requirement, not a quality programme, for cannabis operators manufacturing or importing medicinal products in Europe.
- The legal basis is Directive 2001/83/EC and Directive 2003/94/EC. The technical requirements are in EudraLex Volume 4.
- GMP applies to manufacturers, processors and importers. It does not typically apply to cultivators, who are governed by GACP.
- The core GMP elements — PQS, personnel, premises, documentation, production, QC, QA and the QP function — must all be in place and operating effectively.
- Documentation culture, deviation management, supplier qualification, validation and the GACP-GMP interface are the most common gaps in cannabis operations.
- GMP maturity is a continuum from Level 1 (Emerging) to Level 5 (Pharmaceutical Grade). EU GMP certification requires Level 20 minimum.
- GMP status has direct commercial consequences: market access, supply chain positioning, audit confidence and price premium.
References
- European Commission, EudraLex Volume 4 — EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use
- Directive 2001/83/EC of the European Parliament and of the Council on the Community code relating to medicinal products for human use
- Commission Directive 2003/94/EC laying down the principles and guidelines of good manufacturing practice in respect of medicinal products for human use
- EMA/HMPC, Guideline on Good Agricultural and Collection Practice (GACP) for Starting Materials of Herbal Origin (EMEA/HMPC/246816/2005)
- ICH Q10 Pharmaceutical Quality System
- EU GMP Annex 7 — Manufacture of Herbal Medicinal Products
Related content
GMP vs GACP — Understanding the Difference Pharmaceutical Quality Systems Explained Cannabis Documentation and Good Documentation Practice EU GMP Implementation Checklist GMP Gap Assessment Template