Most products are now made by someone other than the marketing authorisation holder, and most PQR findings at MAHs and contract manufacturers come from the gap between them. The manufacturer writes a review from the data it holds and does not hold the rest; the MAH receives a PDF, files it, and evaluates nothing. Both are then surprised when the inspector treats the PQR as absent. This guide sets out who is responsible for what under Chapter 7, what the agreement must say, what the MAH's evaluation has to consist of, and how the certifying QP draws on the PQR under Annex 16.
Chapter 7: contract giver and contract acceptor
EU GMP Chapter 7 governs outsourced activities. The contract giver is 'ultimately responsible' for ensuring processes are in place to assure the control of outsourced activities (7.3). The contract giver must assess the acceptor's suitability and competence (7.4), provide the acceptor with all the information needed to carry out the activity correctly (7.5), monitor and review the acceptor's performance (7.7), and review and assess the records and results related to the outsourced activities (7.9). The contract acceptor must have adequate premises, equipment, knowledge and experience (7.10) and must not subcontract without the giver's evaluation and approval (7.12). The written contract must specify who is responsible for each activity, including 'the production and control of the product quality review' where relevant, and must describe how the QP releasing each batch exercises full responsibility (7.14 to 7.16).
Applied to the PQR, this means: the contract manufacturer normally compiles and authors the review, because it holds the manufacturing and testing data. The MAH must supply what it holds (complaints received directly, variations, post-marketing commitments, market feedback, sometimes stability if it is run elsewhere). The MAH must then evaluate the review, not merely receive it, because paragraph 1.11 names the MAH explicitly and Chapter 7.9 requires the giver to assess the acceptor's records and results.
What the quality agreement must say
Paragraph 1.11 requires a technical agreement defining the parties' respective responsibilities in producing the PQR. Item (xii) of 1.10 requires the review itself to confirm that agreements are current. A quality agreement that says 'the manufacturer shall perform product quality reviews' and nothing else is the usual finding. The agreement should specify at minimum:
- Who authors the review, and which of the twelve items each party supplies data for, with the format and the date by which it is supplied.
- The review period and the deadline for the approved report, and how extensions are agreed.
- Who approves the report on each side, and what the MAH's evaluation consists of (a documented assessment, not a receipt).
- How actions are agreed, who owns them, and how their status is communicated between the parties before the next review.
- Whether the review is grouped, and who owns the grouping rationale.
- For a manufacturer supplying several MAHs with the same product, whether one review serves all and how MAH-specific data (complaints, variations) is segregated.
The MAH's evaluation
The MAH's evaluation is a document, signed and dated, that states the MAH has read the review, whether it agrees with the conclusions, whether the actions are adequate, and what the MAH will do with anything the review raises that requires a variation, a change in the artwork, a supplier decision or a market action. It should note anything the MAH holds that the manufacturer did not include. It becomes an input to the MAH's own management review under ICH Q10 3.2.4. A stamp saying 'received' is not an evaluation, and a PQR that the MAH cannot show it has read is, from the inspector's point of view, a PQR the MAH does not have.
The QP
Paragraph 1.11 makes the QP responsible for final batch certification, together with the MAH, responsible for ensuring the review is 'performed in a timely manner and is accurate'. Annex 16 describes what certification relies on: the QP must have personal knowledge of the product and process and must assure that the product has been manufactured and controlled in accordance with GMP and the marketing authorisation, drawing on the pharmaceutical quality system to do so. A QP certifying batches of a product whose PQR is a year overdue, or whose PQR concluded 'in control' over a body showing an adverse trend, is certifying without one of the pieces of evidence Annex 16 expects. In practice the QP should sign the PQR (or the MAH evaluation, at an MAH that does not manufacture), should have a documented mechanism for knowing when a PQR is overdue, and should be able to explain to an inspector how the PQR conclusion informed continued certification. Where the certifying QP is at the contract manufacturer and the MAH is elsewhere, the agreement must say how the MAH's evaluation reaches the QP.
Annex 16: what the certifying QP takes from the PQR
Annex 16 sets out what the QP must be satisfied of before certifying a batch for release: that it has been manufactured and controlled in accordance with GMP and the marketing authorisation, that the supply chain is known and audited, that deviations and investigations affecting the batch are closed, and that the sites and activities the QP is relying on are covered by written agreements. The QP may rely on the pharmaceutical quality system and on confirmations from others for activities they did not personally supervise, but Annex 16 expects that reliance to be justified and the QP to have ongoing assurance that it remains justified. The PQR is the record that provides that assurance across batches. Concretely, the QP should be able to show:
- Consistency: that the trend evaluation in item (ii) supports the statement, made at every certification, that the process is producing the product the dossier describes. A QP certifying against a PQR that found an unexplained shift, or against no PQR at all, is certifying on an assumption.
- Supply chain: that item (i) confirmed the active substance supply chain back to the registered manufacturer, and that the audits Annex 16 requires for each site in the chain were current in the period. Where item (xii) found an agreement out of date, the QP's reliance on that site is in question until it is corrected.
- Deviations and CAPA: that item (iv) evaluated whether the corrective actions for recurring deviations actually worked. Annex 16 allows certification with an unexpected deviation only where the impact is assessed and the batch still meets the authorisation; a PQR showing the same deviation nine times is evidence the deviation is no longer unexpected.
- Changes and variations: that items (v) and (vi) confirmed the site is manufacturing to the currently approved dossier, because a batch made to an unapproved change cannot be certified as compliant with the marketing authorisation.
- Imported product: for batches imported from a third country, that the PQR covers the third-country site's data, that the quality agreement routes it to the EU importer, and that the QP's reliance on the third-country site's audit and GMP equivalence is documented. Item (xii) applies to the importation agreement as much as to any other.
- Timeliness: that the QP has a documented mechanism for knowing when a PQR is overdue, because 1.11 makes timeliness the QP's responsibility together with the MAH, and an overdue review removes a piece of evidence Annex 16 expects the QP to have.
- APIs: that for the active substance, the ICH Q7 2.5 review (EudraLex Volume 4 Part II) was performed by the API manufacturer and its outcome reached the QP through the supplier qualification programme.
Module 6 of the course works through the responsibility split for three scenarios (MAH with in-house manufacture, MAH with a single CMO, CMO serving several MAHs), drafts the agreement clause and the MAH evaluation form, and builds the Annex 16 checklist the certifying QP runs against each year's PQR, including the imported-product case.