ICH Q7 Explained: What It Covers and How to Check a Supplier

ICH Q7 is the good manufacturing practice (GMP) guide for active pharmaceutical ingredients (APIs) used in human drug products, issued by the International Council for Harmonisation (ICH). Q7A was its earlier code. The Step 4 text dated 10 November 2000 was renumbered Q7 in November 2005, so Q7 and Q7A are one guide (ICH Q7 guideline).

The guide applies to APIs made by chemical synthesis, extraction, cell culture or fermentation, recovery from natural sources, or a combination (section 1.3). Its boundary is the API starting material: a raw material, intermediate or API "incorporated as a significant structural fragment into the structure of the API." GMP applies from the point the starting material enters the process, and the guide "does not apply to steps prior to" it. Earlier steps still need "an appropriate level of controls", and the starting material is normally defined in the regulatory filing and approved in review (FDA Q7 Questions and Answers, 1.1).

The "2018" document is that Questions and Answers (Q&A) companion. ICH endorsed it in June 2015, FDA published it in April 2018, and the Q7 text itself is unchanged.

The guide also requires a quality unit: a group independent of production whose main duties include "releasing or rejecting all APIs" and which cannot delegate them (paragraph 2.22).

ICH Q7 is guidance that FDA uses as its inspection yardstick, not a law. FDA states that its guidance documents "do not establish legally enforceable responsibilities" (FDA Q7 Questions and Answers). The legal hook is section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, under which a drug made without current good manufacturing practice (CGMP) is adulterated.

FDA's API inspection program, 7356.002F, states that "ICH Q7 represents FDA's current thinking on CGMP for APIs" and that API and related manufacturing and testing facilities that follow it "will generally be considered in compliance with the statutory CGMP requirement." Investigators "should use ICH Q7 as a guideline for inspecting API manufacturers and related facilities" (FDA Compliance Program 7356.002F). As of 1 August 2025, the program adds elements of ICH Q9(R1) on quality risk management, Q10 on the pharmaceutical quality system and Q12 on product lifecycle management, plus control of hazardous impurities. It took effect on 2 September 2025.

Other inspectorates work from the same text. The Pharmaceutical Inspection Co-operation Scheme (PIC/S) publishes Q7 as Part II of its GMP guide (PIC/S PE 009-18, Part II). Proof of compliance therefore sits in inspection outcomes: FDA classifications and warning letters, and in Europe the GMP certificates and non-compliance statements held in EudraGMDP, the European Union's database of manufacturing and distribution authorizations. World Health Organization GMP (WHO-GMP), a drug master file (DMF) and a certificate of suitability to the European Pharmacopoeia (CEP) each answer a different question from Q7.

ICH Q7 covers every party after the original manufacturer, up to the drug product maker. Section 17 applies to "any party other than the original manufacturer who may trade and/or take possession, repack, relabel, manipulate, distribute or store an API or intermediate" (17.10). The original manufacturer is "the facility where the final purified API/intermediate is produced"; later drying, milling or sieving does not change that (Q&A 17.4).

Section 17 is short. We counted the word "should" in the numbered paragraphs of sections 2 to 19 of the Step 4 text and found about 488 occurrences (a text-search count, approximate). Section 11 (laboratory controls) has 59, or 12%. Section 17 has 18, or 3.7%, in 15 numbered paragraphs. A short section governs every intermediary, and the industry interpretation published by the Active Pharmaceutical Ingredients Committee of Cefic (APIC) reads "should" in 17.20 as "must" (APIC "How to do" document, version 17).

An ICH Q7 failure usually looks like a laboratory or release failure that a Certificate of Analysis (CoA), the batch test report, cannot expose on its own. FDA warning letter 320-26-101, issued 13 July 2026 to Shimoga Chemicals of Sangli, Maharashtra, followed an inspection on 19 to 23 January 2026. The firm makes clomiphene citrate, to the United States Pharmacopeia (USP) standard, "for U.S. distribution, intended for pharmacy compounding" (FDA warning letter).

The batch with the unreported result was released and distributed to the US market. FDA listed the firm on Import Alert 66-40 on 2 June 2026. In our inference, a CoA for that batch would have carried the reported result, which is why a CoA alone is weak evidence. This is one plant, and the letter says nothing about the sector.

Import Alert 66-40 is FDA's list of foreign drug firms whose shipments can be detained without physical examination after a GMP failure, and it is checkable. Our own count, approximate: on 3 October 2026 we copied the list as revised 1 October 2026, treated the same firm name and country as one firm, and took countries from the addresses. That gave 458 distinct firm entries, 158 in China and 103 in India. Of them, 45 have a latest listing date of 2 October 2025 or later, 17 in China and 10 in India. The list covers all drug firms, not only API makers, and counts may be off by a few entries where a firm appears under variant names.

Ask for each item in writing and score it pass or fail; one fail means resolve it before ordering. Tests 1 to 4 come from the guideline's paragraphs. Tests 5 to 7 are our recommendations.

1. Can the supplier name the plant and the batch it made?

Pass: you receive the original manufacturer's name and address and that plant's batch number in writing, matching the CoA, container label and shipping documents (17.20, 17.61). Fail: only a trading company's name, no batch number, or any mismatch. Paragraph 17.62 also requires the supplier to give the original manufacturer's identity to regulators on request.

2. Is the Certificate of Analysis the plant's own?

Pass: the CoA is dated and signed by the plant's quality unit and shows the plant's name, address and telephone number (11.43). If an agent reissues it, the new CoA names the testing laboratory, references the original batch certificate and attaches a copy (11.44). Fail: the plant's results retyped on a trader's letterhead, which APIC calls unacceptable.

3. Was anything done to the material after it left the plant?

Pass: a written statement that nothing was, or a description of each repacking, relabeling, drying, milling or sieving step, with the site and the written agreement (Q&A 17.2). Distributors add labels and do not remove the original; repackers and relabelers may replace it with justification, provided the original manufacturer's details reach you (Q&A 17.3). Fail: an undeclared step, or a label that hides the original manufacturer.

4. Who releases each batch, and who tells you about changes?

Pass: a written quality agreement states that the plant's quality unit releases the batch (2.22, 16.12) and that process, site, test-method or specification changes pass to you along the chain (Q&A 13.1; 17.60). Fail: verbal assurances only.

5. Does your own testing match the CoA?

Pass: all three of the first lots meet every CoA specification limit, and each assay result is within the testing laboratory's stated method variability of the CoA value. Fail: any out-of-specification result, or a lot-to-lot difference the supplier cannot explain in writing. Paragraph 7.31 asks API manufacturers to fully analyze at least three batches of a supplier's material before reducing testing, and to check CoA reliability at regular intervals; applying that to every API you buy is our recommendation. Data integrity problems like those in the warning letter cannot be seen on a CoA, which is why independent testing counts. Our page on API quality testing by HPLC, infrared spectroscopy and mass spectrometry describes the methods behind common CoA results.

6. What do regulators' public records show for the plant?

Pass: the plant appears in FDA's Data Dashboard (search by firm name or FDA Establishment Identifier, FEI), its latest inspection is not classified Official Action Indicated (OAI, FDA's classification for serious violations), and it is absent from Import Alert 66-40 and FDA's warning letters. For EU supply, EudraGMDP shows a current GMP certificate and no non-compliance statement. Fail: an alert listing, an unresolved warning letter or a non-compliance statement. A plant with no inspection record is not a fail, but then your own or a third-party audit is the only evidence.

7. Is the stated end use a human drug product?

Pass: the supplier states the intended use in writing, and you have confirmed local registration and import authorization for it. Fail: material described as research-only or veterinary-only is offered as a pharmaceutical-grade API. Q7 applies to APIs "for use in human drug (medicinal) products" (1.3), so a "Q7 compliant" claim about research-only material means nothing.

Aarise Pharmaceuticals publishes this page and is among the suppliers these checks apply to. We are a supplier, sourcing partner and distributor of APIs for importers, distributors, generic drug manufacturers and contract formulators, and we expect buyers to run the seven checks on us.

We make the CoA, specifications and safety data sheet (SDS/MSDS) available where applicable. Sample and evaluation quantities are confirmed product by product, so the three-lot comparison in check 5 depends on availability. Supply capacity and the approved manufacturing source also depend on the product. The plant, quality-release and change-notification terms behind checks 1 to 4 are confirmed in the quotation or proforma invoice. Regulatory status and permitted end use are determined product by product, and buyers confirm local registration and import authorization before supply (check 7).

A request for quotation (RFQ) should state the product or CAS number (Chemical Abstracts Service registry number), quantity, destination, grade or purity, documents needed, payment terms and Incoterms (international trade terms). Prices are quoted per product on request. Send your RFQ with the seven checks to sunil@aarisepharma.com or WhatsApp +91 9899783330.