ICH Q7 – GMP for Active Pharmaceutical Ingredients (APIs)

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • API GMP • See also: GMP / cGMP, GxP, ICH Q10, 21 CFR 210/211, GAMP 5, 21 CFR Part 11

ICH Q7 is the globally harmonized Good Manufacturing Practice guide for Active Pharmaceutical Ingredients (APIs). It defines how to design, operate, and control chemical and biological API processes—from raw materials through intermediates to final API release—so that drug manufacturers receiving those APIs can consistently make finished dosage forms that meet regulatory expectations. Q7 supplements regional GMPs by focusing on API-specific risks: complex multi-step syntheses, microbial and cross-contamination hazards, solvent/reagent carryover, crystalline form control, trace impurities, and supply chain integrity. The guidance is intentionally technology-agnostic and risk-based; it expects firms to demonstrate that facilities, utilities, equipment, processes, and systems are fit for intended use, that changes are controlled, and that data and decisions are attributable and reliable under ALCOA+ principles.

“ICH Q7 is where API reality meets GMP discipline: process knowledge, tight controls, and clean, attributable data from receipt to release.”

1) What It Is (Unbiased Overview)

Q7 applies to the manufacture of APIs (including bulk drug substances) for human use, regardless of scale or route of synthesis (chemical, fermentation, cell culture, recovery, purification). It addresses where GMP begins (typically at the introduction of the starting material defined in the control strategy) and lays out expectations for materials and suppliers, buildings and utilities, equipment and cleaning, process controls and validation, laboratory controls, documentation and records, and change/CAPA systems. Because APIs can be potent, moisture- or oxygen-sensitive, or microbially vulnerable, Q7 stresses contamination prevention, robust cleaning validation, and appropriate environmental controls. It also recognizes modern digitalization: computerized systems that generate or maintain GMP records should meet Part 11 / Annex 11 expectations with protected audit trails.

2) Scope, Boundaries & Risk

Where GMP starts. Q7 distinguishes pre-GMP R&D from commercial or late-stage activities. GMP generally begins at the API starting material—the first point where the material is introduced with the intent for commercial API manufacture and is covered by supplier qualification and specifications. Upstream steps can still be risk-managed (e.g., impurity fate) but may not require full GMP controls. Risk-based scaling. Controls should reflect process stage and risk to quality. For sterile APIs or highly toxic/highly active compounds, more stringent facility segregation, pressure cascades, and cross-contamination controls are expected. For biological APIs, microbial controls and raw material traceability receive added focus. Risk identification techniques such as FMEA and HAZOP help target design and procedural controls.

3) Core Systems Under ICH Q7

• Materials & Supply Chain. Vendors of starting materials, reagents, and critical solvents require qualification; receiving is gated by Goods Receipt with quarantine, Incoming Inspection, and Identity Testing. Sampling is representative; status labels and inventory controls (e.g., FIFO/FEFO) prevent mix-ups and expiry use.
• Buildings, Utilities & Equipment. Layout supports clean flows of materials and personnel with segregation where needed; critical utilities (purified water, clean steam, nitrogen) are qualified and monitored. Major production and control equipment undergo IQ and broader IQ/OQ/PQ to prove fitness for use; changes are documented via Change Control.
• Cleaning & Contamination Prevention. Validated Cleaning ensures carryover of APIs, intermediates, and detergents remains below scientifically justified limits; campaign manufacturing and dedicated equipment are used where warranted. Cross-contamination control covers gowning, pressure cascades, and equipment/area status control.
• Process Controls & Validation. Critical steps and parameters are identified; IPC and PAT tools verify reaction progress, impurity removal, and crystallization endpoints. Process validation confirms reproducibility; ongoing capability is tracked via CPV using SPC control limits.
• Laboratory Controls. Methods for assay, impurities, residual solvents, and microbial/bio-burden (if applicable) are scientifically sound and, where appropriate, validated; reference standards are controlled; OOS/OOT results are investigated to root cause with CAPA.
• Documentation & Data Integrity. Master instructions and batch records are controlled; data meet ALCOA+ and are protected by audit trails. Archival supports the retention period (Data Retention & Archival).
• Quality System Elements. Deviations/nonconformances are investigated (NC→CAPA); periodic internal audits verify effectiveness; changes to process, equipment, or analytical methods are governed by Change Control.

4) Lifecycle & Technology Transfer

Q7 expects a deliberate transition from development to commercial control. Tech transfer packages define critical material attributes, reaction controls, impurity fate, and control strategy. Receiving sites use IQ/OQ/PQ, method verification, and pilot lots to confirm performance in local equipment and utilities. During commercial manufacture, trends (yields, impurity profiles, polymorph ratios) are monitored via CPV; signals trigger investigations and improvements routed through Change Control. If a process is discontinued, remaining inventory is managed under expiry rules and records are archived per policy.

5) Packaging, Labeling & Release

APIs are packaged to protect quality (light, moisture, oxygen barriers as needed). Labels identify API name, lot, retest/expiry date, storage, and status; reconciliation prevents mix-ups. API lots remain under Hold & Release until specifications are met and documentation is complete; release includes review of batch records, IPC results, deviations/CAPAs, and CoA conformance for the receiving drug manufacturer’s needs. For APIs delivered to integrated sites, Finished Goods Release concepts apply at the component level to enable timely downstream production.

6) Relationship to Regional Regulations & Standards

ICH Q7 complements regional laws such as 21 CFR 210/211 (finished drugs) by ensuring that APIs entering those systems are controlled. Where computerized systems underpin Q7 processes, apply GAMP 5-aligned CSV and Part 11 controls. The broader GxP framework—especially data integrity and supplier management—applies across the API lifecycle and through contract manufacturers (CMOs).

7) Common Findings & How to Avoid Them

• Undefined starting material. Ambiguity shifts risk upstream. Fix: clearly define the API starting material and justify the boundary with impurity fate studies and supplier controls.
• Inadequate cleaning validation. Carryover limits not scientifically justified. Fix: set MACO limits with toxicology and dose considerations; verify worst-case equipment and swab locations.
• Weak data integrity. Shared logins, manual transcriptions, gaps in audit trails. Fix: unique users, controlled templates, electronic capture with e-signatures, periodic reviews.
• Uncontrolled changes. Process “drift” without evaluation. Fix: formal Change Control with risk assessment, verification/validation plans, and effectiveness checks.
• Supplier blind spots. Starting material variability causes downstream failures. Fix: robust qualification, incoming testing, and identity confirmation for every lot, as applicable.
• Poor IPC strategy. Late discovery of failures. Fix: move checks upstream with IPC and PAT; monitor via CPV.

8) How This Fits with V5

V5 by SG Systems Global provides the digital plumbing to operationalize Q7. At Goods Receipt, lots are quarantined automatically; Incoming Inspection and Identity Testing generate controlled records with audit trails. Within eBMR, steps enforce weighed tolerances, device captures, and IPC gates; exceptions automatically open Deviation/NC with photo evidence and route to CAPA. Equipment and utilities records support IQ/OQ/PQ; validated software aligns to GAMP 5 and Part 11. Release is gated by Hold & Release rules; CoAs pull from the same controlled dataset for rapid customer supply.

9) FAQ

Q1. Does Q7 apply to intermediates?
Yes—once within the defined GMP boundary, intermediates are controlled with specifications, IPC, and status labeling to prevent mix-ups and ensure consistent conversion to API.

Q2. How strict are environmental controls for APIs?
They must be suitable for the process and risk. For non-sterile chemical APIs, particulate and microbial controls focus on preventing cross-contamination; for biological APIs, environmental monitoring and aseptic concepts may be necessary.

Q3. Is process validation always required?
Q7 expects validated processes. The approach (traditional, continuous process verification) should be justified; capability is then maintained via CPV.

Q4. What documentation proves compliance?
Controlled master instructions and batch records; equipment/utility qualification; cleaning validation; analytical method validation/verification; deviation/CAPA logs; supplier files; release packages (including CoA).

Q5. How are computerized systems handled?
Systems that create/maintain GMP data should be validated per GAMP 5, controlled via Change Control, and meet Part 11 requirements, including secure audit trails.

Q6. How do contract manufacturers fit?
Quality agreements define responsibilities; sponsors audit performance and ensure that PQS elements (deviation/CAPA, incoming controls, cleaning, validation) meet Q7 expectations.

Related Reading
• Foundations: GMP / cGMP | GxP | ICH Q10 | GAMP 5 | 21 CFR Part 11
• API Operations: Goods Receipt | Incoming Inspection | Identity Testing | In-Process Controls | Cleaning Validation | Cross-Contamination Control
• Quality System: Change Control | CAPA | Internal Audit | CPV | Audit Trail (GxP) | Data Retention & Archival