ANVISA RDC 301/2019 – Brazilian GMP Requirements for Medicinal Products

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated December 2025 • GMP, QMS, QRM, Process Validation, CPV, Data Integrity • Regulatory Affairs, QA, Operations, Engineering, IT, QP/Responsible Pharmacists

ANVISA RDC 301/2019 is Brazil’s core GMP regulation for medicinal products, aligning the country’s requirements with PIC/S PE009 and modern ICH concepts. Issued by ANVISA (Agência Nacional de Vigilância Sanitária), it replaces older GMP rules and sets detailed expectations for facilities, pharmaceutical quality systems, validation, documentation, change control, and data integrity. For Brazilian manufacturers and global MA holders sourcing from Brazil, RDC 301 is a step-change: it pushes plants beyond “basic GMP” towards the same type of lifecycle, risk-based control seen in EU and WHO GMP. Sites that only aim to “pass RDC 301” will struggle under SRA inspections; sites that embrace it can position themselves as credible global suppliers.

“RDC 301 is Brazil saying: ‘If you want to be a global player, you need a global-quality GMP system, not just a clean facility and some SOPs.’”

1) What ANVISA RDC 301/2019 Actually Is

RDC 301/2019 is an ANVISA resolution that codifies GMP requirements for the manufacture, packaging, control, storage and distribution of medicinal products in Brazil. It is based on the PIC/S PE009 GMP Guide and replaces previous Brazilian GMP regulations that were less explicit in quality-system and risk-based concepts. The resolution is legally binding: manufacturers operating in Brazil, and those exporting to Brazil, must comply to obtain and maintain GMP certification. In practice, RDC 301 is the benchmark used by ANVISA inspectors during national and foreign inspections and by companies when designing their quality systems and facilities.

2) ANVISA’s Role and Enforcement Approach

ANVISA is Brazil’s national health surveillance agency, overseeing medicines, biologics, medical devices, food and other regulated products. For medicines, ANVISA conducts GMP inspections of Brazilian sites and, increasingly, foreign facilities that supply the Brazilian market. RDC 301 provides the regulatory basis for those inspections. Enforcement mechanisms include GMP certificates (CEFs), corrective action requests, restrictions or conditions on licences, import controls, and, in serious cases, suspension or cancellation of authorisations. ANVISA also participates in international networks, so findings under RDC 301 can influence, and be influenced by, other regulators’ views of a site.

3) Structure – Alignment with PIC/S and EU GMP

RDC 301 is structured into chapters very similar to PIC/S PE009 and EU GMP Part I: pharmaceutical quality system, personnel, premises and equipment, documentation, production, quality control, contract manufacture and analysis, complaints and product recall, self-inspection, and product and technology-specific annexes (e.g. sterile products, biologicals, radiopharmaceuticals). This structure makes it easier for Brazilian sites to benchmark against European or PIC/S expectations and for global MA holders to evaluate Brazilian partners. The alignment also signals ANVISA’s intention to be recognised as a peer regulator rather than a regional outlier.

4) Pharmaceutical Quality System (PQS) in RDC 301

RDC 301 gives central prominence to the PQS, integrating elements of ICH Q10. It expects management to be fully engaged in quality governance, with defined roles, responsibilities and cross-functional processes for change management, deviations, CAPA, risk assessment and continual improvement. Quality cannot be delegated solely to QC or a documentation department; it must be built into each lifecycle stage. For many sites, this means formalising existing practices into coherent systems and ensuring that PQS processes are used in decisions—not just implemented for inspection day.

5) Risk Management – Moving from Checklists to QRM

In line with ICH Q9, RDC 301 expects manufacturers to apply quality risk management throughout the product lifecycle: development, tech transfer, commercial manufacture, changes and discontinuation. That includes using structured tools (e.g. FMEA, HACCP, risk registers) to support decisions on process design, control strategies, sampling plans, investigations and CAPAs. In inspections, ANVISA increasingly looks for evidence that risk assessments are real (current, used, reviewed) rather than retrospective justifications. Risk-based thinking is also important for inspection scheduling, with higher-risk processes and products receiving more frequent attention.

6) Premises, Equipment and Utilities – Designed for Control

RDC 301’s chapters on premises and equipment emphasise prevention of cross-contamination, mix-ups and errors. Requirements include appropriate design and maintenance of buildings, material and personnel flows, environmental control, and qualification of HVAC, water and other critical utilities. For sterile and biological products, expectations align with EU Annex 1 concepts: segregation, cleanroom classification, airflow patterns and environmental monitoring. ANVISA inspectors will expect to see qualification documentation, change-control records and routine monitoring data that show the facility operates consistently within its design envelope—not just that it looked clean during the visit.

7) Validation and Continued Process Verification (CPV)

RDC 301 moves Brazil firmly into lifecycle validation territory. It expects manufacturers to validate processes, cleaning procedures, analytical methods and computerised systems, and to maintain evidence of ongoing process performance. That aligns with modern views of PPQ and CPV. For Brazilian sites, this often means moving from one-time validation exercises to continuous monitoring of critical parameters and attributes, supported by trending, statistical tools and defined action limits. For global sponsors, the presence of robust CPV is often a key differentiator between “GMP on paper” and truly capable manufacturing partners.

8) Documentation, GDP and Data Integrity under RDC 301

Documentation expectations under RDC 301 cover both paper and electronic records. Good Documentation Practices (GDP) are required for master documents, batch records, logs, sampling plans, test results and distribution records. In addition, ANVISA, like many regulators, emphasises data integrity: ALCOA+ principles, control of overwriting, audit trails for electronic changes, and governance of hybrid systems and uncontrolled spreadsheets. Firms must show that records are contemporaneous, complete, attributable and protected. “We can’t retrieve that data” is no longer a tolerable answer when asked about key decisions or historical results.

9) Complaints, Recalls and Product Quality Reviews

RDC 301 formalises expectations for complaint handling and product recalls, requiring documented procedures to investigate and act on quality issues quickly. It also requires periodic Product Quality Reviews (PQR/APR) that consolidate batch data, deviations, OOS/OOT results, stability, returned product, complaints and changes. These reviews are meant to drive process improvement and risk mitigation, not simply be archived. ANVISA can and does ask for PQRs during inspections to verify that the site is learning from its own history and that senior management is engaged with quality outcomes.

10) Contract Manufacturing and Technical Agreements

Contract manufacturing is common in Brazil, and RDC 301 dedicates a chapter to outsourced operations. It requires written technical/quality agreements that clearly define responsibilities for manufacturing, testing, batch release, deviations, changes and communication. ANVISA expects the marketing authorisation holder to maintain oversight of its CMOs rather than delegating full control. For global sponsors, this aligns with EU expectations on MAH and CMO roles. Poorly written or unenforced agreements are a frequent source of gaps: changes made by CMOs without sponsor knowledge, divergent procedures and misaligned specifications.

11) Computerised Systems – MES, LIMS, ERP and CSV

RDC 301 includes explicit expectations for computerised systems used in GMP-relevant activities. That encompasses MES/eBMR, LIMS, ERP, warehouse systems and local tools. Manufacturers must validate these systems (see CSV and GAMP 5), control user access, manage configurations, review audit trails and handle changes under formal change control. In inspections, ANVISA increasingly expects to see evidence that electronic workflows prevent errors and enforce the approved process, rather than just “digitalising” paper weaknesses.

12) Self-Inspection and Internal Audit

RDC 301 requires manufacturers to operate effective self-inspection and internal audit programmes that cover all aspects of GMP. The intent is to ensure that sites can detect and address deficiencies between regulatory inspections. Audit findings should be prioritised using risk management, linked to CAPAs and tracked through to completion. Cosmetic self-inspection—repeating known external findings or focusing only on documentation—is a common ANVISA and SRA criticism. A mature self-inspection programme is often a key differentiator between sites that improve continuously and those that stagnate until an inspection goes badly.

13) Impact on Brazilian Manufacturers and Local Industry

RDC 301 raises the bar for all Brazilian manufacturers, from large multinationals to smaller domestic firms. For some, it primarily formalises practices already adopted to satisfy EU/US inspections; for others, it requires significant upgrades in facilities, systems, documentation and culture. ANVISA has provided transition periods and guidance, but the direction is clear: plants that cannot meet RDC 301 will face increasing difficulties in maintaining licences and export markets. Strategically, the regulation encourages consolidation around stronger players, more investment in PQS and digitalisation, and closer integration with global supply networks.

14) How Global MA Holders Should View RDC 301

For non-Brazilian MA holders and QPs, RDC 301 compliance is an important signal but not a full guarantee of EU/FDA-level GMP. It shows that the site meets PIC/S-style requirements under ANVISA oversight and is at least speaking the same “GMP language.” However, due diligence should still include independent audits, quality agreement reviews, and alignment checks with EU, FDA or WHO expectations where relevant. Sites that can demonstrate both solid RDC 301 compliance and mature PQS, QRM and CPV practices often make strong candidates for long-term global supply partnerships.

15) Implementation Roadmap – From Basic Compliance to Global Readiness

Many Brazilian plants historically aimed for minimum national compliance and then added SRA requirements on top. With RDC 301, that gap is narrowing, but a structured implementation roadmap is still essential. Typical steps include: thorough gap analysis against RDC 301 and PIC/S PE009; prioritised upgrades in PQS, validation, utilities and documentation; investment in computerised systems (MES, LIMS, QMS platforms); and cultural work around deviation reporting, risk-based decisions and management engagement. Sites that treat RDC 301 as a springboard to holistic modernisation, rather than as a one-off hurdle, will find it easier to pass EU/US inspections later.

16) FAQ

Q1. Is RDC 301/2019 fully equivalent to EU GMP or PIC/S PE009?
RDC 301 is closely based on PIC/S PE009 and aligned conceptually with EU GMP, but practical equivalence depends on site implementation and ANVISA enforcement. Global sponsors still typically benchmark Brazilian sites against EU/PIC/S expectations during audits.

Q2. Does RDC 301 apply to APIs as well as finished products?
Yes. RDC 301 includes provisions for active pharmaceutical ingredients, although ANVISA also issues specific regulations and guidance for APIs. API manufacturers supplying Brazil are expected to meet relevant RDC 301 and WHO/PIC/S-style requirements.

Q3. How does RDC 301 affect computerised systems like MES and LIMS?
RDC 301 explicitly brings computerised systems into the GMP framework, requiring validation, access control, audit trails and data integrity governance. MES, LIMS, ERP and related platforms are therefore a focus area during ANVISA inspections.

Q4. Are small Brazilian manufacturers held to the same RDC 301 standards as large multinationals?
Yes, the regulatory standard is the same. However, enforcement may be phased and smaller firms may receive guidance or transition periods. Ultimately, all licence holders must comply with RDC 301 to continue operating.

Q5. What is a practical first step for a site upgrading to RDC 301?
Conduct a detailed gap assessment against RDC 301 (and PIC/S PE009), focusing on PQS maturity, risk management, validation, data integrity and computerised systems. Use that assessment to build a realistic, resourced remediation plan and to align management expectations about timelines and investment.

Related Reading
• Core GMP & QMS: GMP / cGMP | Quality Management System (QMS) | PIC/S PE009 | 21 CFR 211
• Validation & Risk: Process Validation | Continued Process Verification (CPV) | Cleaning Validation | QRM
• Systems & Data: CSV | GAMP 5 | MES | LIMS | Data Integrity
• Monitoring & Improvement: PQR/APR | Deviation / NC | RCA | CAPA