CDMO Quality Agreements: The Clauses Inspectors Expect

Outsourcing the manufacture, packaging, or testing of a drug does not outsource the legal responsibility for its quality. When a Canadian or United States drug owner hands production to a contract development and manufacturing organization (CDMO), the quality agreement is the document that decides who does what under good manufacturing practices (GMP), who releases the batch, and who answers to the regulator when something goes wrong. Inspectors from the United States Food and Drug Administration (FDA) and Health Canada read these agreements closely, and a vague, unsigned, or outdated quality agreement is a finding waiting to happen.

This guide explains what a CDMO quality agreement is, why it matters, what FDA, the European Union (EU), the International Council for Harmonisation (ICH), and Health Canada expect it to contain, and the specific clauses that separate an agreement that protects you from one that leaves gaps. It is written for quality assurance and regulatory affairs leaders, Quality Assurance Persons (QAPs), and manufacturing sponsors in the pharmaceutical, natural health product, and biologics sectors who place work with contract facilities or act as one.

Executive summary

A quality agreement is a written contract that defines how an owner and a contract facility will each meet GMP for a specific product or operation. It is separate from the commercial or supply contract, and it cannot transfer statutory GMP responsibility away from either party. The owner's quality unit remains ultimately responsible for releasing the product.

• A quality agreement sets out, in writing, which party performs each GMP activity, from materials control to batch release.
• FDA's 2016 guidance, EU GMP Chapter 7, ICH Q7 Section 16, and ICH Q10 all require a written, approved agreement that defines GMP responsibilities.
• You cannot delegate GMP accountability through a quality agreement. The owner's quality unit stays legally responsible for approving or rejecting the product.
• Change control, batch release, audit rights, and communication of deviations are the clauses inspectors scrutinize most.
• Missing, unsigned, generic, or outdated quality agreements are common inspection findings that lead to warning letters and import problems.

What is a CDMO quality agreement?

A CDMO quality agreement is a comprehensive written agreement between a product owner and a contract facility that defines, activity by activity, how each party will comply with GMP for the outsourced work. FDA describes it as a document that should clearly state which party carries out each specific GMP activity. It is a quality document, not a commercial one.

The parties usually go by two names. The owner (FDA's term) or contract giver (the EU and ICH term) holds the marketing authorization, drug identification number (DIN), or product licence and places the work. The contract facility (FDA) or contract acceptor (EU and ICH) performs the manufacturing, packaging, labelling, holding, or testing. A CDMO is a contract facility that often provides development and commercial manufacturing together.

FDA recommends that quality agreements be separate documents, or at least severable, from commercial contracts such as master services agreements or supply agreements. General business terms like pricing, delivery, confidentiality, and liability limits belong in the commercial contract. Mixing the two weakens the quality agreement and makes it harder for a quality unit to maintain.

Why a quality agreement matters: you cannot outsource GMP responsibility

It matters because responsibility for GMP compliance does not move with the work. FDA states that a quality agreement cannot be used to delegate statutory or regulatory responsibilities to comply with GMP, and that the owner's quality unit is ultimately responsible for ensuring products are made in accordance with GMP. The agreement allocates tasks. It does not transfer accountability.

Both parties remain subject to GMP for the activities they perform. Under 21 CFR parts 210 and 211, the contract facility must operate its own quality unit, and the owner's quality unit retains the legal responsibility to approve or reject each batch for final release. In Canada, the same principle flows from the Food and Drug Regulations and Health Canada's GMP guide, GUI-0001, which a drug establishment licence (DEL) holder must meet whether it makes the product itself or contracts it out.

This is why inspectors treat the quality agreement as a map of accountability. When a contract facility receives a Form 483 or a warning letter, the owner is expected to know about it, assess the impact on its product, and act. The claim that you did not know what your CDMO was doing is not a defence. For more on this liability, see our article on FDA supplier oversight and contract manufacturer accountability.

What the regulators require

Every major GMP framework requires a written, approved quality agreement for outsourced manufacturing. FDA, the EU, ICH, and Health Canada differ in wording, but they agree on the core: define the activities, define who is responsible, keep records available, and control changes. The table below compares the main sources.

FDA: the 2016 quality agreement guidance

FDA's guidance lists standard sections for the document: purpose and scope, definitions, resolution of disagreements, manufacturing activities, and the life cycle of and revisions to the agreement. It groups the detailed content under manufacturing activities: quality unit activities, facilities and equipment, materials management, product-specific considerations, laboratory controls, and documentation, with a separate section on change control. The guidance is a recommendation rather than a binding rule, but FDA inspects against it and expects to see one.

EU GMP Chapter 7 and the ICH guidelines

EU GMP Chapter 7, Outsourced Activities, uses the terms Contract Giver and Contract Acceptor and requires a written contract that defines responsibilities, including who performs each GMP step and who certifies and releases the batch. The Contract Giver must assess the competence and legality of the Contract Acceptor, and the Contract Acceptor must not subcontract without written approval. ICH Q7 Section 16, which covers active pharmaceutical ingredient (API) contract manufacturers and laboratories, requires a written and approved contract that defines GMP responsibilities, permits the contract giver to audit, and requires that changes not be made unless the contract giver is informed and approves. ICH Q10 Section 2.7 requires the pharmaceutical company to assess suitability before outsourcing and to monitor the contract acceptor's performance.

Health Canada

Health Canada does not publish a standalone quality agreement guidance, but GUI-0001 and the DEL framework require a licence holder to keep GMP control over fabrication, packaging, labelling, and testing, including when these are contracted out. Because Canada is a member of the Pharmaceutical Inspection Co-operation Scheme (PIC/S), Canadian expectations align closely with EU GMP Chapter 7. A QAP or quality unit should hold a current agreement for every contracted activity, supported by a supplier qualification programme that confirms the contract facility is fit to do the work.

The clauses inspectors expect to see

Inspectors expect a quality agreement to answer one question for every GMP activity: who is responsible? The strongest agreements assign each task to the owner, the contract facility, or both, and leave no silent gaps. FDA's guidance groups these clauses into recognizable areas, summarized below.

A well-drafted agreement does more than list these areas. It names the responsible roles, references the controlling SOPs, and sets timelines, for example the number of business days within which the contract facility must notify the owner of a confirmed out-of-specification result or a regulatory inspection. Vague wording such as the parties will cooperate is exactly what inspectors flag. For the laboratory side of this, see our analysis of a contract lab warning letter and the risk of relying on a certificate of analysis, and our procedure for deviation and OOS investigations that survive a Health Canada inspection.

Change control: the clause that fails most often

Change control is the single clause that most often creates inspection problems. FDA's guidance says the parties should agree on which changes the owner must review and approve before implementation, which the contract facility may make on its own, and which must be reported to the regulator. When the agreement is silent, a CDMO can change a supplier, a test method, or a process step without the owner knowing, and the owner discovers it only during a deviation or an inspection.

A strong change control clause lists the change categories that always require the owner's prior written approval (components and suppliers, manufacturing process, major equipment, test methods, container closure systems, establishment location, shipping methods, and lot numbering), and it ties them to the owner's own change control and, where needed, a regulatory filing. Read our guide to GMP change control: how to classify, assess, and close changes for a workable system.

Common inspection findings and how CAPA fits

The most common findings are not exotic. They are an agreement that does not exist, is not signed, is years out of date, or copies a template without naming the real product, roles, and responsibilities. When a finding lands, the owner needs a corrective and preventive action (CAPA) that fixes the agreement and the system behind it, not just the one batch.

• No quality agreement in place for a contracted activity, or an agreement that was never signed by both quality units.
• A generic template that does not name the specific product, process, or responsibilities, so no one can tell who does what.
• An agreement that is out of date and no longer matches the current process, equipment, or suppliers.
• No defined timeline for the contract facility to report deviations, out-of-specification results, or a regulatory inspection to the owner.
• The owner has no record of auditing the contract facility, even though the agreement grants audit rights.
• Change control responsibilities are undefined, so the contract facility makes changes the owner never approved.

A credible CAPA traces each finding to a root cause, for example a missing procedure for maintaining quality agreements, and builds the control that prevents recurrence. Our article on why CAPA keeps failing at root cause analysis shows how to avoid a CAPA that closes on paper but not in practice, and our guide to the batch failure investigation under 21 CFR 211.192 explains the investigation inspectors cite first.

CDMO quality agreement compliance checklist

Use this checklist to review an existing agreement or build a new one before your next inspection.

• A current, signed quality agreement exists for every contracted fabrication, packaging, labelling, testing, and holding activity.
• The agreement is a separate document from the commercial or supply contract.
• Both quality units have reviewed and approved the agreement, with named signatories and an effective date.
• The agreement names the specific product or products and the exact operations covered.
• Each GMP activity is assigned to the owner, the contract facility, or both, with no silent gaps.
• The owner's quality unit retains final batch release authority in writing.
• Audit rights, regulatory inspection notification, and reporting duties are defined with clear timelines.
• Change control categories and approval responsibilities are listed and tied to regulatory filings where needed.
• Deviation, out-of-specification, out-of-trend, complaint, and recall communication is defined with response times.
• A review and revision cycle, for example every two years or on a major change, is built in.

Common mistakes to avoid

• Treating the quality agreement as a legal formality and letting the commercial team draft it without the quality unit.
• Assuming the CDMO's GMP certificate removes your responsibility to oversee the work.
• Using one template for every product and never tailoring it to the actual process and roles.
• Leaving batch release responsibility ambiguous, so neither quality unit clearly owns the final decision.
• Never exercising the audit rights the agreement grants.
• Letting the agreement sit unchanged for years while the process, suppliers, and equipment move on.

Frequently asked questions

Is a quality agreement legally required?

FDA's 2016 guidance is a recommendation rather than a binding rule, but FDA, the EU, ICH, and Health Canada all expect a written agreement, and its absence is a routine inspection finding. EU GMP Chapter 7 and ICH Q7 require a written contract. In practice, operating a contract manufacturing arrangement without one is not defensible.

What is the difference between a quality agreement and a supply agreement?

A supply or commercial agreement covers business terms such as price, volumes, delivery, and liability. A quality agreement covers GMP responsibilities such as who tests, who releases, and who controls changes. FDA recommends they be separate, or at least severable, documents so the quality agreement stays clear and easy to maintain.

Who is responsible if the CDMO makes a defective batch?

Both parties are responsible for GMP for the work they perform, but the owner's quality unit is ultimately responsible for approving or rejecting the product. A quality agreement does not shift that accountability. The owner must oversee the contract facility, review its performance, and act on problems.

How often should a quality agreement be reviewed?

Review it on a defined cycle, commonly every one to two years, and whenever there is a significant change to the product, process, equipment, suppliers, or regulatory status. An out-of-date agreement that no longer matches the real operation is a common inspection finding.

Does a small natural health product or API company need one?

Yes. If you contract any fabrication, packaging, labelling, or testing, you need a quality agreement. ICH Q7 Section 16 applies to API contract manufacturers and laboratories, and Health Canada expects DEL and site licence holders to control contracted activities regardless of company size.

Which clause causes the most inspection problems?

Change control. When the agreement does not define which changes need the owner's prior approval and which must be reported, a CDMO can change a material or method without the owner's knowledge, and it surfaces as a finding during a deviation or inspection.

How MFLRC can help

MFLRC helps drug, natural health product, biologics, and medical device companies build and defend the quality agreements that hold up under FDA and Health Canada inspection. Our senior consultants draft and review CDMO quality agreements, run gap assessments against FDA's 2016 guidance and EU GMP Chapter 7, build the change control and supplier qualification SOPs that sit behind them, provide QAP and quality unit support, and carry out mock inspections and CDMO audits so you find the gaps before an inspector does. We also support validation, CAPA programmes, and licensing across Canada, the United States, and the EU. A good place to start is an inspection readiness self-assessment. Whether you are placing your first contract or cleaning up an agreement an inspector just questioned, we can help you define responsibilities that are clear, current, and defensible.

Conclusion

A CDMO quality agreement is not paperwork. It is the control that keeps accountability clear when manufacturing, testing, or packaging leaves your walls. Define every GMP activity, keep the owner's quality unit in charge of release, write change control and communication clauses that bite, and review the agreement before it goes stale. Do that, and the agreement protects your product and your licence. Leave it vague, and it becomes the first thing an inspector uses against you.

Sources and references

• FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements (Guidance for Industry, November 2016)
• European Commission, EudraLex Volume 4, EU GMP Guide, Chapter 7: Outsourced Activities
• ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, Section 16
• ICH Q10, Pharmaceutical Quality System, Section 2.7
• Health Canada, Good manufacturing practices guide for drug products (GUI-0001)
• US 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals