EMA API Inspection Report 2017 to 2024: What It Means for Supplier Risk

Most finished drug problems begin upstream, at the site that makes the active pharmaceutical ingredient. A new report from the European Medicines Agency puts eight years of hard data behind that reality, and it should shape how you manage API supplier risk.

The Report on the International Active Pharmaceutical Ingredient Inspection Programme 2017 to 2024 (reference EMA/202541/2026) was published in September 2026. It covers 1,684 good manufacturing practice inspections at 936 API manufacturing sites, carried out by 13 participating authorities, including Health Canada. This article explains what the report found and, more importantly, what those findings mean for your supplier qualification, audit planning and supply chain resilience.

Executive summary

The EMA report shows a mature, work sharing programme that inspects a concentrated set of API sites and relies on shared information to avoid duplication. For the 2017 to 2024 period it records 1,684 inspections at 936 sites, up from 1,333 inspections at 944 sites in 2011 to 2016. Of the 936 sites, 644 were sites of shared interest, with about half in India and just over a third in China. About 32 percent of sites were inspected by more than one authority within a twelve month window.

What it means for you. Your API supply chain is concentrated in a small number of countries and, often, a small number of sites that many companies share. A single inspection finding can ripple across products and customers. The practical response is to know exactly where each API is made, use the inspection information that regulators already share, and tier your supplier oversight to the real risk.

What the programme is, and what the report covers

What it is. The international API inspection programme is a collaboration, running as a full programme since 2011, in which regulators coordinate GMP inspections of API manufacturing sites, share inspection outcomes and, where possible, rely on each other's work. The aim is to cover more sites with the same resources and to reduce unnecessary duplicate inspections of the same third country site.

Why it matters. APIs for medicines sold in Canada, the United States and the European Union are made largely at the same global sites. A programme that shares inspection results means a finding at one site can inform regulators and, in turn, customers worldwide. The report, which covers 2017 to 2024, is the clearest public picture of how that oversight works and where it is focused.

What to do. Read the report as a map of your own exposure. If your API sites sit among the concentrated group it describes, assume they are inspected and discussed by several authorities, and manage them accordingly.

The headline numbers

What it is. The report sets the 2017 to 2024 period against the previous 2011 to 2016 period, and highlights where API sites of shared interest are located.

Where the sites are. Of the 644 sites of shared interest, the report places about 50 percent in India and about 35 percent in China, with the remaining 14 percent spread across 16 other countries. In other words, roughly five in six sites of shared interest sit in just two countries.

Why it matters. Inspections rose while the number of sites held roughly steady, which means more attention per site. The geographic concentration is the headline risk: your supply chain depends on a narrow base, and a regulatory action, a natural event or a quality failure in one region can affect many products at once.

What to do. Count how many of your APIs trace back to India and China, and identify any single site that supplies more than one of your products. Those are your concentration points and the place to focus audits and contingency planning.

Who inspects, and why Health Canada's role matters

What it is. The programme includes 13 participating authorities: 10 national authorities and 3 transnational organizations. Founding members include Australia's TGA, France's ANSM, Italy's AIFA, Ireland's HPRA, the UK's MHRA, the EDQM, the EMA and the US FDA. Later members include Denmark's DKMA, the WHO, Health Canada and Japan's PMDA, which joined at the end of 2016, and Brazil's ANVISA, which joined in 2021.

Why it matters. Health Canada is inside this network. An inspection outcome or a concern raised by the FDA, the EMA or another member can inform Health Canada's view of a site that supplies your Canadian products. That is a reason to treat a foreign inspection finding as relevant to your Canadian compliance, not as someone else's problem. It also connects to Canada's broader reliance on international partners, which we discuss in our guide to EU third country API lists and written confirmation.

What to do. When you learn of an inspection or a non-compliance statement at one of your API sites from any member authority, treat it as a trigger to reassess the site, not just a foreign event.

The programme is also widening. The report notes that membership has grown over time, with Brazil's ANVISA joining in 2021 and the WHO contributing data from 2012, and that secretariat duties rotate among members, including Health Canada and the EMA. A broader network means more eyes on the same sites and more channels through which a concern can surface. For a Canadian company, that raises the value of staying current with each of your API sites, because information that once stayed within one jurisdiction now moves between many.

Duplication, reliance and what sites of concern attract

What it is. The report shows that about 32 percent of sites were inspected by more than one authority within twelve months. It also records limited but real use of reliance, with inspection reliance reported on 107 of the 644 sites of shared interest, about 17 percent, and 27 joint inspections at 25 sites. Sites with more than one non-compliant outcome drew a disproportionate share of inspections, and the gap between inspections of non-compliant and compliant sites widened over the period.

Why it matters. Two signals stand out for industry. First, regulators are moving, slowly, toward relying on one another, which over time can reduce duplicate audits of well controlled sites. Second, a site with repeat problems attracts more regulatory attention, so a poor compliance history is itself a forward looking risk indicator for your supply.

What to do. Use a site's inspection history as a risk input. A site with repeat non-compliant outcomes deserves deeper audits, tighter oversight and a serious second source plan. A site with a clean, recently inspected record may justify reliance and a lighter touch.

What this means for your supplier risk programme

What it is. The report is not a new regulation, but it is a strong evidence base for how you should qualify and monitor API suppliers. The concentration of sites, the duplication of inspections and the attention drawn by poor performers all point to the same conclusion: supplier risk is site specific and should be managed with current, verifiable information.

Why it matters. Qualification that stops at a broker, a certificate on file or a one time audit does not reflect how regulators see your sites. An inspector will expect you to know the real manufacturing site, its GMP status and its inspection history, and to show that your oversight matches the risk.

What to do. Build or refresh a supplier qualification programme that risk tiers each API site and sets audit depth to match, as described in our guide to supplier qualification programmes that survive an inspection. Check EudraGMDP for current certificates and any non-compliance statements, hold a current quality or technical agreement with each manufacturer, and keep the written confirmation or equivalent assurance that supports import of each third country API.

A practical example

Consider a Canadian generic manufacturer that sources one active ingredient from a single site in India and another from a site in China. During a routine review, the quality team checks EudraGMDP and finds that the Indian site received a non-compliance statement from one programme authority after an inspection, while the Chinese site holds a current certificate from a recent joint inspection. Reading the EMA report, the team recognizes the pattern: the flagged site is exactly the kind of repeat concern that draws more regulatory attention and more risk. It raises the Indian site to its highest risk tier, schedules an on site audit, and accelerates qualification of a second source. The Chinese site, recently inspected and clean, is kept on a lighter, reliance based schedule. The same report that could have been filed and forgotten becomes the basis for two different, defensible decisions.

The business case is as strong as the compliance case. Concentration is not only a regulatory exposure, it is a continuity risk. If a single site makes an API for several of your products and that site is suspended, the shortage reaches your whole portfolio at once. Tiering oversight, qualifying a second source and linking API risk to your shortage prevention planning protects revenue as much as it protects your licence, which is why this work belongs on the leadership agenda and not only in the quality unit.

API supplier risk checklist

• Sites mapped: every API is traced to its real manufacturing site, not just the broker, with India and China sites flagged.
• Concentration identified: you know which sites supply more than one of your products.
• Inspection status checked: EudraGMDP certificates and non-compliance statements are reviewed for each site.
• Risk tiered: each supplier has a risk tier that sets audit depth and frequency.
• Agreements current: a quality or technical agreement is in place with each API manufacturer.
• Written confirmation held: the import assurance for each third country API is current and on file.
• Second source planned: critical APIs have a qualified second source or a clear plan to qualify one.
• Change notice built in: agreements require the site to notify you of changes before product is affected.

Common mistakes to avoid

• Qualifying the trader, not the site. Risk lives at the manufacturing site, so your file must identify and assess it.
• Treating a certificate as the whole story. A GMP certificate is a point in time. Inspection history and current status matter more.
• Ignoring foreign findings. A finding reported by any programme member can reach Health Canada and your Canadian products.
• Single sourcing a critical API. Geographic and site concentration turns one failure into a shortage. Our guide to exceptional importation during drug shortages shows how costly a gap can become.
• Flat audit plans. Auditing every supplier the same way wastes effort on low risk sites and under scrutinizes high risk ones.
• No change control at the supplier. Without notification terms, you learn of a site change after it has affected your product.

Frequently asked questions

What is the EMA international API inspection programme?

It is a work sharing programme, running as a full programme since 2011, in which 13 authorities coordinate GMP inspections of API manufacturing sites to share information and reduce duplicate inspections of the same third country sites.

What did the 2017 to 2024 report find?

The report, reference EMA/202541/2026, covers 1,684 inspections at 936 sites. Of these, 644 were sites of shared interest, with about 50 percent in India and 35 percent in China. About 32 percent of sites were subject to duplicate inspections within a twelve month window.

Is Health Canada part of the programme?

Yes. Health Canada joined at the end of 2016 and is one of the 13 participating authorities, which also include the EMA, EDQM, the US FDA, the UK MHRA, Australia's TGA, Japan's PMDA, the WHO and several European national authorities.

Why does this matter for my supply chain?

Most API sites of shared interest are concentrated in India and China, so a single site can affect many products and companies. Sites with repeat non-compliant outcomes draw more inspections, and reliance between regulators can reduce the duplicate audit burden on well controlled sites.

What should manufacturers do in response?

Map every API to its real manufacturing site, check EudraGMDP for certificates and non-compliance statements, risk tier suppliers, hold current quality agreements, confirm written confirmations for third country APIs, and qualify a second source for critical ingredients.

Does the report list the most common GMP deficiencies?

No. The report focuses on how inspections are coordinated and shared, including inspection counts, sites, reliance and duplication. It does not provide a breakdown of deficiency categories.

How MFLRC can help

MFLRC turns inspection intelligence like this into a supplier risk programme that holds up. We map your API supply chain to real manufacturing sites, risk tier your suppliers, and set audit depth and frequency to match. Our regulatory affairs and quality assurance teams run supplier and site audits, review written confirmations and import documentation, build quality agreements, and prepare you for EU-GMP and Health Canada expectations. If you are strengthening oversight ahead of an inspection, our Health Canada GMP self assessment is a fast way to find gaps.

If you want your API supplier programme reviewed against how regulators actually inspect these sites, we can help you build it and defend it.

Conclusion

The EMA's 2017 to 2024 API inspection report is a quiet but important document. It confirms that your active ingredients come from a concentrated set of sites, mostly in India and China, that regulators inspect together and increasingly rely on one another to cover. The lesson for industry is practical: know your sites, use the inspection information that already exists, tier your oversight to real risk, and keep a second source for what you cannot afford to lose. Supplier risk managed this way is not a cost, it is what keeps your product on the market.

Sources and references

• EMA, Report on the International Active Pharmaceutical Ingredient Inspection Programme 2017 to 2024 (EMA/202541/2026)
• EMA, International collaboration on GMP inspections
• EudraGMDP, GMP certificates and non-compliance statements
• ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients