Dependent CEP Assessment: When Your CEP Is Reviewed Again

Two suppliers can both hold a valid CEP and sit in completely different positions. One owns the whole file. The other's certificate rests on documents held by somebody else, and that arrangement is not printed on the certificate in terms a buyer would notice.

The dependency becomes visible when it is tested. A referenced file changes, a referenced holder withdraws, a step moves to another site, and suddenly the certificate that was stable for years is under review. The buyer learns about it through a delayed shipment.

The mechanism is described here as structure rather than as a rulebook, because the specific provisions are updated by the issuing authority and should always be read in their current form.

What dependence means in practice

A certificate is dependent when the assessment of the substance rests, in part, on documentation or a decision outside the applicant's own file. Three configurations produce this.

A purchased intermediate covered by somebody else's certificate. The applicant buys a step of the process from a holder who has its own certificate for that material. The applicant's file refers to that certificate rather than reproducing the data.

A process split across holders. Steps are performed by different legal entities, each with its own quality system, and the file has to describe how the parts join.

A shared starting material with a single source. The declared starting material is itself certified elsewhere, and the applicant's control strategy depends on that material staying within its declared specification.

In all three, the applicant controls the outcome but not the inputs to the argument. That is the definition of a dependency worth pricing.

Why a dependency triggers a second look

Assessment conclusions are only as stable as the documents they rest on. When a referenced certificate is revised, renewed, restricted or withdrawn, the conclusion drawn from it may no longer hold. Re-examining the dependent file is the logical response, not a punishment.

The same logic applies when the referenced file itself is assessed under a different regime, or when the scope of the referenced certificate changes in a way that no longer covers what the dependent file assumes.

For a buyer, the useful reframing is this: the question is not whether your supplier's certificate is valid today. It is how many other documents have to stay valid for that to remain true.

The four signals that a dependency exists

None of these is disclosed on the certificate itself. All of them can be established before an order.

Signal	What it suggests	Question to ask
The process description begins with a purchased substance rather than a basic raw material	An earlier step belongs to someone else	Is that step covered by a certificate held by a third party?
Two legal entities appear in the supply chain but one certificate	Steps split across holders	Which entity holds which part of the file?
The declared starting material is a pharmacopoeial substance	Its own certificate may exist and be referenced	Does your file reproduce data or refer to another file?
A site is described as a sister plant or partner plant	Scope may be shared or borrowed in conversation	Is that site named on the certificate?

What happens to the buyer when a dependency is tested

Three commercial effects, in order of how often they occur.

Documentation stops matching. Your supplier qualification file cites a certificate that is under review. Your own quality system now holds a document whose status is uncertain, and that is a finding in your next audit whether or not anyone caused it.

Release decisions get harder. Material may continue to arrive and test correctly while the certificate question is open. Whether you can release against a certificate in review is a decision for your qualified person, not your purchasing team, and it is better made before the shipment than after.

Registration timelines move. If a marketing authorisation or variation references the certificate, the review of that certificate can stall the variation. Dependence propagates upward.

The mitigation that actually works

Asking for the certificate is the beginning, not the control. Three things reduce exposure, and none of them require the supplier to disclose confidential content.

1. Ask which parts of the file rest on documents you do not hold. A holder knows. A vague answer is itself information.
2. Write the dependency into the quality agreement. If a referenced file changes, you want notice before the change lands, not after it delays a batch. Our own quality clauses note covers what belongs in that clause.
3. Keep a second route warm. Dependence is a concentration risk in documentary form. The logic set out in dual sourcing and supply concentration applies here exactly as it does to physical capacity.

There is also a version of this that is entirely legitimate and should not be treated as a defect. A certificate resting on a well-documented upstream file held by a competent party is not weaker than a self-contained one; it is differently distributed. What matters is knowing which shape you are buying, because the two fail in different ways.

How this changes a sourcing conversation

Most supplier questionnaires ask whether a CEP exists. A better question asks how many documents have to remain valid for that answer to stay true, and who is responsible for watching each one. That single question separates a supply chain with one point of control from one with four.

For the broader map of which market route applies where, see CEP, DMF or written confirmation. For verification of the documents themselves, see how a CEP or GMP certificate is actually verified.

The current procedure and its guidance are published by EDQM, with the procedure documents at EDQM CEP procedure. GMP obligations that survive a change in certificate status are set out in EudraLex Volume 4.

Frequently asked questions

Is a dependent CEP less valid than an independent one?

No. It is a legitimate structure that reflects how a real supply chain is organised. What differs is where the risk sits, and how many external documents must remain valid for the certificate to keep meaning what it says.

How would I know my supplier's CEP is dependent?

Not from the certificate alone. The signals are in the process description: where it starts, how many legal entities perform steps, and whether the starting material is itself a certified substance. Each can be raised as a question before an order.

Does a dependent CEP delay new product registration?

It can. If the marketing authorisation or a variation references the certificate, a review of that certificate can hold up the variation. The exposure is proportional to how much of the file rests on documents outside the holder's control.

Can material still be released while the certificate is under review?

That is a decision for a qualified person under your own quality system, not a purchasing judgement. The point to settle in advance is what your procedure says, because the answer rarely arrives quickly enough during a live shipment.

What should a quality agreement say about dependencies?

At minimum, that changes to referenced files affecting the certificate are notified before they take effect, and that the holder states which parts of the file rest on documents held elsewhere. Notice obligations are only useful if they precede the disruption.

Does dependence matter for a non-regulated use?

Less, but not never. If the material is used outside a medicinal product, the certificate may be irrelevant entirely, and the specification plus the COA carry the weight. That is a different conversation from this one.