How to Verify a CEP or GMP Certificate: A Buyer's Check

Ask a supplier for evidence that their material is produced under good manufacturing practice and a PDF will arrive within the hour. It will carry a logo, a reference number, a signature and a border. None of that makes it evidence. Every document in this conversation can be checked in a public database, and the check takes about five minutes.

Three documents are in play and they are confused with each other constantly. Separating them is the first step, because each one answers a different question and each one is verified in a different place.

Three documents that are not the same thing

Document	Who issues it	What it actually confirms
Certificate of Suitability	The EDQM	That the quality of the substance is adequately controlled by the European Pharmacopoeia monograph, together with any additional requirements accepted. It is a statement about the control strategy, not about a batch and not about a facility.
GMP certificate	A national competent authority, after an inspection	That the inspected site was found compliant with good manufacturing practice for the activities listed on the certificate, at the time of the inspection.
Certificate of analysis	The releasing laboratory	That the results for one batch met the specification. It says nothing about the facility or about the control strategy.

The first row is the one that surprises people. A certificate of suitability is not a licence to make anything and it is not a GMP certificate. It confirms that the pharmacopoeial monograph, plus whatever additional requirements the EDQM accepted, is adequate to control the substance. That is a specific and useful statement, and it is a different statement from the other two.

Step one: find the certificate in the public database

The EDQM maintains a public certification database that is updated daily. It can be searched by substance, by company or by certificate number, and it returns the type, the substance, the full certificate number, the issue date and the validity status. That single lookup resolves most of the question. A number that cannot be found there is not a valid certificate, however convincing the document looks.

The number itself carries information. The current format is a two-block alphanumeric code: the letters CEP, then the year and a sequence number, then the revision. The legacy format is a three-block code that begins with a renewal indicator. A transitional hybrid format uses the current numbering with some of the older layout. Knowing which of the three you are reading tells you the document's vintage, and it matters because the newer format carries more information than the older one ever did.

The revision number deserves its own glance. It tells you how many times the certificate has been amended. If the scan in front of you carries an earlier revision than the one in the database, you are looking at a superseded document. That is not necessarily bad faith, but it is not the current position either, and the difference is worth resolving before you file anything.

Step two: read the annexes, especially the sites

The current format attaches an annex listing every site involved with the substance: the holder, the production sites, any intermediate or physical-treatment sites, and any sterilisation or micronisation locations. Each of those sites carries a regulatory identifier, which means sites can be matched across databases rather than by name. Anyone who has tried to reconcile two sites that share a name in two different countries will appreciate why that matters.

There is one limitation to know about, and it is the reason the next question exists. The annex lists the sites but does not say what each site does. The document will not tell you which site performs the final crystallisation and which one only mills. That has to be confirmed by the holder, and asking is a routine request rather than a challenge.

The annexes carry two other pieces of information worth reading. One is the specification, with the controlled attributes and their limits, including any additional impurities controlled beyond the monograph. The other is a statement of which attributes are required for the European market and which are there for other regions. That distinction is easy to miss and it explains a great deal about why two certificates for the same substance do not look alike.

Step three: check GMP status in a separate database

GMP certificates are not in the certification database. They sit in EudraGMDP, maintained by the European Medicines Agency and populated by the national authorities. It is public and searchable by certificate number, by site name and by site identifier, and it carries statements of non-compliance alongside the certificates, plus manufacturing and import authorisations and registrations of active-substance producers. When a supplier sends a scanned certificate, this is where it is checked.

Two cautions belong here. The first is that forged certificates have circulated bearing the letterhead of a national authority; the authorities' own advice is to confirm authenticity in the database rather than to trust the document. A forgery cannot appear in a database it was never entered into.

The second caution cuts the other way and is equally important. Inspections of active-substance producers are risk-based, so a compliant site may simply never have been inspected by a European authority and may therefore hold no GMP certificate. The absence of a certificate is not proof of a problem. Equally, the presence of one is not proof that a given activity is covered, because a certificate lists the activities that were inspected and nothing more. Read the scope of the certificate rather than its existence.

What the letter of access is for

Being shown a certificate is not the same as being able to use it. To rely on a certificate in a submission, the holder has to authorise it. The current format requires a signed letter of access, and the legacy format carries a declaration-of-access box completed by the holder. Either document authorises a specific customer to rely on the certificate for a specific product, and confirms that nothing has changed since the certificate was last updated.

A buyer who has been shown the certificate but not offered the access document has been shown something they cannot use. It is worth noticing that early, because the access document is a normal part of the transaction rather than a concession to be negotiated.

What the check cannot tell you

Three lookups in a database resolve the authenticity and the status of a document. They do not resolve everything a buyer would like resolved, and it is worth being clear about where the boundary sits.

• It does not confirm that your material came from the site named. The certificate says that a site holds a certificate for a substance. It does not say that the drums in front of you were produced there. That link is made by the batch documentation and by the container-wise identity question, not by the certificate.
• It does not confirm a batch. A certificate of suitability covers a control strategy across batches. Whether one particular batch met that strategy is a separate document and a separate check.
• It does not confirm continuity. A certificate in force tells you about the present. It will not tell you that the site will still hold it in two years, which is why the renewal due date on the public record is worth noting at the start of a relationship rather than at the end.

Those limits are not reasons to skip the check. They are the reason the check is the first step rather than the only one.

What to ask

1. The certificate number, and confirmation that you may look it up.
2. Which revision it is, and a statement that it is the current one.
3. The sites annex, together with the activity carried out at each site.
4. The access document, in whichever form the certificate format requires.
5. The GMP status of the site that performs the final step, looked up rather than sent.

None of these questions is hostile, and all five are answerable by a supplier who holds a genuine certificate. The supplier who cannot answer the second and the third has told you something useful.

Where this leaves you

A certificate is evidence only when it has been checked, and the checking is public, free and fast. Separate the three document types, look the certificate up, read the sites annex for what it does not say, and put the GMP status question to a database rather than to the document. Five minutes of that is worth more than an hour of reading letterheads.

What we hold and what we can put in front of you for a given material is set out on our ursodeoxycholic acid page. If you want the certificate position for a specific grade discussed before you commit to a specification, you can raise it through a quotation request. For what a change of source does to your own file, see what adding a second API source involves, and for the limits of a grade label on its own, what an EP grade claim actually proves.

This article describes certification and inspection frameworks for quality, regulatory and procurement professionals. It states no therapeutic use, dose or indication for any substance, and no order quantity or lead time. Confirm all requirements against the current published guidance of the issuing bodies.

Frequently asked questions

What is a certificate of suitability?

It is a certificate issued by the EDQM confirming that the quality of a substance is adequately controlled by the relevant European Pharmacopoeia monograph, together with any additional requirements the EDQM accepted. It supports a regulatory submission in place of part of the quality dossier. It is not a licence, not a GMP certificate and not a statement about any individual batch.

Is a CEP the same as a GMP certificate?

No, and they are issued by different bodies. A CEP is issued by the EDQM and concerns the control strategy for a substance. A GMP certificate is issued by a national authority after an inspection and concerns the compliance of a site for the activities listed on it. A supplier can hold one, both or neither for a given material.

How do I check whether a CEP is genuine?

Look it up in the EDQM certification database, which is public and updated daily. Search by substance, by company or by certificate number, and read the type, the full number, the issue date and the validity status. A document that cannot be found there is not a valid certificate regardless of how it looks.

What does the sites annex on a CEP tell me?

It lists every site involved: the holder, the production sites, any intermediate or physical-treatment sites, and any sterilisation or micronisation locations, each with a regulatory identifier. It does not say what each site does. The activity at each site has to be confirmed by the holder on request, and asking is routine.

What is a letter of access for?

It authorises a specific customer to rely on the certificate for a specific product, and it confirms that nothing has changed since the certificate was last updated. The newest certificate format requires a signed letter; the older format carries a declaration-of-access box completed by the holder. Without it you have been shown a document you cannot use.

Can I check GMP status in the same database?

No. GMP certificates sit in a separate European database, maintained by the EMA and populated by national authorities, which is also public and searchable by certificate number, site name or site identifier. It carries statements of non-compliance as well as certificates, and it is the place to look when a supplier sends a scanned certificate.