ISO 9001 vs ISO 15378: Clause by Clause for Primary Packaging Suppliers
ISO 9001 is the general quality management standard for any organisation; ISO 15378 is the version of it written for manufacturers of primary packaging materials for medicinal products. ISO 15378:2017 reproduces the full text of ISO 9001:2015 and adds Good Manufacturing Practice (GMP) requirements around it, using the same clause numbers from 1 to 10. What it adds are GMP subclauses on customer audits, GMP training, IT systems and data, a formal change control definition with risk management, and a normative annex for printed packaging materials. For a pharmaceutical buyer, ISO 9001 shows a supplier manages quality; ISO 15378 shows it does so to the GMP expectations that apply to material in contact with a medicine.
Key takeaways
- Same clause structure. ISO 15378:2017 follows ISO 9001:2015 clause for clause, 1 to 10; the ISO 9001 text appears in boxes, and GMP requirements sit outside them.
- ISO 15378 adds subclauses, including 5.1.3 Customer audits, 7.2.2 GMP-training and 7.5.4 Administration of IT systems and data.
- Risk is applied more widely. ISO 9001 asks for risk-based thinking; ISO 15378 states that for primary packaging the risk-based approach is applied throughout all processes and adds a set of risk management terms.
- “If appropriate” is read strictly. In ISO 15378 a requirement qualified that way is deemed appropriate unless the organisation documents a justification otherwise.
- Two added annexes matter: Annex C (normative) on GMP for printed primary packaging materials, and Annex D (informative) on verification, qualification and validation.
- Autofits holds both, ISO 9001:2015 and ISO 15378:2017, alongside ISO 14001:2015.
ISO 9001 vs ISO 15378 at a glance
| Aspect | ISO 9001:2015 | ISO 15378:2017 |
|---|---|---|
| Full title | Quality management systems, Requirements | Primary packaging materials for medicinal products, Particular requirements for the application of ISO 9001:2015, with reference to good manufacturing practice (GMP) |
| Who it is for | Any organisation, any product or service | Organisations that design, manufacture and supply primary packaging materials for medicinal products |
| Relationship | The base standard | Contains the ISO 9001:2015 text and adds GMP requirements |
| Clause structure | Clauses 1 to 10 | Clauses 1 to 10, same numbering, with added subclauses |
| Terms | Refers to ISO 9000:2015 | ISO 9000:2015 plus sector terms, including a group of risk management terms (3.11) |
| Risk | Risk-based thinking; actions to address risks and opportunities (6.1) | Risk-based approach applied throughout all processes; change control defined with risk management |
| Normative references | ISO 9000:2015 | ISO 9000:2015, plus ISO 14698-1 and ISO 14698-2 on biocontamination control |
| Added annexes | None of these | Annex C (normative) printed primary packaging; Annex D (informative) verification, qualification and validation |
| Edition | Fifth edition, 2015; a sixth edition is scheduled for publication on 16 September 2026 | Fourth edition, 2017, replacing ISO 15378:2015 |
How the two documents are built
ISO 15378 is an application standard: open it and the ISO 9001 text is there, boxed, with the pharmaceutical requirements printed outside the boxes. Its introduction sets out that convention. Clauses and annexes quoted unchanged from ISO 9001:2015 and ISO 9000:2015 are in boxes; GMP requirements, recommendations and sector terms are outside them.
That layout answers the most common question about the pair. The clause numbers are the same, because ISO 15378 does not renumber ISO 9001; it adds text and a few subclauses underneath. A quality manual or procedure index built on ISO 9001 clause numbers maps straight across, and the gap analysis is the unboxed text.
ISO 15378:2017 also changed from its 2015 predecessor by integrating the sector requirements into ISO 9001:2015, dropping the requirement for a quality manual and taking in all of ISO 9001’s annexes.
What ISO 15378 adds, clause by clause
The additions cluster where a packaging defect can reach a patient: people, data, the production environment, traceability and change. The table uses subclause headings from the ISO 15378:2017 table of contents.
| Clause | ISO 9001:2015 heading | What ISO 15378 adds or changes |
|---|---|---|
| 1 Scope | QMS requirements for any organisation | Adds GMP requirements for primary packaging materials, and the “if appropriate” rule |
| 2 Normative references | ISO 9000:2015 | Adds ISO 14698-1 and ISO 14698-2, biocontamination control |
| 3 Terms | By reference to ISO 9000 | Adds terms such as assembly, change control, GMP, installational and operational qualification, origination, and 3.11 terms relating to risk management |
| 5.1 Leadership and commitment | 5.1.1 General, 5.1.2 Customer focus | Adds 5.1.3 Customer audits |
| 7.1.4 Environment for the operation of processes | Present in both | ISO 9001 text with added GMP requirements on the production environment |
| 7.2 Competence | Single clause | Splits into 7.2.1 General and 7.2.2 GMP-training |
| 7.5 Documented information | 7.5.1 to 7.5.3 | Adds 7.5.4 Administration of IT systems and data |
| 8.5.2 Identification and traceability | Present in both | ISO 9001 text with added GMP requirements on identification and traceability |
| 8.5.6 Control of changes | Present in both | Read with the defined term change control, documented with appropriate risk management |
| Annex C | Not present | Normative GMP requirements for printed primary packaging materials |
| Annex D | Not present | Guidance on verification, qualification and validation requirements |
The detailed wording under each clause is in the purchased standard. A supplier’s own procedures should reference it directly rather than a summary.
How risk management differs
ISO 9001 builds in risk-based thinking; ISO 15378 turns it into a defined vocabulary and applies it to every process. In ISO 9001:2015, risk-based thinking runs through the standard and clause 6.1 asks the organisation to plan actions to address risks and opportunities. It leaves the method to the organisation.
ISO 15378:2017 keeps that text and adds two things. Its introduction states that, because of the nature of primary packaging materials, the risk-based approach is applied throughout all processes of the organisation. And it adds a group of risk management definitions in clause 3.11, so that terms used elsewhere in the standard, such as change control, carry a specific meaning. Change control is defined as documented control of changes with appropriate risk management, and the note lists changes in raw materials, specifications, facilities, equipment, production processes and test methods.
For a buyer, this is where the two certificates differ most in practice. An ISO 9001 supplier may manage a change of raw material well. An ISO 15378 supplier is expected to document the risk assessment behind it.
What each certificate means for a supplier audit
An ISO 15378 certificate tells an auditor that GMP requirements for primary packaging were in scope when the quality system was certified; an ISO 9001 certificate does not. Neither replaces the buyer’s own supplier qualification, and both should be checked for scope, site and validity.
Four things are worth checking on an ISO 15378 supplier that an ISO 9001 audit might not reach:
- Change notification. How changes to raw materials, process, equipment or site are assessed for risk and notified to customers.
- Traceability. Whether a delivered lot can be traced to raw material batches and production records. See seal batch traceability.
- Production environment and cleanliness. The controls behind clause 7.1.4, and cleanroom classification where assembly is done in one.
- Customer audit access. ISO 15378 carries a customer audits subclause, so audit arrangements belong in the quality agreement.
The broader supplier checklist is in vial closure supplier selection, and GMP expectations for closure suppliers are covered in cGMP for vial closure suppliers.
Which one a buyer should ask for
For a supplier of a component that contacts the drug or forms part of the container closure system, ask for ISO 15378, and treat ISO 9001 on its own as the general baseline. ISO 15378 is a voluntary standard, so whether it is required is set by the buyer’s supplier qualification policy rather than by the standard itself.
How this works in practice at Autofits
Autofits holds ISO 9001:2015 (certificate 21.GGCS.IN.091174), ISO 15378:2017 (21.GGCS.IN.151175) and ISO 14001:2015 (21.GGCS.IN.140169), with Drug Master File 18100. Seals are made in Nashik with ISO Class 8 cleanroom assembly for ready-to-use supply, automated washing, 100% camera inspection and an AQL of critical nil, major not more than 2.5% and minor not more than 4%. The certification set is on the quality page and in quality certificates, and copies are supplied on request.
Frequently asked questions
Are the clause numbers of ISO 9001 and ISO 15378 the same?
Yes. ISO 15378:2017 follows the clause structure of ISO 9001:2015 from 1 to 10 and reproduces the ISO 9001 text in boxes. It adds GMP text outside the boxes and a few extra subclauses, such as 5.1.3 Customer audits, 7.2.2 GMP-training and 7.5.4 Administration of IT systems and data, without renumbering the ISO 9001 clauses.
How does risk management differ between ISO 9001 and ISO 15378?
ISO 9001:2015 requires risk-based thinking and actions to address risks and opportunities, leaving the method to the organisation. ISO 15378:2017 states that the risk-based approach is applied throughout all processes for primary packaging, adds a set of risk management terms, and defines change control as documented control of changes with appropriate risk management.
Does an ISO 15378 certificate cover ISO 9001 as well?
ISO 15378 contains all of the ISO 9001:2015 requirements, so a conforming quality system meets both. Certificates are issued against the standard audited, though, so a buyer whose policy asks for an ISO 9001 certificate should check what the supplier holds. Autofits holds separate ISO 9001:2015 and ISO 15378:2017 certificates.
Will a new edition of ISO 9001 change ISO 15378?
Not automatically. ISO 15378:2017 is written as the application of ISO 9001:2015, and that dated edition is named in its title. The ISO committee responsible for ISO 9001 has announced that its sixth edition is scheduled for publication on 16 September 2026; any change to ISO 15378 would come through ISO’s own revision of that standard, so check the ISO catalogue for the current status of both.
What does Annex C of ISO 15378 cover?
Annex C is a normative annex setting GMP requirements for printed primary packaging materials, so it carries requirements for organisations whose products are printed primary packaging. Annex D is informative and gives guidance on verification, qualification and validation requirements for primary packaging materials.
Related reading
Sources
- ISO: ISO 15378:2017, Primary packaging materials for medicinal products, Particular requirements for the application of ISO 9001:2015, with reference to good manufacturing practice (GMP) (https://www.iso.org/standard/70729.html)
- ISO: ISO 9001:2015, Quality management systems, Requirements (https://www.iso.org/standard/62085.html)
- ISO/TC 176/SC 2: ISO 9001 revision update, FDIS approved and sixth edition scheduled for 16 September 2026 (https://committee.iso.org/sites/tc176sc2/home/news/content-left-area/news-and-updates/news-1.html)
- ISO: ISO 9000:2015, Quality management systems, Fundamentals and vocabulary (https://www.iso.org/standard/45481.html)
*Last updated: 2026-09-15. This page summarises the structure of ISO 9001:2015 and ISO 15378:2017 and is not a substitute for the standards, which are available from ISO and national standards bodies. It is not regulatory or certification advice.*
