cGMP for Vial Closure Suppliers: Qualification, Change Control, and Documentation

Current good manufacturing practice does not bind a vial closure supplier directly in most jurisdictions. It reaches the supplier through the drug manufacturer’s own obligation to control its components and container closures, and through the quality agreement that flows those obligations down the supply chain. In operational terms, a closure supplier is expected to run a GMP-aligned quality system (in practice ISO 15378:2017), to qualify its facilities, equipment, and processes, to hold changes under formal control, and to produce a documentation package its customers can put in front of an inspector.

This page covers those obligations from the supplier’s side and gives buyers a checklist of what to qualify, what to ask for, and what to look at during an audit. For the regulation itself, see 21 CFR Part 211: cGMP for finished pharmaceuticals and packaging.

Key takeaways

cGMP regulations bind finished-drug manufacturers, not component suppliers. The supplier’s obligation is contractual and flows down through the quality agreement.
The recognised quality-system standard for this tier is ISO 15378:2017, which applies GMP requirements on top of ISO 9001:2015.
Change control is the most consequential clause in a closure supply agreement: an undeclared change to a lacquer, compound, or tool can invalidate a customer’s filed data.
Qualify a supplier on quality system, process validation, contamination control, traceability, and documentation, in that order.
Under EU GMP Annex 1 (2022 revision), the closure sits inside the contamination control strategy, so its supplier is inside the sterility assurance argument.
In India, revised Schedule M applies to drug manufacturers; component suppliers evidence equivalent discipline through ISO 15378 certification and, where filed, a Drug Master File.
An unrecorded good practice is, for GMP purposes, not a practice at all.

Who cGMP actually binds, and how it reaches a supplier

Every major cGMP framework places the legal duty on the maker of the finished medicine and then requires that maker to control its incoming components, which is the mechanism by which the requirement lands on the closure supplier. Three frameworks matter for most vial closure supply.

United States. 21 CFR Part 211 Subpart E governs the control of components and of drug product containers and closures: receipt, examination, testing against written specifications, approval or rejection, and controlled storage. Subpart G governs the packaging operation. The regulation also requires that containers and closures not be reactive, additive, or absorptive to an extent that alters the drug. None of this is satisfiable without a supplier that can evidence conformity batch by batch.

European Union. EU GMP Part I places supplier qualification and the control of starting and packaging materials on the manufacturing authorisation holder, and Chapter 7 governs outsourced activities. For sterile products, the 2022 revision of Annex 1 requires a contamination control strategy covering the primary packaging components and their supply, which pulls the closure supplier into the sterility assurance case, most visibly for biologic fills where the closure also has to survive the cold chain.

India. The revised Schedule M to the Drugs and Cosmetics Rules, notified in December 2023, applies to manufacturers of drugs; larger manufacturers came into scope during 2024 and small and medium manufacturers received a conditional extension to 31 December 2025. It does not license packaging component makers, so Indian closure suppliers demonstrate equivalent discipline through ISO 15378 certification and, where relevant, a Drug Master File. How that stacks up against a Western supplier’s documentation is set out in Indian versus global vial seal suppliers. Broader Indian context is in CDSCO guidelines for pharmaceutical packaging.

The consequence is the same in all three: the supplier’s obligation is created by contract, and the quality agreement is where it is written down.

The quality system a closure supplier is expected to run

ISO 15378:2017 is the operative standard, because it takes ISO 9001:2015 and adds the GMP requirements a pharmaceutical customer needs to see. The ISO 9001 layer gives process ownership, documented information, internal audit, management review, and corrective action. The GMP layer is what makes it fit for this tier.

Validation and qualification of premises, utilities, equipment, and processes rather than reliance on inspection alone.
Contamination control: classified production areas, gowning, material and personnel flow, cleaning regimes. Air cleanliness is classified under ISO 14644-1:2015, the standard behind designations such as ISO Class 8.
Traceability from incoming aluminium coil, resin, lacquer, and ink through to the delivered batch. What that chain looks like record by record is set out in vial seal batch traceability.
Risk management in the spirit of ICH Q9(R1) (Step 4, adopted 18 January 2023), to decide where control effort goes.
Controlled documentation and records, including batch records that survive the retention period.

A certificate alone proves little. Look at its stated scope (does it cover the products and the site supplying you?) and the accreditation of the body that issued it.

What has to be qualified

Qualification means demonstrating, on the record, that a facility, machine, tool, or process reliably produces conforming output. For a closure plant the scope is wide.

Area	What qualification covers
Facility and utilities	Classified area performance, air handling, compressed air, water quality where used
Production equipment	Design, installation, operational, and performance qualification of presses, coaters, moulding machines, and assembly lines
Tooling	Dies and moulds identified, controlled, inspected on a cycle, retired on a rule
Manufacturing process	Validation against critical dimensions and attributes, with capability data
Cleaning	Validated cleaning of product-contact surfaces and changeover procedures
Inspection and test	Automated visual inspection (detection capability, challenge sets, false-reject behaviour) and the methods used for release
Sterilisation	A validated cycle or dose, for ready-to-sterilise or ready-to-use supply
Packing and transport	Packaging qualified to preserve cleanliness in transit

Automated visual inspection deserves particular attention on an audit, because it decides which defects reach a filling line and its qualification is frequently thinner than the confidence placed in it.

Change control: the clause that matters most

A change made quietly at the component supplier can invalidate data the customer has already filed, which is why change notification, not price or lead time, is the clause to negotiate hardest. The consequences are asymmetric: the supplier sees a minor process improvement, the customer sees a regulatory variation and possibly repeat extractables and leachables testing.

A workable change-control clause defines four things.

What counts as a notifiable change. Raw material or its source; elastomer, lacquer, ink, or resin formulation; tooling and moulds; process parameters; production line or site; sterilisation method; inspection method; specification or drawing; and the supplier’s own upstream suppliers.
Notification categories and lead times. Changes needing customer approval before implementation, versus changes notified for information, with advance written notice for the first category set by how long re-qualification takes.
What comes with the notification. The rationale, the risk assessment, affected part numbers, comparative data, and re-qualification samples.
What happens to existing stock. Whether pre-change material stays available during the transition.

Buyers should also ask to see the change log during an audit. A supplier with no changes recorded in three years is not stable; it is more likely under-recording.

Deviations, complaints, and records

GMP maturity shows in how a supplier handles the things that went wrong, not in how it describes the things that went right. Three record sets tell most of the story.

Deviations and CAPA. Look for deviations detected internally rather than by a customer, root causes naming a mechanism rather than “operator error”, effectiveness checks actually performed, and closure within the stated timeframe.
Complaints. A supplier should trace a complaint to a batch, the batch to its raw materials and production records, and the investigation to a defined disposition. Trending indicates whether the system learns.
Batch records and data integrity. Records should be attributable, legible, contemporaneous, original, and accurate, with the same expectations for electronic systems: access control, audit trails, no shared logins, judged against EU GMP Annex 11 and 21 CFR Part 11 principles.

The documentation a buyer should demand

This is the practical output of supplier cGMP: a package of documents that lets the drug manufacturer defend its component control without re-deriving the supplier’s work.

Document	What it evidences	When to ask
ISO 15378:2017, ISO 9001:2015, and ISO 14001:2015 certificates, with scope and issuing body	A GMP-aligned quality system covering this site and product	Pre-qualification
Component specification and drawing with tolerances	The acceptance criteria both sides are held to	Qualification
Declaration of composition, plus TSE/BSE, animal-origin, latex, and phthalate statements	The material basis for compatibility and E&L work	Qualification
Drug Master File number and letter of authorisation	Confidential material and process detail a regulator can review	Submission
Process validation, equipment qualification, and classified-area monitoring records	Processes are capable and contamination control is maintained	Audit
Particulate and bioburden data, and the sterilisation validation report	Cleanliness as delivered, and a validated cycle for sterile supply	Qualification
Batch certificate of analysis and certificate of conformity	This delivery met the agreed specification	Every batch
Signed quality or technical agreement	The obligations above are contractual	Before first supply
Change notification history, plus deviation, complaint, and CAPA summary	Changes were declared, and issues are detected and closed	Ongoing

A Type III Drug Master File is worth singling out: the supplier files confidential composition and process detail with a regulator, and the customer references it by letter of authorisation, shortening qualification without disclosing formulations to a commercial counterparty.

Running the audit

A closure supplier audit is short if you know what you are looking for: two days is usually enough, and most of the value comes from tracing one real batch end to end. A workable agenda:

Open with scope and the site’s quality metrics. Review the system documents: quality manual, change control log, deviation and CAPA log, training records, internal audit findings, management review minutes. Walk the process in flow order, from material receipt and quarantine through coating, forming, moulding, assembly, inspection, and packing, watching material flow, personnel flow, and segregation of released and unreleased stock. Then pick one delivered batch and trace it backwards to its raw material lots and forwards to its release documentation. That trace is the part that cannot be prepared for, which is why it is worth doing.

Where supplier cGMP stops

A closure supplier can evidence its own process; it cannot qualify the customer’s container closure system. Compatibility with a specific drug, integrity of the assembled package, the capping parameters set on the fill-finish line, and the finished product’s E&L profile remain the drug manufacturer’s responsibility, informed by supplier data but not delegated to it. The commercial side of choosing between suppliers is covered in vial closure supplier selection.

How this works in practice at Autofits

Autofits manufactures primary packaging rather than finished medicines, so cGMP regulations apply to its customers and reach Autofits through their component-control obligations and quality agreements. Production runs under an ISO 15378:2017 quality system, alongside ISO 9001:2015 and ISO 14001:2015 certification and a Drug Master File customers can reference in their submissions, in a 75,000 sq ft Nashik facility with an ISO Class 8 cleanroom. At around 2.4 billion seals a year across a 300-plus person operation, batch-level traceability is an operational discipline rather than an occasional exercise. The seal range those systems produce is on the products page, and the certification set on the quality page. A quality agreement also needs a counterparty: the leadership accountable for that quality system is named on the team page, and the company background on the about page.

Frequently asked questions

Does cGMP apply to vial closure suppliers?

Not directly in most jurisdictions. cGMP regulations such as 21 CFR Part 211 and EU GMP bind manufacturers of finished medicines, who must control their components and container closures and discharge that obligation by qualifying suppliers and signing quality agreements. The supplier’s duty is contractual, and in practice it is met by operating an ISO 15378:2017 quality system.

What is the difference between ISO 15378 and cGMP?

cGMP is a binding regulation on drug manufacturers. ISO 15378:2017 is a voluntary, certifiable quality-management standard for makers of primary packaging materials, applying ISO 9001:2015 with added GMP requirements covering validation, contamination control, traceability, and risk management. A supplier certified to ISO 15378 is not “cGMP certified”, because no such certification exists for this tier.

What documents should a buyer request from a vial closure supplier?

At minimum: ISO 15378:2017, ISO 9001:2015, and ISO 14001:2015 certificates with their scope; the agreed specification and drawing; a declaration of composition with TSE/BSE, animal-origin, and latex statements; the Drug Master File number and letter of authorisation; process validation and qualification summaries; classified-area monitoring records; a batch certificate of analysis with every delivery; and a signed quality agreement with a change-notification clause.

Why is change control so important with packaging suppliers?

Because a change the supplier considers minor can invalidate work the customer has already filed. A different lacquer, compound, resin grade, tool, or production site can alter the extractables profile, the dimensional behaviour on a capping line, or both, leaving the customer facing a regulatory variation, repeat testing, or a re-validated capping setup. A change-notification clause with defined categories and notice periods prevents this.

How often should a vial closure supplier be audited?

Common practice is an on-site audit before first supply, then risk-based re-audit, typically every two to three years for a stable supplier of a critical component, with the interval shortened after a significant change, a quality event, or a site transfer. Between audits the supplier is monitored through batch documentation, complaint and deviation trends, and change notifications.

Does revised Schedule M apply to packaging material manufacturers in India?

Revised Schedule M, notified in December 2023 under the Drugs and Cosmetics Rules, sets good manufacturing practice requirements for manufacturers of drugs, not of packaging components, so Indian closure suppliers are not licensed under it. They demonstrate equivalent discipline through ISO 15378:2017 certification, a Drug Master File where one is filed, and their customers’ quality agreements.

Sources

U.S. FDA / eCFR: Title 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals, Subparts E and G (https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211)
European Commission: EudraLex Volume 4, EU GMP guidelines, including Part I and Annex 1 (2022 revision) (https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en)
ISO: ISO 15378:2017, Primary packaging materials for medicinal products (https://www.iso.org/standard/70729.html)
ISO: ISO 14644-1:2015, Cleanrooms, Part 1: Classification of air cleanliness by particle concentration (https://www.iso.org/standard/53394.html)
ICH: Q9(R1) Quality Risk Management (https://www.ich.org/page/quality-guidelines)
Ministry of Health and Family Welfare, Government of India: conditional extension of the revised Schedule M compliance timeline for small and medium manufacturers (https://www.pib.gov.in/PressReleasePage.aspx?PRID=2102291)

*Last updated: 2026-07-31. This article is general regulatory information, not legal or compliance advice; confirm current regulatory text, standard editions, and requirements with the relevant regulator and issuing bodies.*