EU-GMP Certification for Cannabis: The Complete 2026 Guide for International Producers

What does this mean for the global cannabis industry?

Cannabis is, by volume, one of the fastest-growing pharmaceutical commodity imports in the European Union. Germany’s medical cannabis consumption reached 142 tonnes in just the first nine months of 2025. Portugal’s exports tripled to 42 tonnes. Poland serves more than 105,000 patients. Every gram of cannabis in those supply chains entered the EU pharmaceutical market with the same prerequisite: compliance with EU Good Manufacturing Practice, certified by a national competent authority, and listed in the EudraGMDP database.

For international producers in Canada, Australia, South Africa, Colombia, and across the emerging producer countries, EU-GMP certification is not an optional market access upgrade. It is the minimum threshold for selling into the world’s most tightly regulated cannabis import market. Yet the certification process is poorly understood by many operators outside Europe — a gap that Malta’s Medicines Authority underscored in April 2025 when it issued two formal non-compliance statements against South African cannabis sites and advised EU member states to block marketing authorization applications for those facilities.

This guide explains what EU-GMP certification is, why it is structurally non-negotiable for European market access, what the standard requires for cannabis producers specifically, how the inspection and certification process works in practice, and where international producers most commonly fail.

What EU-GMP Is — And What It Is Not

EU Good Manufacturing Practice is the set of quality standards that govern how medicinal products and their active pharmaceutical ingredients (APIs) must be manufactured, tested, and controlled for sale in the European Union. The standards are codified in EudraLex Volume 4 — the EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use — published and maintained by the European Commission’s Directorate-General for Health and Food Safety.

EU-GMP is distinct from:

• GACP (Good Agricultural and Collection Practice) — the pre-manufacturing standard governing cultivation, harvesting, and initial post-harvest handling of herbal starting materials. GACP does not certify a manufacturer; it establishes baseline quality for the botanical input material.
• GDP (Good Distribution Practice) — the standard governing wholesale distribution and storage of finished medicinal products.
• GPP (Good Production Practice) — Canada’s domestic production standard for cannabis licensed producers, which does not satisfy EU pharmaceutical requirements.

EU-GMP certification is not self-declared. It is awarded by a national competent authority (NCA) — an EU member state’s medicines regulatory body — following a physical inspection of the manufacturing facility. The resulting certificate is listed in the EU’s publicly searchable EudraGMDP database, which also records statements of non-compliance. Any cannabis manufacturer claiming EU-GMP compliance without a current EudraGMDP certificate listing is making an unsupported assertion.

The Legal Framework: Where Cannabis Sits in EU Pharmaceutical Law

Cannabis as a medicinal product or pharmaceutical ingredient does not occupy a separate regulatory silo in EU law. It is subject to the same legal framework that governs all human medicinal products and their active pharmaceutical ingredients.

The Primary Legal Instruments

The foundational legal basis for EU-GMP obligations is Directive 2001/83/EC of the European Parliament and of the Council (the Community Code for medicinal products for human use). Title IV of that Directive establishes manufacturing and importation requirements, requiring manufacturing authorization for any medicinal product manufactured or imported into the EU.

Directive 2003/94/EC lays down the GMP principles and guidelines for human medicinal products and investigational medicinal products, explicitly authorizing the European Commission to publish GMP guidelines — which it does through EudraLex Volume 4.

Directive 2011/62/EU (the Falsified Medicines Directive) introduced Article 111b into Directive 2001/83/EC, establishing the written confirmation requirement for active substance imports from third (non-EU) countries.

How Cannabis Is Classified

The applicable EU-GMP chapter depends on where in the supply chain the manufacturer operates:

The EMA has addressed the classification of cannabis-derived products directly in its published Q&A guidance, confirming that where cannabis is used as a herbal starting material for a medicinal product, the relevant GMP framework is EudraLex Volume 4 — Part I (for finished medicinal products), Part II (for the active substance extraction stage), and Annex 7 (for herbal medicinal product-specific requirements).

The Standards in Detail: What EU-GMP Requires

EudraLex Volume 4 Part I: The Nine Core GMP Chapters

Part I applies to finished medicinal product manufacturers. Its nine chapters establish the baseline quality framework that cannabis processors producing finished dosage forms (oils, capsules, dried flower in patient packaging) must satisfy:

EudraLex Volume 4 Part II: Active Substance (API) Manufacture

For producers whose primary activity is extracting and purifying cannabinoid active substances, EudraLex Volume 4 Part II is the governing standard. Harmonised with ICH Q7, it covers quality management, personnel, facilities, equipment, documentation, materials management, production controls, laboratory controls, validation, change control, and self-inspection. The initial extraction steps — solvent extraction, mechanical separation, distillation — from herbal cannabis starting materials must be conducted under Part II GMP when the extract will be used as a medicinal product active substance.

EudraLex Volume 4 Annex 7: Herbal Medicinal Products

Annex 7 provides supplemental GMP requirements specifically for herbal medicinal product manufacturers. Key requirements include:

• Starting material specifications: Herbal substances (the raw plant material) and herbal preparations (extracts, tinctures, expressed juices) must each have written specifications covering botanical identity, purity, content of active markers, and absence of specified contaminants including pesticides, heavy metals, mycotoxins, and microbial contamination.
• Sampling: The sampling plan for herbal starting materials must account for their heterogeneous nature — a standard statistical approach designed for homogeneous chemical raw materials is not appropriate.
• Storage: Appropriate conditions are required to prevent microbial contamination, mould, insect infestation, and cross-contamination. First-in/first-out stock rotation is required.
• GACP/GMP boundary: Annex 7 contains a reference table indicating which production steps fall under GACP versus GMP. Generally, steps from cultivation through initial sorting and drying are governed by GACP; steps from the production of extracts and preparations onward fall under GMP.

The Revised GACP Guideline (Effective August 2025)

The EMA’s Committee on Herbal Medicinal Products (HMPC) adopted a revised GACP guideline in July 2025, effective August 2025, representing the first major revision since 2006. The revised guideline is directly relevant to cannabis cultivators because it explicitly addresses indoor and controlled-environment cultivation for the first time.

Key changes for cannabis producers:

• Indoor cultivation formalized: Annex 1 of the revised GACP guideline introduces specific requirements for indoor and greenhouse cultivation, including climate, humidity, light, and ventilation controls; identification of Critical Quality Attributes and Critical Process Parameters; daily digital monitoring of critical parameters; and standardised, reproducible cultivation processes.
• Traceability tightened: The guideline requires "unambiguous and unmistakeable" traceability from seed to harvested herbal substance, with detailed batch documentation at each production stage.
• Contamination controls expanded: New requirements address pyrrolizidine alkaloids (PAs), tropane alkaloids (TAs), and polycyclic aromatic hydrocarbons (PAHs), including a prohibition on wood-fired or petroleum-fired drying ovens.
• GACP/GMP boundary clarification: The revision clarifies that drying, cutting, grading, and storage — when not product-defining — remain under GACP, while steps shaping the final dosage form fall under GMP Part II or Annex 7.

GACP alone does not qualify a producer for EU market access. It is the mandatory floor, not the ceiling.

Annex 11: Computerised Systems

EudraLex Volume 4 Annex 11 governs all computerised systems used in GMP-regulated manufacturing — including seed-to-sale tracking software, laboratory information management systems (LIMS), environmental monitoring systems, and electronic batch records. The standard requires:

• System validation documented through User Requirements Specifications, Functional Specifications, and qualification protocols (IQ, OQ, PQ)
• Data integrity controls preventing alteration of records without audit trail
• Electronic signatures with defined identity, meaning, and time-stamp
• Supplier assessment for commercial off-the-shelf software
• Backup and disaster recovery procedures
• Periodic review of validated system status

Annex 11 compliance is one of the most consistently cited deficiency areas in cannabis GMP inspections. Any seed-to-sale platform used by a producer seeking EU-GMP certification must itself be validated to Annex 11 / PIC/S equivalent standards. Understanding how software validation works in practice — including vendor documentation, qualification protocols, and operator responsibilities — is covered in GrowerIQ’s guide to GMP software validation for cannabis producers.

The Written Confirmation Requirement for Active Substance Imports

For international producers supplying cannabis as an active substance (API or herbal preparation) to EU-based manufacturers, a critical legal obligation under Article 111b of Directive 2001/83/EC (as introduced by Directive 2011/62/EU) must be satisfied.

Non-EU active substance manufacturers must have their national competent authority provide a written confirmation to EU importers stating that:

1. The manufacturing site operates under GMP standards at least equivalent to EU standards.
2. The site is subject to regular, strict, and transparent controls.
3. The competent authority has enforcement capability including unannounced inspections.

The Article 111b White List

The European Commission maintains a list of third countries whose GMP regulatory frameworks have been assessed as equivalent to EU standards, exempting manufacturers in those countries from the per-import written confirmation requirement. As of 2025, the listed (exempted) countries are:

This means Canadian and Australian cannabis API exporters benefit from the written confirmation exemption. Producers in South Africa, Colombia, Uruguay, Morocco, North Macedonia, and other emerging cannabis-producing countries do not — their competent authority must issue written confirmation for each export, unless the producer has obtained a GMP certificate from an EU national competent authority that satisfies the importer’s documentation requirements.

How the Inspection and Certification Process Works

EU-GMP certificates for cannabis manufacturers — whether producing in Canada, Colombia, South Africa, or any other non-EU country — are issued by national competent authorities (NCAs), not directly by the European Medicines Agency. The EMA coordinates GMP policy and maintains the EudraGMDP database, but inspection and certification authority rests with the NCAs of EU member states.

The NCAs known to have conducted international cannabis GMP inspections include Germany’s BfArM (through the regional authority system and ZLG), Portugal’s INFARMED, Denmark’s Danish Medicines Agency (Lægemiddelstyrelsen), and Malta’s Medicines Authority. Germany in particular has become the dominant entry point given the scale of its medical cannabis market.

Step-by-Step: The EU-GMP Certification Pathway

Step 1 — Gap Analysis (approximately 1 month)

Before any formal application, an independent pharmaceutical GMP consultant or internal quality team should conduct a thorough gap analysis comparing current facility operations against EudraLex Volume 4 Part I and/or Part II requirements, Annex 7 (if producing herbal medicinal products), and Annex 11 (for all computerised systems). The gap analysis identifies remediation priorities and an estimated timeline to inspection readiness.

Step 2 — Remediation and System Build-out (3–18 months, highly variable)

Remediation scope varies enormously by facility baseline. Operations building from agricultural-standard facilities may require:

• Facility construction or retrofit to pharmaceutical cleanroom standards (typically ISO Class 7 or 8 for primary production areas, with defined HVAC and HEPA filtration)
• Equipment qualification programs (Installation Qualification, Operational Qualification, Performance Qualification for all GMP-critical equipment)
• Quality Management System implementation — written SOPs for every GMP activity, master batch records, deviation and change control systems, CAPA programs
• QC laboratory qualification or contract laboratory agreements with qualified EU-based labs
• Personnel training and qualification records
• Validated computerised systems meeting Annex 11 requirements
• Supplier qualification program for all starting materials including cannabis genetics

Step 3 — Pre-Inspection Internal Audit

A mock inspection by qualified GMP auditors — either an internal team or contracted pharmaceutical consultants — against the applicable EudraLex standards. All identified deficiencies should be resolved before initiating formal application.

Step 4 — Application to a National Competent Authority

The manufacturer, or an EU-based importer with a manufacturing and import authorisation, applies to the chosen NCA for an inspection. Required documentation typically includes:

• A Site Master File (SMF) describing the facility, quality system, and manufacturing activities — formatted per EudraLex Volume 4 guidance
• A manufacturing license or equivalent authorization from the domestic competent authority
• Product information and intended EU market application details

Step 5 — On-Site Inspection (typically 3–5 days)

The NCA dispatches a team of GMP inspectors — typically two to four — to the manufacturing facility. The inspection covers:

• Review of the Site Master File and quality documentation
• Physical walk-through of manufacturing, packaging, storage, and laboratory areas
• Review of batch records, deviation logs, change control records, and CAPA files
• Interviews with key personnel (Qualified Person equivalent, QA Manager, Production Manager)
• Observation of manufacturing operations where possible
• Examination of computerised systems and data integrity controls

At the inspection’s conclusion, inspectors discuss preliminary findings. A formal inspection report follows, categorising any deficiencies as critical, major, or other (minor). Critical deficiencies alone are sufficient grounds for a non-compliance statement.

Step 6 — Certificate Issuance or Non-Compliance Statement

If the inspection is satisfactory, the NCA issues a GMP certificate covering the specific manufacturing activities at the inspected site. The certificate is entered into the publicly searchable EudraGMDP database. If deficiencies cannot be resolved, the NCA issues a non-compliance statement — also publicly listed in EudraGMDP — and advises other EU member states accordingly.

GMP certificates are typically valid for three years, subject to ongoing compliance and re-inspection at renewal or following significant changes.

Total timeline from gap analysis to certification: 12–24 months is a reasonable planning horizon for facilities without prior pharmaceutical GMP history.

The Qualified Person: Your EU Gatekeeper

Even with a valid EU-GMP certificate at the manufacturing site, no batch of cannabis medicinal product can enter the EU market without certification by a Qualified Person (QP).

The QP is a statutory role defined in Article 48 of Directive 2001/83/EC. Every manufacturing and import authorisation holder in the EU must name at least one QP, who must meet specific educational and experience requirements (typically a university-level qualification in pharmacy, medicine, or a related science plus minimum two years practical experience in pharmaceutical manufacturing). The QP’s name appears on the manufacturing authorisation.

For imported cannabis products from third countries, EudraLex Volume 4 Annex 16 establishes the QP’s batch certification responsibilities. Before certifying a batch for release into the EU market, the QP must be satisfied that:

• The batch was manufactured in compliance with the manufacturing authorisation, the marketing authorisation (or approved specifications for the product), and EU GMP
• Full qualitative and quantitative analysis has been conducted in an EU member state (unless a Mutual Recognition Agreement waiver applies)
• All batch documentation is complete and correct, including analytical results from both the manufacturing site and the EU import testing

The batch-by-batch import testing requirement is a significant ongoing compliance cost for non-MRA-country producers. For producers in Canada and Australia — both on the Article 111b white list and covered by MRA-equivalent arrangements — import testing requirements may be waived for specific product categories. For producers in South Africa, Colombia, or other non-listed countries, full batch testing in the EU upon importation is a legal requirement under Article 51(1)(b) of Directive 2001/83/EC, not optional.

International producers without their own EU manufacturing presence typically access QP certification through an EU-based contract importer holding a manufacturing and import authorisation. Selecting and formalising an agreement with a contract importer is a critical early step in the EU market entry strategy.

The EudraGMDP Database: Transparency as Enforcement

The EudraGMDP database is the publicly accessible EU union database established under the pharmaceutical regulations. It contains:

• Manufacturing and import authorisations
• GMP certificates issued by EU NCAs
• Statements of non-compliance (GMP refusals)
• GDP certificates for wholesale distributors
• Registration records for active substance manufacturers and importers in the EEA

The database is the instrument through which EU member state authorities, marketing authorisation holders, and importers verify the GMP status of any manufacturing site. A buyer in Germany sourcing cannabis from a South African producer will search EudraGMDP before committing to purchase. A national medicines authority will search it before accepting a marketing authorisation application naming that site.

The April 2025 non-compliance statements against two South African cannabis sites (MT/001/NCR/2025 and MT/002/NCR/2025) demonstrate the database’s enforcement function: once a non-compliance statement is listed, member states are advised to refrain from authorising marketing applications naming those sites. Market access is blocked until compliance is demonstrated and a new certificate issued.

Common Pitfalls: What Causes Cannabis Manufacturers to Fail Inspection

The April 2025 Malta non-compliance reports, Germany’s BfArM enforcement escalation in 2025, and documented cannabis GMP deficiencies in the ECA Academy’s reporting identify consistent failure patterns across cannabis manufacturing facilities:

1. Inadequate Facility and Equipment Qualification

Many cannabis facilities were designed and built for agricultural or food-grade production, not pharmaceutical manufacturing. EU-GMP Part I Chapter 3 requires defined cleanroom classifications, qualified HVAC systems, and documented equipment qualification (IQ/OQ/PQ) for all GMP-critical equipment. Agricultural-grade facilities with no formal IQ/OQ/PQ documentation fail immediately on infrastructure.

2. Insufficient Process Validation

GMP requires documented evidence that manufacturing processes consistently produce a product meeting its specification. For cannabis, this includes validated extraction processes, drying processes, and analytical methods for cannabinoid potency and contaminants. The Malta inspections cited "insufficient process validation" as a critical finding.

3. Data Integrity Failures

Inspectors focus on ALCOA+ principles — data must be Attributable, Legible, Contemporaneous, Original, and Accurate. Paper-based systems with backdated entries, electronic systems lacking audit trails, and the common "notebook then re-key" workflow create timestamp discrepancies that inspectors are specifically trained to detect. Understanding what contemporaneous documentation actually requires in a GMP environment is addressed in GrowerIQ’s ALCOA guide on contemporaneous data capture in cannabis GMP.

4. Computerised Systems Not Validated to Annex 11

The Malta inspections noted "IT system and backup deficiencies with serious data integrity implications" as a major finding in the QC laboratory. Seed-to-sale tracking systems, LIMS, and environmental monitoring systems that have not been validated to Annex 11 standards — with documented IQ/OQ/PQ, user requirement specifications, and change control — are a consistent inspection weakness.

5. Limited QA Expertise

The Malta non-compliance statements explicitly cited "limited GMP expertise within Quality Assurance (QA)" as a critical finding. Cannabis producers transitioning from agricultural or recreational production models frequently underestimate the depth of pharmaceutical QA knowledge required. QA personnel overseeing EU-GMP manufacturing must have pharmaceutical industry qualifications and experience, not cannabis-sector-only backgrounds.

6. Supplier Qualification Gaps

Germany’s BfArM has formally identified "purchase of dried cannabis flowers from non-GMP facilities" as a GMP compliance violation. As of 2025, BfArM’s position is that a valid GMP certificate must cover the drying step — meaning GACP-only certification for upstream suppliers is not sufficient for cannabis flowers entering GMP-certified processing. This is a supply chain-level challenge for producers sourcing from multiple cultivation sites.

7. Inadequate Deviation and CAPA Management

Deviation management systems that merely record deviations without formal root cause analysis, effectiveness checks, and systematic CAPA closure are a recurring major finding. The deviation management system is a window into whether a quality culture is functional or merely documented.

Choosing Your National Competent Authority

Selecting which EU NCA to approach for inspection is a strategic decision. The NCAs with documented international cannabis GMP inspection experience include Germany’s BfArM (through the ZLG network — the largest EU market and highest inspection volume since 2024), Portugal’s INFARMED (a major EU cannabis export hub), Denmark’s Lægemiddelstyrelsen (DKMA), and Malta’s Medicines Authority (which has specific cannabis production legislation and issued two non-compliance statements in April 2025). BfArM has become the dominant entry point for third-country producers in Colombia, South Africa, and Canada by volume, and its scrutiny of cannabis supply chain documentation — including the source of dried flower and drying step GMP coverage — has intensified markedly since 2024.

How Digital QMS Infrastructure Determines Inspection Outcomes

Every EU-GMP chapter and annex described above — quality management, documentation, production, QC, computerised systems, batch release — generates a documentation burden that cannot be managed sustainably on paper or in generic software. The practical reality of EU-GMP certification is that the quality management system is not just a prerequisite: it is the product the inspector evaluates.

A GMP inspection is fundamentally a documentation review with supporting facility observation. Inspectors ask to see the deviation log, the CAPA register, the batch records, the environmental monitoring data, the equipment calibration records, the training files, the supplier qualification records, and the validated system audit trails. If any of those are incomplete, inconsistent, or not retrievable in real time, the inspection fails.

GrowerIQ’s seed-to-sale platform was independently validated as GxP-compliant in December 2025 by RQC, a pharmaceutical GMP system validation consultancy, confirming alignment with EudraLex Volume 4 Annex 11 and PIC/S standards. The platform provides the integrated QMS and traceability infrastructure — master batch records, electronic signatures, activity logs, document control, deviation management, and real-time data capture — that EU-GMP certified facilities require.

For producers building toward EU-GMP certification, the choice of digital infrastructure is a compliance decision, not a software procurement exercise. More on GrowerIQ’s EU GMP, GACP, and GPP compliance capabilities is available on the EU GMP, GACP & GPP compliance page.

The producers who succeed in EU markets are not simply those with the best cannabis. They are the ones whose quality systems, documentation architecture, and digital infrastructure make it possible for a national competent authority inspector to spend three days at their facility and leave confident that every batch is controlled, every deviation is tracked, every record is retrievable, and every operator knows what the rules are. EU-GMP certification is the credential. The quality management system is what earns it.

This analysis is current as of May 2026 and draws on the European Commission’s EudraLex Volume 4 (including Part I, Part II, Annex 7, Annex 11, and Annex 16), Directive 2001/83/EC and its amendments, the EMA HMPC revised GACP guideline (effective August 2025), the EudraGMDP database, Malta Medicines Authority non-compliance statements MT/001/NCR/2025 and MT/002/NCR/2025, and reporting from the ECA Academy’s GMP compliance network. Figures reflect the best available data as of the publication date.

Sources

• EudraLex Volume 4 — EU Guidelines for Good Manufacturing Practice — European Commission DG SANTE
• EudraLex Volume 4 Annex 7 — Manufacture of Herbal Medicinal Products — European Commission
• EudraLex Volume 4 Annex 11 — Computerised Systems — European Commission
• EudraLex Volume 4 Annex 16 — Certification by a Qualified Person and Batch Release — European Commission
• EudraGMDP Database — EU Union Database of Manufacturing Authorisations and GMP Certificates — European Medicines Agency
• EMA HMPC Draft Guideline on GACP for Starting Materials of Herbal Origin, Revision 1 — European Medicines Agency (adopted July 2025)
• Directive 2001/83/EC — Community Code Relating to Medicinal Products for Human Use — European Parliament and Council
• Importation of Active Substances — Listing of Third Countries (Article 111b White List) — European Commission DG SANTE
• EU Good Manufacturing and Distribution Practices — European Commission DG SANTE
• GMP Non-Compliance Reports for Two Cannabis Sites (MT/001/NCR/2025; MT/002/NCR/2025) — ECA Academy (reporting on Malta Medicines Authority EudraGMDP entries)
• Malta Medicines Authority — Good Manufacturing Practice — Medicines Authority Malta
• Germany’s BfArM Clarifies Cultivar Approval as EU-GMP Scrutiny Increases — StratCann
• EMA Revises GACP After 19 Years: What the New Standard Means for Medical Cannabis Cultivation — Cannavigia
• Importing Medicinal Products into the EU: A Brief Guide to EU GMP Compliance — QbD Group
• EU-GMP Roadmap for Cannabis Producers — Cannaflos (notes BG-Labs Colombia and GES Labs South Africa certification cases)
• GrowerIQ Renews GMP Compliance Through Independent Validation by RQC — GrowerIQ