EU GMP Chapter 7 covers outsourced activities, and Annex 11 expects the suppliers and service providers of computerized systems to be assessed, with formal agreements that set out who is responsible for what. ICH Q10 describes managing outsourced activities and purchased materials as part of the pharmaceutical quality system, and for medical devices ISO 13485 requires controls over purchasing and suppliers. The depth of qualification should match the risk: a questionnaire for a low-risk supplier, an audit for a critical one.
Why it matters for labeling
Printers, translation agencies, design studios and software vendors all handle labeling content or support release decisions. A printer that changes a file, or a tool vendor with a weak release process, puts the label at risk. For a labeling verification tool, qualification means looking at the vendor's quality system, validation documentation, hosting and support arrangements, and agreeing responsibilities in writing, which Annex 11 expects. See also periodic review.
Common mistakes
- Qualifying a supplier once and never reviewing it again
- Treating a cloud vendor as outside the scope of supplier control
- No quality agreement defining who does what
- No assessment of printers and agencies who handle labeling files
- Relying on a certificate without checking it covers the services you use