Same principles, different regulatory force We find that gMP and cGMP describe the same fundamental concept — the minimum quality standards for manufacturing pharmaceutical products — but they originate from different regulatory frameworks and carry a critical practical distinction. GMP (Good Manufacturing Practice) is the term used by the World Health Organization, the European Medicines Agency, and the PIC/S (Pharmaceutical Inspection Co-operation Scheme). cGMP (current Good Manufacturing Practice) is the FDA’s term, codified in 21 CFR Parts 210 and 211. The difference is not semantic. The “c” in cGMP means that compliance is measured against contemporary capabilities, not historical baselines. If a superior manufacturing control method becomes commercially established and widely adopted, the FDA expects manufacturers to adopt it — even if the regulation’s text does not explicitly require it. This is an evolving standard, not a static checklist. Side-by-side comparison Dimension GMP (WHO/EU) cGMP (FDA/US) Regulatory authority WHO, EMA, national agencies FDA Legal basis WHO TRS, EudraLex Volume 4 21 CFR Parts 210, 211 Standard evolution Updated through revisions to guidance documents “Current” — expectation evolves with available technology Computerised systems EU GMP Annex 11 21 CFR Part 11, FDA CSA guidance Data integrity ALCOA+ principles (PIC/S PI 041) ALCOA principles (FDA guidance) Validation approach Traditional IQ/OQ/PQ or risk-based CSA (risk-based) or traditional Inspection framework National inspectorates, MRA agreements FDA inspections (domestic and foreign) Where the differences matter in practice For pharmaceutical companies operating in multiple markets, the practical question is not “GMP or cGMP?” but “which standard is more stringent for this specific requirement?” The answer varies by topic: Computerised systems: EU GMP Annex 11 is more prescriptive than 21 CFR Part 11 on audit trail requirements and periodic review. Annex 11 explicitly requires consideration of audit trails for all GMP-relevant changes. Part 11 focuses on electronic records and signatures but is less explicit about audit trail review processes. Software validation: FDA’s CSA guidance (2022) is more progressive than current EU expectations, allowing unscripted testing and risk-proportionate assurance for lower-risk software. EU inspectorates still tend toward traditional validation approaches, though the GAMP 5 Second Edition is shifting this. Process validation: Both frameworks align on lifecycle process validation (FDA’s 2011 guidance, EU GMP Annex 15), but FDA’s three-stage model (process design, process qualification, continued process verification) is more explicitly structured. Manufacturers supplying both US and EU markets apply the more demanding requirement in each area. This sometimes means following EU expectations for audit trail review while applying FDA’s CSA approach for software validation — combining elements from both frameworks to achieve compliance in both jurisdictions. The EU GMP Annex 11 requirements are particularly relevant for organisations that need to understand the European perspective on computerised system governance alongside FDA cGMP expectations. The convergence trend ICH harmonisation guidelines (particularly ICH Q8, Q9, Q10, and Q12) are gradually aligning GMP and cGMP expectations across major markets. The Pharmaceutical Inspection Co-operation Scheme (PIC/S) further harmonises inspection practices among 54 participating authorities. For most practical purposes, the core requirements are converging. The remaining differences are in regulatory emphasis, inspection style, and the pace at which new approaches (like CSA) are adopted across jurisdictions. What does the “current” in cGMP mean for software systems? The “current” prefix creates an evolving obligation: cGMP-regulated software systems must reflect the current state of technology and industry expectations, not merely the technology available when the system was first validated. This means that a system validated and compliant in 2015 may not meet cGMP expectations in 2025 if the industry standard has advanced significantly. For data integrity, the evolution is concrete. In 2010, paper-based records with manual signatures met cGMP data integrity expectations. By 2025, regulators expect electronic records with full audit trails, access controls, and automated data integrity checks. A manufacturing site still using paper batch records is technically cGMP-compliant only if it can demonstrate that paper records provide equivalent data integrity assurance to electronic systems — an increasingly difficult argument to make. For process monitoring, cGMP expectations have similarly evolved. Early cGMP required periodic manual checks of critical process parameters. Current expectations include continuous monitoring with automated alerts for out-of-specification conditions. Manufacturing sites that have not upgraded their monitoring systems face regulatory observations not because their process control is inadequate but because the technology standard has moved beyond periodic manual checks. We advise pharmaceutical clients to conduct technology currency assessments every 3–5 years: evaluate whether their validated systems meet current industry expectations, identify gaps, and plan remediation. This proactive approach prevents the regulatory risk that accumulates when systems age without modernisation. The assessment typically takes 2–4 weeks and produces a prioritised remediation roadmap with cost estimates and risk rankings.
