Pharmaceutical Quality Due Diligence Explained | TDP
A manufacturing site replaces an ageing piece of equipment with a newer model. The change is raised, risk assessed, qualified and approved by Quality. Batches are made. Nobody asks whether the equipment was described in the marketing authorisation.
Months later, someone does. The answer decides whether those batches were made in line with the registered details.
Pharmaceutical change control is meant to prevent exactly this. Most systems handle the GMP side well. Fewer make a reliable link between a change on site and the regulatory filing it may require. That gap is where a routine improvement turns into a compliance problem.
Two systems, one change
Every change to a licensed product sits in two systems at once.
The first is the site’s quality system. EU GMP Chapter 1 expects arrangements for the prospective evaluation of planned changes and their approval before implementation, taking into account regulatory notification and approval where required. It also expects an evaluation after implementation to confirm that the quality objectives were achieved. ICH Q10, the international guideline on pharmaceutical quality systems, lists a change management system among its core elements.
The second is the marketing authorisation. This is the product licence, and it contains registered details of how the product is made, tested, packed and supplied. A change to those details is a variation, and variations follow their own legal procedure with their own classifications and timelines.
The two systems are usually owned by different teams, and sometimes by different companies. Quality owns change control. Regulatory Affairs owns the dossier. Where manufacturing is outsourced, the contract manufacturer owns the change and the marketing authorisation holder owns the licence. A change can be handled properly in one system and missed entirely in the other.
Why classification matters before implementation
Variations are classified by their potential impact, and the classification determines whether a change can be made first or has to wait. The MHRA’s current guidance sets the position out for UK authorisations. The same structure applies in the EU, where the detail sits in the European Commission’s guidelines and the procedural guidance published by the EMA and the CMDh, the coordination group for nationally authorised products.
Type IA variations have little or no impact on quality, safety or efficacy. They are “do and tell” changes: the change is implemented and then notified, no later than 12 months afterwards. A subset, Type IAIN, must be notified immediately after implementation, and the MHRA treats two weeks as reasonable.
Type IB variations are more significant. The MHRA must approve them before they are implemented, and it takes up to 30 days to process a complete application. Many concern manufacturing or testing procedures.
Type II variations are major changes expected to have a significant impact. They also need approval before implementation, on timetables that run from 30 to 120 days once time for questions is included.
Some changes go beyond a variation altogether. A change to the active substance, the strength, the pharmaceutical form or the route of administration needs an extension application, which follows the process for a new authorisation.
The practical point is simple. If a change is Type IB or Type II, it should not be implemented until approval is in place, and product made under it should not be released. A site that implements first and classifies later has no way back for the batches already made.
IN PRACTICE
Classification is a scheduling decision as much as a regulatory one. It tells you when the first batch made under the change can be supplied.
What changed in January 2026
The rules themselves have moved. The EU Variations Regulation was amended with effect from 1 January 2025, and the European Commission published new Variations Guidelines in September 2025. According to the EMA, those guidelines apply to variation applications from 15 January 2026.
The UK has followed the same date. MHRA guidance states that the new guidance on procedures and categories of variations applies to all UK variations from 15 January 2026, regardless of the route of application.
Two consequences are worth checking against your own procedures.
The first is classification. Categories and their conditions have been revised, so a classification table built on the 2013 guidelines may now give the wrong answer. Any internal matrix that maps change types to variation types should be checked against the new annex.
The second is the handling of Type IA changes. Those that do not need immediate notification are now bundled into an annual update for each marketing authorisation, subject to listed exceptions. The MHRA expects that update no earlier than nine months after the first change was implemented and no later than 12 months after the oldest. This only works if implementation dates are recorded accurately. The MHRA treats implementation as the point at which the company makes the change in its own quality system, which puts the site’s change control record at the centre of the regulatory timeline.
A missed window has a cost. If a Type IA change goes more than 12 months without notification, MHRA guidance requires it to be submitted late as a Type IB variation.
HOW TDP SUPPORTS THIS
TDP’s CMC, MS&T and Regulatory Affairs consulting provides regulatory input for CMC-related change and submissions, with coordination across QA, manufacturing, supply chain and RA.
CMC, MS&T and Regulatory Affairs Consulting →
Where the link breaks
The failures are rarely dramatic. They are small gaps in ordinary process.
The change form has a regulatory impact box, and the person completing it ticks “no” without access to the dossier. It is a familiar weakness and one of the easiest to fix.
The registered details are not available to the site. Contract manufacturers often work from a technical agreement and a set of specifications, not from the dossier. They cannot assess the impact on a document they have never seen.
A contract partner does not notify at all. A starting material supplier changes its process, or a contract site changes a cleaning agent, and the notification clause in the quality agreement is vague about what counts.
Like-for-like assumptions go untested. Replacement equipment, an alternative supplier of the same grade of excipient or a new site for the same test may each be technically equivalent and still be a registered detail.
Changes accumulate. Ten small adjustments, each assessed alone as minor, can add up to a process that no longer matches its description.
Timing is ignored. The variation is identified correctly but submitted late, and manufacturing proceeds on the original plan.
What it costs when a variation is missed
The consequences reach further than the regulatory team.
At batch release, the Qualified Person certifies that each batch has been made in accordance with GMP and the marketing authorisation. A batch made under an unapproved change puts that certification in question, and the options are unattractive: hold the stock until approval, or reject it.
At inspection, the issue is graded on its merits. The MHRA’s definition of a major deficiency includes one that has produced, or may produce, a product that does not comply with its marketing authorisation.
Commercially, held stock means supply gaps, and supply gaps mean patients waiting and customers looking elsewhere. In a transaction, a pattern of unfiled changes is the kind of finding that changes a valuation.
Consider an illustrative example. A marketing authorisation holder uses a contract manufacturer for a tablet product. The contract site moves a blending step to a larger vessel to improve capacity and handles it as an internal change. The authorisation holder learns of it at the annual product review, by which time six batches are on the market. The technical risk may be low. The regulatory position still has to be assessed, explained and corrected, and none of that was planned.
Connecting change control to the licence
The fix is mostly organisational.
Put regulatory assessment into the change control workflow as a required step, completed before approval to implement by someone with access to the registered details. A tick box is not an assessment. A short written rationale is.
Maintain a usable summary of registered details for each product and site, so that the question “is this in the dossier?” can be answered quickly and by the right person.
Tighten quality agreements. Define which changes a contract manufacturer or supplier must notify, how far in advance, and who decides the classification. Then test the clause against last year’s changes.
Plan implementation around approval. For Type IB and Type II changes, build the assessment timetable into the project plan and agree in advance how stock made before and after the change will be segregated.
Record implementation dates precisely and keep a running register of Type IA changes for each authorisation, so that the annual update can be compiled without reconstruction.
Review periodically. EU GMP expects product quality reviews to cover all changes made to processes and analytical methods, which makes the annual review a natural check that site changes and regulatory filings still agree.
For products with frequent or predictable changes, ICH Q12 describes tools such as post-approval change management protocols, which allow the approach to a future change to be agreed with the regulator in advance. They take effort to set up and are worth considering where the same type of change will recur.
HOW TDP SUPPORTS THIS
For companies without in-house regulatory or CMC resource, TDP provides fully outsourced Quality, Regulatory and CMC functions.
Outsourced Quality, Regulatory and CMC functions →
How TDP can help
TDP supports CMC, MS&T and Regulatory Affairs activities through a network of specialist partners and consultants, with integrated support to manage change, maintain compliance and keep manufacturing moving. That includes regulatory input for CMC-related change and submissions, risk assessments and comparability thinking, and coordination between QA, manufacturing, supply chain and RA. Where teams need to build their own capability, we also provide regulatory training built around your products and processes.
If you are planning a site, supplier or process change, or want your change control process checked against the 2026 variations framework, request a call back to discuss what you need.