Remote Certification – Take-aways from legal Considerations
Triggered in particular by the Covid-19 pandemic and increased activities from the home office, QPs are repeatedly faced with the question of the extent to which batch certification can also be carried out remotely. This was also demonstrated by the great interest in the parallel session on this topic at the 19th QP Forum of the European QP Association at the end of 2024 in Amsterdam. The session was moderated by EQPA Board members Cheryl Chia and Ulrich Kissel.
During the pandemic we saw a higher importance of establishing procedures on a remote basis and this was also applied for remote certification for Qualified Persons (QPs). Remote certification was an already practiced option in several member states of the EU/ EEA prior to the pandemic but during the pandemic it became a generally allowed procedure across EU/EEA. After the end of the pandemic the discussion continued whether this procedure could stay in effect for all member states or would become constrained by harmonized or not harmonized prerequisites to be fulfilled differently for each member state. In response, the inspectors working group (IWG) therefore published a Questions and Answers (Q&As) document which outlines a set of requirements and appropriate tools to be available to the QP prior to execute remote certification. The level of harmonization may be constrained by the need to get allowance from competent authorities.
This essay discusses the emerging practise since the Q&A was published and specifically the approach followed by some member states and QPs to accept and execute remote certification including scenarios across borders of the different member states within the EU/EEA.
Is remote certification a defined term?
We only know the definition of certification as it is given in Annex 16. According to this definition certification is a certification in a register or equivalent document by a QP. The content of the Batch Certificate for Medicinal Products includes signature of the Qualified Person certifying the batch. Remote certification is not defined.
Recommendation
Copenhagen, Denmark26 August 2025
Raw Data - Understanding, Defining and Managing
Are the Q&As consistent with Annex 16 on certification?
The current Q&As introduces a different meaning of certification which includes the assessment of a variety of data which needs to be managed and accessible in way of robust IT tools for distant assessment prior to the signature of the - in case of remote certification - electronic register. The Q&As discuss certification as a process and not as the (final) signature to the batch certificate/ register.
The Q&As are therefore widening the term certification inconsistently to the definition given in Annex 16. Certification if remotely performed is now referring to the process of assessing data which happens outside the premises covered by the MIA. The author finds this fully appropriate but concludes that the definition of Annex 16 needs revision to reflect better the process of certification which ends by giving a signature instead of limiting the definition to such signature only.
How are the Q&As structured?
There are three Q&As on remote certification. The first part expresses the general possibility of remote certification under the provision that the competent authority gives its consent, the second part focuses on the data and data handling by electronic means required for certification, and the third part more specifically discusses the requirements for an appropriate electronic signature for certification. Although applicable, no references are made on general EU regulations on data protection and electronic signatures established for the EU/EEA.
Is remote certification paper-based or partly paper-based possible?
The Q&As do not allow for any paper-based remote assessment of documents. Not completed GMP documents need to continuously be held under GMP control and can therefore by definition not leave the GMP controlled premises of the MIA holder which prevents from any paper-based remote assessment.
Recommendation
Copenhagen, Denmark27-29 August 2025
Data Integrity Master Class
Are there territorial implications included in the Q&As?
Territorial considerations are included in the first answer. The competent authority (CA) where the manufacturing authorization (MIA) holder is established should be asked for allowance. No other reference to the location of remote certification is given in the Q&As. No reference is made to directive 2001/83/EC which limits by its applicability to the territory of EU/EEA that certification must be performed on EU/EEA soil.
Where should we consider the location of remote certification if the QP is for example at home and therefore distant from the MIA holder?
In case of remote certification supported by appropriate IT tools the location of certification could be assigned to the location where the QP presses the button on his keyboard or alternatively where the certification takes effect at the MIA holder´s site. Different competent authorities who have so far allowed for remote certification all put in place territorial provisions either to the member state borders or at least to the borders of EU/EEA territory. Even with using appropriate IT tools remote certification was to the author´s knowledge never allowed any time from outside EU/ EEA. By introducing such territorial provisions of applicability to an allowance of remote certification it is obviously common understanding for CAs and QPs that remote certification takes place where the QP pushes the button and not at the address of the MIA holder.
Is certification manufacturing?
QP certification is considered partial manufacturing and can only be executed under association to an appropriate MIA.
Can there be any allowance of remote certification across member state borders issued by the CA of another member state?
According to directive 2001/83/EC article 40 "member states shall take all appropriate measures to ensure that the manufacturer of the medicinal products within their territory is subject to holding up an authorization...". Furthermore, "the authorization referred to in paragraph 1 shall be required for both total and partial manufacture …". Each CA must ensure enforcement for its own territory empowered by and in line with the national medicinal legislation. The applicability and supervision of national law ends where the member state ends.
Does remote certification always need to have a manufacturing authorization in the member state where remote certification is executed?
As long as certification by a QP is considered partial manufacturing such activity should be subject to the establishment of a national MIA before execution. Art. 40 of directive 2001/83/EC lists some activities which would need such national MIA. This list does not include QP certification. The national laws and the harmonized template for MIAs are more specific as published with the Compilations of Union Procedures. The QP has always to comply with national requirements. MIAs limited to certification exist, cross-border MIAs do not exist. One main reason is the division of CA supervision by the member states. Although cases are known where the CA of one member state did allow remote certification from all over EU/EEA under their national MIA this should not be comprehensive without involvement of all involved CAs of all potentially involved member states. Any manufacturing activity within one member state must comply with the applicable national rules and allowance therefore can only be given on a national basis.
How can we prove that national authorities should only give national remote certification allowance? Nothing is said in the Q&As.
If the principle of national allowance should not apply in case of remote certification the opposite should be possible as well. Any CA of any neighbouring country should quid pro quo have the power and possibility to revoke certification eligibility and remote certification allowance of any QP colleague in abroad. This is probably not the situation we anticipate and where we want to end.
In other areas of daily life, we are used to follow local rules and regulations for example by driving a car across Europe. Nobody would expect that the speed limit of your home country is applicable all over Europe. Coming from Ireland you will probably not try to drive on the left side of the road in continental Europe or vice versa.
Do we need to contact the local CA before we execute certification if we want to perform remote certification outside the member state where our MIA is established?
Each member state must ensure that manufacturing is performed under an MIA and CA´s supervision. Likewise, QPs must ensure that they follow local laws and rules. This is even more important as these rules are not fully harmonised across Europe and implemented differently. Consequently, if more than one member state is involved more than one CA needs to be involved to give allowance.
Which risks need to be considered for the QP performing remote certification?
If the national CA of the member state where the MIA is established has formally allowed remote certification the QP can exactly follow the recommendations given in the Q&As. The Q&As do not provide sufficient and complete requirements in case of re mote setups executed in more than one member state. In addition, the applicable requirements are defined in the national laws and not in GMP guidelines which could be interpreted in different ways. The CA of a neighbouring member state cannot give any relief not to follow the laws and their implementation of the country you are in, if different. The risks to violate national laws stays solely with the QP who can be expected to interpret and follow the laws correctly.
And what are the conclusions?
The Q&As are inconsistent in their application of the definition of certification and incomplete for the consequences what may be needed in remote setups where more than one member state is involved. The Q&As would need clarification in this respect. Annex 16 defines certification partly impractical and too restrictive. The definition of certification would benefit to follow the approach used for remote certification to also cover the process of assessing data and information to be able to sign the batch certificate/ register. For the QP performing remote certification it is advisable to interact with all CAs which may have a role in the given set-up they execute their responsibilities. An occasional remote certification in holidays should not be possible nor advisable even if not leaving EU/EEA.
About the Author
Dr Ulrich Kissel is Chairman of the European QP Association Board and Managing Director of Kissel Pharma Consulting GmbH.
