GMP Requirements for a Certificate of Analysis (CoA)

In short: A certificate of analysis (CoA) reports test results for an identified sample or batch and states how those results compare with a specification. WHO publishes a model and laboratory guidance, while EU GMP Part II has specific CoA provisions for intermediates and active substances. Use the rules that apply to the product and market; there is no single template that automatically fits every CoA.

CoA, analytical report, and batch record

A CoA is a controlled report of test results and a conclusion about a sample or batch. An analytical test report may provide more context about why a sample was tested, the method used, the results and their interpretation. The underlying laboratory records contain the supporting data and evidence. These documents are related, but they do not serve the same purpose.

WHO’s current good-practice guidance says that a CoA contains the same information as the analytical test report. It also describes the report as a compilation of results for review and approval, with the supporting sample dossier retained. For U.S.-regulated drug products, 21 CFR 211.194(a) requires complete laboratory records for tests needed to assess compliance; a summary certificate should not be treated as a replacement for required underlying records. (WHO Technical Report Series 1052, Annex 4, §§6.84, 6.88–6.90 (2024); 21 CFR 211.194(a), current eCFR)

Information commonly included

WHO’s 2024 guidance for pharmaceutical quality control laboratories describes report information such as:

• identifiers for the sample and report, the issuing laboratory, and the party that requested testing;
• the sample or product name, description, batch identity, and relevant manufacturer details;
• the specification and test procedure used, including limits, and identification of any external testing provider;
• results for the tests performed, with additional uncertainty or discussion where relevant;
• a conclusion on conformity or, for investigative testing, the identity of detected substances;
• receipt and test-completion dates and approval by the laboratory director or another authorised person.

The WHO model CoA also gives examples of useful particulars such as the certificate number, page numbering, quantity received, original manufacturer, repacker or trader, and expiry or retest date where applicable. WHO describes this model as guidance for quality control laboratories, notes that the format is at the issuing laboratory’s discretion, and says that national legal requirements should also be considered. It further recognises that a manufacturer laboratory may keep some information in other quality-system documents rather than repeat it on the CoA. (WHO TRS 1052, Annex 4, §6.88 (2024); WHO TRS 1010, Annex 4, Model Certificate of Analysis (2018))

EU GMP Part I, Chapter 6, §6.17 (2014) separately describes batch testing records, including the material or product and batch, the specification and procedure, results and calculations, testing dates, performer and verifier, a status decision, and the equipment used. These are laboratory record expectations; they should not be presented as a universal customer-facing CoA format. (EU GMP Part I, Chapter 6, §6.17 (2014))

How the cited requirements differ

For intermediates and active pharmaceutical ingredients, EU GMP Part II, Chapter 11, §11.4 (2014) says an authentic CoA should be issued for each batch on request. It specifies that the CoA identify the material, including grade where relevant, batch number and release date; show expiry or retest dating when applicable; and list the tests, acceptance limits and numerical results where applicable. The certificate should be dated and signed by authorised personnel. This provision has a defined scope: intermediates and APIs under Part II. It should not be applied automatically to every finished product or excipient. (EU GMP Part II, Chapter 11, §§11.40–11.43 (2014))

WHO TRS 1052, Annex 4, §6.89 (2024) says a CoA is prepared for each batch of a substance or product and contains the same information as the analytical test report. Section 6.90 gives a specific exception for national quality control laboratories: an issued CoA is not obligatory if an adequate analytical test report is issued and remains as an internal document. WHO’s 2018 model also says to consider the specific legal requirements of the country of issue or importation. These are WHO good-practice recommendations and a model; they do not by themselves replace applicable national law.

For bulk pharmaceutical excipients, USP General Chapter <1080>, Bulk Pharmaceutical Excipients—Certificate of Analysis (2020), is a general information chapter that guides preparation and use of excipient CoAs. USP describes it as derived from an IPEC-Americas guide. It is specific to bulk excipients and should not be cited as a universal CoA rule for drug products. The IPEC Federation also publishes the IPEC Certificate of Analysis Guide for Pharmaceutical Excipients (Version 2.1, 2024, announced by IPEC Federation / IPEC Americas in July 2024; it replaces Version 2 of 2022). It is voluntary industry guidance, not a regulation; check the current edition on the IPEC Europe or IPEC Americas website before using it. (USP–NF General Chapter <1080> (2020))

Example: batch certificate for MRA exports

For medicines shipped between countries that have a Mutual Recognition Agreement (MRA) with the EU, the EMA document Internationally Harmonised Requirements for Batch Certification (EMA/INS/MRA/387218/2011 Rev 5, 2011) sets the content of the manufacturer’s batch certificate. It is separate from a routine CoA, although it is issued after full analysis and states that the batch meets the importing country’s marketing authorisation. In the official template, the certificate contains, for example:

• product name (as used in the importing country), importing country, and marketing authorisation number (or clinical trial authorisation number for investigational products);
• strength or potency, dosage form, and package size and type;
• batch or lot number, date of manufacture and expiry date;
• names, addresses and authorisation numbers of the manufacturing and quality control sites, with GMP compliance evidence for those sites;
• analysis results against the specification, and any comments;
• a certification statement, plus the name, title, signature and date of the person authorising batch release.

Use the current official template for the exact wording and field order; check whether the agreement for your target market applies it.

A practical CoA review

Example in-house criterion (not a pharmacopoeial requirement): Use a controlled CoA review checklist to confirm the sample and batch identity, applicable specification and methods, required results and limits, outsourced test identification where relevant, authorised conclusion, supplier or laboratory identity, review outcome, and discrepancy follow-up. Compare the CoA with the purchase or testing requirements and supplier qualification controls applicable at the site. A CoA is evidence to assess; it does not automatically establish the reliability of its issuer or remove other testing and review obligations.

Retain CoAs and laboratory records that form part of batch-associated documentation for at least one year after the expiry date of the respective product batch. EU GMP Part I, Chapter 4, §4.11 (January 2011) requires batch documentation to be kept for one year after batch expiry or at least five years after QP certification, whichever is longer. For U.S.-regulated drug products, 21 CFR 211.180(a) sets a minimum of one year after the batch expiry for batch-associated production, control, or distribution records. Follow any longer period required by applicable law or the marketing authorisation. (EU GMP Part I, Chapter 4, §4.11 (January 2011); 21 CFR 211.180(a), current eCFR)

For related topics, see QC testing of raw materials, APIs, and finished products, the finished-product CoA procedure, and the finished-product batch-release procedure.

Frequently asked questions

Does every CoA need the same fields?

No single list should be assumed to apply everywhere. WHO guidance and model certificates provide useful content, but applicable product-specific and national requirements determine what is required. EU GMP Part II contains specific provisions for intermediates and APIs.

Does a CoA replace a laboratory’s supporting records?

No. A CoA summarises results. Complete supporting laboratory data and records remain subject to the applicable recordkeeping requirements, including 21 CFR 211.194(a) for U.S.-regulated drug products.

How long should batch-related CoAs be retained?

At least one year after the expiry date of the respective product batch under EU GMP Part I, Chapter 4, §4.11 and 21 CFR 211.180(a), where applicable. EU GMP also requires five years after QP certification when that is longer for batch documentation.

References

• World Health Organization. WHO good practices for pharmaceutical quality control laboratories, WHO Technical Report Series No. 1052, Annex 4, §§6.84, 6.88–6.90 (2024). Official WHO text.
• World Health Organization. Model Certificate of Analysis, WHO Technical Report Series No. 1010, Annex 4 (2018). Official WHO text.
• European Commission. EudraLex Volume 4, EU GMP Guide, Part I, Chapter 4: Documentation, §4.11 (January 2011), and Chapter 6: Quality Control, §§6.7–6.8, 6.17 (2014; effective 1 October 2014). Chapter 4; Chapter 6.
• European Commission. EudraLex Volume 4, EU GMP Guide, Part II: Basic Requirements for Active Substances Used as Starting Materials, Chapter 11, §§11.40–11.43 (2014; effective 1 September 2014). Official text.
• U.S. Electronic Code of Federal Regulations, current as of 14 October 2026: 21 CFR §§211.180(a), 211.194(a). Official eCFR text.
• European Medicines Agency. Mutual Recognition Agreements, Sectoral Annex on Good Manufacturing Practices: Internationally Harmonised Requirements for Batch Certification, EMA/INS/MRA/387218/2011 Rev 5 (2011). Official text.
• IPEC Federation. IPEC Certificate of Analysis Guide for Pharmaceutical Excipients, Version 2.1 (2024). IPEC Europe; IPEC Americas announcement. Check the current edition.
• United States Pharmacopeia. General Chapter <1080>, Bulk Pharmaceutical Excipients—Certificate of Analysis (2020). Official public preview.