The Q&A is based on the fundamentals of the EU GMP Guidelines, in particular those of Annex 16, and is applicable to EU/EEA QP certification or QP confirmation. It applies to the production and importation of human and veterinary medicinal products as well as investigational medicinal products. Following is a brief summary of the four Q&As:

Is remote batch certification / batch confirmation by the QP (i.e. when not at the authorised site address specified on the MIA) allowed on a routine basis?

This could be acceptable if a remote certification is accepted by the national authority at the site. The manufacturer and the qualified person should meet all valid local requirements.

Where remote QP certification / confirmation is allowed on a routine basis, what conditions should apply?

Broadly summarised, they include

• full compliance of the remote certification with EU legislation and EU GMP guidelines
• a certification that must take place within the EU/EEA in any case
• adequate documentation and control within the quality system when remote certification is used on a routine basis
• electronic access to any information required for QP according to Annex 16 EU GMP Guidance. All IT systems must comply with the requirements of EU-GMP Annex 11
• The availability of all performed measurements for inspection purposes by the competent authorities.

Is the QP required to be a resident in the Member State where the authorised site is located?

Reference is made to the specific national requirements

What are the technical requirements for the remote access and the signature used for batch certification / confirmation?

In terms of IT security and data integrity, the risk for remote access is higher than for access within the controlled environment at the approved site. The minimum requirements are highly dependent on the state of the technology and should be consistent with the guidelines of Annex 11. For instance, among other things:

• Recognized industry standards should be used for authentication and authorization (e.g., two-factor or multi-factor authentication)
• Security parameters on the network operating system, database, and application layer of the QP should be configured adequately
• data should be secured using a high-level of transport encryption

• the MIA holder must ensure that only the QP is able to perform remote certification/confirmation of batches

Source:

EMA: Public Consultation Concerning The Physical Attendance And The Location Of Personal Residency Of The Qualified Person