EU GMP Annex 20 - Quality Risk Management

What it says

Annex 20 incorporates quality risk management principles into EU GMP, establishing that risk management should be applied systematically throughout the product lifecycle, using structured methodologies proportionate to the level of risk, closely mirroring the framework subsequently harmonised through ICH Q9(R1).

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• This annex represents the EU's own early adoption of quality risk management principles into its GMP framework, which has since been substantially aligned with and reinforced by the internationally harmonised ICH Q9(R1) guideline.
• Quality risk management under this annex is expected to be integrated throughout GMP decision-making generally, facility design, supplier qualification, change control, deviation handling, rather than existing as a standalone, separate risk assessment exercise disconnected from operational decisions.
• The proportionality principle, formality scaled to actual risk level, appears here in the EU framework in a manner consistent with the same principle later made explicit in the ICH Q9(R1) 2023 revision.

What inspectors look for

• Whether quality risk management principles are visibly integrated into real operational decisions across the site, not confined to a standalone risk management document rarely referenced in practice.
• Whether the formality of risk assessments genuinely scales with actual risk level, rather than being applied uniformly regardless of risk.
• Whether risk assessment conclusions demonstrably inform actual decisions, such as validation scope, supplier oversight intensity, or facility design choices.

Related regulations