INTRODUCTION

EXCiPACT certification appears on supplier qualification checklists across the global pharmaceutical supply chain. Most procurement and quality teams recognise the name. Fewer can explain precisely what the certification verifies, what the audit scope covers, and what it does not.

That gap matters. EXCiPACT is a specific certification with a defined scope. Using it correctly changes how supplier qualification works and what documentation it can replace. Using it incorrectly means missing what it was designed to do.

This blog explains what EXCiPACT actually covers, why regulators accept it, and what it means in practice when you are qualifying an excipient supplier.

‍

WHAT EXCiPACT IS

EXCiPACT is a non-profit certification scheme established for pharmaceutical excipient manufacturers and distributors. It is not a regulatory body and it is not a government standard. It is an independent, third-party certification programme built on one specific problem: excipient manufacturers are not subject to the same direct regulatory oversight as drug manufacturers, but the excipients they produce end up in drug products that reach patients.

The scheme is built as an annex to ISO 9001:2015. A supplier seeking EXCiPACT GMP certification must already hold an ISO 9001:2015 certificate covering the relevant scope. The EXCiPACT standard then adds pharmaceutical-specific GMP requirements on top of that quality management foundation.

Certification is granted for three years. Surveillance audits are required at least annually throughout that period. The certificate and audit status are publicly verifiable on the EXCiPACT website. This means a buyer can confirm in real time whether a supplier's certification is current, without contacting the supplier directly.

In August 2025, EXCiPACT launched its revised 2025 standard, consolidating twelve years of implementation learning and aligning the GMP and GDP sections more precisely with ISO/IEC 17021-1:2015.

‍

WHAT THE AUDIT ACTUALLY COVERS

The EXCiPACT audit examines the pharmaceutical excipient GMP practices of the manufacturer's site. It is a system-level audit, not a product-level audit. The auditor evaluates how the manufacturer runs its quality operations, not whether a specific excipient is suitable for a specific drug application.

The audit scope covers:

Quality management system design and implementation. Whether documented procedures exist, whether they are followed, and whether the system produces consistent outputs.

Change control. How the manufacturer manages changes to materials, processes, equipment, and specifications, and whether those changes are assessed for their impact on excipient quality before implementation.

Supplier qualification. How the manufacturer qualifies and monitors its own raw material and component suppliers.

Process validation. Whether manufacturing processes are validated and whether that validation is maintained under routine conditions.

Complaint and recall procedures. Whether the manufacturer has formal systems for receiving, investigating, and responding to product quality complaints, and whether recall capability has been defined and tested.

Documentation and traceability. Whether batch records, specifications, and quality data can be retrieved and reviewed in a way that supports investigation and regulatory inspection.

Personnel and training. Whether staff involved in manufacturing and quality have defined roles, appropriate qualifications, and documented training records.

Facilities and equipment. Whether the manufacturing environment and equipment are suitable, maintained, and qualified for the intended use.

This is a thorough audit of how a company runs its quality system. It is not a brief questionnaire.

‍

WHAT IT DOES NOT COVER

This section matters as much as the previous one.

EXCiPACT certification does not confirm that a specific excipient is suitable for your specific drug product. That assessment remains the responsibility of the formulation team and is part of the drug development process, not the supplier qualification process.

It does not replace stability data, compatibility testing, or a technical review of the supplier's product against your formulation requirements. A certified supplier still needs to provide a full technical dossier: certificate of analysis, specification sheet, regulatory support file, and any relevant pharmacopoeial compliance data.

It does not cover distribution practices unless the supplier has also obtained EXCiPACT GDP certification separately. GMP and GDP are distinct certifications under the scheme. A manufacturer certified for GMP may not hold GDP certification for its logistics operations.

Understanding what the certification covers and what it does not is what allows you to use it correctly in your qualification programme.

‍

WHY REGULATORS ACCEPT IT

The regulatory requirement for pharma manufacturers to qualify their excipient suppliers exists in every major market. The FDA, the EMA, and regulators across Asia require evidence that excipient suppliers operate to appropriate GMP standards. The question is what form that evidence must take.

Regulators have consistently indicated that third-party auditing is acceptable when the certification body is credible, the auditors are qualified, and the audit reports are accessible and verifiable. EXCiPACT was designed specifically to meet that standard.

The European Falsified Medicines Directive requires pharma manufacturers to conduct a formalised risk assessment of their excipient suppliers and obtain GMP compliance evidence through audit or from information received from the excipient manufacturer. An EXCiPACT certificate with the accompanying audit report satisfies this requirement. The FDA has similarly indicated acceptance of credible third-party GMP certificates in the excipient supplier qualification context.

The practical consequence is that an EXCiPACT audit report can replace a direct customer audit in most regulatory jurisdictions. A buyer who holds the EXCiPACT audit report for a supplier has documentation that satisfies their own regulatory obligations without conducting an additional on-site audit.

‍

HOW IT WORKS IN PRACTICE FOR BUYERS

The most significant practical feature of the EXCiPACT scheme is that the audit report is shared. A single EXCiPACT audit covers all of the certified supplier's customers simultaneously. Every pharmaceutical company sourcing from that supplier can access the same audit report. They do not each need to commission or conduct their own audit.

This changes the economics of supplier qualification considerably. An on-site supplier audit, when conducted by a pharmaceutical company's internal quality team or an external audit firm, typically costs between one and three days of auditor time plus travel, logistics, and scheduling coordination. When a supplier has multiple customers, those costs are replicated independently across each of them for what is ultimately the same information.

EXCiPACT converts that into a shared resource. The cost of the independent audit is borne by the supplier once. The benefit is available to all customers simultaneously.

For buyers, this also means that a new supplier relationship does not automatically require an audit timeline. If the supplier holds a current EXCiPACT certificate, the audit report exists and can be requested immediately. Qualification work can begin with the documentation already available rather than waiting for an audit to be scheduled, conducted, and reported.

The audit report itself contains detailed findings, not just a pass or fail outcome. A buyer who reads it understands where the supplier is strong, where corrective actions were required, and how those actions were addressed. This is more useful than a questionnaire response.

‍

THE INDIA CONTEXT

India is one of the largest producers of pharmaceutical excipients in the world. Indian manufacturers supply a significant proportion of the global drug product supply chain, including APIs, excipients, and finished dosage forms.

Despite this scale, EXCiPACT GMP certification has not been widely adopted in the Indian excipient sector. The infrastructure for independent third-party excipient GMP certification has developed more slowly here than in Europe and North America. For buyers sourcing excipients from India, this has historically meant heavier reliance on direct audits, supplier questionnaires, and certificate-of-analysis review, without access to the independent third-party audit reports that certification provides.

For buyers sourcing our DRUGCOAT®, DRCOAT®, AQUAPOL®, and APION® product families, this means the supplier qualification process works differently than it does with non-certified Indian suppliers. The audit report exists. The independent verification has been conducted. The documentation framework that your regulatory obligation requires is in place.

This matters particularly for manufacturers submitting New Drug Applications to the FDA or EMA where excipient GMP excipient manufacturer evidence is required as part of the submission package. Sourcing from a certified supplier in a category where certification was previously unavailable in India is a qualification decision with regulatory downstream consequences.

‍

HOW TO USE EXCIPACT IN YOUR QUALIFICATION PROGRAMME

Verify the certificate status directly on the EXCiPACT website before accepting any supplier's claim of certification. The certificate holder list is maintained publicly and shows current status. An expired certificate that has not been renewed means the annual surveillance audit has not occurred and the certification is no longer valid.

Request the full audit report, not just the certificate. The certificate confirms the outcome. The audit report explains what was examined, what was found, and what corrective actions were required. The detail in the report is what gives the certificate its value in your qualification file.

Confirm the scope. The audit covers a specific site and specific product categories. If you are sourcing a product from a manufacturing site that is not listed in the certificate scope, the certification does not cover that product. Ask the supplier to confirm which products and which sites are included.

Do not stop at certification. EXCiPACT satisfies the GMP evidence requirement for your supplier qualification programme. Your technical assessment of the excipient itself, the compatibility review, and the formulation validation remain your responsibility. Certification addresses the manufacturer quality system. Product suitability requires your own technical judgement.

If your quality system requires periodic re-qualification of suppliers, note that EXCiPACT surveillance audits occur annually. You can align your re-qualification cycle with the surveillance audit schedule, requesting updated audit reports each time they are issued, rather than conducting independent assessments.

‍

WHAT TO ASK A CERTIFIED SUPPLIER

The following four questions help you use the certification properly rather than treating it as a checkbox:

Is your certificate current and does it cover the specific product and site I am sourcing from? A valid certificate for a different product or a different manufacturing site is not relevant to your qualification.

Can you provide the full audit report, including any corrective action notes? The corrective actions section shows what was found during the audit and how it was resolved. A clean audit report with no corrective actions is unusual. A supplier who has addressed corrective actions properly is typically more reliable than one who has never been examined in that level of detail.

What is the scope of your EXCiPACT certification, GMP only, GDP only, or both? If distribution conditions for your excipient are critical, confirm that GDP is covered.

Has any change been made to the certified site or process scope since the most recent audit? EXCiPACT requires that significant changes be reported to the certification body between audits. A supplier who has made manufacturing changes after the last audit should be able to explain how those changes were managed within the certification framework.

‍

FREQUENTLY ASKED QUESTIONS

1. Is EXCiPACT certification mandatory for excipient suppliers?

No. The certification is voluntary. The regulatory requirement is for pharma manufacturers to qualify their excipient suppliers to appropriate GMP standards. EXCiPACT certification is one way to meet that requirement. Direct customer audits and questionnaire-based assessments are other options. EXCiPACT is accepted by regulators because it uses qualified independent auditors and produces a verifiable, shareable report. Mandatory or not, the absence of any GMP compliance evidence for an excipient supplier creates a regulatory documentation gap for the drug product manufacturer.

2. How often is the supplier re-audited under the scheme?

The full certification audit is conducted at the start of the three-year cycle. Surveillance audits occur at least annually during that period. After three years, a recertification audit is required. The annual cadence means the compliance status is reviewed regularly, not just once at the point of initial approval.

3. Can one EXCiPACT audit report be used by multiple pharmaceutical customers?

Yes. This is a designed feature of the scheme. The audit report is shared with all customers of the certified supplier. Each customer does not need to conduct a separate audit. This is one of the primary advantages of the scheme for the pharmaceutical supply chain, reducing duplicated audit effort while maintaining independent verification.

4. Does EXCiPACT cover drug product manufacturers or only excipient manufacturers?

Only excipient manufacturers and distributors. The scheme was created specifically because excipient manufacturers are outside the direct regulatory authority that covers drug manufacturers, but excipient quality directly affects drug product safety. EXCiPACT fills that gap with an independent standard specific to excipient supply.

5. Is the certification recognised outside Europe?

Yes. The FDA has indicated acceptance of credible third-party GMP certificates for excipient supplier qualification. EXCiPACT is recognised in over 20 countries and is designed to satisfy the supplier qualification documentation requirements of most major regulatory markets. We hold US DMF registration alongside our EXCiPACT certification, which together cover the documentation requirements for both regulatory acceptance and formulation submission in the US market.

‍

CONCLUSION

EXCiPACT is a specific certification with a specific scope. It independently verifies that a pharmaceutical excipient manufacturer operates a GMP-compliant quality system. It satisfies the regulatory requirement for excipient supplier qualification across the FDA, EMA, and most other major markets. It produces a shareable audit report that replaces the need for individual customer audits. And it requires annual surveillance to keep the certification current.

What it does not do is assess whether a specific excipient is suitable for a specific drug product. That technical judgement belongs to the formulation team. The certification handles the quality system evidence. The product suitability assessment is yours.

For buyers sourcing excipients from India, the availability of EXCiPACT-certified suppliers has historically been limited. We are the first polymer excipient manufacturer in India to hold this certification. That means the qualification pathway that EXCiPACT enables, with shared audit reports, regulatory-ready documentation, and independently verified GMP compliance, is now available for the DRUGCOAT®, DRCOAT®, AQUAPOL®, and APION® product families sourced from our facility in Ahmedabad.

The standard exists. The audit has been conducted. The documentation is in place.

‍

Qualifying a New Excipient Supplier? Talk to Us.

If you are working through an excipient supplier qualification for a new product or reviewing your existing supply chain against current regulatory requirements, we are ready to help.

We can provide the full EXCiPACT audit report, our US DMF registration details, and the technical documentation for any product in our range. If you have a specific regulatory requirement or a submission timeline, tell us what you need and we will put together what is required.

Write to us at contact@vikramthermo.com

‍