Roughly one in five generic medicines dispensed anywhere in the world was made in India. The United States draws more than 40% of its generics from Indian plants; the United Kingdom sources around a quarter of all its medicines there. A supply chain that large runs on documents — and those documents are quoted far more often than they are read.
“WHO-GMP certified.” “ISO 9001:2015.” “Batch-tested, COA available.” These phrases appear on manufacturer sites, wholesaler listings and retail product pages across the industry. They are not interchangeable, they are issued by different bodies, and each one answers a narrower question than most readers assume.
This is a plain-language guide to what each document covers, what it does not, and how to check a claim rather than take it on trust.
The supply chain most buyers never see
Before the paperwork makes sense, the scale does.
MeasureFigureSourceShare of global generic medicine supply by volume~20%GaBI OnlineUS generic medicines sourced from Indiamore than 40%GaBI OnlineUK medicines sourced from India~25%GaBI OnlineIndia’s rank among global API producers3rd, about 8% of the global API industryIndia Brand Equity FoundationDistinct active ingredients manufactured in Indiamore than 500India Brand Equity FoundationShare of WHO-prequalified APIs made in India57%India Brand Equity Foundation
An active pharmaceutical ingredient (API) is the substance that does the work; the rest of a tablet is binder, filler and coating. India is a major producer of both finished tablets and the ingredients that go into other countries’ tablets — which is why the same manufacturing names recur across markets that otherwise have nothing in common.
Four documents, four different promises
This is where most of the confusion lives. These are not tiers of the same certificate. They are separate instruments with separate scopes.
DocumentWho issues itWhat it actually certifiesWhat it does NOT certifyWHO-GMP certificateIn India, the Central Drugs Standard Control Organisation (CDSCO) for export purposes; domestic GMP certificates come from State Drug Licensing AuthoritiesThat a named manufacturing site was inspected and found to meet WHO Good Manufacturing Practice guidelines. Validity in India is three yearsAny individual batch. Any specific product’s quality on the day you received it. Approval to sell in the EUEU-GMP certificateA national competent authority of an EU or EEA member state, after inspectionThe same idea under EU rules, and it is the version that matters for the European supply chain. Recorded in the public EudraGMDP databaseThat the site makes the exact product you are holding, or that a given consignment came from that siteISO 9001:2015An accredited certification body — a commercial body, not a medicines regulatorThat the organisation runs a documented quality management system: procedures exist, are followed, are auditedAnything medicine-specific. ISO 9001 is a generic management standard. A furniture factory can hold itCertificate of Analysis (COA)The manufacturer’s own quality-control laboratory, or a contracted labTest results for one specific batch: identity, assay, purity, and usually dissolution and microbial limitsThat the batch tested is the batch in your hand. A COA is only as good as the link between the document and the package
The single most common error is treating a site certificate as a product certificate. WHO-GMP says a factory met a standard at inspection. It says nothing about the box on your table.
What a Certificate of Analysis should contain
A COA is the most product-specific document of the four, and also the easiest to produce a meaningless version of. A usable one names, at minimum:
- Product name and dosage form — including the declared strength
- Batch or lot number — which must match the number printed on the carton
- Manufacturing and expiry dates
- Identity test — confirmation that the substance is the one named, and the method used, typically HPLC or a spectroscopic method
- Assay — how much active ingredient was found, against the declared amount, with the acceptance range
- Purity and related substances — named impurities with limits, not a bare “passes” line
- Dissolution — for tablets, how the ingredient releases under standard conditions
- Microbial limits where applicable
- The testing laboratory, a signature and a date
Two practical checks separate a document from a decoration. First: does the batch number on the certificate match the batch number on the carton? A COA with no batch number, or one that never changes between orders, is a template. Second: are results reported as numbers with acceptance ranges, or only as the word “complies”? A specification with no figures cannot be checked by anyone.
What none of these documents cover
Being straightforward about the gaps is more useful than listing the strengths again.
- None of them follows the product to you. GMP covers the site. A COA covers a batch at the point of testing. Neither covers storage, transport temperature or handling after dispatch.
- ISO 9001 is not a medicines standard. It is regularly cited in contexts that imply pharmaceutical oversight, and it carries none.
- A certificate is a snapshot. Inspections happen on a date. Certificates expire, get suspended, and occasionally get withdrawn.
- A PDF is not a chain of custody. Anyone can host a document. The certificate proves something about a batch only if you can tie the document to the specific package you received.
- None of them is a legal authorisation to sell. Manufacturing quality and market authorisation are separate questions, decided by different bodies under different rules.
How to verify a claim instead of trusting it
Most of these documents can be checked independently, free, in a few minutes.
- Look up the manufacturing site in EudraGMDP. The European Medicines Agency maintains the EU database of manufacturing and import authorisations and GMP and GDP certificates. A public version has been available since 2011, covering everything that is not commercially or personally confidential. If a site claims EU-GMP status, this is where it is recorded.
- Check the EU common logo on any site selling medicines to EU consumers. Introduced by the Falsified Medicines Directive 2011/62/EU and given its design by Implementing Regulation 699/2014, the logo has been mandatory since 1 July 2015 for online pharmacies and retailers legally operating in the EU. It is not decorative: clicking it must lead to the official register of the country whose flag it shows. A logo that is a flat image linking nowhere is the single clearest warning sign available to a consumer.
- Cross-check the national register. Every EU member state publishes a list of retailers permitted to sell medicines online. The logo links there; you can also go directly.
- Match the batch. Compare the number on the COA to the number on the carton before anything else.
- Read what the certificate is about. Site, batch, or management system — the scope is always stated on the document itself, and it is the part that decides what the document is worth.
Where this leaves the buyer
The documentation ecosystem is genuinely informative, and it is also routinely used as decoration. The difference is verifiability: a certificate you can look up in a public register carries weight, and one that exists only as an image on the seller’s own page carries whatever weight you decide to give it.
That distinction is worth applying evenly. Manufacturer names that recur across this industry — Sun Pharma, HAB Pharmaceuticals, Natco — hold certifications that can be checked at source rather than taken from a retailer’s summary of them. Retailers vary widely in how much they publish: some list nothing, while others, such as the EU-warehouse retailer NeuroPeak, publish per-batch analysis documents alongside the manufacturer of each product. Publishing a document is not the same as a regulator having verified it, and readers are better served treating the two as separate facts.
The useful habit is narrow and boring: read the scope line, match the batch number, and check the register. It takes about five minutes and it is the only part of this that does not depend on trusting the person selling to you.
Frequently asked questionsIs WHO-GMP the same as FDA approval?
No. WHO-GMP certification concerns whether a manufacturing site meets WHO Good Manufacturing Practice guidelines, and in India it is issued by CDSCO for export purposes. Approval to market a specific product in a specific country is a separate decision by that country’s regulator.
Does ISO 9001:2015 mean a medicine is high quality?
It means the organisation operates a documented and audited quality management system. ISO 9001 is deliberately generic and applies across industries; it is not evidence about a medicine.
Can I check a GMP certificate myself?
For EU and EEA sites, yes — EudraGMDP is public. For non-EU sites, availability depends on the national authority, and some certificates are only obtainable from the manufacturer.
What is the difference between a COA and a GMP certificate?
Scope. A GMP certificate is about a site over a period. A COA is about one batch at one point in time. Neither substitutes for the other, and a seller citing only one of them is answering only half the question.
Sources
Figures on India’s share of global generic supply are from GaBI Online. Figures on active pharmaceutical ingredient production and WHO prequalification are from the India Brand Equity Foundation. Rules on the EU common logo are set out in Directive 2011/62/EU and Commission Implementing Regulation 699/2014, and published by the European Commission and the European Medicines Agency. The EudraGMDP database is maintained by the European Medicines Agency.
