Quality Agreement: What FDA Expects & Requires

A quality agreement (also called a supplier quality agreement, vendor quality agreement, or quality-technical agreement) is a written, signed document that defines which party in a supply relationship is responsible for which current Good Manufacturing Practice (cGMP) or quality-system obligation — and how the two parties will exchange the information needed to meet those obligations. It sits alongside, but separate from, the commercial or business terms in a purchase order or master service agreement.

In the US pharmaceutical, biologics, medical device, blood/tissue, and cell and gene therapy sectors, a quality agreement is the document regulators and auditors expect to find whenever one organization (an “Owner,” in FDA’s terminology) relies on another organization (a “Contract Facility”) to perform any GMP-covered activity — manufacturing, testing, packaging, labeling, or storage.

What Is a Quality Agreement?

Operationally, a document qualifies as a quality agreement when it does all of the following:

It is a standalone, signed document (or a clearly labeled quality-specific section/annex of a broader contract) — not just a clause buried in a purchase order.
It allocates specific GMP/quality-system responsibilities — batch release, change control, deviation and complaint handling, out-of-specification (OOS) investigations, stability testing, record retention, audit rights — explicitly to one party or the other.
It is referenced by, and consistent with, the underlying commercial contract, but does not itself set price, payment terms, or delivery schedules.
It is reviewed and approved by the quality units (not just procurement or legal) of both organizations.

Worked example: A drug sponsor (“Owner”) contracts a third-party facility to manufacture and package a finished dosage form. The quality agreement specifies that the Owner’s quality unit approves the master batch record and reviews/approves any change to the manufacturing process, while the Contract Facility’s quality unit is responsible for in-process testing, environmental monitoring, and notifying the Owner within a defined number of business days of any deviation. Both quality units sign off before manufacturing begins.

Counter-example: A one-page “quality clause” that simply states “Supplier shall comply with all applicable cGMP requirements,” attached as an exhibit to a purchase order and never reviewed by either party’s quality unit, is not a quality agreement in the sense FDA’s guidance describes — it doesn’t allocate specific responsibilities or establish a communication mechanism, so an auditor or investigator is likely to flag it as insufficient.

Why Quality Agreements Matter: The Regulatory Basis

US drug cGMP is set out in 21 CFR Parts 210 and 211. Neither part uses the phrase “quality agreement,” but both assume a single quality unit is accountable for GMP compliance even when manufacturing steps are outsourced. FDA’s guidance for industry, Contract Manufacturing Arrangements for Drugs: Quality Agreements, is the document that translates that expectation into a concrete recommendation: put the division of GMP responsibilities in writing, in a document distinct from the business contract, agreed by both quality units. The guidance defines the “Owner” as the party that introduces the drug into interstate commerce (and therefore holds ultimate GMP responsibility) and the “Contract Facility” as the party performing the manufacturing operation, and it lays out the elements FDA expects the written agreement to cover.

For device manufacturers, the equivalent expectation runs through the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference and requires documented purchasing controls and supplier evaluation — a quality agreement is the standard mechanism device makers use to satisfy that requirement with critical suppliers.

At the international level, ICH Q10 (the Pharmaceutical Quality System guideline) treats outsourced activities and purchased materials as an explicit element of the quality system that must be managed with the same rigor as internal operations — reinforcing, rather than replacing, the FDA guidance for sponsors operating globally.

Sector-specific bodies publish their own quality-agreement guidance built on the same underlying logic: the Active Pharmaceutical Ingredients Committee (APIC, part of CEFIC) publishes a widely used “how to do” guide and template for quality agreements between API manufacturers and their customers; AABB (blood banking/transfusion medicine) and ISCT (the International Society for Cell & Gene Therapy) publish guidance addressing quality agreements between cell, tissue, and blood establishments and their suppliers of critical starting materials; and SOCMA (the Society of Chemical Manufacturers and Affiliates) addresses them from the custom/specialty chemical manufacturing side. The core content each expects — defined responsibilities, change notification, deviation handling, audit rights — is consistent across all of them, even though the underlying regulatory frameworks differ.

Quality Agreement vs. Technical Agreement vs. Master Service Agreement

These three documents are often confused because they usually exist for the same supplier relationship. They are not interchangeable, and an auditor will expect to see the right content in the right document.

Document	Owner (typically)	Covers	Does NOT cover
Master Service Agreement (MSA) / Supply Agreement	Legal / procurement	Price, payment terms, delivery, liability, indemnification, term and termination of the commercial relationship	Who reviews a deviation, how a change is communicated, batch release authority
Quality Agreement	Quality units of both parties	GMP/quality-system role allocation: change control, deviations, complaints, OOS results, audit rights, batch disposition, record retention	Price, delivery schedules, indemnification
Quality-Technical Agreement	Quality + technical/manufacturing teams	Everything in a standard quality agreement, plus product-specific technical detail — specifications, analytical methods, process parameters — where the relationship is technically complex enough that quality and technical terms are combined into one document	Commercial terms

“Quality-technical agreement” is not a separate regulatory category — it is a naming convention some organizations use when they combine the quality-responsibility allocation with detailed technical specifications (particularly common for API and biologics manufacturing, where the technical detail is extensive) rather than maintaining two separate documents.

Who Needs a Quality Agreement

A written quality agreement is standard practice — and, in FDA’s view, expected — wherever a GMP-covered activity is outsourced. That includes:

Contract manufacturing organizations (CMOs) and contract development and manufacturing organizations (CDMOs) performing drug substance or drug product manufacturing, packaging, or labeling on behalf of a sponsor.
Active pharmaceutical ingredient (API) suppliers and their customers, per APIC/CEFIC guidance.
Contract testing laboratories performing release, stability, or characterization testing.
Medical device manufacturers and their critical suppliers of components, subassemblies, or contract sterilization/testing services, under QMSR/ISO 13485 purchasing-control requirements.
Blood, tissue, and cell/gene therapy establishments and their suppliers of critical starting materials, reagents, or ancillary products (AABB, ISCT).
Specialty and custom chemical manufacturers supplying GMP-regulated customers (SOCMA member context).

A quality agreement is generally not needed for suppliers of non-critical, non-GMP-impacting goods (general lab consumables with no product-contact or data-integrity role, office supplies, etc.) — reserving quality agreements for suppliers whose output actually affects product quality or patient safety keeps the quality system focused and auditable, rather than diluted across every vendor relationship.

What Belongs in a Quality Agreement

FDA’s guidance and the sector-specific frameworks above converge on a similar core content set. A defensible quality agreement should assign clear responsibility, to a named party, for each of the following:

Scope — the specific product(s), process(es), or site(s) the agreement governs.
Quality unit responsibilities — which party’s quality unit approves what (batch records, specifications, analytical methods, labeling).
Change control — who must approve a change before it is implemented, and how much notice the other party receives.
Deviations and out-of-specification (OOS) results — investigation ownership, and the timeframe for notifying the other party.
Complaints and adverse event handling — who receives complaints first, and how/when they are shared with the other party.
Batch/lot disposition and release — who has final release authority.
Audit rights — the Owner’s right to audit the Contract Facility, frequency, and notice period.
Subcontracting restrictions — whether the Contract Facility may further subcontract any step, and under what approval.
Record retention and access — retention period and how records are made available on request or during an inspection.
Communication mechanism — named contacts and escalation path for quality issues.
Term, review, and revision — how often the agreement is reviewed and how amendments are made and approved.

Building a Quality Agreement: A Practical Outline

Organizations building their first quality agreement, or standardizing an existing one, commonly work from a quality agreement template that mirrors the element list above. A workable structure is:

Preamble — parties, effective date, reference to the underlying commercial contract, and a statement that this agreement governs quality/GMP matters and controls over the commercial contract in the event of conflict on quality matters.
Definitions — Owner, Contract Facility, Product, Specification, and any other terms used with a specific meaning.
Responsibility matrix — a table (often the most-referenced part of the document during an audit) mapping each GMP activity to “Owner,” “Contract Facility,” or “Shared,” with a note on the shared items describing exactly how responsibility splits.
Change control, deviation, and complaint procedures — with defined notification timeframes (e.g., “within 3 business days”).
Audit and inspection rights — including regulatory inspection notification (each party informing the other promptly if a regulator requests access related to the product covered by the agreement).
Record retention and access provisions.
Signature block — signed by an authorized representative of each party’s quality unit, not only by procurement/legal signatories.
Review cycle — most organizations review quality agreements on a fixed schedule (commonly annually) or whenever the underlying commercial contract, product, or process changes materially.

Because the responsibility matrix is what auditors and inspectors reference most directly, it is worth building it first and building the narrative sections around it, rather than starting from prose and extracting a table afterward.

Common Pitfalls

Treating it as a legal formality. A quality agreement drafted and filed by legal/procurement without quality-unit review at both organizations routinely misses operational detail (notification timeframes, who actually has release authority) that only the people running the quality system would know to specify.
Letting it drift from the commercial contract. If the master service agreement is amended (new product, new site, new scope) without a corresponding review of the quality agreement, the two documents can end up describing different relationships — a common audit finding.
No defined review cadence. A quality agreement signed once and never revisited is a recurring inspection observation; build a periodic review requirement into the document itself.
Vague responsibility language. “Both parties shall ensure compliance” allocates nothing. Each line item needs a single accountable party, even where the underlying work is genuinely collaborative.
Confusing a quality clause for a quality agreement. A short compliance statement in a purchase order exhibit does not substitute for a reviewed, quality-unit-approved document with the content described above.

Frequently Asked Questions

What is a quality agreement?

A quality agreement is a written, signed document — separate from the commercial contract — that allocates specific GMP or quality-system responsibilities between two organizations in a supply relationship, most commonly a drug, biologic, or device sponsor (“Owner”) and a contract manufacturer, tester, or supplier (“Contract Facility”).

Does FDA require a quality agreement?

21 CFR Parts 210 and 211 do not use the term “quality agreement” and do not mandate the document by name. FDA’s guidance for industry, Contract Manufacturing Arrangements for Drugs: Quality Agreements, describes a written quality agreement as the recommended way to document how GMP responsibilities are divided between an Owner and a Contract Facility, and FDA investigators routinely ask to see one during inspections of outsourced manufacturing arrangements. In practice, operating without one is a significant compliance risk even though no single regulation names the document explicitly.

What does FDA’s quality agreement guidance actually cover?

FDA’s guidance defines the Owner and Contract Facility roles, recommends the agreement be a standalone document (or clearly delineated section) reviewed and approved by both parties’ quality units, and lists the categories of GMP responsibility — batch release, change control, deviations, complaints, and similar — that it expects the agreement to allocate explicitly.

What is the difference between a supplier quality agreement and a vendor quality agreement?

The terms are generally used interchangeably — both describe a quality agreement between a purchasing organization and the organization supplying a GMP-relevant material, component, or service. Some organizations use “vendor” for suppliers of materials/components and reserve “supplier” or “contract facility” for organizations performing an outsourced process step, but there is no regulatory distinction between the two terms.

What is a quality-technical agreement?

A quality-technical agreement combines the standard quality-agreement content (responsibility allocation, change control, deviations) with detailed technical specifications — analytical methods, process parameters, product specifications — in a single document, rather than maintaining a separate technical/specification document alongside the quality agreement. It is common in API and biologics manufacturing relationships, where the technical detail is extensive.

Is there a standard quality agreement template?

There is no single FDA-mandated template. APIC/CEFIC publishes a widely referenced template and “how to do” guide for API quality agreements; many pharmaceutical and device companies also maintain their own internal templates built around the same core element set (scope, responsibility matrix, change control, deviations, audit rights, record retention). The outline in this guide reflects the content those templates share.

Quality Agreement: What It Is and What FDA Expects

Ask about Quality Agreement: What It Is and What FDA Expects