GMP ISO Standards Explained: What Suppliers Must Prove

Most buying guides tell labs to collect every GMP and ISO logo they can find, then treat the pile as proof. That advice sounds careful, and it fails the first question a buyer should ask. A certificate shows that someone checked a system inside a written scope on a stated date. It does not show that this filling line, this lot, or this research use was controlled.

GMP ISO standards work as layers of evidence, not as interchangeable badges. Sort each claim by what it proves, what it leaves open, and which document a supplier must hand over before you accept the lot.

Table of Contents

• GMP and ISO Standards Compared Side by Side
• How GMP Requirements and ISO Layers Fit Together
  • What each ISO layer adds
• Why 0.22 µm Filtration Is Not the Whole Story
  • Six steps, and what each one guards
• What Certificates, Audits and Claims Actually Prove
  • Three claims on a supplier page
  • Audits, weakest to strongest
• Documents to Request From a Lab Supplier
  • What to ask for first
• Digital Records and Documentation Expectations for Small Labs
  • Two files, two owners
• Your Next Step This Week

GMP and ISO Standards Compared Side by Side

GMP is a set of manufacturing rules enforced by regulators and inspectors. ISO 9001 and ISO 13485 are management-system standards checked by third-party certification auditors. They answer different questions, so stacking logos does not multiply assurance.

Framework	Type	Scope	Verified by	Does not prove
GMP (WHO and national regulators)	Regulatory manufacturing rules	Production, documentation, validation, personnel, premises, batch release	Regulatory inspection and GMP certificates from national authorities	Clinical efficacy, or that a product is suitable for a specific research use on its own
ISO 9001:2015	General quality-management standard	Any organization's processes, document control, internal audit, corrective action	Accredited third-party certification audit	Aseptic validation, environmental monitoring, batch-release controls or regulatory authorization
ISO 13485:2016	Quality-management standard for medical devices	Design, risk management, traceability, supplier control, post-production activities	Accredited third-party certification audit	That a specific product meets GMP rules, or that it is clinically approved

Think of GMP as the recipe plus the health-inspection rules for a kitchen. ISO is the system that keeps that kitchen running the same way every day. The recipe can be followed badly inside a tidy management system, and a spotless recipe book can sit unused.

Buyers usually mix the rows in three ways.

• Framed GMP: They treat GMP as a wall certificate. GMP is a manufacturing rule set. A certificate, when one exists, names a site and an inspection outcome. It is not a product endorsement.
• ISO 9001 as aseptic cover: ISO 9001 can be adopted by any sector. It does not, by itself, show filter integrity, environmental monitoring, or batch release.
• One logo for every line: A certificate covers the sites and product lines written in its scope. A second building, or a different fill line, can sit outside that scope.

Practical rule: Count evidence, not logos. Ask which site, which line, which date, and which edition of the standard.

The table is the map for the rest of this guide. Each later point takes one cell and turns it into a document you can request. If you buy research peptides or sterile diluents, use the same test when you verify GMP claims for research peptides: match the claim to a named site and a lot record, not to a badge on a product page.

How GMP Requirements and ISO Layers Fit Together

A batch record links each raw material and process step to the final release decision. If a result is questioned later, the record should show who performed the work, which materials were used, and when each step took place.

GMP controls the way products are made and checked. In practice, buyers may encounter:

• Documented procedures: Instructions are written before a batch begins.
• Trained personnel: Staff are qualified for their assigned tasks.
• Controlled premises and equipment: Rooms, filters, and machines are maintained in defined conditions.
• Validated processes: Evidence shows a process can meet preset criteria.
• Batch records: Work is recorded as it happens, including deviations.
• Complaints and recalls: Problems after release can be investigated, traced, and addressed.

Requirements depend on the product category and jurisdiction. A laboratory reagent and a licensed medicine do not necessarily face the same rules. Assess a supplier's claim against the product's intended use.

What each ISO layer adds

GMP sets manufacturing requirements. A quality management system provides the operating structure for applying procedures consistently. ISO standards define requirements for that structure.

ISO 9001:2015 sets a general framework that includes document control, internal audits, corrective action, and continual improvement. Any sector can adopt it. The Herbilabs guide to ISO 9001 explains this framework; an ISO 9001 certificate alone does not show that a specific product or process is sterile.

ISO 13485:2016 sets quality-management requirements for medical devices, with added attention to areas such as risk management, traceability, supplier control, and post-production activities. It was first published in 1996 as a companion to ISO 9001 for the design, development, installation, and servicing of medical devices. Its scope does not make it a substitute for GMP.

The WHO GMP programme describes the World Health Assembly's adoption of the GMP text in 1969 as part of a certification scheme for products in international commerce. That history helps explain GMP's role in cross-border trade.

For supplier review, separate the system certificate from evidence about the product and production line. Ask for records showing that the process ran as written. If a supplier cites ISO 9001, request documentation explaining how the relevant process is controlled, validated, and recorded.

Why 0.22 µm Filtration Is Not the Whole Story

A 0.22 µm filter can be a meaningful control for a sterile diluent, but its pore-size rating cannot prove that the finished vial is sterile. Consider multi-dose vials of water with 0.9% benzyl alcohol for reconstituting lyophilized research materials. The supplier's filtration specification describes one step in the process. The other steps determine whether the solution stays controlled through filling, sealing, testing, and release.

A sterile filter can reduce bacteria and moulds, but filtration alone does not establish that every biological contaminant has been removed. Nor does a supplier's pore-size claim show that a filter was intact during a particular production run. For that, ask for batch-specific filter-integrity records and evidence of the controls applied after filtration.

Six steps, and what each one guards

1. Prepare the solution. Water and 0.9% benzyl alcohol are made to a written specification. The specification defines what is supposed to enter the filter; without it, the pore-size claim says nothing about whether the right solution was prepared.
2. Filter at 0.22 µm. The solution passes through a sterile filter with that nominal pore size, or an equivalent. Ask how integrity is tested and whether the result is recorded for the batch.
3. Fill sterilized vials. The filtered solution goes into sterilized multi-dose glass vials in a controlled environment. The vial and filling process matter because contamination can be introduced after filtration.
4. Close and label. Each vial is closed and labeled, and the first-puncture date is recorded for later use. That date lets users track when a multi-dose vial was first opened.
5. Test the environment and finished lot. Environmental and finished-product tests are compared with preset limits. Ask for the applicable results and acceptance limits, rather than relying on the filtration specification alone.
6. Review and release. Quality assurance reviews the production and test records before releasing the lot with its certificate of analysis. The certificate should relate to the lot being purchased; a filter specification does not replace that review.

When a supplier leads with “0.22 µm filtered,” ask two specific questions: how was filter integrity checked for this batch, and what records show that filling and closure remained controlled afterward? The answers help distinguish a process claim from evidence about the vial you are buying.

The short walkthrough below shows how filtration fits into a longer chain of controls.

What Certificates, Audits and Claims Actually Prove

"Certified" does not mean "compliant" for the vial in your hand. A certificate shows that a management system existed and was audited on a stated date, inside a stated scope. The batch record and the certificate of analysis show that the process ran for one lot.

The same split shows up in other accredited testing. The role of accredited blood testing depends on method, scope, and the result for that sample, not on a logo beside the report. Labware is no different. The labware certification details from Herbilabs are worth reading with that split in mind: system evidence on one side, lot evidence on the other.

Three claims on a supplier page

"ISO certified" means a management system was audited within its scope. It does not mean the product was made under the GMP rules that apply to that product category.

"GMP compliant" means a regulator or auditor checked manufacturing controls. That check may cover one site or one product line. Ask which ones. The European Medicines Agency reported that 210 GMP inspections requested by the CHMP or CVMP were performed in 2024. Inspection activity is real, and a marketing line is not the same thing as one of those outcomes.

"High purity" has to point to a test method, a specification, and a lot number. Without those three, the phrase is a slogan.

More logos do not mean more assurance. Scope, audit depth, and batch evidence matter more than the count of badges.

Audits, weakest to strongest

1. Self-declaration. A supplier questionnaire is the supplier describing itself. Useful as a start, weak as proof.
2. Document review. You read the evidence pack: certificates, validation summaries, and a sample batch file.
3. Buyer audit. Your team, or a hired auditor, reviews the site on location or remotely and writes findings.
4. Third-party or regulator inspection. An inspection report from an independent body or a regulator is the strongest of the four, and it is still limited to what was inspected.

A useful audit report classifies findings, states corrective-action status, and gives closure dates. Open findings with no owner are not closed.

For the certificate itself, check the certificate number, the issuing body, the edition (for example ISO 13485:2016), the date, and the scope statement that names sites and product lines. Confirm the scope covers the filling line you are buying. Request the certificate, not a cropped screenshot.

Ask every claim the same four questions: which site, which product line, which date, and which edition of the standard?

Documents to Request From a Lab Supplier

Request documents in an order that ties claims to one production run, then to the process behind it.

Document	What it proves	Red flag
Lot-specific certificate of analysis	Test results for that exact lot, such as purity, pH and sterility or endotoxin where tested	Generic COA with no lot number or test method
Batch manufacturing record	Steps performed for that batch, with dates, operators and any deviations	Blank deviation fields or missing signatures
Process validation summary	The process reproducibly meets predefined acceptance criteria	No protocol, or no acceptance criteria stated
ISO 13485 certificate with scope statement	The audited management system and the sites and product lines it covers	Scope excludes the filling line or product you will buy
GMP certificate or inspection outcome	A regulator or auditor checked manufacturing controls at a named site	Claim with no certificate number, issuing body or date
Filtration and integrity test records	The 0.22 µm filter was used and passed integrity testing per batch	Integrity test results absent or not batch-linked
Deviation and CAPA log	How failures were investigated, corrected and closed with root cause	No trend review, or closed items with no root cause
Change notification procedure	The supplier informs buyers before process or raw-material changes	Changes made without notice or with no impact assessment
Training records	Staff are qualified for aseptic and GMP tasks they perform	Undated, unsigned or missing training records

What to ask for first

Lead with the lot-specific certificate of analysis and the batch manufacturing record. Those two tie results and actions to one run. The lab accuracy insights from Herbilabs show why a result without a lot identity cannot support a reproducible experiment.

Next, ask for validation and qualification records. FDA process validation guidance defines three connected stages: process design, process qualification, and continued process verification. Trained personnel review statistically trended routine-production data. One good release certificate is never the whole story.

A strong pack links incoming materials, in-process measurements, finished-product tests, deviations, and environmental results. If a document is missing, ask for a short written summary with a date and a named owner. A refusal is information. Record it, and decide whether that gap is acceptable for the use you have in mind before the lot arrives.

Digital Records and Documentation Expectations for Small Labs

Small labs feel documentation pressure first when suppliers move records onto computerized systems. The useful question is practical. What minimum evidence should you hold now so a file still makes sense if an inspector, a customer, or your own quality lead asks how a lot was accepted?

Keep this set current, whether the record is paper or electronic.

1. Version control. Each controlled document has dated revisions and a named owner.
2. Audit trails. Electronic records show who changed what, and when. A shared login erases that trail.
3. Supplier qualification. The supplier file is reviewed on a stated interval, not only at first purchase.
4. Change notification. A process or raw-material change arrives with an impact assessment before you keep buying.
5. Deviation and CAPA. Failures have a root cause, a correction, and a trend review. A closed box with no cause is not closed.
6. Data-integrity checks. Paper entries, electronic values, and certificate figures are compared for the same lot.
7. A contingency plan. You know what you will do if a contract manufacturer changes a process or a raw-material source.

Two files, two owners

Supplier qualification evidence stays with the supplier: procedures, validation summaries, certificates, and their audit trails. Customer laboratory records stay with you: lot numbers, storage conditions, opening dates, and in-use dates. Do not assume the supplier's file covers your fridge log.

Digital systems can raise the compliance burden for a small lab before they save any time. A computerized system has to be validated for its use, access-controlled, backed up, and governed. Ask suppliers whether they can show version control and audit trails for the electronic records you will rely on. If they cannot, treat the PDF they email as unverified until a named person confirms it against the batch.

Your Next Step This Week

Set a minimum supplier file before the next order, and check it against your own risk assessment. Drafts issued in July 2025 proposed revisions to EU GMP Chapter 4 on documentation, Annex 11 on computerized systems, and a new Annex 22 on artificial intelligence, with consultation closing in October 2025, according to the GMP Journal developments update. A supplier's ISO certificate still does not replace acceptance criteria you write before the lot arrives.

• Tier 1, every purchase: the lot-specific certificate of analysis, the certificate with its scope statement, and a written change-notification commitment.
• Tier 2, higher-risk uses such as reconstitution in repeatedly accessed multi-dose vials: the process validation summary, filtration and integrity records, the deviation and CAPA log, and training records for aseptic and GMP tasks.
• Tier 3, your own lab: supplier approval date, lot numbers, storage conditions, opening dates, and in-use dates.

Give each tier an owner and a review date. Score each supplier against the tiers and mark missing items as open. This week, request the three Tier 1 items from your current supplier, compare them with the tiers, and record any gap before the next lot arrives.

---

Herbilabs supplies research-use bacteriostatic water and related labware with lot-specific certificates of analysis and quality-assurance review before release. If you are building the supplier file described here, start with the documents behind a sterile diluent rather than with a logo. Visit Herbilabs to see vial formats, documentation, and how to request the records that match your tier list.