On 21 August 2022, Annex 21 of the EU-GMP Guide came into operation. It put one expectation in writing for every EU importer that certifies product made outside the bloc: documentary evidence that it has qualified the third-country manufacturer and monitors it through periodic on-site audits. For a Canadian Licensed Producer shipping medical cannabis flower into Europe, that line is the reason an importer's quality team eventually books flights to your facility.
A cannabis supplier audit is a second-party GMP audit in which an EU importer, or an auditor acting for its Qualified Person (QP), checks whether your site produces flower to EU-GMP or an equivalent standard. It covers your quality system, batch records, testing, sampling and supply chain. Pass it and you stay on the approved supplier list. Fail it and batches that already hold import and export permits can sit uncertified.
Why EU importers run a cannabis supplier audit
Health Canada licensing under the Cannabis Act proves your site meets Canadian rules. It doesn't, on its own, give an EU QP what the release rules ask for. Under EU-GMP Annex 16, the QP certifying a batch must have the full supply chain up to certification documented, and must be satisfied that the third-country manufacturing site has been audited. Annex 21 then spelled out the import-specific duties, including qualification of the foreign manufacturer and periodic on-site audits.
The European Commission published the final Annex 21 on 16 February 2022 and gave importers six months before it came into operation. For importers that had leaned on documents mailed from overseas suppliers, the change meant showing auditable oversight instead. For a Canadian LP, that turned the supplier audit into a condition of QP batch release.
An importer's audit is also different from an authority inspection. An EU competent authority inspects a site to issue an EU-GMP certificate. The importer audits to satisfy its own QP and its own inspectors. Holding a certificate helps, but it doesn't remove the importer's duty to qualify you. Treat the certificate as the entry ticket and the supplier audit as the exam you keep sitting.
What auditors check at a Canadian cannabis LP
Expect the audit to follow the structure of the EU-GMP Guide rather than the Cannabis Regulations. Auditors work through the chapters that matter for a flower supplier and test each one against records, including whether your contract lab holds ISO/IEC 17025 accreditation and whether you've qualified that lab yourself.
| Audit area | What the auditor asks for | Common weak point |
|---|---|---|
| Quality system (Chapter 1) | Quality manual, management review, product quality review | Reviews with no trend analysis |
| Documentation (Chapter 4) | Complete batch records, controlled SOPs | Gaps in older harvest records |
| Cultivation and post-harvest | GACP records, drying and curing logs | Unrecorded environmental excursions |
| Quality control (Chapter 6) | COAs, contract lab qualification | No audit of the testing lab |
| Sampling for EU testing (Annex 16) | Sampling SOP, comparative test data | Canadian samples relied on without justification |
| Deviations and change control | Open deviations, CAPA closure evidence | CAPAs closed without effectiveness checks |
| Supply chain and transport | Shipment records, transport conditions | No documented transport qualification |
The sampling row deserves extra attention. Annex 16 allows samples to be taken at the third-country site only under a technically justified approach, and the UK MHRA inspectorate has said comparative testing of third-country and post-import samples should continue until that reliance is justified. If your importer plans to rely on samples you pull in Canada, the auditor will want to watch someone pull them. It's the same reason your COA results and EU retest results get compared line by line. If a control isn't written down, signed and retrievable, expect the auditor to log it as absent.
The 5-step supplier audit readiness path
Preparation starts weeks before the auditor lands. This is the sequence we'd run, in order.
1. Send a complete pre-audit document pack
Expect a supplier questionnaire before the importer confirms dates. Answer it with your site master file, organisation chart, SOP index, latest product quality review, a deviation log summary and recent COAs. A clean site master file shortens the on-site agenda because the auditor arrives with fewer open questions.
2. Run a mock audit against EU-GMP
Use someone who didn't write your SOPs. Have them audit chapter by chapter and grade each finding as critical, major or minor. An LP that hasn't run a mock audit against EU-GMP shouldn't accept an importer's audit date. The first real audit is the wrong place to learn that your batch records were built for a Health Canada GPP audit rather than for a QP.
3. Trace one exported batch end to end
Pick a batch you shipped to Europe and trace it from mother plant to export permit: cultivation, harvest, drying, packaging, testing, release and shipment. This drill is where gaps show up. The records usually exist, but they sit in different systems owned by different teams, and nobody has pulled them together under time pressure.
4. Set up a front room and a back room
Assign one person to host the auditor and a separate team to retrieve documents. Log every request, who answered it and what was handed over. A half-day wait for a record reads as a control problem, even when the record exists.
5. Prepare the response plan before the closing meeting
Decide in advance who signs CAPA commitments and what turnaround you can actually deliver. Your quality agreement should set the deadline for responding to audit findings. Know it before the auditor leaves the building.
After the audit: findings, CAPA and re-audit timing
The closing meeting gives you the headline findings. The written report follows and grades each observation by severity. A critical finding generally blocks the importer from relying on your site until it's resolved. Major findings need a CAPA plan with owners and dates. Minor findings get tracked and checked at the next visit.
Write CAPAs that would survive a second auditor reading them cold. That means a real root cause, an action that removes it and a planned check that the fix worked. "Staff retrained" with no evidence of why the error happened is the response auditors trust least. Our guide to deviation and CAPA management covers how to structure that evidence.
Re-audit timing is risk-based and set in the importer's own procedures. The MHRA has acknowledged that importers rely on existing audit reports until the next scheduled audit, so the report you earn this year is the one their QP reads until the next visit. A weak report shapes every batch decision until then. A clean one becomes evidence you can point to in every new importer conversation.
AlphaLeaf is a Health Canada Licensed Producer based in Montreal, growing indoor, hand-trimmed flower from refined genetics. Each batch carries ISO/IEC 17025 test data and full traceability records, and we export under Cannabis Act authorisation, which gives EU importers and their QPs the documentation trail a supplier audit is built to test.
If you're qualifying a Canadian supply partner for the EU market, contact AlphaLeaf to start the qualification conversation. Book the mock audit first.
Frequently Asked Questions
What is a cannabis supplier audit?
A cannabis supplier audit is a second-party GMP audit in which an EU importer, or an auditor acting for its Qualified Person, assesses a Licensed Producer's quality system, batch records, testing, sampling and supply chain. Its purpose is to qualify the producer as an approved supplier and give the QP grounds to certify imported batches.
Does an EU-GMP certificate replace an importer's supplier audit?
No. An EU-GMP certificate comes from a competent authority inspection, while EU-GMP Annex 21 expects the importer to hold its own documentary evidence that it qualified the third-country manufacturer and monitors it through periodic on-site audits. A certificate can inform how often the importer audits, but it does not remove the audit.
Can an EU importer audit a Canadian LP remotely?
Remote reviews of documents are common before a visit, but Annex 21 refers to periodic on-site audits of third-country manufacturers. Plan for an on-site visit even if your documents are reviewed remotely first.
What documents should an LP send before a supplier audit?
Send a site master file, organisation chart, SOP index, the latest product quality review, a summary of recent deviations and CAPAs, and recent certificates of analysis. Include your Health Canada licence and any EU-GMP certificate you hold.
How often will an EU importer re-audit a Canadian cannabis supplier?
Re-audit frequency is risk-based and set in the importer's own procedures. Serious findings, product complaints, retest discrepancies or significant changes at your site usually shorten the interval, and a clean record tends to lengthen it.
What happens if a supplier audit finds a critical deficiency?
A critical deficiency generally stops the importer from relying on the site until it is corrected and verified. The LP should respond with a root-cause analysis and a CAPA plan within the deadline set in the quality agreement, and the importer may schedule a follow-up audit.
