Annex 21 of the EU GMP Guide came into operation on 21 August 2022 and put a long-standing expectation in writing: an EU importer must qualify its third-country manufacturer and keep monitoring it through periodic on-site audits. If you're a Canadian Licensed Producer shipping medical flower to Germany, Poland or Italy, someone from your buyer's quality team, or an auditor they hire, will eventually walk your floor.
A cannabis supplier audit is a GMP audit run for an EU importer's Qualified Person (QP) to confirm that your flower is produced to EU GMP or an equivalent standard. It's separate from a Health Canada inspection and from the authority inspection behind an EU GMP certificate. In practice, it decides whether the importer keeps buying from you.
Why EU importers audit Canadian cannabis suppliers
The legal obligation sits with the importer, not with you. A QP can only certify an imported batch if the supply chain is visible and the manufacturing site has been shown to operate to EU GMP. Annex 16, section 1.7.3, expects the audit reports for every manufacturing and testing site to be available to that QP. Annex 21 adds that the importer must document how it qualified you and how it keeps monitoring you. The importer can outsource the audit to a contracted auditor. It can't skip it.
Canadian cannabis gets no shortcut here. The Canada-EU Mutual Recognition Agreement covers drugs and natural health products made under a Canadian establishment licence. Cannabis is regulated under the Cannabis Regulations to Good Production Practices (GPP), and Health Canada doesn't inspect GPP sites to GMP. So every batch you export is tested again on arrival in the EU, and the QP leans heavily on audit evidence before signing.
The European Commission published Annex 21 in February 2022 and gave importers six months to comply. Questionnaire-only qualification of non-EU suppliers stopped being defensible almost overnight.
Three different reviews get confused in supplier conversations, so it helps to keep them apart:
| Review | Who runs it | What it produces | What it decides |
|---|---|---|---|
| Health Canada GPP inspection | Health Canada inspectors | Inspection report and rating | Your standing as a Canadian licence holder |
| EU authority GMP inspection | An EU member-state inspectorate | EU GMP certificate for your site | Whether your site is GMP compliant in EU eyes |
| Importer supplier audit | Importer QA team or contracted auditor | Audit report, graded findings, your CAPA plan | Supplier approval and audit frequency |
An EU GMP certificate opens the door. The importer's audit decides whether you stay in the room.
What the auditor checks at a cannabis facility
Most auditors arrive with an agenda built on the chapters of the EU GMP Guide, then adapt it for dried flower as a herbal starting material. Expect the scope to cover seven areas.
Pharmaceutical quality system
Management review minutes, quality metrics and your Product Quality Review. The auditor wants proof that senior management reads trend data and acts on it. A review signed once a year and filed away won't pass.
Deviations, CAPA and OOS results
Auditors pull a sample of closed deviations and test whether the root causes were real. Files that all end in "operator error" draw attention fast, and so do open items past their due date. Our guide to deviation and CAPA management covers the record structure auditors expect.
Change control
Any change to cultivar, growing media, lighting, drying parameters or the contract lab needs a documented impact assessment. The auditor will also check whether the change triggered a notification to the importer.
Data integrity
Grow logs, environmental data and lab results are read against ALCOA+ principles. Paper cultivation logs with overwritten entries are one of the most common findings at cannabis sites.
Cultivation and GACP
Because the starting material is the plant itself, auditors look at clone sourcing, pest control records and harvest documentation against GACP expectations.
Sampling and testing
Who samples, how the sampling plan is justified, and whether your laboratory works to ISO/IEC 17025. If the importer wants to rely on samples taken in Canada, Annex 16 expects audit evidence that sampling is random and representative of the whole batch.
Outsourced activities
Irradiation contractors, third-party labs and transport providers all fall under Chapter 7 of the EU GMP Guide. You'll be asked how you qualified each one and when you last audited them.
The pattern is consistent. Auditors spend less time admiring grow rooms and more time reading the records behind them.
The 5-step supplier audit readiness path
Preparation starts the day the importer proposes a date. This sequence, which we call the 5-Step Supplier Audit Readiness Path, keeps the work in the right order.
- Agree the scope in writing. Confirm which buildings, processes and products are in scope, the reference standard (EU GMP Part I plus the relevant annexes), the auditor's name and working language, and whether any portion runs remotely.
- Send the pre-audit document pack. Auditors usually request your site master file, organisation chart, SOP index, deviation and change control logs for the past year, the latest Product Quality Review and your approved supplier list. Send it early, so questions arrive before the visit rather than during it.
- Run a mock audit against the same scope. Use someone who didn't write the SOPs. Trace two or three released batches from mother plant to certificate of analysis and fix whatever breaks.
- Prepare the audit days. Set up a front room for the auditor and a back room for document retrieval, name one host, and brief staff to answer only the question asked. Physical security rules under the Cannabis Regulations restrict access to areas where cannabis is present, so plan escorts and visitor records before the auditor lands.
- Answer findings with a CAPA plan. Findings are normally graded critical, major or minor. Give each one a root cause, corrective action, preventive action, owner and due date, within the response window set in your quality agreement.
Step 3 is the one most LPs skip. It's also the best predictor of how the real audit goes.
Where Canadian LPs lose points in importer audits
Health Canada licensing gives Canadian producers a strong base in security, record keeping and traceability. The gaps appear where GPP and GMP expect different things from the same documents:
- SOPs written for GPP that lack GMP elements, such as defined review cycles, training effectiveness checks or a link to change control.
- Product Quality Reviews that list data without trending it or reaching a conclusion about the process.
- Irradiation or testing contractors approved on a certificate alone, with no audit report or technical agreement on file.
- Deviation investigations that stop at human error, with no retraining record or effectiveness check.
- Batch records that can't show, in one sitting, the path from mother plant to released lot.
Findings don't stay in the audit room either. The report sits in the file the importer's QP reviews before certifying each batch, so a weak audit can slow every shipment that follows.
If you haven't run a mock audit against EU GMP in the last six months, don't accept the importer's proposed date. Ask for more time. A postponed audit costs a few weeks. A failed one can cost the supplier approval and the batches already in transit.
AlphaLeaf is a Montreal-based Health Canada Licensed Producer of indoor-grown, hand-trimmed cannabis flower from refined genetics. We hold export authorisation under the Cannabis Act and keep the ISO-certified batch testing, full traceability and EU GMP-aligned documentation that EU importers' auditors work through, from cultivation records to the approved supplier list.
Planning to qualify a Canadian supplier? Contact our team to start the conversation. Bring your audit agenda. We'll have the records ready.
Frequently Asked Questions
What is a cannabis supplier audit?
A cannabis supplier audit is a GMP audit an EU importer runs, directly or through a contracted auditor, to qualify a non-EU cannabis producer. It checks the quality system, records, cultivation, testing and outsourced activities so the importer's Qualified Person can rely on the site when certifying batches.
Is an EU GMP certificate enough to supply an EU importer?
No. An EU GMP certificate shows an EU inspectorate found your site compliant, but under EU GMP Annex 21 the importer must still qualify you itself and monitor you through periodic on-site audits. Most importers treat the certificate as the entry requirement and their own audit as the approval decision.
Does a Health Canada inspection count as a supplier audit?
No. Health Canada inspects licence holders against the Cannabis Regulations and Good Production Practices, not EU GMP, and cannabis falls outside the Canada-EU Mutual Recognition Agreement. EU importers can review your inspection history, but it doesn't replace their own audit.
Can an EU importer audit a Canadian cannabis LP remotely?
Annex 21 expects periodic on-site audits, so a remote review usually supplements a site visit rather than replacing it. Some importers use remote document reviews between on-site audits or to close out CAPA follow-up.
How often do EU importers re-audit a cannabis supplier?
EU GMP sets no fixed interval. The importer decides frequency through quality risk management. Previous findings, complaints, deviation history and product risk all feed that decision, and major or critical findings usually shorten the cycle.
What documents should a Canadian LP send before a supplier audit?
Expect requests for the site master file, organisation chart, SOP index, the past year of deviation and change control logs, the latest Product Quality Review and the approved supplier list. Sending them early lets the auditor arrive with focused questions.
