A Canadian Licensed Producer rarely ships a batch of dried flower to Europe alone. At least four other companies touch it: a contract laboratory, an irradiation or antimicrobial treatment provider, a freight forwarder with bonded storage, and the EU importer whose Qualified Person certifies the batch for release. Each of those relationships is an outsourced activity, and EU-GMP Chapter 7 sets the rules for how they must be controlled.
EU-GMP Chapter 7 outsourced activities requirements come down to one rule. Any GMP activity you hand to a third party must be defined, agreed and controlled through a written contract between you (the Contract Giver) and the contractor (the Contract Acceptor). Responsibility for the batch never leaves you. In 2026, EU importers and their auditors read a Canadian LP's contractor files the same way they read its batch records. A purchase order and a certificate of analysis no longer pass.
What EU-GMP Chapter 7 requires from a contract giver
Chapter 7 is short. It runs to 17 numbered paragraphs across four parts: general principles (7.1 to 7.3), the Contract Giver (7.4 to 7.8), the Contract Acceptor (7.9 to 7.13), and the contract itself (7.14 to 7.17). The current revision took effect on 31 January 2013. It was rewritten around ICH Q10, which is why it now covers every outsourced GMP activity, well beyond contract manufacture and analysis.
The principle is blunt. There must be a written contract that establishes each party's duties. The Contract Giver's quality system must also state how the Qualified Person certifying each batch exercises full responsibility. For a Canadian LP, that Qualified Person usually sits at the EU importer, and your file has to let that person rely on your contractors with confidence.
The Contract Giver's duties (7.4 to 7.8)
Your pharmaceutical quality system must include the control and review of every outsourced activity, using quality risk management. Before you outsource anything, you assess the legality, suitability and competence of the contractor. The contractor then needs every piece of information required to do the work, including any hazard the product poses to its premises or people. Performance gets monitored and reviewed. Records and results get assessed by you, and you confirm that whatever comes back was processed in accordance with GMP.
The Contract Acceptor's duties (7.9 to 7.13)
The contractor must have the premises, equipment, knowledge and competent personnel to do the work. It cannot subcontract any part of that work without your prior evaluation and approval. It cannot make unauthorised changes outside the contract. And it must understand that its work, including contract analysis, can be inspected by a competent authority.
The contract (7.14 to 7.17)
People who know both the activity and GMP must draft the contract. It states who performs each step, from knowledge management and technology transfer to sampling, testing and release. All records, including reference samples, must be kept by you or be available to you. It must also give you the right to audit the contractor and any agreed subcontractor.
| Chapter 7 clause | What it means for a Canadian LP | Evidence an EU auditor asks for |
|---|---|---|
| 7.5 Assess legality, suitability, competence | Qualify every lab, treatment provider and storage partner before first use | Supplier qualification report and approved supplier list |
| 7.6 Provide all necessary information | Send specifications, methods, sampling plan and hazard notes to the contractor | Technology transfer record and signed specification versions |
| 7.7 Monitor and review performance | Track turnaround, deviations and out-of-specification results per contractor | Annual contractor review and metrics |
| 7.11 No subcontracting without approval | Know which panels your lab sends out and approve each one | Subcontractor list signed by both parties |
| 7.16 Records available to Contract Giver | Raw data, dose records and chain of custody retrievable within hours | Record retrieval test during audit |
| 7.17 Right to audit | Audit clause covering the contractor and its subcontractors | Audit schedule and last audit report |
Which cannabis activities count as outsourced
Most LPs undercount their outsourced activities because they think of Chapter 7 as a contract-manufacturing rule. Chapter 7 covers any activity in the GMP Guide that someone else performs on your behalf. In a Canadian flower export operation, that list is longer than it looks.
Contract analytical testing
Under the Cannabis Regulations, you cannot sell or export a cannabis product until the testing in sections 90 to 92 is complete. That testing covers phytocannabinoids and contaminants, uses validated methods, and runs on a representative sample of each lot. Most LPs send that work to a third-party laboratory holding a Health Canada licence for analytical testing. That laboratory is a Contract Acceptor. Its ISO/IEC 17025 accreditation scope, method validation and subcontracting arrangements are all your responsibility to assess. Our guide to ISO 17025 cannabis testing covers what the scope certificate needs to show.
Irradiation and antimicrobial treatment
Section 42 of the Cannabis Regulations lets a licence holder conduct antimicrobial treatment of cannabis at a location other than its licensed site. The condition is that the cannabis returns to the site or is distributed in accordance with the Regulations. Irradiation at a third-party facility is therefore a lawful, and very common, outsourced activity. It is also a production step that changes the product, which puts it squarely inside Chapter 7. Dose mapping, dosimetry records, chain of custody and the treatment provider's own quality system all need to be in your file. See our guide to cannabis irradiation for export markets for the market-by-market position on treated flower.
Contract trimming, drying, packaging and storage
If another Licensed Producer dries, trims, packages or stores your flower, that producer is performing GMP activities on your product. The same applies to a bonded warehouse or a freight forwarder that holds product under its control. On the distribution side, the EU Good Distribution Practice guidelines carry their own Chapter 7 on outsourced activities with near-identical logic. Our EU GDP guide for Canadian LPs explains how the two frameworks meet at the customs border.
EU-side re-testing and QP release
The importer that re-tests your batch and certifies it is both your customer and, in practice, an outsourced quality function. Many LPs route flower through a processing partner in Portugal before it reaches Germany, which adds a second EU Contract Acceptor. Your quality agreement must cover who samples, who tests, who investigates a discrepancy between your COA and the EU result, and whose Qualified Person signs the release. Our articles on EU QP batch release and the Portugal processing hub route show how those responsibilities are typically split.
Service contractors most LPs forget
Several service providers also perform activities the GMP Guide covers:
- Calibration and metrology providers
- HVAC and environmental monitoring contractors
- Pest control and cleaning services
- Electronic batch record and LIMS vendors
They do not all need the same depth of file, but each needs a risk assessment that justifies the level of control you apply.
Health Canada frames all of this differently. The Cannabis Regulations place every obligation on the licence holder and its quality assurance person under section 19, and they say nothing about contractor agreements. That is why a Canadian LP with a clean Health Canada inspection history can still fail an EU supplier audit on contractor control. The Canadian framework assumes you are responsible. Chapter 7 requires you to prove how.
How to build a Chapter 7 contractor file in 6 steps
Auditors do not expect a Canadian LP to hold an EU manufacturing authorisation. They expect to see that your quality system controls every third party the way Chapter 7 describes. The 6-Step Contractor Control File below is the structure that gets through a supplier audit by an EU importer without a major finding.
Step 1: Inventory and classify every outsourced activity
List every external party that performs an activity on your product, your data or your facility. Classify each by GMP impact using the quality risk management approach you already apply to deviations and CAPA. A contract laboratory and an irradiation provider are high impact. A pest control contractor is low impact. The classification sets how deep the rest of the file goes.
Step 2: Qualify the contractor before first use
Legality means the right licences. For a laboratory, that is a Health Canada licence for analytical testing. For an irradiation provider, it is a licence covering the site where treatment takes place. Suitability means the contractor's scope actually covers your matrix. An ISO/IEC 17025 certificate that lists pesticide residues in food but not in dried cannabis does not qualify the lab for your pesticide panel. Competence means validated methods, trained staff and a quality system you have assessed, on site for high-impact contractors and by questionnaire for low-impact ones. Record the outcome and add the contractor to an approved supplier list with a requalification date.
Step 3: Write the quality and technical agreement
This is the contract Chapter 7 refers to, and it is separate from the commercial agreement. It needs:
- A responsibility matrix that assigns every step in clause 7.15 to one party
- A communication clause fixing how fast the contractor must notify you of a deviation, an out-of-specification result or a proposed change
- An explicit prohibition on subcontracting without your written approval
- A records clause giving you access to raw data and retained samples
- An audit clause covering the contractor and its subcontractors
- An acknowledgement that competent authorities may inspect the contracted work
The structure mirrors the quality agreement you sign with the EU importer. The difference is that here you are the Contract Giver.
Step 4: Transfer the knowledge the contractor needs
Send approved specifications, test methods, the sampling plan, packaging instructions and any product hazard information. Keep a technology transfer record showing which version of each document the contractor holds. When a specification changes, that record is what proves the contractor was working to the current version.
Step 5: Monitor, review and feed the results into your PQR
Set a small number of measurable indicators per contractor: turnaround time, out-of-specification results, deviations raised, and audit findings closed on time. Review them at least annually and summarise the outcome in your product quality review. A contractor that has never been reviewed is, in an auditor's eyes, a contractor that has never been controlled.
Step 6: Make the file retrievable for the importer's Qualified Person
Under EU-GMP Annex 16, the Qualified Person certifying your batch relies on the whole supply chain. That includes your contractors. Your importer is itself a Contract Giver under Chapter 7 for the activities it outsources, so its auditors will ask for your contractor files as part of their own compliance. Keep agreements, qualification reports, review minutes and audit reports in one indexed location, and test how long it takes to produce a given laboratory's raw data on request.
Chapter 7 gaps that stall EU supplier audits
The same findings appear in audit after audit of Canadian LPs. None of them concern the flower itself. They concern whether the LP can show it controls the parties around the flower.
- A purchase order is the only document governing the contract laboratory. No quality agreement, no responsibility matrix, no audit clause.
- The laboratory's ISO/IEC 17025 scope does not list the cannabis matrix or the specific contaminant panel being reported on the COA.
- Heavy metals or pesticide residues are subcontracted to a second lab the LP has never evaluated or approved.
- The irradiation provider holds all dosimetry and dose-mapping records, and the LP cannot retrieve them during the audit.
- A contractor changed a method, a supplier or an instrument without the LP's knowledge, so the change control file has no record of it.
- No annual contractor performance review exists, so the product quality review treats outsourced results as if they were generated in house.
- The contractor file is spread across email threads and shared drives, and the auditor's retrieval request takes a day instead of an hour.
Every one of these gaps is a documentation and control gap, not a technical one. That is good news for an LP with sound operations, because each can be closed in weeks with the six steps above. It is also why EU importers increasingly treat contractor control as a proxy for an LP's overall quality maturity. A producer that controls its laboratory, its treatment provider and its logistics partners is a producer whose batch records can be trusted.
AlphaLeaf is a Health Canada Licensed Producer based in Montreal, growing indoor, hand-trimmed cannabis flower from refined genetics. Every batch carries ISO/IEC 17025-tested results and full traceability from clone to export carton. Our export authorisation under the Cannabis Act is backed by documented control of each contract laboratory and treatment provider in our supply chain, built to the EU-GMP standard that European import partners audit against.
If you are an EU importer qualifying a Canadian supplier, or a Canadian LP preparing for a first EU supplier audit, contact AlphaLeaf to discuss how our contractor control files are structured.
Frequently Asked Questions
What does EU-GMP Chapter 7 cover?
EU-GMP Chapter 7 covers every activity in the GMP Guide that a manufacturer outsources to a third party, including but far wider than contract manufacturing and contract analysis. It requires a written contract between the Contract Giver and the Contract Acceptor and keeps full responsibility with the Contract Giver. It also sets duties for assessment, information transfer, monitoring, record access and audit rights. The current revision has applied since 31 January 2013.
Is a third-party cannabis testing laboratory an outsourced activity under Chapter 7?
Yes. Contract analysis is explicitly named in Chapter 7. A Canadian LP that sends batch testing to a laboratory holding a Health Canada licence for analytical testing must qualify that laboratory and hold a quality and technical agreement with it. It must also approve any subcontracting, have access to raw data and retained samples, and review the laboratory's performance.
Does a Canadian LP need a quality agreement with its irradiation provider?
For EU supply, yes. Section 42 of the Cannabis Regulations allows antimicrobial treatment at a location other than the licensed site, but Health Canada does not require a contractor agreement. EU auditors do. Irradiation is a production step that changes the product, so a quality agreement, dosimetry record access and audit rights are expected under Chapter 7.
Can my contract laboratory subcontract part of the testing?
Only with your prior evaluation and approval. Chapter 7.11 prohibits a Contract Acceptor from subcontracting any entrusted work without the Contract Giver's approval, and the subcontractor must be controlled to the same standard. A lab that sends your pesticide or heavy metals panel to another laboratory you have not approved creates a finding in an EU audit.
Who is responsible if an outsourced step fails, the LP or the contractor?
The LP, as Contract Giver, remains ultimately responsible under clause 7.4 for making sure outsourced activities are controlled. Commercially, the contract allocates tasks and liability between the parties, but it does not transfer GMP responsibility. The EU importer's Qualified Person will look to the LP's file, not the contractor's, when certifying the batch.
Does Health Canada require the same contractor controls as EU-GMP Chapter 7?
No. The Cannabis Regulations place all obligations on the licence holder and its quality assurance person under section 19. They do not require written contractor agreements, performance reviews or audit clauses. A Canadian LP exporting to the EU has to build those controls voluntarily, because EU importers audit against Chapter 7 regardless of what Health Canada asks.
