Why pharmaceutical supply, FDA inspections and manufacturing compliance belong in the commercial contract, not just the Quality Agreement
A pharmaceutical company can have an approved ANDA, a favorable patent position, launch inventory plans and customers waiting, and still miss the market because its API supplier cannot release compliant material. The same manufacturing problem can derail an NDA or BLA approval milestone, destroy contingent transaction value, or turn a seemingly routine vendor relationship into high-stakes litigation. The lesson is simple: current good manufacturing practice (CGMP) risk is not only an FDA issue. It is a commercial allocation-of-risk issue.
| THE PRACTICAL POINT: A Quality Agreement tells the parties who performs CGMP tasks. A commercial Supply Agreement should say who bears the economic consequences when a CGMP failure prevents supply, delays FDA approval, or destroys a time-sensitive market opportunity. |
The API Supplier Problem: An Approved ANDA Without API Is Not a Launch
Consider a familiar generic-drug scenario. An ANDA sponsor expects to launch immediately after a patent barrier falls, after prevailing in litigation, or upon another market-opening event. Its API is sourced from a third-party manufacturer. Weeks before launch, the API facility receives significant FDA inspection observations, places batches on quality hold, discovers data-integrity or contamination issues, or becomes subject to an import alert or other regulatory restriction. The ANDA holder may remain legally approved but commercially unable to manufacture saleable finished dosage form. Or worse, the FDA withholds final ANDA approval until the underlying GMP issue is corrected. There are significant legal differences between a finally approved ANDA for which the product cannot be launched versus the ANDA is not even yet approved.
The lost opportunity can be disproportionate to the value of the API itself. A supplier may have failed to deliver $500,000 of material, while the ANDA sponsor loses tens of millions of dollars from a first-to-market or early-entry window. Competitors enter, wholesalers establish alternative supply relationships, price erosion accelerates, and the market opportunity may never return. This arrangement may be especially problematic because the typical ANDA only qualifies a single API source. Switching sources is not easy.
A purchase order may be dangerously thin protection
If the parties operate through individual purchase orders incorporating a supplier’s standard terms, the buyer may discover that the operative documents contain little more than product, quantity, price and delivery date, plus supplier-friendly disclaimers, force-majeure language, warranty limitations and a damages cap tied to the purchase price. The documents may say nothing about inspection readiness, prompt disclosure of Form FDA 483 observations, warning letters, import alerts, batch failures, data-integrity investigations, remediation obligations, allocation priority during shortages, alternate sites, safety stock, or consequential launch damages.
That does not mean the buyer necessarily has no remedy; governing law, incorporated terms, warranties, course of dealing and the facts surrounding the breach matter. But the buyer has converted what should have been an express allocation of pharmaceutical regulatory risk into an after-the-fact contract dispute. For a time-sensitive launch, that is a poor place to be.
FDA Treats Contractors as Part of the Manufacturing System
FDA’s regulatory framework reinforces why the commercial documents need to be more sophisticated. FDA’s guidance on contract manufacturing recommends a written Quality Agreement defining the parties’ CGMP responsibilities. The guidance specifically addresses audits, inspections, communication of inspection findings and relevant FDA correspondence. ICH Q7 likewise contemplates written agreements for API contractors, audit rights, controls over subcontracting, and approval of changes that may affect API quality.
But FDA also draws an important line: Quality Agreements generally should not contain business terms such as pricing, delivery obligations, liability limitations or damages. Those belong in the commercial agreement. Thus, a well-drafted pharmaceutical relationship often needs two coordinated documents: (1) a Quality Agreement allocating regulatory and quality responsibilities, and (2) a Supply Agreement allocating the commercial consequences if those responsibilities are not performed.
Nor can the parties contract away FDA responsibility. FDA has repeatedly emphasized that contract facilities remain responsible for CGMP compliance regardless of their agreements, and product owners retain their own regulatory responsibilities. Contract drafting does not replace compliance; it determines the private remedies and incentives when compliance breaks down.
The Same GMP Risk Can Become M&A and CVR Risk
The stakes become even larger in life-sciences transactions. Contingent value rights (CVRs), the public-company analogue of an earnout, are increasingly used to bridge valuation gaps where future value depends on regulatory or commercial milestones. A 2026 survey reports that 28 of 59 announced public life-sciences transactions in 2025 included a CVR, and regulatory and sales/use milestones make up a large share of CVR events.
A deadline-based FDA milestone creates a distinctive conflict. After closing, Buyer Company owns the program and ordinarily controls development, manufacturing remediation, inspection readiness and FDA interactions. Buyer wants the drug ultimately approved because it owns the asset. But if a multibillion-dollar CVR becomes payable only when approval occurs before December 31, Buyer may be economically better off with approval on January 15 than on December 30.
Recent high-profile CVR litigation illustrates the issue. In one major biopharma acquisition, a trustee alleged that the buyer failed to use contractually required diligent efforts to obtain FDA approval of an acquired product before a milestone deadline, allegedly avoiding a potential $6.4 billion CVR obligation. That is, the buyer could have been on the hook to pay the $6.4 billion to the original seller shareholders. The buyer disputes the allegations. The case demonstrates the structural issue without requiring a finding of intentional delay: manufacturing readiness, remediation, FDA inspection timing and regulatory execution can become evidence in a contract dispute over whether the buyer used the promised level of efforts.
The problem is therefore broader than deliberate “slow playing.” A buyer can lose a milestone because an acquired facility or CMO has genuine CGMP deficiencies. The legal question then becomes who assumed that risk and what level of post-closing effort was required to prevent, remediate or work around it.
Drafting for GMP Risk: Clauses That Deserve More Attention
1. Regulatory-event notice
Require prompt, often one-business-day or similarly short, notice of events reasonably capable of affecting supply or approval, including FDA inspection notices, Form FDA 483 observations, warning letters, import alerts, Official Action Indicated classifications, recalls, significant deviations, sterility or contamination events, data-integrity investigations, material CAPAs, regulatory holds and loss or suspension of manufacturing licenses. The obligation should extend to relevant subcontractors and critical upstream sites.
2. Inspection participation and information rights
Give the affected party meaningful rights to receive inspection correspondence, participate in strategy calls where appropriate, review proposed responses affecting its product, obtain CAPA status, and conduct routine and for-cause audits. Confidentiality and third-party restrictions can be addressed, but “we cannot tell you what FDA found” is an unacceptable position when the finding may stop the customer’s launch.
3. Inspection-readiness and continuing-compliance covenant
A supplier should covenant to maintain the facility, quality systems, personnel, data systems and registrations necessary to manufacture the contracted material in compliance with applicable CGMP. For a transaction tied to FDA approval, consider an express obligation to maintain inspection readiness and to devote specified or objectively reasonable resources to remediation of deficiencies affecting the milestone.
4. Defined remediation timelines and escalation
Do not rely only on a generic promise to “use commercially reasonable efforts.” For critical observations, the agreement can require an initial impact assessment within a specified period, a written remediation plan, regular status reporting, executive escalation, and agreed deadlines or milestone dates. Where FDA controls the ultimate inspection date, the covenant should focus on the actions the regulated company actually can control.
5. Supply continuity, safety stock and allocation priority
For launch-critical API, require minimum safety stock, rolling forecasts, reserved capacity and clearly defined allocation priority if the supplier experiences constrained output. Consider whether the supplier must maintain qualified alternate equipment, an alternate manufacturing line, a second source, or technology-transfer capability. The right answer depends on product economics and regulatory feasibility, but the contract should make the choice consciously.
6. Alternate-source and step-in rights
If a GMP event threatens supply, the buyer may need the right to qualify an alternate supplier, obtain necessary technical packages, letters of authorization or DMF cooperation, access validation and analytical information, and transition production. In development or M&A settings, carefully drafted step-in rights may permit the protected party to fund or direct remediation if the party controlling the facility does not act with sufficient urgency.
7. Change control and subcontracting restrictions
A seemingly minor supplier change can become an ANDA/NDA supplement issue or create new inspection risk. Require advance notice and, where appropriate, consent before changes to site, process, critical raw materials, specifications, analytical methods, equipment, key subcontractors or other matters that may affect product quality, regulatory filings or supply continuity. ICH Q7 specifically recognizes approval controls over contractor changes and subcontracting.
8. Launch-specific service levels
A generic delivery covenant may not capture the economics of a launch. Define the launch window, required batch-release dates, minimum quantities, reserve inventory, testing turnaround and escalation procedures. If timing is genuinely material, say so expressly. That record can matter later when interpreting remedies and foreseeability.
9. Damages, indemnification and liability caps
This is where many agreements fail the business team. If supplier liability is capped at the price of the delayed API, the remedy may bear no relationship to the buyer’s actual launch exposure. The parties should negotiate whether GMP breaches, regulatory noncompliance, data-integrity violations, gross negligence, willful misconduct, confidentiality breaches, recall costs, replacement supply and specified launch losses are outside, or subject to a higher “super-cap” limit than the ordinary liability cap.
Consequential-damages waivers deserve particular scrutiny. Lost profits and lost market opportunity are often exactly the damages created by a blown generic launch. A buyer that agrees to a blanket consequential-damages waiver should understand that it may be waiving the category of loss it cares about most. Alternatives include a negotiated launch-failure payment, liquidated damages where enforceable, a special indemnity, or a higher cap tied to forecasted annual purchases or a multiple of fees rather than the affected purchase order.
10. Force majeure should not become a GMP safe harbor
A supplier should not be able to characterize its own preventable CGMP failure, inadequate maintenance, deficient quality system, staffing shortage or failure to remediate known observations as force majeure. The clause can distinguish truly external events from failures within the supplier’s reasonable control. Even where an external event qualifies, mitigation, allocation and notification duties should survive.
11. CVR/earnout provisions should address the regulatory conflict directly
Where contingent consideration depends on FDA approval, consider: an objective rather than purely subjective efforts standard; an express prohibition on considering the contingent payment itself when allocating development resources; anti-avoidance language; defined obligations concerning inspection readiness and timely responses to FDA; information and audit rights for the representative of the contingent holders; and a mechanism addressing government-caused delay.
A particularly important negotiation is the outside date. An absolute midnight deadline creates cliff risk. Depending on the deal, the parties could negotiate tolling or a limited tail where the application was timely filed and substantially review-complete but approval was delayed by an FDA inspection schedule, government shutdown or another specifically defined regulatory event. The drafting should distinguish an FDA-caused delay from a delay caused by the company’s own CGMP deficiencies.
Due Diligence: Read the Quality System Like a Transaction Document
Contract protections are only part of the solution. Before a critical supply agreement, license, acquisition or milestone-based transaction, regulatory diligence should test whether the manufacturing assumptions underlying the economics are real.
- Review recent FDA inspection history, Form FDA 483s, Establishment Inspection Reports when available, warning letters, import alerts and inspection classifications, not merely whether the site is currently “approved.”
- Examine recurring deviations, CAPA aging, data-integrity investigations, out-of-specification trends, contamination controls, stability issues, batch rejection rates and management’s response to repeat observations.
- Map the complete manufacturing chain: API, key starting materials, intermediates, testing laboratories, sterile fill/finish, packaging and critical single-source vendors.
- Confirm that the regulatory filing actually supports the site, process and supplier the business model assumes will be used at launch.
- Stress-test the launch: What happens if the sole API site is unavailable for 90 days? Six months? What regulatory work is required to add a second source?
- For milestone transactions, build a reverse calendar from the CVR/earnout deadline through manufacturing, PPQ/validation, filing, inspection and FDA review. A milestone date without a regulatory critical-path analysis is only a date on paper.
A Better Contracting Architecture
For a mission-critical pharmaceutical relationship, the better architecture is usually not a longer purchase order. It is an integrated set of documents in which the commercial agreement and Quality Agreement speak to one another without confusing their functions.
| Document | Primary Function | Examples |
|---|---|---|
| Supply / Commercial Agreement | Economic risk and performance | Supply quantities; launch dates; allocation; remedies; indemnity; liability caps; force majeure; alternate source; termination |
| Quality Agreement | CGMP roles and quality governance | Batch release; deviations; investigations; change control; audits; inspection communications; CAPA; records |
| Transaction / CVR Agreement | Post-closing milestone risk | Efforts standard; anti-avoidance; inspection readiness; information rights; milestone definition; tolling/tail; dispute rights |
Bottom Line
Pharmaceutical companies often negotiate intellectual-property rights, exclusivity, price and termination provisions with extraordinary care while treating manufacturing compliance as a matter for the quality department. That division is increasingly untenable. A CGMP problem can prevent an approved ANDA from launching, interrupt an established product, delay an NDA or BLA, destroy an earnout or CVR, and create damages far exceeding the value of the affected batch.
The contracting question should therefore not be merely, “Who is responsible for CGMP?” FDA law already answers much of that question. The more commercially important questions are: Who must tell us when the problem arises? Who controls remediation? How quickly must they act? What information can we obtain? Can we move the product elsewhere? And who bears the economic loss if the quality failure destroys the regulatory or market opportunity?
For launch-critical supply and milestone-driven transactions, GMP risk should be negotiated at the same time, and with the same seriousness, as patent, regulatory exclusivity and deal-price risk.
