What gives GMP its legal force in the United States and the European Union?

Short answer

In the United States, 21 CFR Parts 210 and 211 set the minimum CGMP requirements for finished drugs, and a drug not made under them is legally adulterated. In the EU, Commission Directive (EU) 2017/1572 lays down the GMP principles for human medicines and EudraLex Volume 4 holds the detailed guidelines inspectors apply.

Why

GMP is not a voluntary standard like an ISO certificate. In the US it is regulation, and the FDA says that a drug made without following CGMP is adulterated under the law even if nothing is wrong with the product itself. The "C" stands for current: firms are expected to use up-to-date systems and technology, not just the practices that were normal when the rules were written in 1978.

The regulations are deliberately short and flexible, so FDA guidance documents describe its current thinking without being binding. In the EU, Directive 2001/83/EC is the medicines code and Directive (EU) 2017/1572 supplements it with GMP principles. EudraLex Volume 4 then gives the detail: Part I chapters 1 to 9 for medicinal products, Part II for active substances (based on ICH Q7) and annexes such as Annex 1 for sterile products.

A sterile injectable sold in both markets is inspected against Part 211 by the FDA and against Volume 4 and Annex 1 by EU inspectors. The two overlap heavily but are not identical. The EU requires a Qualified Person to certify each batch, while US law gives release authority to the quality unit.

Biologics add 21 CFR Parts 600 and onward, and medical devices follow a different quality system regulation altogether.

A strong answer covers

21 CFR 210 and 211 as binding minimum requirements
Adulteration does not require a proven defect
Directive (EU) 2017/1572 plus EudraLex Volume 4
Guidance explains expectations but regulations bind
Regional differences such as QP certification

Common mistakes

Calling GMP a voluntary industry standard that firms choose to adopt.
Assuming an adulterated drug must be contaminated or out of specification.
Treating FDA guidance documents as if they had the force of regulation.

The interviewer might ask next

How would you handle a requirement where EU Annex 1 and FDA aseptic guidance set different expectations for the same line?