How to Get on a Pharmaceutical Company's Approved Vendor List (and Stay On It)

You get on a pharmaceutical company's approved vendor list by being invited into its supplier qualification process, passing it, and then giving the quality department no reason to take you off. The invitation usually comes from an engineer or buyer who wants your product. The pass comes from your quality documents and, for higher risk supplies, an audit. Staying on comes from certificates that never lapse, changes that are always notified, and deliveries that match the paperwork. None of this is mysterious, but it is slow, and most of the lost weeks usually sit on the vendor's side of the table.

This article is written from the vendor's seat: a sales or quality manager at a maker of vessels, pumps, valves, skids, filters or instruments who keeps hearing "you are not on our approved list". This is general information, not legal advice.

Why this matters now

Supplier qualification is not a procurement preference. It is a regulatory duty on the buyer. EU GMP (Good Manufacturing Practice, the rules a medicines manufacturer must follow) Chapter 7 requires a company that outsources any GMP activity to assess the "legality, suitability and the competence" of the other party before outsourcing, to monitor and review its performance, and to have a contract that permits it to audit the outsourced activities [1]. Chapter 5 requires that the selection, qualification, approval and maintenance of suppliers of starting materials are documented in the pharmaceutical quality system, with the supporting evidence for each approval kept on file, and says packaging suppliers get similar attention [2]. ICH Q10, the international model for a pharmaceutical quality system, says the same in general terms: assess the suitability and competence of the other party before outsourcing or selecting a supplier, define responsibilities in a written agreement, and monitor performance [3].

For medical device buyers the ground shifted this year. On 2 February 2026 the FDA's Quality Management System Regulation (QMSR) came into effect. It replaces the old Quality System regulation in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference. The rule removed and reserved Subparts C to O of the old regulation, which included the purchasing controls section, 21 CFR 820.50, so purchasing and supplier evaluation requirements for US device makers are now those of the incorporated standard; in ISO 13485:2016 they sit in clause 7.4, purchasing. In its responses to comments the FDA says the QMSR requires finished device manufacturers to apply an ongoing, risk informed assessment of suppliers and to document the type and extent of control they intend to apply [4]. If you sell to device makers, their questionnaires may be rewritten against ISO 13485 wording over the coming year.

Notice what these rules name: materials, packaging, outsourced services and, for devices, purchased product. A vessel or valve maker is rarely named directly. The formal GMP requirement on an equipment vendor is usually indirect. Buyers extend qualification to critical equipment and services through their own quality system because an inspector will ask how they controlled them, and because EU GMP Annex 15 allows documentation review and some tests performed at your factory acceptance test (FAT) to count towards the buyer's own qualification without being repeated on site, where it can be shown that transport and installation did not affect the function tested, and only after the buyer's own people have confirmed that vendor protocols are suitable [5]. A buyer who intends to lean on your documentation has to be able to show why they trust it. That is why "not on the list" blocks a purchase order even when the engineer is already sold.

What the list is, and what sits behind it

An approved vendor list (AVL), also called an approved supplier list, is the controlled register of companies a site may buy from. It often lives in the purchasing or ERP system so that a purchase order cannot be raised against a company that is not on it. Purchasers may only select from the list, and a supplier can be moved back to provisional status or rejected [7]. The list itself is a short table. What matters is the file behind each entry. EU GMP requires the supporting evidence for each supplier approval to be kept [2], and in practice that means the questionnaire, certificates, audit report, risk assessment and approval signature that an inspector can ask to see.

Approval is graded, not binary. The type and extent of control depends on the effect the supply has on the product, so a supplier of an active ingredient is audited while a supplier of low risk items may not be. A supplier can hold provisional approval while early deliveries are checked more heavily, then move to full approval [7]. USP General Chapter 1083, the United States Pharmacopeia's supplier qualification standard that became official on 1 August 2023, also describes conditional approval of an existing supplier whose performance has become unsatisfactory, under an agreed action plan with criteria and timelines, and a disqualification step that removes suppliers that no longer meet the approval criteria from the list [6]. Where an equipment vendor sits on that scale depends on the buyer. A product contact diaphragm valve for a sterile line will usually be treated as higher risk than a utility pump on a cooling water loop.

How qualification runs on the buyer's side

Seen from inside the buyer's quality department the process is a loop, not a line. The phases below follow USP 1083 and the practice described in the pharmaceutical trade press [6] [7].

1. Preparation and selection. A cross functional team defines what is needed and how critical it is, then shortlists candidates [6].
2. Vendor setup. Procurement or finance creates the commercial record: legal entity, tax registration, bank details, insurance. At many large buyers this runs through a registration portal. One buyer whose supplier guide is public, Harbour Energy, uses SAP Ariba: the supplier needs an SAP Business Network account, completes a registration questionnaire and uploads PDF copies of its certificate of incorporation, VAT certificate and a bank letter on its own company letterhead signed and dated within the last six months [9]. This step is administrative and typically takes days to a few weeks (illustrative; it depends on how many revisions your submission needs).
3. Quality questionnaire and document review. The quality department sends its supplier questionnaire and reviews your certificates, procedures and organisation.
4. Risk assessment and audit decision. The buyer classifies the supply by its effect on the product and decides between a paper review, a remote audit or a site audit. Audits need suitably trained and competent auditors, and some suppliers refuse to be audited at all, often because the buyer's spend with them is small [7].
5. Approval and agreement. The outcome is approved, provisional or conditional, or not approved. Responsibilities and communication routes are written into a quality agreement or specification where the supply warrants it [3].
6. Monitoring and requalification. Performance, certificates and financial viability are checked at regular intervals [6]. One GMP trainer writing in Manufacturing Chemist puts the typical surveillance audit interval at every 2 or 3 years depending on risk, and says supplier performance should also feature in the annual Product Quality Review [7]. The interval is the buyer's decision, not a fixed rule.

Vendor setup and qualification are run by different departments with different clocks. A vendor number from procurement is not approval from quality.

What to have ready before anyone asks

The fastest qualifications are the ones where the vendor already has a current, signed pack and a named person who answers within two days. Build the pack once, keep it current, and send it the day the questionnaire arrives. The table shows what a buyer typically checks for an equipment vendor, what to send, and who on your side should own it.

Two of these deserve a comment. First, the ISO 9001 certificate. UKAS, the UK's national accreditation body, advises buyers to check that the certification body is accredited by a signatory to the IAF multilateral arrangement, that the accreditation covers the relevant sub scope, and that the certificate is valid, by going back to the certification body itself rather than relying on a database that is not fully populated [8]. Buyers who follow that advice will read your certificate's scope line word for word. If it says "manufacture of industrial valves" and you are selling a hygienic valve with a documentation pack, expect a question.

Second, change notification. Buyers are expected to assess the suitability and competence of their suppliers and to monitor their performance [3], and they cannot do that if the product changes under them without notice. A one page signed statement that you will notify changes to materials, design, site or sub suppliers, with a defined notice period, removes a whole class of audit observations.

Why vendors stall, and how to get invited at all

The reasons vendors get rejected or stall are rarely dramatic. Common ones are no named quality contact so the questionnaire bounces around; a certificate that expired between the sales call and the review; an ISO scope that does not cover the product; no change notification commitment; and answers that take three weeks instead of three days. On the vendor setup side, the common rejection reasons published by one SAP Ariba user are mundane: the name on the VAT certificate or certificate of incorporation does not match the registered name, the bank letter is not on company letterhead or not signed and dated within the last six months, the bank details do not match the letter, or the VAT or company number is invalid [9]. Each of these is usually fixable in a day and each typically costs a week.

Getting invited is a different problem. Three routes work.

1. An internal sponsor in engineering. Most new vendor requests start with an engineer who has a problem your product solves. They raise the request and defend it when procurement asks why the incumbent will not do. Your technical pack is written for them.
2. Registration portals. If a buyer runs SAP Ariba, Coupa or a similar portal, registering is the formal first step; the Harbour Energy guide, for example, asks even existing suppliers to complete its questionnaire so that purchase orders and payments can be processed [9]. Register before you need to, with the documents in the table already uploaded.
3. Being found in supplier databases. Buyers searching for a capability they do not already have on the list look outside it. A complete profile with product detail and current certificates is what turns a search into an invitation. The supplier prequalification article covers what buyers screen for at that first look.

Practical example

All figures in this example are illustrative. A diaphragm valve manufacturer with ISO 9001 and a hygienic range is invited to qualify at a sterile fill finish site after a process engineer specifies its valves for a new buffer skid. The site treats product contact valves as medium risk: paper review plus a remote audit. The table shows how the weeks were spent.

Total: 10 weeks from invitation to provisional approval, of which 5 were lost to avoidable vendor side gaps. With a current pack and a named contact the same qualification, at the same site, would have taken about 5 weeks. The buyer's own steps (review, risk assessment, audit) took roughly the same time in both cases. In this example the vendor doubled the elapsed time, not the buyer.

Staying on the list afterwards is the easier half, provided someone owns it. Diary the certificate expiry dates, send the renewed certificate before the buyer asks, notify changes in writing before shipment, and answer complaints with a documented investigation. The periodic surveillance audit, typically every 2 or 3 years in the account cited above [7], is then a review of a file that is already in order.

Being found before you are on the list

The hard part of this journey is the first step: an engineer or buyer has to know you exist and want you enough to raise the request. On ChemCapital, a verified company profile with detailed product listings and stored certifications is what buyers using AI supplier discovery search against, so they can find you and invite you to quote even if they have never heard of you and before you appear on their approved vendor list. Certification expiry alerts notify you 30 days before any record lapses, and a lapsed certificate is one of the most common reasons a qualification stalls. Product listings carry the technical specifications, compliance approvals and supporting documents that a quality reviewer wants to see. The full list of what suppliers get is on the benefits for suppliers page.

Ready to be found by the buyers already looking for what you make? List your company on ChemCapital. It is free to start.