Your managing director wants a date. A customer has made GMP a condition of supply. You’re wondering how long it will really take to get certified—weeks or months? I’ve sat on both sides of this, as a consultant and as a certification auditor, and the honest answer is: it depends, but you can plan it.
With a clear scope, committed people, and sensible project management, most small to mid-sized manufacturers complete certification in six to nine months. If you’re starting from a blank page, or operate multiple sites and regulated processes, a year is more realistic. Here’s how that breaks down in the real world.
First, be clear what “GMP certification” means for you
GMP isn’t a single global standard; it’s a set of principles that different schemes and sectors interpret. Your timeline hinges on the scheme you pursue and the regulatory context you operate in.
- Pharma/APIs and medical devices: Typically follow EU/UK GMP, ICH Q7 or PIC/S expectations. Validation and change control add time.
- Cosmetics: Often align to ISO 22716. Documentation and hygiene controls are central, but validation is lighter than pharma.
- Food and supplements: GMP may be part of schemes like BRCGS or FSSC, or a standalone prerequisite programme.
- Contract manufacturers: Client-specific requirements can extend scope and add approval cycles.
If you’re unsure what best fits your products and customers, speak with your clients and regulator, then define the scope early. A brief call with an auditor can save you weeks of rework. You can also read more about how we approach GMP certification.
A practical timeline at a glance
Every site is different, but the cadence below is typical for an SME with one manufacturing site and an existing quality system. Adjust upwards for complex validation or multiple sites.
- Weeks 0–2: Scoping and gap analysis. Define products, processes, and sites in scope. Review current procedures and records against the chosen GMP scheme.
- Weeks 3–8: System design and upgrades. Write or revise procedures, update layouts and flows, set up supplier controls, and plan training and validation.
- Weeks 9–16: Implementation and training. Roll out procedures on the shop floor, train people, and start collecting records that show the system works.
- Weeks 17–20: Internal audit and management review. Audit the full scope, raise findings, complete corrective actions, and hold a management review.
- Weeks 21–22: Certification Stage 1. The auditor reviews your readiness, focusing on documentation, scope, and planning for Stage 2.
- Weeks 23–26: Close Stage 1 gaps. Tighten what Stage 1 flagged and ensure enough implementation evidence is on file.
- Weeks 27–30: Certification Stage 2. The on-site audit tests implementation across departments and shifts.
- Weeks 31–34: Close nonconformities. Address findings with root cause analysis and evidence of effective correction.
- Weeks 35–36: Certification decision. The certification body completes its review and, if satisfactory, issues the certificate.
That’s roughly six to nine months from kick-off to certificate for a prepared single site. If you compress design and implementation, you risk scrambling later; build in breathing space to generate credible records.
What speeds you up or slows you down
Factors that shorten timelines
- Existing QMS maturity: If you already run ISO 9001 or a sector scheme, you’ll have a foundation to build on.
- Clear process ownership: Named process owners who can write procedures and train teams keep work moving.
- Stable products and processes: Fewer variations mean fewer validations and simpler risk assessments.
- Pragmatic scoping: Starting with one line or product family limits complexity and accelerates evidence gathering.
Factors that extend timelines
- Complex validation: Sterile or high-risk products require protocol writing, execution, and reporting.
- Facilities upgrades: Construction, HVAC zoning, or segregation changes take time and often permits.
- Supplier approval backlog: Bringing suppliers into compliance can be the long pole in the tent.
- Data integrity remediation: Rebuilding batch records and electronic controls isn’t quick if issues surface.
- Multi-site rollouts: Staggered audits and consistent implementation across locations add months.
Common bottlenecks and how to avoid them
- Procedures stuck in draft: Time-box approvals and use a simple document control flow to get controlled versions issued.
- Training lag: Create short, role-specific sessions and capture attendance and competency checks early.
- Housekeeping and hygiene: Daily audits and 5S routines prevent a last-minute scramble before Stage 2.
- Calibration and maintenance: Build a credible schedule and bring critical kit into calibration well before audit.
- Change control inertia: Write a practical change control SOP and test it with a real change; auditors want to see it in action.
- Root cause quality: Train teams in simple techniques like 5 Whys to improve corrective actions after internal audits.
How much time your team will need
You don’t need a huge project office. You do need a core team who can make decisions and free up time. Expect your quality lead to carry the load during design and internal audits, with production, engineering, and supply chain each taking clear tasks. During implementation, supervisors and operators need time for training and for getting comfortable with new checks and records. Plan this into shifts; don’t treat it as overtime, or quality will slip.
For validation-heavy environments, factor in specialist time—engineers, microbiology, or IT—for protocols and data integrity. Bringing these people in late is a common cause of delay.
What the certification audits involve
The certification audit comes in two steps. Stage 1 is a readiness check. The auditor confirms your scope, reviews key procedures, and checks whether you’ve scheduled internal audits and a management review. It’s also where we agree the Stage 2 plan and areas of focus. Use Stage 1 to surface weak spots early.
Stage 2 tests implementation. We walk the facility, observe production, and sample records: training, batch records, equipment logs, deviations, and supplier approvals. Expect interviews across shifts. Findings aren’t a failure; they’re part of the process. What matters is that you respond with clear root cause, corrections, and preventive actions that you actually implement.
Audit duration scales with headcount, product risk, and the number of lines and shifts. If you have multiple sites in scope, we’ll sample them based on size and risk, which extends the schedule. Build that into your plan.
Example timelines by organisation type
- Small single-site cosmetics manufacturer: With ISO 9001 in place and modest facility changes, six months is achievable.
- Mid-sized food supplement packer: With supplier approvals and hygiene upgrades to complete, allow eight to ten months.
- API plant with validation scope: Protocols, requalification, and data integrity remediation can extend the journey to twelve months or more.
- Multi-site contract manufacturer: Phased implementation and staggered audits commonly push beyond a year, especially if clients must approve changes.
Keeping momentum: practical tips
- Start with a focused scope: Certify one product family or line first, then expand post-certification.
- Run a real pilot batch: Use it to test procedures, records, and training before an auditor does.
- Schedule internal audits early: Don’t wait until everything is “perfect”; early findings save calendar time.
- Visualise progress: A simple plan-on-a-page with owners and dates helps busy teams stay aligned.
- Engage your suppliers: Share your requirements and timelines so they aren’t the reason you slip.
- Keep management reviews short and regular: Monthly 30-minute reviews beat one long meeting that never happens.
If you want a calm, predictable journey to certification, start with clarity on scope, commit to realistic dates, and give your team the time to implement properly. If you’d like to talk through your situation and map a sensible timeline, the UKCTL team is happy to help—no hard sell, just practical advice tailored to your products and site.