The Regulatory Onion

Layer by layer

What each ring actually does

Outermost layer

ICH — Global Harmonisation

The International Council for Harmonisation brings together regulators and industry from the US, EU, Japan, and beyond to agree on common technical requirements for drug safety, quality, and efficacy. ICH does not regulate directly — it produces guidelines (the Q, S, E, and M series) that national regulators then adopt into law.

Why it matters

A dossier built to ICH standards can be submitted to regulators in multiple markets — because they've all agreed on what "acceptable" looks like.

Key guideline series

Q (Quality) · S (Safety) · E (Efficacy) · M (Multidisciplinary — includes the CTD/eCTD dossier format)

Who enforces it

Nobody — ICH harmonises, it does not inspect. Enforcement sits with the regional regulators in the next layer down.

Chemical safety layer

GHS — Globally Harmonized System

The UN Globally Harmonized System of Classification and Labelling of Chemicals standardizes how hazardous chemicals are classified and communicated worldwide. Before GHS, the same chemical might have been labeled as flammable in one country and not in another. GHS ended that. It is the reason an SDS (Safety Data Sheet) looks identical in Raleigh and in Tokyo — same 16 sections, same pictograms, same signal words.

The 16-section SDS

Every SDS globally follows the same section order: Identification → Hazard ID → Composition → First Aid → Fire Fighting → Accidental Release → Handling & Storage → Exposure Controls → Physical/Chemical Properties → Stability & Reactivity → Toxicology → Ecology → Disposal → Transport → Regulatory → Other.

In practice

GHS is adopted into local law (OSHA HazCom in the US, CLP Regulation in the EU, JIS Z 7252 in Japan). EHS owns SDS management in most pharma companies — it sits at the SOP layer, but it's built on GHS standards.

Enforcement layer

Regional Regulators

The authorities that translate ICH and GHS principles into binding national law — and actually inspect, cite, and enforce. Same global playbook, translated by jurisdiction. A company operating across multiple markets must comply with each regulator in every country where it manufactures, sells, or conducts trials.

FDA + OSHA United States

EMA European Union

PMDA Japan

AMA Africa (AU)

ANVISA Brazil

COFEPRIS Mexico

NMPA China

CDSCO India

The African Medicines Agency (AMA) has now been ratified by over half of AU member states — a significant step toward a unified African regulatory framework for medicines.

Where it gets real

Company SOPs — Department by Department

Regulatory requirements don't arrive at the bench as a copy of 21 CFR. They arrive as a Standard Operating Procedure written by your QA team. Each department translates the regulations above into procedures that govern its specific work. This is the layer where global rules become daily tasks.

Quality (QA) Owns deviation management, CAPA, SOP approvals, and the batch disposition process. QA signs off before any product leaves the site.

Manufacturing Owns line clearance procedures — confirming no materials from the previous batch remain before the next one starts. A fundamental cGMP safeguard.

QC Owns method validation and out-of-specification (OOS) investigations. Every test result that doesn't meet spec triggers a mandatory, documented investigation before any disposition decision can be made.

Validation & IT Owns equipment qualification (IQ/OQ/PQ) and computerized system validation, including audit trail integrity. Ensures every instrument and system can be demonstrated to do what it is claimed to do.

EHS Owns chemical handling procedures and SDS management. Translates GHS requirements into site-specific controls: PPE selection, spill response, exposure limits, and the SDS library.

Clinical Ops Owns informed consent procedures and adverse event reporting. Every deviation from ICH E6 GCP at the site level — a missed signature, a late SAE report — is ultimately a patient protection failure.

The core

The Patient

Every ICH guideline, every SDS section, every inspection finding, every deviation investigation, every batch record signature — they exist because a person is going to take this drug, handle this chemical, or be enrolled in this trial. The onion model is a reminder that regulation is not bureaucracy for its own sake. It is a layered system of accountability, built outward from the most important thing in it.

How the layers connect

From a global principle to a specific task — the same idea expressed at every level of specificity.

Global to local

ICH E6 sets the GCP standard. The FDA adopts it into 21 CFR Parts 50, 56, and 312. Your company writes an informed consent SOP. A CRA checks the site. One principle, four expressions.

Layers stack

A QC chemist following an OOS SOP is simultaneously satisfying cGMP (regional), ICH Q10 (global), and GDocP (documentation layer). One action, multiple layers met at once.

Same destination

Peel back every layer — a Warning Letter, a failed batch, a recalled product, an unreported adverse event — and you find the same root: patient protection was compromised somewhere.

The Regulatory Onion

Why layers?

Global to local — patient at the center