Disputes with CROs and CDMOs: Contract Clauses That Prevent Compliance Failures

Biotechnology sponsors operating in Europe increasingly rely on Contract Research Organizations (CROs) and Contract Development and Manufacturing Organizations (CDMOs) to accelerate development timelines and access specialized expertise. While this outsourcing model offers flexibility, it introduces complex regulatory and operational risks. When disputes arise, they rarely concern a single clause; they typically stem from ambiguous responsibilities regarding quality standards, data integrity, audit capabilities, and change management. Under the European Union’s regulatory framework, the legal manufacturer remains ultimately responsible for the product’s quality, safety, and efficacy, regardless of the tasks delegated to third parties. Consequently, a contract is not merely a commercial instrument but a foundational element of a compliance strategy. This article analyzes common dispute patterns and outlines the specific contractual architecture required to prevent compliance failures, focusing on the interplay between EU Good Manufacturing Practice (GMP) requirements, the EU Artificial Intelligence Act (AI Act) for data-driven processes, and national enforcement variations.

The Regulatory Foundation: Legal Responsibility Cannot Be Outsourced

Before dissecting specific contract clauses, it is essential to understand the regulatory context in which these agreements operate. For medicinal products, Directive 2001/83/EC and Regulation (EU) 2019/6 (Veterinary Medicines) establish that the Marketing Authorization Holder (MAH) or the legal manufacturer is the primary entity responsible for compliance. The European Medicines Agency (EMA) and national competent authorities (NCAs) do not recognize the concept of “outsourcing” liability. If a CDMO fails to adhere to Good Manufacturing Practice (GMP), the regulatory sanction falls upon the sponsor. Similarly, for medical devices, the Medical Device Regulation (MDR) (EU) 2017/745 and the In Vitro Diagnostic Regulation (IVDR) (EU) 2017/746 impose strict obligations on the legal manufacturer to ensure that suppliers operate in accordance with the quality management system.

In the context of AI-enabled biotech or automated manufacturing, the emerging AI Act (EU) 2024/1689 introduces a similar liability structure. The provider of a high-risk AI system (which may be the biotech sponsor utilizing a CDMO’s automated production line) retains full responsibility for conformity assessments and post-market monitoring. A dispute regarding the “accuracy” of an AI model used for quality control cannot easily be shifted to the software vendor if the sponsor integrated it into the manufacturing process without proper validation. Therefore, the contract must serve as a risk-transfer mechanism that aligns the CRO/CDMO’s operational reality with the sponsor’s regulatory obligations.

Pattern 1: The “Scope Creep” and Ambiguous Quality Agreements

A frequent source of litigation involves the blurring of lines between “Development Services” (GCP/GLP) and “Manufacturing Services” (GMP). In Europe, the requirements for a Quality Agreement (also known as a Technical Agreement) are stringent. According to EMA GMP Annex 16, the responsibilities of the legal manufacturer and the contract acceptor must be clearly defined and agreed upon in a written contract (or Quality Agreement).

The Distinction Between Quality Agreement and Commercial Contract

Many disputes arise because sponsors treat the Quality Agreement as a secondary document appended to a commercial Master Services Agreement (MSA). In practice, regulatory inspectors review the Quality Agreement first. If the Quality Agreement states that the CDMO is responsible for “batch release,” but the MSA indemnifies the CDMO for all quality defects, a fatal contradiction exists.

Practical Implementation: The Quality Agreement must be a standalone, living document. It should not merely reference “compliance with GMP”; it must specify which version of EU GMP applies (e.g., Annex 1 for sterile products) and who is responsible for specific Annex requirements, such as Annex 11 (Computerised Systems) or Annex 15 (Qualification and Validation).

Scope Definition and “GxP” Ambiguity

Disputes frequently occur when a CRO performing early-phase research (GCP/GLP) transitions a process to a CDMO for GMP manufacturing. If the contract does not explicitly define the “state” of the material or data transferred, the receiving party may reject the data, claiming it does not meet GMP data integrity standards (ALCOA+).

Regulatory Note: Under EU GMP, data generated during development must be audited and verified to ensure it is suitable for inclusion in the Marketing Authorization Dossier (Module 3). If the contract does not mandate that the CRO maintains audit trails equivalent to GMP, the sponsor faces delays in regulatory submission.

Pattern 2: Audit Rights and Access Restrictions

The right to audit is a non-negotiable regulatory requirement. However, a common dispute pattern involves CROs/CDMOs restricting audit access to “once per year” or limiting the scope to specific areas, citing commercial disruption or confidentiality concerns with other clients.

Regulatory Obligation vs. Contractual Limitation

EU regulations mandate that the legal manufacturer must conduct regular audits of their suppliers. The frequency and depth depend on the risk associated with the activity. A contract that limits audits to a fixed schedule may comply with commercial norms but fail regulatory standards if a critical deviation occurs.

Comparative Insight: While the regulatory baseline is EU-wide, enforcement intensity varies. Germany (BfArM) inspectors are known for rigorous scrutiny of supplier qualification programs. In contrast, authorities in some Southern European jurisdictions might focus more on the final product testing rather than the supply chain audit trail. However, relying on this variance is risky, as the Centralized Procedure requires compliance with the highest standard.

Unannounced Inspections and “Right to Enter”

Disputes often escalate when a sponsor demands an unannounced inspection following a whistleblower report or a data integrity concern. CDMOs frequently refuse, citing the General Data Protection Regulation (GDPR) or the need to protect other clients’ intellectual property.

Contractual Solution: The contract must explicitly override these objections for regulatory compliance. It should state that GDPR Article 6(1)(c) (Legal Obligation) and Article 6(1)(f) (Legitimate Interest) provide the legal basis for entry. Furthermore, the agreement should detail a “clean room” procedure where the sponsor’s auditors can inspect specific equipment without viewing proprietary processes of other clients.

Pattern 3: Data Integrity and Electronic Systems

The digitization of biotech has introduced disputes regarding access to and control of electronic data. This is where the intersection of GMP and the AI Act becomes critical.

Access to Raw Data and Audit Trails

A frequent dispute involves a CDMO providing summary reports but refusing to share raw electronic data or system audit trails, claiming proprietary rights to the software used. Under Annex 11, the legal manufacturer must have access to data to verify it.

AI Act Implications: If the CDMO uses an AI-driven quality control system (a high-risk AI system), the sponsor (as the provider of the finished product) must ensure the AI system is compliant. The contract must grant the sponsor the right to review the AI system’s training data, risk management file, and post-market monitoring logs. Without this clause, the sponsor cannot fulfill their obligations under the AI Act.

Cloud Infrastructure and Data Sovereignty

Many CROs utilize US-based cloud providers for data storage. This creates a conflict with EU data sovereignty requirements. Disputes arise when a sponsor requires data to be hosted exclusively within the EU (e.g., on AWS Frankfurt) to comply with GDPR and EMA expectations regarding cross-border transfers of personal data in clinical trials.

Contractual Solution: The Data Processing Agreement (DPA) must be embedded within the service contract. It must specify the Standard Contractual Clauses (SCCs) for data transfers outside the EEA and explicitly define the “Controller-Processor” relationship. In the context of the AI Act, if the CDMO is providing an AI system, they may be considered a “Deployer,” and the sponsor needs assurance that the Deployer has performed a Fundamental Rights Impact Assessment (FRIA).

Pattern 4: Deviation Handling and Change Control

Operational deviations—unexpected events that affect product quality—are inevitable. The dispute usually centers on who has the authority to approve the deviation and whether it impacts the regulatory filing.

The “Change Control” Bottleneck

CDMOs often prefer to implement process improvements (e.g., changing a reagent supplier) without rigorous change control, arguing it improves efficiency. However, for a biotech sponsor, any change to the manufacturing process or critical materials can invalidate stability data or require a variation submission to the EMA or NCAs.

Regulatory Context: Under Directive 2001/83/EC, changes to the manufacturing process or specifications generally require approval via a “Type II Variation” or “Major Change,” which can take months to approve. If a CDMO implements such a change without authorization, the sponsor may be forced to halt distribution until the variation is approved.

Deviation Classification and Notification Timelines

Disputes often arise over the definition of “Critical Deviation.” A CDMO might classify an environmental excursion as “Major” rather than “Critical,” delaying notification. The sponsor, however, may view it as a Critical Quality Attribute (CQA) failure.

Contractual Solution: The Quality Agreement must include a precise matrix defining deviation classifications and mandatory notification timelines (e.g., “Critical deviations must be notified within 24 hours”). This must be a contractual service level agreement (SLA), not just a procedural guideline. Failure to meet the timeline should trigger a breach of contract, allowing the sponsor to take immediate remedial action.

Pattern 5: Liability, Indemnification, and Insurance

When a compliance failure leads to a product recall or regulatory fine, the financial fallout can be substantial. Disputes often center on the interpretation of “gross negligence” and the limits of liability.

The “Indemnity Gap”

Commercial contracts often cap liability at the total value of the fees paid. However, a single product recall can cost millions of euros, far exceeding the contract value. If the CDMO’s error caused the recall, the sponsor will seek full indemnification. The CDMO will argue that the sponsor is the legal manufacturer and thus liable to the public/regulator.

Legal Analysis: While the sponsor is liable to the regulator, the contract must clearly state that the CDMO indemnifies the sponsor for losses caused by the CDMO’s breach of GMP. The contract must explicitly waive the “cap on liability” for breaches of regulatory compliance, data integrity, or gross negligence.

Insurance Requirements

Disputes frequently occur regarding the adequacy of insurance coverage. A CDMO may hold general liability insurance that excludes “product recall” or “regulatory fines.”

Contractual Solution: The contract must mandate specific insurance types: Product Liability Insurance (covering bodily injury and property damage) and Recall Insurance (covering the costs of retrieving the product). The sponsor should be named as an additional insured. Furthermore, for AI-enabled manufacturing, specific cyber-liability insurance is advisable to cover risks associated with algorithmic errors or data breaches.

Specifics for AI and Robotics in Biotech

As biotech integrates robotics and machine learning, standard GMP contracts become insufficient. The AI Act introduces new obligations that must be reflected in the contract between the sponsor and the CRO/CDMO.

Quality Management Systems for AI (QMS-AI)

The AI Act requires a risk management system for high-risk AI systems. If a CDMO uses an AI robot for aseptic filling, the CDMO is effectively a “Provider” of that AI system to the sponsor. The contract must require the CDMO to maintain a QMS that complies with the AI Act, including:

• Conformity assessments.
• Technical documentation (design specifications, capabilities, limitations).
• Logging capabilities (the “black box” functionality).

Human Oversight and “Meaningful Information”

Disputes may arise if an AI system causes a batch failure, and the CDMO claims the operator failed to intervene. The AI Act mandates that high-risk AI systems be designed to allow for human oversight. The contract must define the training requirements for the CDMO’s operators to ensure they understand the AI’s logic and limitations. If the CDMO cannot prove their staff was trained to the standard required by the AI Act, they are in breach of the service agreement.

Dispute Resolution: Governing Law and Jurisdiction

When disputes cannot be resolved operationally, the legal venue matters. European biotech contracts often involve parties from different Member States.

Brussels I Regulation and Forum Selection

For civil and commercial matters, the Brussels I Regulation (Recast) governs jurisdiction. Parties are generally free to choose a forum (court or arbitration). However, in regulatory disputes, speed is essential. If a CDMO in France is producing defective batches for a sponsor in Sweden, the sponsor needs a quick injunction to stop production.

Comparative Approach:

• Arbitration: Often preferred for confidentiality. However, interim measures (injunctions) can be slower in arbitration unless the rules specifically provide for emergency arbitrators.
• Courts: National courts can issue rapid injunctions. Choosing the courts of the sponsor’s domicile is often advantageous for enforcing compliance.

Enforcement of Judgments Across Borders

Even with a favorable judgment, enforcing it against a CDMO in another Member State is streamlined under the Regulation (EU) No 1215/2012, which abolished the need for a declaration of enforceability (exequatur). However, if the dispute involves a non-EU CDMO (e.g., a Swiss or UK-based entity), enforcement becomes significantly more complex. Sponsors should carefully consider whether to subject their EU operations to non-EU jurisdiction, as it may complicate interactions with EMA or NCAs.

Practical Checklist for Contract Structuring

To mitigate the disputes outlined above, the following structural elements should be integrated into the contract and Quality Agreement:

1. Definition of Deliverables and Acceptance Criteria

Move beyond “best efforts.” Define acceptance criteria for data, materials, and processes based on regulatory requirements (e.g., “Data must be ALCOA+ compliant”).

2. Audit and Inspection Rights

Include a clause that explicitly grants the right to conduct unannounced audits and to observe regulatory inspections (including EMA and FDA inspections) conducted at the CRO/CDMO site.

3. Change Control and Deviation Matrix

Attach a matrix to the Quality Agreement that classifies deviations and changes (Critical, Major, Minor) and sets strict notification windows (e.g., 24/48/72 hours).

4. Data Ownership and Access

Explicitly state that the sponsor owns all data (including raw data and metadata). Ensure the contract guarantees the return or destruction of data upon termination, compliant with GDPR.

5. Liability and Insurance

Carve out regulatory fines and recall costs from liability caps. Require specific insurance certificates and the right to review policy terms.

6. AI and Automation Specifics

For automated processes, require the CDMO to provide technical documentation proving compliance with the AI Act (if applicable) and to maintain logs of automated decisions.

Conclusion: The Contract as a Compliance Tool

Disputes with CROs and CDMOs are rarely resolved by pointing to a single clause. They are resolved by the clarity of the governance structure established at the outset. In the European regulatory landscape, the contract is not just a shield against commercial loss; it is the primary tool through which the legal manufacturer exercises control over their supply chain. By aligning the contract’s technical and legal terms with the rigorous demands of EU GMP, the AI Act, and national enforcement practices, sponsors can transform potential disputes into structured, compliant operational workflows.