EU GMP, Chapters 2 and 3
GMP visitors in production areas: what Chapter 2 says, and how you evidence it
Paragraph 2.13 of EudraLex Volume 4 Chapter 2 is three sentences long, and an MHRA inspector who asks about visitors is asking about all three: keep them out where you can, tell them in advance about hygiene and protective clothing where you cannot, and supervise them closely. This page quotes the paragraph in full, with its number and its date, says plainly that it is a should, and says what an iPad at the door records towards each sentence, including the one it cannot.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not the MHRA, a Qualified Person or a consultancy.
In Ireland or elsewhere in the EU? The installed kiosk on this page is sold in the UK. For EU sites: the same software on an iPad you already own, with the record kept in the EU, from €179 a month.
What the guideline says
Two should paragraphs about visitors, and the page that says who inspects
EudraLex Volume 4 is the EU’s GMP guideline, published chapter by chapter with the date each came into operation. Two paragraphs reach the front door: one in Personnel, one in Premises and Equipment. Both say should. GOV.UK says the MHRA inspects against GMP and lists Volume 4 among the guidance; it does not say more than that, and neither does this page.
Chapter 2, Personnel, paragraph 2.13
Visitors in production and quality control areas
Visitors or untrained personnel should, preferably, not be taken into the production and quality control areas. If this is unavoidable, they should be given information in advance, particularly about personal hygiene and the prescribed protective clothing. They should be closely supervised.
The whole paragraph, from the chapter that came into operation on 16 February 2014. Three sentences: keep them out if you can; if you cannot, tell them in advance about hygiene and protective clothing; and supervise them closely. It is a should, three times over, and the page below says what a record can show for each sentence and what it cannot.
Chapter 3, Premises and Equipment, paragraph 3.5
Preventing the entry of unauthorised people
Steps should be taken in order to prevent the entry of unauthorised people. Production, storage and quality control areas should not be used as a right of way by personnel who do not work in them.
From the chapter that came into operation on 1 March 2015. Steps is the operative word, and the guideline does not list them. Knowing who is in the building, who authorised them and where they were meant to be is the step a record supports; a locked door is the step it does not replace.
GOV.UK, GMP and GDP
Who inspects, and against what
The Medicines and Healthcare products Regulatory Agency (MHRA) carries out inspections to check if manufacturing and distribution sites comply with GMP or GDP. You will be inspected when you apply for a manufacturer or wholesaler dealer licence and then periodically based on risk assessments.
The same page lists, under guidance the MHRA and the European Medicines Agency have published, Volume 4 of the rules governing medicinal products in the EU and the Orange Guide 2022. It does not say in so many words that the UK follows EudraLex Volume 4, and this page does not claim more than GOV.UK does. Read the Orange Guide for the UK position; this page quotes the EU text because that is the free document.
Quoted from EudraLex Volume 4, Part 1, Chapter 2 (Brussels, 16 August 2013, in operation since 16 February 2014) and Chapter 3 (Brussels, 13 August 2014, in operation since 1 March 2015), and from GOV.UK’s page on GMP and GDP (updated 13 May 2024), all read on26 September 2026. Nothing in the guideline tells you to buy anything: a visitor procedure, a signed sheet at the gowning room door and a host who stays in the room satisfy 2.13. What paper struggles with is showing, during a deviation investigation a year later, exactly which information a contractor accepted before a named host took them into QC.
The record
What the kiosk holds against each sentence of 2.13, and what it does not
Each line below describes what the kiosk’s code does, not what a brochure would like it to. One of the three sentences it only half answers, and that line says so.
- Given information, and acceptedYour personal hygiene and protective clothing information for visitors, in your own wording, on the iPad at sign in. Nobody signs in without accepting it, and the record keeps who accepted which exact wording and when, fingerprinted so it can be shown after you change it.
- In advanceNot by the kiosk. It shows the information at the door, before the visitor goes further than reception, and records that it was accepted before they went in. Giving it in advance of the day, by email with the booking, is the host’s act, and the kiosk record shows only that the same information was accepted on arrival. If your interpretation of 2.13 wants a pre-visit record, that record lives with the host.
- Closely supervisedA host is required on every sign in, stored with the visit, and told by name in Microsoft Teams or Slack the moment the visitor arrives. With the badge module, the label carries a clearance level you define, a label and a colour of your own choosing, so a supervised visitor looks different from a cleared engineer on the floor. Whether the host stayed with them is not something the kiosk can see.
- Unauthorised peopleThe kiosk does not open doors, hold keys or stop anyone walking past it. It records who came through the door it sits by, who authorised them, and when they left, which is the record that shows the steps under 3.5 were taken for each visitor.
- Who was in the buildingName, company, host, a vehicle registration if given, the time in and the time out. Filter by date, by company or by host and export it as a file that opens without our software. A deviation investigation that needs to know who was in QC on a Tuesday gets a list rather than a handwriting sample.
- RetainedYou set one retention period for the company, anywhere from one day to two years, with a year the default, and records are deleted automatically when it expires. The guideline states no period for a visitor record; set yours to match how long your own procedures need to show it.
- Where it livesIn the European Union, in Ireland, on ISO 27001 certified infrastructure, under a data processing agreement supplied as standard. The security page lists every sub-processor and where each one is.
The kiosk does not make a site compliant, licensed or inspection ready. It produces a timestamped record for the paragraphs named on this page, and the inspector decides what that record is worth.
The visitor management kiosk in fullThe same screen carrying a confidentiality wording, for R&D and medical device sitesThe wholesaler’s version, GDP section 3.2: visitors should be accompaniedWhat an HSE inspector asks to see, for the other regulator at the doorContractors and RAMSOur security and sub-processors
On the day
What the inspector asks at reception, and what you put in front of them
| What you are asked | What you show them |
|---|---|
| How are visitors given information about hygiene and protective clothing before entering production areas? | The information on the kiosk, in your wording, and the record of each visitor who accepted it with the time. Anything sent in advance is the host’s record. |
| How do you know a visitor was supervised? | The host named on the visit and told at once; with the badge module, a badge whose clearance colour says the wearer is supervised. |
| Who was in the building on the day of this deviation? | A list filtered to that day, exported to a file the inspector can keep. |
| What steps prevent the entry of unauthorised people? | Your own steps under 3.5, and beside them a record of who was let in, by whom and when. The kiosk does not control doors. |
| Did the inspector sign in? | Yes, on the same kiosk, with the same information and a named host. |
Closely supervised, made visible
A badge printed only after a named approver’s PIN
The visitor signs in and waits. The host is told, walks over and enters a PIN on the kiosk. No approval, no badge. The clearance label and colour on the label are yours to define, which is how a supervised visitor is told apart from a cleared engineer on the floor.
The badge module is an add-on at £150 a month plus VAT, label printer included. The platform works without it. The player loads from YouTube only when you press play; nothing is sent to Google before that. What happens when you do.
Before you ask
The questions QA managers ask
Is paragraph 2.13 a legal requirement?
It is a should paragraph in EudraLex Volume 4 Chapter 2, which describes itself as guidance for the interpretation of the principles and guidelines of good manufacturing practice laid down in Directive 2003/94/EC. GOV.UK says the MHRA carries out inspections to check if manufacturing and distribution sites comply with GMP, and lists Volume 4 and the Orange Guide among the published guidance. Whether a should in the guideline becomes a deficiency at your site is the inspector’s judgement, and it usually turns on whether you can show what you did.
Does the UK still use EudraLex Volume 4?
GOV.UK’s page on GMP and GDP, updated 13 May 2024, lists Volume 4 of the rules governing medicinal products in the EU and the Orange Guide 2022 as guidance the MHRA and the European Medicines Agency have published, and says the MHRA inspects against GMP. It does not say in terms that the UK follows Volume 4, and this page does not say so either. The Orange Guide is the UK compilation; this page quotes the EU chapters because they are the free text with the paragraph numbers people search for.
Does 2.13 mean visitors are banned from production areas?
No. It says visitors or untrained personnel should, preferably, not be taken into the production and quality control areas, and then says what to do if this is unavoidable: give information in advance, particularly about personal hygiene and the prescribed protective clothing, and supervise them closely. Most sites read that as a rule of avoidance with a documented exception, and the exception is where a record matters.
What counts as information in advance?
The guideline does not define it. The kiosk shows your hygiene and protective clothing information at the door, before the visitor goes further than reception, and records that they accepted it before they went in. If you read in advance as before the day, the email with the booking is the host’s act and the host’s record; the kiosk then shows that the same information was accepted on arrival. Put both in your procedure and you have covered either reading.
Does the kiosk record who supervised the visitor?
It records the host: a named member of staff required on every sign in, stored with the visit and told the moment the visitor arrives. With the badge module and approval switched on, it also records the approver whose PIN released the badge. Whether the host then stayed with the visitor in the production area is something the kiosk cannot see, and your supervision procedure has to say who does.
Does the kiosk record visitor training or GMP awareness?
No. It records that a visitor accepted the information you put on the screen, with the wording and the time. It asks no questions, tests nothing and stores no answers. Training records for your own personnel under section 2.10 onwards are a different system, and the kiosk does not pretend to be one.
Being straight with you
What this does not do
- We are not the MHRA, a Qualified Person, a GMP consultancy or an inspector. This is general information about published guidance, not regulatory advice.
- Paragraphs 2.13 and 3.5 are should paragraphs in a guideline for the interpretation of GMP. What your inspector expects for your licence, and what the Orange Guide says for the UK, is yours to read; this page quotes the free EU text and GOV.UK’s description of the MHRA’s role and stops there.
- The kiosk gives the information at the door, not in advance. If in advance means before the day, that is the host’s email and the host’s record.
- It does not supervise anyone, open doors or keep anyone out of QC. It records who came in, who they came to see, what they accepted and when they left.
- Two paragraphs out of the whole of Volume 4. Your pharmaceutical quality system, your training records and your premises are still yours, and the inspector spends most of the day on them.
- If your inspector has raised a specific deficiency, bring their wording to the call and we will tell you honestly whether this closes it.
Sources
Check any of this yourself
- EudraLex Volume 4, Part 1, Chapter 2: PersonnelEuropean Commission, Brussels, 16 August 2013, in operation since 16 February 2014. Paragraph 2.13 is quoted from it in full. Read 26 September 2026.
- EudraLex Volume 4, Part 1, Chapter 3: Premises and EquipmentEuropean Commission, Brussels, 13 August 2014, in operation since 1 March 2015. Paragraph 3.5 is quoted from it in full. Read 26 September 2026.
- European Commission, EudraLex Volume 4The index of every chapter and annex with the date each came into operation, and the place to check for a revision.
- GOV.UK, Good manufacturing practice and good distribution practiceThe MHRA’s role and the guidance it lists, last updated 13 May 2024. Read 26 September 2026.
General information about published guidance, not regulatory advice. Paragraph numbers move between revisions; confirm against your own copy and the Orange Guide.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Bring your inspector’s wording to the call
Fifteen minutes on the phone. Read us the deficiency or the question on visitors, and we will tell you straight which sentence of 2.13 a kiosk record answers and which stays with your host.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case