"The dossier holder (client) is responsible for the specifications, even if the product is manufactured by a CRO. The CRO may propose or assist in developing the specifications, but the final responsibility lies with the marketing authorization holder. It is important that the client reviews and formally approves the specifications before submission."

Learn more from Dr. Patanachai “Kong” Limpikirati. by viewing his presentation “Basic regulatory science behind drug substance and drug product specifications of monoclonal antibodies and other protein therapeutics” during the Expert Forum: Setting Biopharmaceutical Specifications: Navigating Regulatory Requirements in Accordance with ICH Q6B

In addition to the previous answer: the so-called sponsor, the license-holding pharmaceutical company, has the overall responsibility for the quality of the medicine, whether it produces or releases the medicine themselves or whether (some of) it is outsourced.