21 CFR Part 211: cGMP Compliance, Inspections, and Penalties

21 CFR Part 211 is the Food and Drug Administration’s set of current good manufacturing practice (cGMP) rules for finished pharmaceuticals sold in the United States. It governs how drugs are made, tested, packaged, labeled, stored, and documented, and it applies to every company that produces a finished human or animal drug product, whether the plant sits in New Jersey or overseas. A drug made outside these standards is legally “adulterated” under federal law, even if the pill itself tests within specification, because the process that produced it was not controlled enough to guarantee safety batch after batch.¹

Who Has to Follow Part 211

Part 211 reaches any company involved in making, processing, packaging, or holding a finished drug product for humans or animals. Large pharmaceutical manufacturers, contract manufacturers producing on behalf of other firms, and third-party packagers are all covered. The rules apply to finished dosage forms — tablets, capsules, injectables, and similar patient-ready products — rather than to bulk active ingredients, which fall under separate FDA guidance.²

Two categories sit outside Part 211. Positron emission tomography (PET) drugs and medical gases have their own regulatory frameworks and are explicitly excluded.² Outsourcing facilities registered under Section 503B of the Federal Food, Drug, and Cosmetic Act are subject to cGMP requirements when they compound drugs without individual prescriptions, though the FDA scales its expectations based on each facility’s size and scope.³

Foreign manufacturers get no geographic exemption. Anyone shipping a finished drug into the United States must meet the same cGMP standards as a domestic plant. The FDA inspects overseas facilities, and product from sites that refuse inspection or fail to meet the standard can be blocked at the border.

Why Noncompliance Makes a Drug “Adulterated”

The teeth in Part 211 come from the definition of an adulterated drug at 21 U.S.C. § 351. If the methods, facilities, or controls used in manufacturing do not conform to cGMP, the drug is adulterated as a matter of law — the FDA does not need to find an actual defect in the pill.¹ Introducing an adulterated drug into commerce is a prohibited act under the FD&C Act, which is what opens the door to seizure, injunctions, and criminal prosecution.

The “current” in cGMP is doing real work. The FDA expects manufacturers to keep pace with evolving science and technology, so what qualified as adequate process control years ago may not meet the bar today. Part 211 sets the floor, and the agency interprets that floor in light of what modern manufacturing can reasonably achieve.⁴

Quality Control Unit and Personnel

Every facility subject to Part 211 must have a quality control unit with authority to approve or reject raw materials, packaging components, in-process materials, and finished drugs.⁵ The unit operates independently from production; the people checking the work cannot be the people doing it. They review production records, oversee laboratory testing, and investigate any batch that deviates from specifications, and no batch leaves without their sign-off.

Staff at every level must have the education, training, and experience their job requires. Machine operators need demonstrated competency on that equipment; lab analysts need verified skills in the test methods they run. Training must be documented, and most manufacturers refresh it at least annually. Outside consultants brought in for manufacturing or quality advice are held to the same competency standard, and the firm must keep records of each consultant’s name, address, qualifications, and the type of service provided.⁶

Hygiene rules keep people from becoming a contamination source. Employees wear protective clothing appropriate to the task, and anyone with a visible illness or open wound that could affect a drug product is kept away from direct contact with components or finished products.

Facilities and Equipment

Subparts C and D address the physical environment. Buildings must have enough space to keep equipment and materials organized, with a layout that minimizes the chance of mixing up different products or batches.⁷ In practice, that means careful traffic flow for personnel and materials, dedicated areas for different manufacturing stages, and physical separation where cross-contamination is a real risk.

Environmental controls go well beyond housekeeping. Areas where drugs are exposed to the air require specialized ventilation and filtration. Plumbing must prevent backflow, water used in production must meet defined purity standards, and even lighting and waste systems face scrutiny because any of them can introduce contaminants.

Equipment must be made of materials that will not react with or absorb the drug product, and surfaces touching drug components have to be easy to clean and sanitize between batches.⁸ The FDA does not impose a universal residue limit; each manufacturer sets its own scientifically justified acceptance limits and must be prepared to defend them during an inspection.

Computerized Systems

Automated and electronic equipment, including computers that control manufacturing processes, must be routinely calibrated and inspected under a written program. Access controls have to limit master production records and laboratory data to authorized users, and backup copies must be maintained in a secure format that prevents alteration or accidental loss.⁹ Where automated equipment performs a step that would otherwise require one person to do the work and a second to verify it, the equipment can satisfy both roles if it has been properly validated and someone confirms it performed correctly.

Production and Process Controls

Subpart F requires manufacturers to write down their production procedures and follow them. Every drug product must be made according to documented steps designed to ensure the finished product has the identity, strength, quality, and purity it is supposed to have, and each significant step must be performed by one person and independently verified by a second person or by validated automated equipment.¹⁰

Deviations happen. A temperature drifts, a mixing time runs long, a raw material arrives out of spec. When they do, the deviation must be documented and formally investigated. The quality control unit reviews the situation, determines the root cause, and decides whether the batch can be released or must be rejected. Superficial deviation investigations are one of the most common findings on FDA inspection reports.

Yield calculations at each manufacturing phase serve as a mathematical check on the process. Starting with 100 kilograms and ending significantly short means something went wrong — material was lost, a mix-up occurred, or the equipment malfunctioned — and the discrepancy has to be investigated before the batch moves forward.

Preventing Cross-Contamination

When multiple products share a facility, cleaning validation becomes critical. Manufacturers must prove their cleaning methods remove all traces of a previous product from shared equipment before the next one goes into production. For highly potent or allergenic substances such as penicillin, dedicated equipment or entirely separate production areas are often necessary, because even trace amounts can harm a sensitive patient.

In-process testing lets manufacturers monitor critical characteristics during production rather than waiting for the end. Checking weight variation, dissolution rates, or potency during manufacturing catches problems while they can still be corrected.

Packaging, Labeling, and Tamper-Evident Requirements

Labeling errors are one of the most frequent causes of drug recalls, and Part 211 attacks the problem through physical separation and verification at every step. Different labeling operations must be kept apart from each other, and labeling materials are inspected on receipt to confirm they match the approved master labels.¹¹

Over-the-counter drug products sold at retail must use tamper-evident packaging that shows visible evidence if someone has opened or interfered with the product. The packaging must include design features that are difficult to replicate with commonly available materials, and each package must carry a statement identifying the tamper-evident feature so consumers know what to look for. Dermatological products, toothpastes, insulin, and lozenges are exempt. Two-piece hard gelatin capsules face an additional requirement: they must be sealed using an accepted tamper-evident technology in addition to whatever external packaging is used.¹²

Before any batch is released for distribution, the finished product is tested for conformance to all specifications — correct amount of active ingredient, absence of harmful contaminants, and proper dissolution characteristics. Only after the quality control unit reviews and approves those results can the batch ship.

Stability Testing and Expiration Dating

Every drug product needs an expiration date, and that date has to be backed by data. Part 211 requires a written stability testing program that evaluates how a drug holds up over time under defined storage conditions. The program must include statistically justified sample sizes and test intervals, testing in the same container and closure system the product will actually be sold in, and reliable test methods specific to each characteristic being measured.¹³

Accelerated stability studies, which expose the drug to elevated temperature and humidity, can support a tentative expiration date while longer-term studies run. That tentative date must eventually be confirmed or adjusted based on real-time shelf-life data. A drug product for reconstitution, such as a powder mixed with water before use, must be tested both in its original form and after reconstitution.¹³

Records, Documentation, and Data Integrity

Subpart J is the record-keeping backbone that makes everything else in Part 211 enforceable. Without documentation there is no way to prove a process was followed, no way to trace a problem to its source, and no way for the FDA to verify compliance.

Records You Have to Keep

Master production and control records are the blueprint for every product: ingredients, quantities, equipment, and each step in the process. Batch production records document the specific history of each lot — who did what, when, with what materials, and what the results were. Every entry is signed and dated by the person who performed the work and by the person who verified it. Distribution records track where each lot went after it left the facility, capturing the recipient’s name and address, shipment date, and lot numbers. That traceability is what makes rapid recalls possible.

How Long to Keep Them

Batch-specific records must be kept for at least one year after the expiration date of that batch. For certain OTC products that qualify for an exemption from expiration dating under § 211.137, the retention period is three years after distribution of the batch.¹⁴ Complaint records follow the same timeline: retained for one year past expiration or one year after the complaint was received, whichever is longer.¹⁵

Data Integrity

The FDA evaluates manufacturing records against what it calls the ALCOA principles: data must be attributable to the person who created it, legible, recorded contemporaneously with the activity, preserved as an original or verified true copy, and accurate. The agency has expanded these into “ALCOA+” to include expectations that records are also complete, consistent, enduring, and available.¹⁶

Data integrity has become one of the FDA’s most frequent inspection findings. Common problems include backdating entries, deleting failed test results without documented justification, sharing login credentials so individual actions cannot be traced, and failing to maintain audit trails that record who changed what and when. The FDA expects any process generating cGMP data to be designed so records cannot be altered without a documented trail of the modification.¹⁶ All records must be available for FDA inspection at any reasonable time; refusing access or providing falsified information can lead to criminal prosecution on top of the regulatory consequences.

Complaints and Annual Product Reviews

Manufacturers must have written procedures for handling every complaint they receive about a drug product, whether it comes in by phone or in writing. Each complaint generates a written record covering the product name, strength, lot number, the complainant’s identity, the nature of the complaint, and the response given. The quality control unit reviews any complaint involving a possible failure to meet specifications and decides whether a formal investigation is needed.¹⁵

If a complaint suggests a serious and unexpected adverse reaction, the manufacturer has to determine whether it triggers a reporting obligation to the FDA. When an investigation is conducted, the findings and follow-up must be documented. When no investigation is conducted, the record must explain why and identify the person who made that decision.¹⁵

At least once a year, manufacturers must evaluate the quality standards for each drug product they make. The annual product review examines a representative sample of batches, both approved and rejected, along with complaints, recalls, returned products, and any investigations conducted during the review period. The point is to spot trends individual batch records might not reveal, such as a slow drift in potency, a recurring complaint, or a pattern of deviations that suggests a deeper process problem.¹⁷

How the FDA Inspects and Enforces

The FDA uses a risk-based model to decide which facilities get inspected and how often. Being selected does not necessarily mean the agency suspects a problem; surveillance inspections are routine. For-cause inspections happen when specific information, such as a consumer complaint or an adverse event report, warrants a closer look.¹⁸

When an inspector finds cGMP deficiencies, the observations are documented on FDA Form 483 and presented to the facility’s management at the close of the inspection. A manufacturer is not legally required to respond, but failing to respond, or responding inadequately, dramatically increases the chance the agency will escalate. The FDA recommends submitting a written response within 15 business days of the Form 483 being issued; responses received after that window may not be considered in the agency’s decision about next steps.¹⁹

The typical escalation runs from Form 483 observations to a Warning Letter, which carries its own 15-business-day response deadline that is treated as firm. From there, unresolved problems can lead to product seizure, an injunction, or a consent decree. Consent decrees are the most severe outcome short of criminal prosecution; they are court-supervised agreements that typically force a manufacturer to halt production, hire independent experts, and demonstrate compliance before resuming any manufacturing.

Penalties for cGMP Violations

Because a cGMP violation renders a drug adulterated, introducing that drug into commerce is a prohibited act under the FD&C Act, and criminal penalties follow.¹ A first offense is a misdemeanor carrying up to one year in prison, a fine of up to $1,000, or both, and no intent to defraud is required. A repeat offense, or one committed with intent to defraud or mislead, carries up to three years in prison and fines up to $10,000 per violation.²⁰

Beyond fines and imprisonment, the FDA can seize adulterated products and seek court injunctions that shut down manufacturing operations entirely. Separate civil penalty schemes exist for other kinds of drug law violations, but the core cGMP exposure runs through the adulteration/prohibited-act pathway.

Drug Recall Classifications

When a drug product that violates cGMP or otherwise poses a risk reaches the market, the FDA classifies the resulting recall based on the severity of the health hazard.

Class I is the most serious. A reasonable probability exists that using the recalled drug will cause serious health consequences or death. These recalls are urgent and usually extend to the consumer level, meaning products are pulled from pharmacy shelves.²¹
Class II covers drugs that may cause temporary health problems, with a remote chance of a serious outcome. These recalls are typically conducted at the retail level, and patients can generally continue using the medication unless the manufacturer or FDA says otherwise.²¹
Class III covers products unlikely to cause health problems, often involving minor labeling errors, packaging defects, or incorrect expiration dates. The recall usually stops at the wholesale level.²¹

The distribution records required under Subpart J are what make any of this operationally possible. Without lot-level traceability showing where each batch went, a manufacturer cannot identify which pharmacies, hospitals, or distributors received a problem product, and the response becomes a slow scramble through incomplete files instead of a targeted recall.

1
Office of the Law Revision Counsel. 21 U.S. Code 351 – Adulterated Drugs
2
eCFR. 21 CFR 211.1 – Scope
3
U.S. Food and Drug Administration. Current Good Manufacturing Practice – Guidance for Human Drug Compounding Outsourcing Facilities Under Section 503B of the FD&C Act
4
U.S. Food and Drug Administration. Current Good Manufacturing Practice (CGMP) Regulations
5
eCFR. 21 CFR Part 211 Subpart B – Organization and Personnel
6
eCFR. 21 CFR 211.34 – Consultants
7
eCFR. 21 CFR Part 211 Subpart C – Buildings and Facilities
8
eCFR. 21 CFR Part 211 Subpart D – Equipment
9
eCFR. 21 CFR 211.68 – Automatic, Mechanical, and Electronic Equipment
10
eCFR. 21 CFR Part 211 Subpart F – Production and Process Controls
11
eCFR. 21 CFR Part 211 Subpart G – Packaging and Labeling Control
12
eCFR. 21 CFR 211.132 – Tamper-Evident Packaging Requirements for Over-the-Counter (OTC) Human Drug Products
13
eCFR. 21 CFR 211.166 – Stability Testing and Expiration Dating
14
eCFR. 21 CFR Part 211 Subpart J – Records and Reports
15
eCFR. 21 CFR 211.198 – Complaint Files
16
U.S. Food and Drug Administration. Data Integrity and Compliance With Drug CGMP – Guidance for Industry
17
eCFR. 21 CFR 211.180 – General Requirements
18
U.S. Food and Drug Administration. Pharmaceutical Inspections and Compliance
19
U.S. Food and Drug Administration. Responding to FDA Form 483 Observations at the Conclusion of a Drug CGMP Inspection – Guidance for Industry
20
Office of the Law Revision Counsel. 21 U.S. Code 333 – Penalties
21
U.S. Food and Drug Administration. Understanding Drug Recalls – What to Know and What to Do