21 CFR Part 211 sets the Current Good Manufacturing Practice (cGMP) requirements that any company making, processing, packing, or holding a finished human or animal drug for the U.S. market must meet. The rules are enforced by the FDA under the Federal Food, Drug, and Cosmetic Act, and a drug produced outside them is legally adulterated even if the product itself tests fine.1Office of the Law Revision Counsel. 21 USC 351 – Adulterated Drugs and Devices That legal fiction is what gives Part 211 its teeth: a paperwork failure or a missing signature can trigger the same enforcement consequences as a contaminated batch.
Part 211 covers finished dosage forms such as tablets, capsules, injections, and ointments, and it reaches every firm that touches the product on the way to the patient, including contract processors, packagers, labelers, and warehouses.2eCFR. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals Positron emission tomography (PET) drugs are the notable exclusion; they follow separate compounding standards. Foreign facilities that ship into the United States are held to the same cGMP standards as domestic ones, and those that fail inspection can be placed on an import alert that detains their shipments at the border until the deficiencies are corrected.3U.S. Food and Drug Administration. Detention Without Physical Examination of Drugs From Firms Which Have Not Met Drug GMPs
The Quality Control Unit Holds Final Authority
Every facility covered by Part 211 must have a quality control unit (QCU) that operates independently of production. The QCU holds the authority to approve or reject every raw ingredient, packaging material, label, and finished drug product, and no batch ships without its sign-off.4eCFR. 21 CFR 211.22 – Responsibilities of Quality Control Unit After each batch, the QCU reviews production records to confirm no errors occurred, and where errors did occur, it must confirm they were fully investigated before release.
The separation between production and quality control is deliberate. The people running the line have an incentive to keep it running; the QCU exists specifically to stop it when something is wrong.
Personnel and Hygiene
Everyone involved in making, processing, packing, or holding a drug must have the education, training, and experience appropriate to the work, and training must be ongoing rather than a one-time orientation.5eCFR. 21 CFR 211.25 – Personnel Qualifications Facilities also need enough qualified staff to handle the workload without cutting corners.
Workers must wear clean clothing suited to their duties, along with head coverings, gloves, and gowns where contamination is a risk. Anyone with a visible illness or open wound stays away from direct contact with ingredients or products until cleared by medical personnel, and only authorized individuals may enter limited-access areas.6eCFR. 21 CFR 211.28 – Personnel Responsibilities Outside consultants advising on manufacturing, processing, or holding must also be qualified, and the facility must keep records of each consultant’s name, address, qualifications, and services provided.7eCFR. 21 CFR 211.34 – Consultants
Buildings, Sanitation, and Equipment
The physical space must be large enough and properly constructed for thorough cleaning and orderly operations. Layout matters: materials must flow through the building in a way that prevents mix-ups between different products and avoids contamination at each stage.8eCFR. 21 CFR 211.42 – Design and Construction Features
Sterile operations carry stricter requirements. Aseptic processing areas need smooth, hard, easily cleanable surfaces on floors, walls, and ceilings, HEPA-filtered air under positive pressure, environmental monitoring, and decontamination systems. Penicillin manufacturing must occur in a facility completely separate from other human drug production to prevent cross-contamination.
Buildings must be kept free of rodents, insects, birds, and other pests. Written sanitation procedures cover cleaning schedules, methods, equipment, and materials, and even rodenticides and insecticides follow written procedures designed to keep those chemicals away from drug products.9eCFR. 21 CFR 211.56 – Sanitation The sanitation rules apply to contractors and temporary workers, not just full-time employees.
Equipment
Equipment surfaces that contact drug ingredients or products must be made from materials that will not react with, add to, or absorb the drug in ways that change its safety, strength, or purity. Written cleaning and maintenance procedures must cover every piece of equipment, and all previous batch identification must be removed before the next product runs.10eCFR. 21 CFR 211.67 – Equipment Cleaning and Maintenance Equipment must be inspected for cleanliness immediately before each production run.
Automated, mechanical, electronic, and computer systems are permitted throughout manufacturing, but they carry their own compliance obligations. Such equipment must be routinely calibrated, inspected, or checked under a written program, with records kept of each check.11eCFR. 21 CFR 211.68 – Automatic, Mechanical, and Electronic Equipment Computer systems need access controls so only authorized personnel can change master production records, all inputs and outputs must be verified for accuracy, and a backup of all data must be maintained in a form secure from alteration or accidental deletion. When properly validated automated equipment performs a step that normally requires one person to execute and another to verify, the automation can satisfy both roles if one person confirms the equipment performed correctly.
Components, Containers, and Closures
Nothing enters production without QCU release. Every incoming ingredient, container, and closure must be quarantined, sampled, tested, and released before use. Sample sizes and the amount of material tested must be based on statistical criteria that account for variability, confidence levels, and the supplier’s track record.12eCFR. 21 CFR 211.84 – Testing and Approval or Rejection of Components, Drug Product Containers, and Closures
Each lot must undergo at least one identity test, and each component must be tested for purity, strength, and quality against written specifications. A manufacturer may accept a supplier’s certificate of analysis in place of running the full battery itself, but only if it still performs its own identity test and periodically validates the supplier’s results.
Production and Process Controls
Manufacturing follows written procedures drafted by qualified personnel and approved by the QCU. These are binding, not guidance; any deviation must be recorded and justified in writing.13eCFR. 21 CFR 211.100 – Written Procedures and Deviations
Actual yield must be calculated and compared to theoretical yield at each appropriate phase of production. That calculation must be done by one person and independently verified by a second, or handled by validated automated equipment with one person confirming the result.14eCFR. 21 CFR 211.103 – Calculation of Yield A yield outside established limits signals that material was lost, an ingredient was dosed wrong, or product ended up where it should not be, each with direct safety implications.
In-process testing is governed by written procedures at each stage, with specifications consistent with final product specifications and, where possible, derived from historical process data using sound statistical methods.15eCFR. 21 CFR 211.110 – Sampling and Testing of In-Process Materials and Drug Products Rejected in-process materials go into quarantine. Drugs not required to be sterile still need written procedures to prevent objectionable microorganisms; drugs that must be sterile require validated aseptic and sterilization processes.16eCFR. 21 CFR 211.113 – Control of Microbiological Contamination
Reprocessing a failed batch is allowed only under tightly controlled conditions. Written reprocessing procedures must already exist before the need arises, must spell out the steps needed to bring the batch into compliance, and must be reviewed and approved by the QCU before work begins.17eCFR. 21 CFR 211.115 – Reprocessing
Packaging, Labeling, and Expiration Dating
Labeling errors drive a disproportionate share of drug recalls, and Part 211 treats label control as a high-risk area. Written procedures must govern how labels are received, identified, stored, sampled, examined, and released, and labels must be stored securely with access limited to authorized personnel.18eCFR. 21 CFR 211.122 – Materials Examination and Usage Criteria
When cut labels are used on immediate containers, the manufacturer must employ at least one special control: dedicating packaging lines to a single product strength, using electronic equipment for 100-percent label verification, conducting visual inspection by one person with independent verification by a second, or using automated technology that physically prevents the wrong label from being applied. Before a new batch begins on any packaging line, the area must be cleared of all materials from the previous run and documented as clean.
Over-the-counter drugs sold at retail must use tamper-evident packaging that provides visible evidence of interference. The packaging must include at least one indicator or barrier to entry and must be distinctive by design or carry an identifying characteristic like a logo, trademark, or pattern that cannot be easily duplicated. Two-piece hard gelatin capsules must be sealed with an accepted tamper-evident technology.19eCFR. 21 CFR 211.132 – Tamper-Evident Packaging Requirements for OTC Human Drug Products Dermatological products, dentifrices, insulin, and lozenges are exempt. An OTC drug that does not meet these packaging standards is considered adulterated, misbranded, or both.
Every drug product must bear an expiration date determined through appropriate stability testing. The date must correspond to any storage conditions stated on the label; if the label reads “store below 25°C,” the stability data must support that the drug stays within specifications under those conditions through the labeled expiration.20eCFR. 21 CFR 211.137 – Expiration Dating
Laboratory Controls and Stability Testing
Specifications, standards, sampling plans, and test procedures must all be written by qualified technical staff and approved by the QCU. Any deviation from written laboratory procedures must be recorded and justified, and every testing method, automated or manual, must be validated to confirm it produces accurate and reproducible results.21eCFR. 21 CFR 211.160 – General Requirements
Each manufacturer must maintain a written stability program to assess the stability characteristics of its drug products, with sample sizes and test intervals based on statistical criteria. Results feed directly into storage conditions and expiration dates.22eCFR. 21 CFR 211.166 – Stability Testing For generic drug applications, manufacturers typically submit six months of accelerated stability data alongside six months of long-term data; if accelerated data show a significant change or failure, intermediate stability data and a failure analysis are also required.23Food and Drug Administration. ANDAs: Stability Testing of Drug Substances and Products Questions and Answers
Records and Batch Release
Part 211 requires a paper trail, or a validated electronic equivalent, for every batch. Batch production and control records must document the dates of each significant step, the identity of major equipment used, the specific identification of each component lot, actual weights and measures, in-process and lab results, packaging area inspection records, actual yield calculations, complete labeling records, and the identity of the personnel who performed or supervised each step.
Before release for distribution, the QCU must review every production and control record, including packaging and labeling records, to confirm compliance with all written procedures. Any unexplained discrepancy or specification failure triggers a mandatory investigation, and that investigation must extend beyond the single batch to cover other batches of the same drug and any other products that may share the failure.24eCFR. 21 CFR 211.192 – Production Record Review The requirement applies even if the batch has already shipped, which means a late-discovered discrepancy can force a manufacturer to trace and potentially recall product already on pharmacy shelves.
All production, control, and distribution records tied to a specific batch must be kept for at least one year after the batch’s expiration date. For OTC drugs that qualify for an exemption from expiration dating, the retention period is three years after distribution. Records for components, containers, closures, and labeling follow the same schedule.25eCFR. 21 CFR 211.180 – General Requirements
What Happens When the FDA Finds Problems
FDA enforcement escalates in stages, and understanding the sequence tells a manufacturer what is at stake at each step.
Form 483
At the end of a facility inspection, if investigators observe conditions that may violate the FD&C Act, they issue an FDA Form 483 listing those observations. The Form 483 is not a final determination that a violation occurred; it is a notification to the company’s management of objectionable conditions.26Food and Drug Administration. FDA Form 483 Frequently Asked Questions Companies are encouraged to respond in writing with a corrective action plan and to implement it quickly. The FDA then weighs the Form 483, the full inspection report, all collected evidence, and the company’s response before deciding on further action.
Warning Letters
If violations are serious enough, the FDA may issue a warning letter. Recipients typically must respond within fifteen working days with a corrective action plan. The letter can affect a company’s ability to win federal contracts, and where cGMP violations are cited, it can delay or block approval of new drug applications and export certificates. Inadequate response can lead to formal enforcement without further notice.
Seizure, Injunction, and Criminal Penalties
Introducing an adulterated or misbranded drug into interstate commerce is a prohibited act under federal law.27Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts Because a drug made in violation of cGMP is adulterated by definition, the FDA can seize product, seek court injunctions to halt manufacturing, or pursue criminal charges.
The statutory penalty structure escalates with the nature of the conduct:
- First offense: up to one year of imprisonment, a fine of up to $1,000, or both.
- Repeat offense or intent to defraud or mislead: up to three years of imprisonment, a fine of up to $10,000, or both.28Office of the Law Revision Counsel. 21 USC 333 – Penalties
- Intentional adulteration with a reasonable probability of causing serious harm or death: up to 20 years of imprisonment, a fine of up to $1,000,000, or both.
For felony convictions, the general federal sentencing statute allows fines up to $250,000 for individuals and $500,000 for organizations where those amounts exceed the figures in the underlying statute.29Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine Foreign manufacturers that fail cGMP requirements face import alerts that effectively block their products from entering the United States until they demonstrate to FDA investigators that the problems have been corrected.3U.S. Food and Drug Administration. Detention Without Physical Examination of Drugs From Firms Which Have Not Met Drug GMPs