21 CFR Parts 210 and 211 are the FDA’s minimum current good manufacturing practice (CGMP) rules for finished human drug products, and they govern nearly every physical and procedural aspect of pharmaceutical production: building design, equipment, personnel, raw materials, production controls, packaging, laboratory testing, recordkeeping, and complaint handling. Any drug made outside these standards is legally “adulterated” under Section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, even if lab testing shows the drug itself is fine.1Office of the Law Revision Counsel. 21 USC 351 – Adulterated Drugs and Devices That classification is what gives the FDA authority to seize product, halt operations, and prosecute responsible individuals without having to prove that anyone was harmed.
How Parts 210 and 211 Fit Together
Part 210 is the framework. It states that these regulations represent the minimum CGMP for drugs and ties non-compliance directly to the adulteration statute.2eCFR. 21 CFR 210.1 Part 210 also sets scope: a firm that performs only some of the operations covered by these regulations only has to comply with the parts applicable to those operations.3eCFR. 21 CFR 210.2 A warehouse that only stores finished drugs, for example, is not held to laboratory requirements it does not perform.
Part 211 fills in the substance, organized into subparts covering organization and personnel, buildings and facilities, equipment, components, production and process controls, packaging and labeling, holding and distribution, laboratory controls, records and reports, and returned or salvaged drug products. Everything below tracks that structure.
Facilities and Equipment
Building Design
Manufacturing space must be laid out so that different components, in-process materials, and finished products cannot be mixed up or cross-contaminated, with enough room for orderly equipment placement and material flow.4eCFR. 21 CFR 211.42 Separate or clearly defined areas are required for receiving and holding components, storing rejected materials, manufacturing, packaging, quarantine before release, laboratory operations, and post-release storage.
Aseptic processing areas carry additional requirements: smooth, cleanable walls, floors, and ceilings; temperature and humidity control; HEPA-filtered air under positive pressure; and environmental monitoring and room disinfection systems.4eCFR. 21 CFR 211.42 Penicillin manufacturing must be performed in a facility entirely separate from other drug product operations.
Equipment Cleaning, Maintenance, and Automation
Equipment and utensils must be cleaned, maintained, and where appropriate sanitized or sterilized at intervals that prevent contamination. Written procedures must assign responsibility and cover schedules, methods, materials, removal of prior-batch identification, and protection of clean equipment before use.5eCFR. 21 CFR 211.67 Equipment must be inspected for cleanliness immediately before each use, with records kept.
Automated, mechanical, and electronic equipment, including computers, may be used if it is routinely calibrated and inspected under a written program with records for each check.6eCFR. 21 CFR 211.68 – Automatic, Mechanical, and Electronic Equipment Computer systems must restrict changes to master production records to authorized personnel, verify all data input and output for accuracy, and maintain backups secure from alteration or accidental erasure. This is the regulatory basis for data integrity, and it is one of the most frequently cited areas in FDA inspections.
Personnel and the Quality Control Unit
Every person involved in manufacturing must have the education, training, or experience needed for their assigned functions. Training must cover the specific operations the employee performs and CGMP as it relates to those functions, on a continuing basis and at sufficient frequency to keep employees current.7eCFR. 21 CFR 211.25 Supervisors must have the qualifications to give assurance that the drug product has the safety, identity, strength, quality, and purity it is supposed to have. Employees must wear clean clothing appropriate to their duties, and written procedures must exclude anyone with an illness or open lesion from areas where their condition could compromise product quality.
The quality control unit (QCU) is the regulatory backbone of any pharmaceutical operation. It has the authority to approve or reject all components, containers, closures, in-process materials, packaging, labeling, and finished drug products, and it reviews production records to catch and investigate errors.8eCFR. 21 CFR 211.22 – Responsibilities of Quality Control Unit It also reviews and approves all written production and control procedures before they are used and oversees drugs manufactured under contract. Its independence matters in practice: the FDA looks for evidence that the QCU actually exercises authority, not just an organizational chart that places it outside production on paper.
Component Controls
Every lot of components, containers, and closures must be quarantined upon receipt and withheld from use until the QCU samples, tests, and releases it.9eCFR. 21 CFR 211.84 – Testing and Approval or Rejection of Components, Drug Product Containers, and Closures At minimum, at least one identity test must be performed on each component, using specific identity tests where they exist, and each must be tested against written specifications for purity, strength, and quality.
A manufacturer may accept a supplier’s certificate of analysis in place of full testing, but only if it still runs at least one identity test itself and has validated the reliability of the supplier’s results at appropriate intervals. Sampling has its own detailed requirements, including sterile equipment and aseptic technique where needed, no compositing of samples taken from different levels of a container, and clear marking of any container that has been sampled.
Production and Process Controls
Written procedures for production and process control are required for every drug product, designed to ensure identity, strength, quality, and purity. They must be drafted by the appropriate organizational unit and reviewed and approved by the QCU before use, and any deviation from those procedures must be recorded and justified.10eCFR. 21 CFR 211.100 Undocumented deviations, and deviations that are documented but never investigated, are among the most common FDA findings.
A Master Production and Control Record is the definitive template for every batch of a given product. It must include the product name and strength, dosage form, weight or measure of each active ingredient per dosage unit, a complete list of components, theoretical yield with maximum and minimum percentages that trigger investigation, container and packaging descriptions with specimen labels, and complete manufacturing and control instructions.11eCFR. 21 CFR 211.186
Every batch also gets its own Batch Production and Control Record. That record must capture dates, identification of major equipment, specific identification of each component lot used, weights and measures, in-process and laboratory results, packaging area inspections before and after use, actual yield against theoretical yield, and the identity of every person who performed or supervised each significant step.12eCFR. 21 CFR 211.188 – Batch Production and Control Records Where automated equipment performs a significant step, the record must identify the person who verified that the equipment performed correctly.
Packaging and Labeling Controls
Mix-ups in packaging and labeling can put the wrong drug in a patient’s hands, so the regulations build in several safeguards. Written procedures must include physical or spatial separation from operations on other products, examination of packaging and labeling materials for correctness before each operation, and inspection of the packaging area immediately before and after use to confirm nothing from a previous run remains.13eCFR. 21 CFR 211.130
Every drug product must carry a lot or control number that permits full tracing of its manufacturing and control history. Filled containers held in an unlabeled condition for later labeling must still be identified sufficiently to determine product name, strength, quantity, and lot number. Label reconciliation is required: the quantity of labels issued for a batch is compared against quantities used, returned, and destroyed, and any significant discrepancy triggers investigation.
Laboratory Controls
General Requirements
Laboratory controls must include scientifically sound specifications, sampling plans, and test procedures to confirm that components, in-process materials, and finished drug products meet standards for identity, strength, quality, and purity. Specifications are drafted by the appropriate unit and approved by the QCU, and deviations from written laboratory procedures must be recorded and justified.14eCFR. 21 CFR 211.160 Instruments, gauges, and recording devices must be calibrated at suitable intervals under a written program that includes directions, schedules, accuracy and precision limits, and remedial action when limits are not met. Equipment that fails to meet its specifications cannot be used.
Stability Testing and Expiration Dating
Every drug product must have a written stability testing program to determine appropriate storage conditions and expiration dates. The program must use statistically-based sample sizes and test intervals, the same container-closure system used for marketing, and reliable test methods, and it must cover an adequate number of batches.15eCFR. 21 CFR 211.166 Accelerated studies can support a tentative expiration date, but long-term data must ultimately confirm or adjust it. The label must bear an expiration date consistent with the storage conditions stated on the labeling, and products requiring reconstitution must carry expiration information for both forms.16eCFR. 21 CFR 211.137 Homeopathic products and certain allergenic extracts are exempt.
Out-of-Specification Results
When a test result falls outside established specifications, the FDA expects a thorough investigation. The agency’s guidance on investigating out-of-specification (OOS) results applies to all test results outside specifications in drug applications, drug master files, official compendia, or manufacturer-established criteria, including in-process tests.17U.S. Food and Drug Administration. Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production The investigation begins in the laboratory to rule out analyst error, instrument malfunction, or calculation mistakes, then expands to the manufacturing process if no laboratory cause is found. Retesting until a passing result appears, without a documented scientific rationale, is exactly the kind of practice that draws enforcement attention.
Reserve Samples
A representative reserve sample must be retained from each lot or batch, stored in the same container-closure system used for marketing (or one with essentially the same characteristics) and under conditions consistent with the labeling. The sample must be at least twice the quantity needed for all required tests except sterility and pyrogen testing, and most reserve samples must be visually examined at least once a year for signs of deterioration.18eCFR. 21 CFR 211.170 Reserve samples for most drug products must be kept for one year after the product’s expiration date.
Records and Retention
Records are the proof that CGMP was actually followed. Every significant operation must be documented at the time it is performed, not reconstructed later. Batch-associated production, control, and distribution records must be kept for at least one year after the batch’s expiration date. For certain over-the-counter products exempt from expiration dating under 21 CFR 211.137, the retention period is three years after distribution.19eCFR. 21 CFR 211.180 Records for components, containers, closures, and labeling follow the same rules, measured from the expiration date of the last lot of drug product that used them. All of these records must be readily available for FDA inspection.
Complaints and Returned Products
Written procedures are required for handling all complaints, whether they arrive in writing or by phone. The QCU must review any complaint alleging a possible failure of a drug to meet its specifications and decide whether a formal investigation is warranted. When the QCU decides an investigation is not needed, the written record must include the reasoning and the name of the person who made the call — skipping that documentation is a common FDA finding. Complaints that represent serious and unexpected adverse drug experiences must also be reported to the FDA under separate adverse event reporting requirements.20eCFR. 21 CFR 211.198
Returned products must be identified and held separately. If there is any doubt about whether storage, shipping, or handling compromised the product’s safety, identity, strength, quality, or purity, the return must be destroyed unless testing proves it still meets appropriate standards.21eCFR. 21 CFR 211.204 A returned product may be reprocessed only if the resulting product meets all specifications. Return records must include the product name and potency, lot number, reason for the return, quantity, date of disposition, and ultimate fate of the product. When the reason for a return implicates other batches, a broader investigation is required.
FDA Inspections and Enforcement
The FDA inspects pharmaceutical manufacturing facilities on a risk-based schedule. At the close of an inspection, investigators issue a Form FDA-483 listing observed conditions or practices that may violate CGMP. Firms are encouraged to respond in writing within 15 days with a corrective action plan and supporting documentation.22U.S. Food and Drug Administration. Inspection Classification Database
The FDA then classifies the inspection, generally within 45 to 90 days, into one of three categories:
- No Action Indicated (NAI): the facility is in an acceptable state of compliance, and usually no Form 483 was issued.
- Voluntary Action Indicated (VAI): objectionable conditions were found, but the agency judges that the firm can correct them voluntarily.
- Official Action Indicated (OAI): the facility is in an unacceptable state of compliance, and regulatory action may follow.
An OAI classification can lead to a Warning Letter, an import alert for foreign manufacturers, or direct enforcement action. Warning Letters cite specific violations and demand correction, and they are made public. Beyond Warning Letters, the FDA can pursue product seizure, court-ordered injunctions halting manufacturing, consent decrees requiring third-party oversight before production resumes, and criminal prosecution of responsible individuals. Every one of these tools rests on the same statutory hook: a drug produced outside CGMP is adulterated under federal law, whether or not it caused harm.1Office of the Law Revision Counsel. 21 USC 351 – Adulterated Drugs and Devices
Who Has to Comply
Not every facility that prepares medications falls under Parts 210 and 211. Traditional compounding pharmacies operating under Section 503A of the Federal Food, Drug, and Cosmetic Act prepare drugs against individual patient-specific prescriptions and are regulated primarily by state boards of pharmacy under USP compounding standards; they are not required to comply with Parts 210 and 211.
Outsourcing facilities under Section 503B, created by the Drug Quality and Security Act of 2013, are a different matter. They may produce large batches of compounded medications without patient-specific prescriptions, and while they can qualify for exemptions from certain FDA approval and labeling requirements, they must comply with CGMP under Parts 210 and 211 and are inspected by the FDA on a risk-based schedule.23U.S. Food and Drug Administration. Information for Outsourcing Facilities If a facility is making finished human drugs at manufacturing scale, the presumption is that these rules apply.