Good Manufacturing Practices: FDA Inspections, Penalties, and Recalls

FDA Good Manufacturing Practices are the federal quality standards that every manufacturer of food, drugs, dietary supplements, medical devices, and cosmetics must follow when making products for the U.S. market. The rules focus on the manufacturing process itself, not just the finished product, and a facility that falls short produces goods that are legally “adulterated” under the Federal Food, Drug, and Cosmetic Act even if the product tests fine. Enforcement runs from public warning letters through seizure and injunction to criminal prosecution, with the most serious offenses carrying up to 20 years of imprisonment and fines up to $1,000,000.¹

Why the Process Itself Is What the Law Regulates

Under 21 USC 351, a drug is adulterated if the methods, facilities, or controls used in its manufacture do not conform to current good manufacturing practice.² The government does not have to prove your product hurt anyone. It only has to show your process fell below the standard. Once a product qualifies as adulterated, it is subject to seizure anywhere it sits in interstate commerce, and the company behind it faces potential injunctions and criminal charges.³

That is the whole point of GMP. Documentation, training, validated procedures, and independent quality oversight exist so the manufacturer can prove, batch by batch, that every unit was made under conditions designed to produce a safe and consistent product. The burden sits on the company to demonstrate compliance, not on the FDA to prove a defect.

Which Products Are Covered

The GMP rules live in Title 21 of the Code of Federal Regulations, with a different framework for each product category:

Finished pharmaceuticals, both human and veterinary, are covered by 21 CFR Parts 210 and 211 — the most prescriptive set of the group and the reference standard for most GMP discussions.⁴
Human food is covered by 21 CFR Part 117, which combines traditional GMP requirements with hazard analysis and risk-based preventive controls added by the Food Safety Modernization Act.⁵
Dietary supplements follow their own regime under 21 CFR Part 111, with distinct identity testing and batch production requirements.
Medical devices are governed by 21 CFR Part 820, which as of February 2, 2026 is restructured as the Quality Management System Regulation and incorporates the international standard ISO 13485:2016.⁶
Cosmetics are the newest category. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) directs the FDA to establish GMP regulations for cosmetic facilities and requires biennial facility registration. Some small businesses are exempt, but the exemption does not apply to products that contact the eye, are injected, are used internally, or alter appearance for more than 24 hours.⁷

The categories share the same underlying logic — controlled personnel, controlled facilities, controlled records, controlled testing — but the specifics vary. What follows draws mainly from the pharmaceutical rules, which are the most detailed.

What the Rules Actually Require

Personnel and the Quality Unit

Everyone working in manufacturing needs the education, training, and experience appropriate to the job, and training has to be ongoing rather than a one-time onboarding event.⁸ Hygiene rules are specific: clean clothing suited to the duty, protective coverings when contamination is a risk, and exclusion of anyone with an illness or open wound that could affect product safety.⁹

The quality control unit is the single most powerful function in the facility. It has authority to approve or reject every component, container, closure, in-process material, label, and finished product, including work produced under contract by another company.¹⁰ It also approves the written procedures and specifications that govern identity, strength, quality, and purity, and it must review every batch record before release. Any unexplained discrepancy — whether or not the batch has already shipped — triggers a documented investigation.¹¹ FDA inspectors read closely for whether the quality unit actually has independence and whether its investigations are substantive rather than a paperwork exercise.

Facilities and Equipment

Buildings must be large enough for orderly placement of equipment and materials so that different components and products do not get mixed up, and constructed in a way that supports cleaning.¹² Product-contact surfaces cannot be reactive, additive, or absorptive in ways that alter safety or quality.¹³

Equipment must be cleaned, maintained, and sanitized on defined schedules, with written procedures and records to prove it.¹⁴ Automated, mechanical, and electronic equipment must be routinely calibrated under a written program, with calibration records maintained.¹⁵ Utility systems draw scrutiny too. For pharmaceutical water, the FDA sets action limits of 100 colony-forming units per milliliter for Purified Water and fewer than 10 per 100 milliliters for Water for Injection; exceeding either triggers an investigation and an assessment of whether affected product moved.¹⁶

Documentation and Data Integrity

Documentation is the backbone of GMP. Without records, there is no way to prove any procedure was followed, and the FDA treats missing documentation as missing compliance.

Every drug product needs a master production and control record that lays out the manufacturing instructions, testing procedures, and specifications, prepared and signed by one person and independently verified by a second.¹⁷ For each batch actually made, a batch production and control record captures the date of each significant step, the equipment used, the lot number of every component, the weights and measures, the labeling controls, and the identity of the people who performed or supervised each step.¹⁸ Lot-level traceability in these records is what makes recalls possible.

Records must be kept at least one year past the batch’s expiration date, or three years after distribution for OTC products that carry no expiration.¹⁹ Facilities that keep records electronically also have to comply with 21 CFR Part 11, which requires secure, computer-generated, time-stamped audit trails; unique, non-transferable electronic signatures; and controls that detect unauthorized access.²⁰

The FDA evaluates manufacturing data against five principles it abbreviates as ALCOA: data must be Attributable, Legible, Contemporaneous, Original, and Accurate.²¹ Backdated notebooks, reprocessed analytical runs with the original result hidden, or parallel record systems are the kinds of failures that turn a routine inspection into a criminal referral.

Raw Materials and Finished Product Testing

Every incoming lot of components, containers, and closures has to be quarantined until the quality unit samples, tests, and releases it, and each lot gets a distinctive code to track its status.²² Each component must be tested for identity, purity, strength, and quality. A manufacturer can accept a supplier’s certificate of analysis instead of full independent testing, but only after running at least one identity test in-house and validating the supplier’s reliability at appropriate intervals.²³

Finished products need laboratory confirmation of identity and strength of each active ingredient against final specifications before release. A batch that fails must be rejected; reprocessed material has to meet every applicable standard before it can be accepted.²⁴

How the FDA Inspects

Under 21 USC 374, FDA investigators can enter any factory, warehouse, or establishment where regulated products are made or held for interstate commerce. They must show credentials and written notice and inspect at reasonable times, but the facility cannot refuse entry.²⁵ For drug and device sites, the inspector’s access covers records, processes, controls, and facilities bearing on adulteration or misbranding.

The FDA prioritizes inspections on a risk-based schedule that considers compliance history, recall history, product risk, the time since the last inspection, and whether a foreign regulator has already inspected under a mutual recognition agreement.²⁶

When a company files a new drug application or an abbreviated new drug application, the FDA may run a pre-approval inspection (PAI) at any manufacturing site named in the filing. The PAI confirms that quality systems can support commercial-scale production and that the data in the application match what actually happened on the floor.²⁷ Once the application is filed, the facility is considered ready for inspection at any time.

The agency also runs remote regulatory assessments, requesting records in advance of or in place of an on-site visit. A June 2025 guidance formalized this practice outside the COVID-19 context, covering both voluntary and mandatory remote record reviews under section 704(a)(4) of the FD&C Act.²⁸ Records produced remotely carry the same regulatory weight as records reviewed on site.

What Happens When a Facility Falls Short

Form 483 Observations

When an inspector sees conditions or practices that may violate federal requirements, they list them on a Form 483 handed to management at the close of the inspection. A 483 is not a final agency determination. It records the investigator’s observations and starts the clock on the facility’s response.²⁹

The FDA recommends responding within 15 business days. That timeline is a recommendation rather than a legal deadline, but responses received within the window are reviewed before the agency decides whether to escalate. Responses should address every observation in a single submission and include a corrective action plan with concrete timelines. Where the fix is genuinely complex, the FDA advises submitting the plan and proposed timeline inside the 15-day window and following up with substantive results later.²⁹

Warning Letters, Seizures, and Injunctions

If the response to a 483 is inadequate, the next step is often a Warning Letter. Warning Letters are officially advisory and do not represent final agency action, but they are published on the FDA’s website, which creates immediate reputational and business pressure.³⁰

When product on the market poses a risk, the FDA can pursue seizure in federal court against any adulterated or misbranded food, drug, or cosmetic in interstate commerce.³ Federal district courts also have authority to enjoin violations of the FD&C Act, which can effectively shut down a manufacturing operation until the company shows it has come into compliance.³¹ Consent decrees, which are court-supervised compliance agreements, are the usual vehicle for these injunctions and often require years of monitored remediation before full operations can resume.

Criminal Penalties

Criminal prosecution under the FD&C Act is tiered. A first offense is a misdemeanor punishable by up to one year in prison. A second offense, or any violation committed with intent to defraud or mislead, is a felony punishable by up to three years.¹

The dollar figures in the FD&C Act itself ($1,000 for a first offense, $10,000 for a second) are overridden by the general federal sentencing statute. Under that statute, an individual convicted of a misdemeanor faces fines up to $100,000 and an organization up to $200,000. For felonies, the caps rise to $250,000 for individuals and $500,000 for organizations. If a misdemeanor results in death, both caps jump — individuals to $250,000, organizations to $500,000.³²

The severest penalties apply to knowing and intentional adulteration that creates a reasonable probability of serious health consequences or death: up to 20 years of imprisonment and fines up to $1,000,000.¹ Courts may also impose an alternative fine of twice the gross gain from the offense or twice the gross loss to victims, whichever is greater, which can push the actual amount well beyond the statutory caps.³²

Recalls

When product already on the market turns out to violate GMP requirements, the manufacturer is expected to notify the appropriate FDA district office immediately and initiate a recall. The FDA generally relies on voluntary recalls, and most recalls follow that path.³³

The agency classifies each recall by the severity of the health risk:

Class I: a reasonable probability that use of or exposure to the product will cause serious health consequences or death.
Class II: use may cause temporary or medically reversible consequences, or the probability of serious consequences is remote.
Class III: use is not likely to cause adverse health consequences.³⁴

The classification drives how aggressively the company has to verify that affected product is actually leaving the market. Effectiveness checks run from Level A (contacting 100% of consignees) down to Level E (no checks required), and the level is set in the recall strategy.³⁵ While a recall is active, the company files periodic status reports, typically every two to four weeks depending on urgency. The recall ends only when the FDA’s district office issues a written termination confirming that all reasonable efforts have been made.³⁶

For food products other than infant formula, the FDA can also order a mandatory recall when there is a reasonable probability that the food is adulterated or misbranded with respect to allergen labeling and will cause serious adverse health consequences or death. Even then the agency must first offer the company a chance to recall voluntarily; only the FDA Commissioner can issue the final mandatory recall order, and the company may request an informal hearing within two days of any cease-distribution order.³³

Foreign Facilities Selling Into the U.S.

Foreign manufacturers face the same GMP standards as domestic ones, plus obligations tied to importation. Food importers must maintain a Foreign Supplier Verification Program (FSVP) providing adequate assurance that foreign suppliers meet U.S. preventive controls or produce safety requirements, and confirming compliance with adulteration and allergen-labeling provisions of the FD&C Act.³⁷

Foreign food facilities exporting to the United States must register with the FDA and renew biennially between October 1 and December 31 of each even-numbered year. Registrations not renewed by 11:59 PM on December 31 expire, which effectively blocks the facility’s products from lawful entry.³⁸

For pharmaceuticals, the FDA relies on Mutual Recognition Agreements with the European Union (covering all 27 EU member countries for human drug inspections since the U.S.-EU MRA took full effect in November 2017), Switzerland, and the United Kingdom. The MRAs cover routine surveillance inspections and do not extend to advanced therapy products, blood and plasma products, or human tissues and organs.³⁹

Food importers with strong safety records can apply to the Voluntary Qualified Importer Program (VQIP) for expedited entry. Eligibility requires a three-year import history, current facility certifications for each foreign supplier, a quality assurance program, no active import alerts or Class I recalls on any of the importer’s products, and payment of an annual user fee. Applications are denied if any product tied to the importer is subject to an ongoing FDA enforcement action.⁴⁰

1
Office of the Law Revision Counsel. 21 USC 333 – Penalties
2
Office of the Law Revision Counsel. 21 USC 351 – Adulterated Drugs and Devices
3
Office of the Law Revision Counsel. 21 USC 334 – Seizure
4
eCFR. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals
5
eCFR. 21 CFR Part 117 – Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
6
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)
7
U.S. Food and Drug Administration. Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
8
eCFR. 21 CFR 211.25 – Personnel Qualifications
9
eCFR. 21 CFR 211.28 – Personnel Responsibilities
10
eCFR. 21 CFR 211.22 – Responsibilities of Quality Control Unit
11
eCFR. 21 CFR 211.192 – Production Record Review
12
eCFR. 21 CFR 211.42 – Design and Construction Features
13
eCFR. 21 CFR 211.65 – Equipment Construction
14
eCFR. 21 CFR 211.67 – Equipment Cleaning and Maintenance
15
eCFR. 21 CFR 211.68 – Automatic, Mechanical, and Electronic Equipment
16
U.S. Food and Drug Administration. Guide to Inspections of High Purity Water Systems
17
eCFR. 21 CFR 211.186 – Master Production and Control Records
18
eCFR. 21 CFR 211.188 – Batch Production and Control Records
19
eCFR. 21 CFR 211.180 – General Requirements for Records and Reports
20
eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
21
U.S. Food and Drug Administration. Quality Essentials: Inspectional Coverage of QMS and Data Integrity
22
eCFR. 21 CFR 211.80 – General Requirements
23
eCFR. 21 CFR 211.84 – Testing and Approval or Rejection of Components, Drug Product Containers, and Closures
24
eCFR. 21 CFR 211.165 – Testing and Release for Distribution
25
Office of the Law Revision Counsel. 21 USC 374 – Inspection
26
Office of the Law Revision Counsel. 21 USC 360 – Registration of Producers of Drugs or Devices
27
U.S. Food and Drug Administration. FDA Pre-Approval Inspection (PAI) Program and How to Prepare for a Successful Outcome
28
Food and Drug Administration. Conducting Remote Regulatory Assessments Questions and Answers
29
U.S. Food and Drug Administration. Responding to FDA Form 483 Observations at the Conclusion of a Drug CGMP Inspection
30
U.S. Food and Drug Administration. Warning Letters
31
Office of the Law Revision Counsel. 21 USC 332 – Injunction Proceedings
32
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
33
U.S. Food and Drug Administration. Questions and Answers Regarding Mandatory Food Recalls: Guidance for Industry and FDA Staff
34
U.S. Food and Drug Administration. Recalls Background and Definitions
35
eCFR. 21 CFR 7.42 – Recall Strategy
36
eCFR. 21 CFR 7.55 – Termination of a Recall
37
eCFR. 21 CFR 1.502 – What Foreign Supplier Verification Program Must I Have
38
U.S. Food and Drug Administration. Food Facility Registration User Guide: Biennial Registration Renewal
39
U.S. Food and Drug Administration. European Union (EU) Mutual Recognition Agreement
40
U.S. Food and Drug Administration. Voluntary Qualified Importer Program (VQIP)