cGMP (current good manufacturing practice) is the set of FDA regulations in 21 CFR Part 210 and Part 211 that sets the minimum requirements for the methods, facilities and controls used to manufacture, process and pack a drug product. Under 21 CFR 210.1, failing to comply with any of these regulations makes the drug adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, and both the drug and the person responsible for the failure are subject to regulatory action. cGMP is one strand of the wider family of GxP regulations; how GxP and GMP fit together, and what that means for AI software, is covered separately.
What the cGMP regulations in 21 CFR 210 and 211 require
Part 210 covers the manufacturing, processing, packing or holding of drugs, and Part 211 covers finished pharmaceuticals. 21 CFR 210.1 describes them as the minimum current good manufacturing practice needed to assure that a drug is safe and has the identity, strength, quality and purity it claims to have. The legislative history quoted in the 1978 final rule makes the same point: the regulations define minimum standards, not an exclusive method of meeting them.
FDA wrote Part 211 to be general enough to suit essentially all drug products, flexible enough to allow sound judgement and innovation, and explicit enough to make clear what is required. Words such as “adequate”, “appropriate” and “as necessary” are there so that requirements not relevant to a given operation do not apply to it.
Within that frame, the obligations are concrete:
- Production and process control procedures must be written, approved and followed, and any deviation must be justified and documented (§ 211.100).
- Critical processes that can cause variability must be monitored, and in-process materials must meet acceptance criteria (§ 211.110).
- Equipment must be qualified, calibrated, cleaned and maintained to prevent contamination and mix-ups (§§ 211.63, 211.67, 211.68); FDA’s quality systems guidance notes this is a higher bar for calibration and maintenance than most non-pharmaceutical quality system models set.
- A quality control unit must make sure that controls are implemented, although management decides how to organise it.
- Corrective actions must be documented (§ 211.192).
The 1978 preamble is blunt about the gap between paper and practice: written procedures are only part of the requirement, and an equally critical part is that they are followed. For anyone introducing new software into a plant, that means a validated system with procedures nobody uses fails cGMP just as surely as a missing procedure. Inspections, warning letters and why there is no “cGMP certificate” to buy are part of how FDA enforces cGMP, which this page does not cover.
What the “current” in cGMP obliges
FDA states that the “C” stands for “current”, requiring companies to use technologies and systems that are up to date, and that equipment that was “top-of-the-line” for preventing contamination, mix-ups and errors 10 or 20 years ago may be less than adequate by today’s standards.
The 1978 preamble explains how far “current” reaches. A practice must be current in the industry but need not be widely prevalent: Congress did not require a majority of manufacturers to follow it already, only that it had been shown to be feasible and valuable in assuring drug quality. Case law cited in the same record held that the regulations must rest on current industry practice, although not necessarily the predominant one, and that FDA is directed to consider the current “good” practices. FDA argued it was well placed to judge this because it alone had access to the facilities and records of every US drug manufacturer.
The regulations have also been revisited. The 1978 rule updated Parts 210 and 211 in light of current technology, and FDA notes that 1978 was the last major revision of the cGMP regulations. In August 2002, FDA launched the Pharmaceutical CGMPs for the 21st Century initiative to modernise its regulation of pharmaceutical quality. Its final report describes a risk-based approach in which the intensity of oversight relates partly to a manufacturer’s product and process understanding and the robustness of its quality system.
For software, WHO states that where organisations use computerised systems that do not meet current GxP requirements, an action plan for upgrading them should be documented and implemented. A system that passed validation years ago is not exempt from what “current” now means; that is the clause through which expectations for data handling, and eventually for AI components, tighten without a rule change.
Is cGMP different from GMP?
No, the two terms are used as equivalents. FDA’s Q7A guidance for active pharmaceutical ingredients states that, for its purposes, current good manufacturing practice and good manufacturing practice are equivalent terms. WHO likewise describes GMP as “also referred to as ‘cGMP’”. The “c” stands for “current”. The finer points of usage are in our page on good manufacturing practice and cGMP in pharmaceutical production.
How EU GMP and WHO GMP relate to FDA cGMP
The European Medicines Agency describes GMP as the minimum standard a medicines manufacturer must meet in its production processes. Any manufacturer of medicines for the EU market must comply with EU GMP wherever in the world it is located. The EU principles are laid down in Directive 2003/94/EC for human medicines and Directive 91/412/EEC for veterinary products, with detailed guidance in the EU GMP guideline and its annexes.
WHO publishes its own GMP guidance. Its main principles are used as the standard for justifying GMP status within the WHO Certification Scheme on products moving in international commerce, and as a basis for inspecting manufacturing facilities. WHO reports that more than 100 countries have incorporated its GMP provisions into national medicines law.
The regimes differ in detail but share their core. EMA states that EU and WHO GMP guidance differ in some details while the main principles remain the same, and that EU requirements fulfil all WHO recommendations. An FDA working group that formally compared 21 CFR 210 and 211 with EU and PIC/S GMP found many more similarities than differences, and found that where differences exist they can often be explained by unique aspects of the product regulated.
| Regime | Defining text | Legal reach | Computerised systems and data integrity guidance |
|---|---|---|---|
| FDA cGMP | 21 CFR Parts 210 and 211 | Noncompliance renders a drug adulterated | § 211.68, with Part 11 for electronic records |
| EU GMP | Directives 2003/94/EC and 91/412/EEC plus the EU GMP guideline | Any manufacturer supplying the EU market | Annex 11 |
| WHO GMP | WHO main principles (TRS 986 Annex 2) | Incorporated into national law in more than 100 countries | WHO data integrity guideline (TRS 1033 Annex 4) |
What cGMP demands of computerised systems
21 CFR 211.68 allows any automatic, mechanical or electronic equipment, computers included, that performs its function satisfactorily under Part 211. It also requires that input to and output from the computer of formulas, records or data be checked for accuracy. FDA refused to drop that requirement because input and output errors occur even in validated systems, through faulty input, programming, equipment malfunction or human error, and can lead to adulterated or misbranded products. The extent and frequency of checking is left to the firm and should reflect the complexity of the system and its built-in controls. For vision models, even the choice between axis-aligned and oriented bounding boxes changes that complexity and what must be checked. Backup data must be exact, complete and secure from alteration, erasure and loss.
FDA’s Q7A guidance adds detail on computerised systems. GMP-related computerised systems should be validated, with depth and scope depending on the system’s diversity, complexity and criticality. They should prevent unauthorised access or changes, prevent omissions in data, and record every data change with the previous entry, who changed it and when. Changes should be formally authorised, documented and tested, with records showing the system stays in a validated state.
In the EU, Annex 11 covers all computerised systems used in GMP-regulated activities: the application should be validated, IT infrastructure qualified, and a system that replaces a manual operation must not reduce product quality, process control or quality assurance, nor increase overall process risk. Risk management applies across the system lifecycle, taking patient safety, data integrity and product quality into account. A system-generated audit trail of GMP-relevant changes and deletions should be considered on the basis of risk, with reasons documented and the trail regularly reviewed. Critical processes need documented, tested continuity arrangements for a system breakdown.
Whether a given piece of software falls inside this scope at all is the first question to settle; how GxP systems are classified is worth reading before scoping validation.
Part 11 and electronic records under cGMP
21 CFR Part 11 applies to electronic records created, modified, maintained, archived, retrieved or transmitted under any FDA records requirement. FDA interprets that scope narrowly: Part 11 applies when a record required by a predicate rule such as Part 211 is kept electronically in place of paper, but not when a computer simply prints a paper record that meets the rules and the firm relies on the paper. Reliance decides it: if a firm prints a record but still uses the electronic version to perform regulated activities, FDA may treat it as an electronic record.
FDA exercises enforcement discretion over the Part 11 requirements for validation, audit trails, record retention and record copying, while the underlying predicate rules still apply in full. It continues to enforce access limits, operational, authority and device checks, training of those who develop, maintain or use the systems, and the electronic signature provisions. Predicate rule requirements for validation still apply, and Q7A expects GMP-related computerised systems to be validated.
EMA treats storage of electronic data no differently from paper, and expects electronic signatures to remain valid for the whole retention period. Data integrity is a fundamental requirement of the pharmaceutical quality system in EU GMP Chapter 1, applying equally to paper and electronic systems. WHO frames the expectation as ALCOA+: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. The detail of each principle belongs to our page on GxP data and ALCOA+.
Which GxP roles own AI-specific risks, and how is that documented?
The regulations assign responsibility to roles that already exist, and AI software used in GMP manufacturing is a computerised system that inherits them. Ownership is therefore documented in the same places as for any GMP software: the validation policy, the risk assessments, change control and periodic review.
| Role | What the guidance assigns | Where it is written down |
|---|---|---|
| Senior management | Accountable for systems that minimise data integrity risk and for an effective data governance system embedded in the quality system; responsible for a quality culture and data integrity measures | Written data integrity policy |
| Quality unit | Independent of production, covering QA and QC; ensures controls are implemented; reviews and approves validation protocols | Approved procedures, validation protocol and report |
| Business process owner with IT | Performs the data lifecycle review of a computerised system together with IT staff who understand its architecture | System description under Annex 11 paragraph 4.3 |
| System administrators | A limited number, with no conflict of interest in the data; deletion or configuration privileges only with justification and documented authorisation | Access and privilege records, administrator audit trails |
| Qualified Person (EU) | Only Qualified Persons may certify batch release in a computerised system, and the system must record who did | Batch certification records |
| Developers, maintainers and users | Must have the education, training and experience for their tasks | Training records |
The documents carry the ownership. Q7A expects the company’s validation policy to cover computerised systems and to name the persons responsible for design, review, approval and documentation of each validation phase. FDA recommends basing the validation approach on a justified, documented risk assessment of the system’s potential to affect product quality, safety and record integrity, and Annex 11 expects manufacturers to justify their protocols and acceptance criteria from that assessment. WHO adds a documented Data Integrity Risk Assessment that covers the data lifecycle, weighs data criticality and is kept current.
We would place the risks that feel specific to AI in these existing mechanisms. Q7A expects changes to computer software that could affect production or control to pass through formal change control, and we would treat retraining a model or swapping its weights as such a change. EMA expects data processing methods to be approved, identifiable and version controlled, and locked where appropriate; we would treat a trained model as exactly such a method, so the version that made a release decision must be identifiable afterwards. EMA expects systems to be reviewed periodically for performance, reliability and change history to confirm they remain validated, which is where we would look for drift in model behaviour. Where the model comes from a vendor, a vendor assessment and verification against intended use are expected.
Batch certification in the EU stays with the Qualified Person, and the quality unit remains independent of production.
Where the text runs out
The last major revision of the cGMP regulations was in 1978. What they do give is risk-based depth of validation, a quality unit responsible for ensuring controls are implemented, and a “current” standard defined as feasible and valuable practice rather than majority practice. The question a team has to settle early is whether its model touches a GMP decision at all, and if so, who in the quality organisation will put their name to its validation.
FAQ
What are the four pillars of GMP?
The closest regulatory description is WHO’s, which requires processes to be defined, validated, reviewed and documented, and personnel, premises and materials to be suitable for production.
