cGMP compliance means that the methods, facilities and controls a manufacturer uses to make, process, pack or hold a drug conform to current good manufacturing practice, so that the drug has the identity, strength, quality and purity it claims to have. In the United States the requirement sits in section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, and the FDA’s implementing regulations for finished drugs are 21 CFR Parts 210 and 211. The FDA does not issue GMP certificates after its inspections. The FDA judges compliance through inspection, classifying each as acceptable or unacceptable with respect to CGMP requirements.
This matters for anyone building software, automation or AI for life sciences manufacturing. Data generated to satisfy a CGMP requirement becomes a CGMP record, and CGMP records are subject to FDA inspection.
Where cGMP compliance is written down
351), a drug is adulterated if the methods, facilities or controls used to make it do not conform to current good manufacturing practice. FDA warning letters charge exactly that: the article is adulterated within the meaning of section 501(a)(2)(B) because its manufacture fails to conform to the CGMP regulations in 21 CFR 210 and 211.
The regulations then split the work:
| Regulation | What it covers |
|---|---|
| 21 CFR Part 210 | Current good manufacturing practice in manufacturing, processing, packing or holding of drugs: general provisions |
| 21 CFR Part 211 | Current good manufacturing practice for finished pharmaceuticals |
| 21 CFR Part 212 | Current good manufacturing practice for positron emission tomography (PET) drugs |
| 21 CFR Part 11 | Electronic records and electronic signatures, applying to certain records required under Parts 210, 211 and 212 |
The FDA describes these drug regulations as minimum requirements for the methods, facilities and controls used in manufacturing, processing and packing. They apply to all human drugs: prescription and nonprescription products, products with pending applications, clinical trial supplies and products that need no approval.
Active pharmaceutical ingredients are treated differently. The FDA has published no CGMP regulations specifically for APIs, so for APIs “CGMP requirements” means the requirements of the FD&C Act itself rather than Parts 210 and 211. The FDA treats ICH Q7 as its current thinking on API manufacturing, and facilities following it will generally be considered compliant, although alternative approaches are allowed if they satisfy the statute. Regulatory action on API deficiencies cites the statute, not Parts 210 and 211.
Why the FDA expects up-to-date systems, not just the ones that passed years ago
The “C” that separates cGMP from GMP stands for current: the FDA expects companies to use up-to-date technologies and systems, and equipment that was adequate to prevent contamination, mix-ups and errors 10 or 20 years ago may fall short today. ICH Q7 states that for its purposes “current good manufacturing practices” and “good manufacturing practices” are equivalent. The fuller explanation sits in our piece on what the cGMP regulations require in pharmaceutical manufacturing, and the wider family of practices is covered in our overview of how GxP and GMP relate.
One consequence surprises people coming from product testing. The FDA can bring a seizure or injunction case over CGMP violations even when there is no direct evidence of a defect affecting the drug’s performance.
How the FDA decides a site is in a state of control
The FDA expects compliant establishments to operate in a state of control and to consistently manufacture drugs of acceptable quality. Compliance Program 7356.002 (2022) defines a state of control as employing conditions and practices that comply with section 501(a)(2)(B) and the parts of the CGMP regulations that apply to the establishment’s systems.
Inspections are organised around six systems: quality, facilities and equipment, materials, production, packaging and labelling, and laboratory controls. A drug manufacturing inspection evaluates two or more of these, always including the quality system. An establishment is out of control if any one system is out of control, and documented CGMP deficiencies are the evidence for that conclusion.
For API sites, Program 7356.002F distinguishes a full inspection, covering at least four systems including quality, from an abbreviated inspection covering two to three. It also distinguishes two triggers. Surveillance inspections happen routinely, while for-cause inspections follow a violative surveillance inspection or specific events and information. The FDA also uses reports of potentially defective products from the public and industry to pick sites for inspection, and a review of the manufacturer’s CGMP compliance is part of approving new and generic drug applications.
Preparing a site for this scrutiny is its own subject, covered in our pharmaceutical inspection essentials.
From Form 483 to consent decree: how cGMP enforcement escalates
An inspection that finds problems ends with a Form FDA 483, which lists conditions that in the investigator’s judgement may violate the FD&C Act, and is presented to and discussed with senior management. The FDA itself states two limits of the 483. It is not a final agency determination of a violation, and it is not exhaustive: other objectionable conditions may exist that it does not cite. Companies are encouraged to respond in writing with a corrective action plan; Leucine, a compliance software vendor, describes that response window as 15 business days.
The FDA then weighs the 483 together with the Establishment Inspection Report, the evidence collected on site and the company’s response. Its final classification usually arrives by letter within 45 to 90 days of the inspection closing, depending on inspection type.
| Outcome or instrument | What it means |
|---|---|
| NAI (no action indicated) | Acceptable state of compliance; usually no Form 483 was issued |
| VAI (voluntary action indicated) | Objectionable conditions found, but the firm can correct them voluntarily and the FDA recommends no action; usually a 483 was issued |
| OAI (official action indicated) | Unacceptable state of compliance; the initial classification when one or more systems are documented as out of control |
| Warning letter | Notice of federal law violations; any significant deviation, repeated or isolated, may warrant one |
| Untitled letter, regulatory meeting, recall | Lesser or parallel tools for CGMP issues; untitled letters are not necessarily posted publicly |
| Import alert | Used to stop drugs entering the US market; the FDA uses import alert 66-40 among others for CGMP concerns |
| Court action via the Department of Justice | Injunctions including consent decrees that can shut a facility until it complies, seizures, criminal prosecution |
Court orders in seizure and injunction cases often require repairs to facilities and equipment, better sanitation, extra testing and improved training. Warning letters are also posted in the FDA’s searchable public database and stay findable after the issues are corrected, which is where a compliance problem becomes a commercial one with customers and partners.
Is there a cGMP certificate, and what proves compliance instead?
No. The FDA does not issue GMP certificates after inspecting pharmaceutical facilities, which EFPIA notes is problematic for US manufacturing sites.
What exists instead is documentary proof of inspection status. EFPIA lists the documents applicants should submit for US sites: the FDA’s 90-day facility classification letter, a screenshot from the FDA Inspection Classification Database, the most recent Establishment Inspection Report, and a Certificate of Pharmaceutical Product where the product is FDA-authorised. For foreign regulators that will not accept a CPP, the FDA issues letters called CGMP declarations conveying the compliance status of sites it has inspected. A site can request one only if its latest FDA inspection was acceptable.
A third-party certificate such as ISO 13485 is not among the documents the FDA and EFPIA name as showing a US site’s status.
How cGMP compliance reaches software, electronic records and AI systems
The FDA’s 2018 data integrity guidance makes the reach explicit: when data is generated to satisfy a CGMP requirement, it becomes a CGMP record. All CGMP records are open to FDA inspection, including those on computerised systems and the electronic communications supporting CGMP work; an email authorising batch release is a CGMP record. Record retention and review requirements are the same whether the record is on paper or electronic.
The guidance defines data integrity as completeness, consistency and accuracy, with data that is attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA). Several consequences land directly on system design:
- Validation for intended use. A CGMP workflow such as an electronic master production and control record is an intended use to be checked through validation, scaled to the risk the system poses; qualifying a Manufacturing Execution System platform does not show that a given record it produces calculates correctly.
- Access control. Changes to computerised records may be made only by authorised personnel, and the FDA recommends technically restricting who can alter specifications, process parameters, data or methods, with system administrators independent of those responsible for record content.
- Unique identity. Shared login credentials mean no individual can be identified, and such a system does not conform to Parts 211 and 212.
- Audit trails. Data must not be modifiable without a record of the modification, and reviewers should examine audit trails alongside the rest of the record. Program 7356.002F names systems without audit trails activated, and systems that allow raw data to be altered or deleted, as examples of failure to ensure data integrity.
- Complete data. Failing, suspect and obviously erroneous data must stay in the retained record; invalidating a result requires a documented, scientifically sound justification.
Part 11 adds electronic record and signature controls, but the FDA interprets its scope narrowly: it applies when records required under the predicate rules are kept electronically in place of paper.
For AI, the guidance already names the case. Automated visual inspection records are among those the FDA says should be restricted to authorised personnel. A computer vision model that accepts or rejects units on a line is therefore producing CGMP records. Validation has to cover the deployed workflow, since the guidance says qualifying a platform such as an MES does not show that the workflow it runs is correct. Electronic data generated for CGMP purposes must include the metadata needed to reconstruct the activity. TechnoLynx’s AI Readiness Scorecard scores an AI programme against GxP with an evidence trail and a remediation backlog.
Checklist before a system touches a CGMP record
- Is the data it produces generated to satisfy a CGMP requirement? If so, it is a CGMP record.
- Has the workflow, not only the platform, been validated for its intended use, at a depth matched to risk?
- Does every user have a unique login, with documented access privileges?
- Is the audit trail activated and part of record review?
- Are data saved at the time of performance rather than at the end of a run?
- If a system handling GxP data and systems also performs non-GxP system functions, has their potential effect on CGMP operations been assessed and mitigated?
The FDA expects processes to be designed so that required data cannot be modified without a record of the modification. A design that relies on people following a procedure answers that question more weakly than one where the control is built into the configuration, and the escalation ladder above is what an unconvincing answer costs.
