Current good manufacturing practices, known as CGMP, are the federal rules that dictate how drugs, medical devices, food, and dietary supplements must be produced, tested, and stored in the United States. The Food and Drug Administration enforces them under the Federal Food, Drug, and Cosmetic Act. Any product made outside these standards is legally “adulterated,” whether or not anyone was actually harmed, and that single classification unlocks the full range of FDA enforcement: seizure of goods, court injunctions that can shut a facility for months, import bans on foreign manufacturers, and criminal charges against individual executives.
Why “Adulterated” Is the Word That Matters
Under federal law, a drug is adulterated if the methods, facilities, or controls used to manufacture it do not conform to current good manufacturing practice. The statute does not require proof of contamination or injury. A manufacturing process that fails to follow CGMP produces an adulterated product by definition, even if the finished pill tests fine in a lab.
That legal label is what gives the FDA leverage. An adulterated product can be seized in interstate commerce, its manufacturer can be dragged into federal court for an injunction, and the people responsible can face prison time. The word “current” carries its own weight. Manufacturers cannot freeze their processes at whatever passed muster a decade ago; as better equipment, testing methods, and scientific understanding emerge, the baseline expectation moves with them.
Where the Rules Live and Who Must Follow Them
CGMP requirements sit in Title 21 of the Code of Federal Regulations, but the specific rules differ by product type. Each set is tailored to the risks and complexity of what it covers.
- Finished pharmaceuticals fall under 21 CFR Parts 210 and 211, the most detailed set. Part 210 establishes the regulations as the minimum standards for drug manufacturing, and Part 211 spells out requirements from personnel qualifications to laboratory controls.
- Medical device manufacturers operate under the Quality Management System Regulation at 21 CFR Part 820, which took effect February 2, 2026 and aligns federal requirements more closely with the international ISO 13485 standard.
- Food manufacturers follow 21 CFR Part 117, which combines CGMP with the hazard analysis and preventive controls framework required by the Food Safety Modernization Act. Each facility must maintain a written food safety plan.
- Dietary supplement manufacturers follow 21 CFR Part 111, which requires them to establish specifications for identity, purity, strength, and composition, and to verify those specifications through testing.
The regulated universe is broad. Pharmaceutical companies producing everything from over-the-counter pain relievers to injectable biologics are the most obvious targets. Biotechnology firms making vaccines and gene therapies face the same requirements, and their product complexity often drives even tighter internal controls. Veterinary drug makers are covered because animal medications carry contamination risks that can reach the human food supply. Medical device makers, food producers, and supplement companies fill out the rest. Supplements draw particularly heavy scrutiny because consumers often assume they undergo pre-market approval like drugs, when in fact CGMP is the primary regulatory check on supplement quality.
What Compliance Actually Requires
CGMP touches every part of a manufacturing operation, and weakness in any one area can bring the whole system into question during an inspection.
People and Facilities
Everyone involved in production must be trained for their specific tasks, with training documented and refreshed. Hygiene rules are strict because people handling products are often the biggest contamination risk. Facilities must be designed to prevent cross-contamination, with physical separation between manufacturing stages and controlled flow of materials, personnel, and air. Environmental monitoring for air filtration and water quality runs continuously, and the facility must be protected from pests and temperature swings that could compromise product stability.
Equipment and Raw Materials
Every piece of manufacturing equipment must be calibrated on a set schedule and maintained to documented standards. Where equipment handles multiple product lines, validated cleaning procedures must remove all traces of previous materials before a new batch begins. Raw materials cannot simply arrive and enter production. They must be quarantined, tested against specifications for identity and purity, and released by the quality unit before anyone touches them.
Documentation and Batch Records
If it isn’t written down, it didn’t happen. That principle runs through every CGMP regulation. For pharmaceutical manufacturers, 21 CFR 211.186 requires a master production and control record for each drug product, which functions as the definitive recipe: every ingredient, its exact weight or measure, and each step required to produce the product. A second person must independently verify the master record before it goes into use.
Each production run generates a batch production and control record that captures dates, equipment used, component identification, weights and measures, in-process test results, and the identity of everyone who performed or supervised a significant step. Records are signed and dated, creating an audit trail from raw materials through final packaging.
A quality control unit with independent authority sits at the top of this system. It has the power to approve or reject any material, intermediate product, or finished batch. Management cannot override a quality unit rejection to push product out the door, which is where many companies get into trouble during inspections.
Electronic Records and Signatures
Most manufacturers now keep their records digitally, which triggers a separate set of requirements under 21 CFR Part 11. Any electronic system used to create, modify, or store CGMP records must generate secure, time-stamped audit trails that record every operator action, and changes cannot erase or hide the original entry. Audit trail documentation must be retained at least as long as the underlying records.
Electronic signatures carry the same legal weight as handwritten ones, but only if the system meets specific criteria. Each signature must be unique to one individual and cannot be reassigned. Non-biometric signatures must use at least two identification components, such as a user ID and password. Before using electronic signatures, organizations must certify to the FDA that they intend those signatures to serve as legally binding equivalents of pen-and-ink signatures.
Process Validation
Buying the right equipment and writing good procedures is not enough. Manufacturers must prove through documented testing that their processes consistently produce the intended result. The FDA treats this as a lifecycle: designing the process through laboratory and pilot studies, then qualifying the facility, equipment, and full process at commercial scale under real conditions, then continuing to monitor and analyze data to confirm the process stays in a state of control throughout its commercial life.
What an FDA Inspection Looks Like
FDA investigators do not schedule courtesy visits. An inspection begins the moment the investigator arrives, presents official credentials, and hands over Form 482, the Notice of Inspection. That form is the legal authority to enter the premises, observe manufacturing in real time, and examine relevant documents.
Investigators walk the production floor, interview employees, review batch records, and check whether what happens on the ground matches what the company’s written procedures say should happen. The gap between what a standard operating procedure describes and what workers actually do is where most findings originate. Documentation gets particular attention because incomplete or inconsistent records are often the clearest evidence that a process is not under control.
If the investigator identifies conditions that appear to violate regulations, the findings go on Form 483, Inspectional Observations, and are discussed with company management before the investigator leaves. Corrections a company can demonstrate on the spot, while the investigator is still there, count in the company’s favor.
In June 2025, the FDA finalized guidance establishing a framework for Remote Regulatory Assessments, allowing the agency to review records and gather information without sending an investigator on-site. Under section 704(a)(4) of the FD&C Act, the FDA can request records in advance of or in lieu of a physical inspection. The guidance covers both voluntary assessments and mandatory records requests, and it is particularly useful for foreign facilities where on-site visits involve significant logistical challenges.
Responding to a Form 483
A Form 483 is not a legal charge, but ignoring one is a serious mistake. Companies generally have 15 business days from the end of the inspection to submit a written response detailing what corrective actions they have taken or plan to take. A vague promise to “look into the issue” does not satisfy the FDA. Investigators expect root cause analysis, specific procedural changes, timelines for implementation, and evidence that fixes are already underway.
If the response is inadequate or the company fails to respond, the next step is typically a Warning Letter. Warning Letters are public documents that name the company and describe the violations in detail. They give the manufacturer 15 working days to respond and put the company on notice that the FDA may withhold approval of new drug applications, refuse entry of the company’s products into the United States, or take further enforcement action.
Penalties When Companies Do Not Fix the Problems
When a manufacturer does not voluntarily correct violations, the FDA has several escalating tools.
Seizures and Injunctions
The FDA can ask a federal court to seize adulterated products wherever they are found in interstate commerce. Condemned goods are either destroyed or released back to the manufacturer only if the company posts a bond and brings the products into compliance under federal supervision.
For ongoing violations, the FDA can seek a court injunction ordering the company to stop manufacturing until it fixes the problems. Many injunctions take the form of consent decrees, where the company agrees to specific terms rather than litigating. A consent decree typically prohibits manufacturing until the company hires an independent expert to audit the facility, completes all corrective actions, and receives explicit FDA authorization to resume operations. Consent decrees can effectively shut down a facility for months or years.
Import Alerts
Foreign manufacturers face an additional risk. The FDA can place a company’s products on an import alert, which lets U.S. customs detain and refuse future shipments without physically examining them. The burden then shifts to the importer to demonstrate that the specific shipment does not have the violations identified in the alert. For a foreign manufacturer dependent on the U.S. market, an import alert can be commercially devastating.
Criminal and Civil Penalties
CGMP violations can lead to criminal prosecution. A first offense is a misdemeanor carrying up to one year in prison and a fine of up to $1,000. A second conviction or a violation committed with intent to defraud becomes a felony with up to three years in prison and a $10,000 fine. Knowingly adulterating a drug in a way that creates a reasonable probability of serious health consequences or death carries up to 20 years in prison and a $1,000,000 fine.
On the civil side, the FDA can impose monetary penalties that are adjusted annually for inflation. For device-related violations, the penalty can reach roughly $35,000 per violation and over $2.3 million in aggregate for a single proceeding. For food adulteration, individual penalties can exceed $99,000 per violation and approach $1 million in aggregate.
Personal Liability for Executives
Corporate executives sometimes assume CGMP violations are the company’s problem, not theirs personally. The Park Doctrine says otherwise. Named after the Supreme Court’s 1975 decision in United States v. Park, the doctrine lets federal prosecutors bring misdemeanor criminal charges against individual corporate officers for CGMP violations even when the officer had no personal knowledge of the violation.
The theory is straightforward. If you hold a position of authority that gave you the power to prevent or correct the violation, and you failed to do so, you can be held personally responsible. The government does not need to prove you intended to break the law or even knew about the problem. When deciding whether to prosecute, the FDA considers the officer’s position relative to the violation, whether the violation was obvious, whether it reflects a pattern of noncompliance, and whether the company ignored prior warnings.
C-suite executives and plant managers carry personal criminal exposure for manufacturing failures happening on their watch. That exposure extends beyond fines. A misdemeanor conviction can result in up to one year in prison and can lead to debarment from the pharmaceutical industry. The doctrine is the FDA’s way of ensuring that compliance pressure reaches the people who control budgets and make staffing decisions, not just the workers on the production floor.
When CGMP Failures Reach the Market: Recalls
When a CGMP failure results in a defective product reaching the market, the FDA classifies the recall by health risk.
- Class I recalls involve products with a reasonable probability of causing serious health consequences or death. These trigger the most urgent response and broadest public notification.
- Class II recalls involve products that may cause temporary or medically reversible health problems, or where the probability of serious harm is remote. Most recalls fall here.
- Class III recalls involve products unlikely to cause any adverse health consequences, often labeling errors or minor deviations from specifications.
Most recalls are voluntary. The manufacturer identifies the problem, or receives notice from the FDA, and initiates the recall on its own. For food products, the FDA has mandatory recall authority. Before issuing a mandatory recall order, the agency must first give the company an opportunity to voluntarily pull the product. If the company refuses or fails to act, the FDA can order the recall directly. A company subject to a mandatory recall order can request an informal hearing, which must be held within two days of the order being issued.