21 CFR 606: CGMP for Blood and Blood Components

21 CFR 606 is the U.S. regulation in Title 21, Part 606 of the Code of Federal Regulations governing current good manufacturing practice for blood and blood components. It provides a blood-specific CGMP framework, rather than a generic manufacturing checklist.

For an operational reading, organize the work around personnel, facilities, equipment, supplies, procedures, labeling, compatibility testing, records and reports. Then ask three practical questions:

• Which procedure governs the work at this step?
• Which records establish what happened to this unit?
• Who evaluates exceptions and decides the next action?

Three provisions anchor this article. 606.100(b) requires establishments to establish, maintain and follow written SOPs across collection, processing, compatibility testing, storage and distribution. 606.160(a)(1) requires records maintained concurrently with significant steps so the work can be traced—a central concern for data integrity. 606.171(a) addresses product-deviation reporting responsibility for licensed manufacturers, unlicensed registered blood establishments and transfusion services that controlled the product when the deviation occurred. These are reference points, not substitutes for the rest of Part 606.

Keep requirements separate from implementation choices. The cited regulations are binding requirements; official guidance and recommended industry practices are distinct categories. A workflow, checklist or database design is an implementation method, not regulatory approval. Use such tools to organize evidence and support accountable human review and release decisions—not to declare a site compliant.

Scope the operation by product purpose, activity and establishment role—not merely by whether the site handles blood. For U.S. blood and blood components, 21 CFR 606.100(b) requires written SOPs covering collection, processing, compatibility testing, storage and distribution for allogeneic transfusion, autologous transfusion and further manufacturing.

For reporting responsibility specifically, 21 CFR 606.171(a) identifies licensed manufacturers, including Source Plasma manufacturers, unlicensed registered blood establishments and transfusion services that controlled the product when the deviation occurred. This is not an exhaustive applicability statement for Part 606. A contracted holding step remains under the establishment’s control when the product remains in its control.

Use this worksheet as an industry-practice tool, not a regulator-prescribed form. Assign an accountable reviewer and review date. Include a responsibility field naming who controlled the product at the event time; for contracted storage, distinguish that party from the physical custodian. For other products or jurisdictions, identify primary rules separately—for example, through the relevant UK regulatory framework—rather than extending blood-specific requirements by analogy.

The Part 211 relationship is set by 21 CFR 211.1(b): for drug products, the CGMP regulations in parts 600 through 680 (as they pertain to drugs that are also biological products for human use) supplement and do not supersede Part 211 unless they explicitly provide otherwise, and where applicable regulations conflict, the regulation specifically applicable to the drug product in question supersedes the more general. 606.171(f) similarly states that Part 606 supplements, and does not supersede, other provisions in the chapter.

Assess each framework separately for the product and activity. A blood-specific rule is not a reason to disregard other applicable provisions.

21 CFR 606.100(a) requires SOPs to comply with Part 640’s published additional standards for the products being processed, except clinical investigations.

FAQ: What is the licensure qualification?

Under 606.100(a), establishments not subject to Public Health Service Act section 351 licensure are excluded from Part 640 references concerning licenses, licensed establishments, and submission of material or data to, or approval by, the CBER Director—not from all product standards.

Keep binding regulations distinct from separately identified official guidance and recognized industry practice. This article’s workflows, status names and data schemas are practical design examples, not FDA prescriptions. Evaluate software as support, not compliance certification or a replacement for human approval and release.

The binding resource duties are specific. 606.20(b) requires personnel responsible for collection, processing, compatibility testing, storage or distribution to be adequate in number, educational background, training and experience, with capabilities commensurate with their functions and a thorough understanding of the procedures they perform. 606.40 requires clean, orderly facilities of suitable size, construction and location. 606.60(a) requires equipment to be maintained clean and orderly and to be observed, standardized and calibrated on a regularly scheduled basis as prescribed in the SOP manual. 606.65 requires all supplies and reagents to be stored in a safe, sanitary and orderly manner. Equipment must also be located to facilitate cleaning and maintenance and perform as designed; 606.60(b) specifies minimum observation, standardization and calibration frequencies for listed equipment. The role assignments and checks in the table below are suggested implementation, not additional legal duties.

Resource controls should connect each procedure to usable facilities, suitable materials and accountable people. In the matrix below, regulatory anchors describe binding requirements; operational checks and responsible roles are suggested implementation practices, not additional statutory language.

Role authorization and competency review are separate implementation practices. Authorization defines who may perform a task or enter an area; competency review assesses whether that person can perform the assigned work correctly. A training matrix can organize task-specific assessments, while role-based access control can support electronic permissions. Neither check substitutes for the personnel-exclusion requirement above.

For each operational failure, name the escalation contact and the conditions for resuming work. Equipment substitution should follow a defined procedure rather than an operator's assumption that two devices are interchangeable.

21 CFR 606.100(b) requires establishments to establish, maintain and follow written procedures for collection, processing, compatibility testing, storage and distribution of blood and blood components. Coverage also includes investigation of product deviations related to § 606.171 and CGMP recordkeeping and other applicable requirements and standards. Those procedures must be available to personnel in the areas where the work is performed. An SOP therefore needs to function as a usable instruction at the point of work, not merely a centrally filed document.

The following is an operational model, not a prescribed universal sequence. Precise order and assigned roles depend on the applicable product and procedure. Each handoff connects an input, a resulting record and a responsible person.

A completed processing step is not an authorized disposition decision. 21 CFR 606.100(c) requires review of all pertinent lot or unit records before release or distribution. Status names such as “processing complete” and “awaiting review,” and the placement of review gates, are implementation choices. Approval and release remain human responsibilities; a workflow status change should reflect, not replace, the authorized decision.

For example, when revising a collection instruction through change control, identify the effective version, communicate the change to affected personnel, and confirm readiness before use. Preserve the version associated with completed work so a later reviewer can reconstruct which instruction governed that activity.

Under 21 CFR 606.160(a)(1), records must be maintained concurrently with each significant collection, processing, compatibility-testing, storage and distribution step for each unit. The record must make those steps traceable and provide a complete history of the work—not merely a final status.

That same provision requires legible, indelible records identifying the performer, dates of entries, test results, their interpretation and assigned product expiration dates. Keep a measured result distinct from its recorded interpretation: a value with its unit of measurement answers a different question from the conclusion drawn from it. An implementation should preserve both rather than replace the result with a pass/fail flag.

Calculate both retention dates

21 CFR 606.160(d) sets the individual-product record minimum at the later of 10 years after processing records are completed or 6 months after the latest individual-product expiration date. It also requires retention beyond expiration as necessary to facilitate reporting unfavorable clinical reactions.

Assume processing records were completed on 15 January 2025 and the latest product expiration date was 15 February 2025. Using calendar years and months:

This calculation establishes the stated minimum; it is not an instruction to delete records automatically. As a retention-management practice, require an authorized review of continuing retention needs before disposal.

Electronic-record implementation practices

Practical data integrity controls include role-based access, attributable corrections that preserve original entries and record who changed what, when and why, readable exports, backups and recovery testing. Test whether a restored record still contains its linked results and interpretations—not just whether a file opens. These are implementation recommendations, not prescriptions here for a particular database, audit-trail feature or electronic-signature technology.

Illustrative record relationships

The following model uses recommended field names, not regulatory field labels or an exhaustive content checklist. Production context tagging helps connect an action to the unit and resources involved.

A collection can link to several components, each with multiple process entries. Where manufacturing and quality records are integrated, retain stable identifiers so reviewers can follow a quality event back to the affected component and original work record without relying on free-text name matching.

21 CFR 606.160(b)(2)(v) requires labeling records, including the initials of the person or persons performing the procedure. This is a recordkeeping requirement, not a list of required container-label fields. 21 CFR 606.160(b)(3)(i) covers records of distribution and disposition, as appropriate, of blood and blood products.

The SOP topics in 21 CFR 606.100(b)(10) include storage temperatures and methods of controlling them for blood products and reagents, as prescribed in §§ 600.15 and 610.53. Select applicable product-specific conditions rather than applying one temperature range to every blood product.

The following are implementation practices, not additional label-field requirements:

An illustrative identifier scheme could link a unit identifier to a label-print event, storage location and dispatch record. Keep those relationships distinct: a reprint creates a new print event, not a new physical unit. This example selects no barcode standard and should not determine product-specific label content or storage conditions.

Use custody handoff records to structure transfers and storage-exception assessment to organize exception review. A missing temperature interval is an evidence gap to assess, not proof that conditions remained acceptable.

Under 21 CFR 606.171(b), an event is reportable only when it meets all of the following criteria: it either represents a deviation from current good manufacturing practice, applicable regulations, applicable standards or established specifications that may affect the safety, purity or potency of the product, or represents an unexpected or unforeseeable event that may affect safety, purity or potency; it occurs in your facility or another facility under contract with you; and it involves distributed blood or blood components. Under 606.171(c), you should report as soon as possible, but you must report within 45 calendar days of the date you, your agent, or another person performing a manufacturing, holding or distribution step under your control acquires information reasonably suggesting that a reportable event has occurred. Reports go on Form FDA 3486 to CBER. In a contractor-storage scenario, the clock can start when the contractor learns of the event, which is why 606.171(a) requires a procedure for receiving deviation information from such parties; whether a specific event is reportable still depends on applying each criterion.

Separate the investigation from the reporting assessment

Under 21 CFR 606.170(a), records must be maintained of complaints reporting adverse reactions regarding each unit of blood or blood product arising from collection or transfusion. Each reported adverse reaction requires a thorough investigation. The collecting or transfusing facility must prepare and maintain a written investigation report, including conclusions and followup, as part of the record for the lot or unit of final product.

When a complication of blood collection or transfusion is confirmed fatal, 21 CFR 606.170(b) requires notification to the Director, Office of Compliance and Biologics Quality, CBER, as soon as possible and a written investigation report within 7 days after the fatality. The collecting facility reports a donor reaction; the facility that performed compatibility tests reports a transfusion reaction. This fatality duty is separate from the product-at-fault forwarding condition in 606.170(a) and the biological product deviation reporting assessment and 45-calendar-day clock in 606.171.

Keep two questions separate in the event workflow: what happened and what the investigation establishes; and whether the event meets the applicable biological product deviation reporting conditions. An adverse-reaction investigation and a biological product deviation reporting assessment are not interchangeable labels. As an implementation practice, link their records when they concern the same event, but document their conclusions separately. The broader topic of adverse-reaction investigation provides context, not a substitute reporting test for blood products.

Worked case 2: a contractor reports a storage event

Assume a licensed blood manufacturer retains control of its units while a contractor stores them, and the contractor reports a storage event. Under 21 CFR 606.171(a), that contracted holding step remains under the manufacturer's control. Outsourcing therefore does not transfer the manufacturer's reporting responsibility for that step. The manufacturer must also establish, maintain and follow a procedure for receiving the contractor's information on all deviations, complaints and adverse events concerning the affected product. The storage-event notification alone does not establish the reporting outcome.

For this case, use the following containment and decision-record design as implementation practices, not as a complete regulatory reporting test:

1. Identify potentially affected units and their locations; place them under a documented hold pending assessment.
2. Preserve original storage readings, alarms, timestamps and contractor communications. Retain relevant context from the storage data logger, rather than relying only on a summary.
3. Document the investigation: event chronology, storage conditions, affected-unit assessment, conclusions and follow-up actions.
4. Record an authorized person's reportability decision, its rationale, supporting records and decision date. Track product disposition separately from the reporting decision.

Consult the current text of 606.171 for reportability conditions, timing and submission details; do not infer them from this example. For an electronic filing, 21 CFR 606.171(e)(2) directs submission of the completed Form FDA3486 through CBER's electronic Web-based application. A local investigation record or contractor notification is not that electronic filing.

For laboratory, labeling and inventory interfaces, define a vendor-neutral message contract: unit identifier, event identifier, source system, event time, receipt time, result or status, acknowledgment and error reason. Treat these as suggested design fields, not a prescribed Part 606 technical architecture. Keep unit identity separate from event identity: serialized unit tracking concerns the physical unit, while event identifiers distinguish transactions and retries.

Worked case 3: retries are not additional units

Assume one original message per unit, 10 units and 2 duplicate retry messages. The interface receives 12 messages: 12 messages minus 2 duplicate messages equals 10 unique unit messages. Nine units reconcile; one has an unmatched identifier. Therefore, 10 units minus 9 reconciled units equals 1 unresolved unit.

Total message count cannot demonstrate complete unit-level reconciliation: retries inflate traffic, and receipt alone does not establish a valid identifier match or agreement between results, labels and inventory.

• Place the unmatched message in a visible exception queue with its error reason and an assigned reviewer.
• Compare the source record, physical unit identifier and destination mapping. Document the verified correction while retaining the original message; do not silently create a replacement unit.
• Use idempotent reprocessing: replaying the same event should not create another transaction. Record the acknowledgment and reconciliation outcome.
• Require human review before the affected unit advances under the applicable SOP. Link the exception to the unit’s history for backward tracing.

Downtime and delayed entry

21 CFR 606.160(a)(1) requires concurrent records of significant steps. During downtime, preserve contemporaneous offline records. After recovery, reconcile them against electronic entries, distinguishing when work occurred from when the later electronic entry was made. Retain the offline record’s connection to that entry rather than disguising delayed transcription as contemporaneous electronic recording.

Use this checklist as an implementation and review practice—not an FDA inspection protocol or assurance against enforcement. Assign named owners and test whether records support decisions, rather than merely checking that documents exist. Use the earlier failure-control pairs as review prompts.

Run two reconstruction challenges

Traceability challenge: select one distributed unit. Retrieve its collection relationship, processing records, relevant resource references, label record, disposition and any linked quality event. Follow identifiers across systems rather than accepting a summary screen. Record broken links and assign each gap an owner and resolution date.

Exception challenge: select one unresolved interface or quality event. Show its owner, affected units, preserved original information, current status and authorized next action. Use an audit trail review workflow to examine changes and their attribution. Confirm that recovery preserves the distinction between original information and subsequent correction.

Ask a reviewer to distinguish four conditions: missing evidence, an incomplete task, a rejected result and an approved disposition. Each should have supporting detail and a clear decision history; a generic label such as “complete” or “closed” should not substitute for that explanation.

Repeat the review deliberately

Define scope; assign responsibilities; map procedures to records; test normal and exception paths; review retention and recovery; and reassess after material process changes through change control. Keep findings, owners and closure evidence together so the next review can test whether corrective work actually resolved the identified gap.