Guide

Pharmaceutical GMP readiness in the United States

The US drug market is regulated by FDA's Center for Drug Evaluation and Research (CDER) under the Federal Food, Drug, and Cosmetic Act. Finished pharmaceuticals follow 21 CFR Parts 210 and 211; APIs follow ICH Q7 (adopted as guidance); PET drugs follow 21 CFR 212; bioresearch follows 21 CFR 58. The US does not require Qualified Person batch release — release is by a designated quality unit under 211.22. Distribution is governed by DSCSA (Drug Supply Chain Security Act), not EU GDP. This guide covers the US-specific layer over an ICH Q10 PQS. For deep-dive cGMP detail, see the dedicated 21 CFR 211 guide.

Start free trial Free trial, no credit card, onboard in days, not months.

Regulator and legal basis

FDA/CDER enforces cGMP for human drugs; CBER covers biologics; CVM covers veterinary drugs. The primary regulations are 21 CFR Part 210 (general cGMP) and 21 CFR Part 211 (finished pharmaceuticals). FDA expects ICH Q10, Q9, and Q7 as supporting guidance; ICH Q1A drives stability; ICH M7 drives mutagenic impurity control. The US relies on inspection rather than per-batch release: a Pre-Approval Inspection (PAI) accompanies NDA/ANDA/BLA approval; routine surveillance inspections follow on a risk-based cadence.

Market entry pathway

Establishment registration and drug listing under 21 CFR Part 207 are required for every facility shipping into the US. Marketing requires an NDA, ANDA (generics), or BLA (biologics) with CMC content per ICH M4Q. Foreign manufacturers need a US Agent. A successful PAI is normally the gating step before commercial supply.

Release model, distribution, and serialization

Release: by the quality unit under 211.22 — no QP. Distribution: DSCSA requires serialized transaction information, transaction history, and transaction statement (Tier 1: package-level serialization with GS1 SGTIN; Tier 2: enhanced traceability and verification). Wholesale distributors are licensed at state level. Returns, recalls, and suspect-product investigations must be documented per DSCSA.

Inspection patterns and common findings

FDA inspectors issue Form 483 observations on the last day; a Warning Letter follows if responses are inadequate. The 2020–2025 trend list is consistent: inadequate investigation of deviations/OOS (211.192), unreliable laboratory data (data integrity / ALCOA+ gaps), poor change control, and weak supplier qualification. Computerised systems are reviewed against Part 11, the FDA CSA guidance, and GAMP 5.

A 90–180 day US readiness path

Days 0–30: confirm Part 211 coverage, Part 11 controls, DSCSA Tier-1 serialization, US Agent appointment, and FDA establishment registration. Days 31–90: tighten OOS and deviation investigations, supplier qualification, and data-integrity controls; run a mock PAI. Days 91–180: close findings, request the PAI, and stand up DSCSA Tier-2 enhanced traceability.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

21 CFR Part 11

Part 11 makes electronic records and signatures legally defensible by requiring validation, audit trails, security, signature controls, accurate copies, and retention in line with underlying FDA recordkeeping rules.

CSA

CSA applies risk-based, fit-for-purpose validation to production and quality system software, keeps Part 11 and device QMS expectations intact, and reduces superfluous paperwork by using the right testing and evidence for the real risk.

GAMP 5

GAMP 5 Second Edition shows how to right-size validation for modern, cloud and agile software while meeting Annex 11 and Part 11 expectations without drowning teams in documents.

DSCSA

US law requiring item-level serialisation and electronic traceability across the Rx drug supply chain.

ICH Q7

ICH Q7 sets the worldwide GMP baseline for API manufacture, clarifying where GMP begins, how controls scale by step, and what validation, change control, and supply-chain measures regulators expect.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Document control

Versioned SOPs, controlled artwork, periodic review with e-signatures.

QMS

CAPA, deviations, change control, management review wired together.

Audits & CAPA

Findings auto-route to owners with statutory clocks and evidence trail.

Industries this hits hardest

Frequently asked

Do we need a Qualified Person for the US?

No. The US uses a quality unit (211.22) accountable for release; there is no statutory QP. A named Head of Quality with documented authority and independence is sufficient.

Does FDA accept EU GMP certificates?

Under the EU–US MRA, FDA recognizes routine EU GMP inspections for most human drugs, reducing on-site surveillance. A Pre-Approval Inspection tied to an NDA/ANDA/BLA is generally still required for new products.

How does DSCSA differ from EU FMD?

Both serialize at saleable-unit level, but identifiers, data carriers, and reporting differ. DSCSA uses GS1 SGTIN with transaction documents flowing through the supply chain; EU FMD uses a unique identifier verified against a national/EU hub at dispense.

What triggers a Warning Letter rather than a 483?

Failure to respond adequately to a 483 within 15 working days, repeat findings across inspections, or systemic data-integrity issues. Warning Letters are public and often cite Part 211 subparts B (organization), F (production), I (laboratory controls), and J (records).

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →