Knowledge base
Every regulation/standard Regscribe checks documents against, with full sourcing. This renders the exact same file the analysis pipeline uses — there's no second copy to drift out of sync.
FDA
FDA 21 CFR Part 11 (Electronic Records; Electronic Signatures)
Electronic records and signatures must be trustworthy, reliable, and equivalent to paper records.
21 CFR Parts 210/211 (US Drug cGMP)
The actual US drug manufacturing quality substance — distinct from Part 11's record-keeping rules.
21 CFR Part 600 series (Biologics Licensing & Manufacturing)
US biologics licensing, lot-release testing, and potency requirements — for biologics manufacturers.
21 CFR Part 58 (Good Laboratory Practice)
Nonclinical/preclinical toxicology and pharmacology study requirements — for companies running their own preclinical labs.
21 CFR Part 820 QMSR — FDA-Specific Delta (US Medical Devices)
The residual FDA-specific requirements (MDR/corrections/tracking/UDI cross-references, US-specific records and labeling controls) layered on top of ISO 13485 under FDA's Feb 2026 QMSR rule — use alongside, not instead of, the ISO 13485 rubric.
EU/UK
EU GMP (Volume 4) / EU GDP
EU manufacturing and distribution quality requirements for medicinal products.
EU GMP Annex 1:2023 (Sterile Medicinal Products)
Sterile manufacturing and Contamination Control Strategy requirements — fully rewritten 2023, stricter than the general GMP/GDP rubric.
EU GMP Annex 11 (Computerised Systems)
EU requirements for computerised systems used in GxP activities — the risk-based EU counterpart to FDA's 21 CFR Part 11, currently mid-revision to add AI governance.
EU MDR / IVDR (Medical Device & IVD Regulation)
The legal CE-marking regime for devices/diagnostics — distinct from ISO 13485 itself, which alone doesn't grant EU market access.
PMCPA / ABPI Code of Practice (2024, UK)
UK industry self-regulation for medicine promotion, HCP interactions/hospitality, and transfer-of-value disclosure — checks promotional material and interaction records, not manufacturing/quality documents.
GVP — Good (Pharmaco)vigilance Practice (EU & UK)
Post-market drug safety monitoring — ICSR adverse-event reporting, signal management, Risk Management Plans, and PSURs, with real EU/UK divergence (Windsor Framework, QPPV residency, dual ICSR routing).
KRITIS-Dachgesetz (Germany, Critical Infrastructure Resilience)
Germany's cross-sector critical-infrastructure resilience law (implements EU CER 2022/2557) — covers hospitals, pharma manufacturers, and blood/tissue institutions under its healthcare sector; physical/organizational resilience, not cybersecurity.
NIS2 (EU Network and Information Security Directive 2)
EU cybersecurity risk-management and incident-reporting directive — healthcare providers, reference labs, and pharma manufacturers are named essential/important entities; the cyber counterpart to KRITIS-Dachgesetz's physical resilience regime.
APAC
Japan GMP Ordinance (MHLW Ordinance No. 179)
Japan's drug/quasi-drug manufacturing-site quality requirements — the PMDA/MHLW GMP ordinance, structurally split from Japan's separate GQP and GVP ordinances.
China GMP (2010 Revision, NMPA)
China's national drug manufacturing quality regulation — the NMPA/CFDA analogue to EU GMP and US cGMP, with its own annex system and a 2019 shift away from standalone certification.
Japan GCP (MHLW Ordinance No. 28)
Japan's GCP ordinance for drug trials — implements ICH E6 with Japan-specific IRB accreditation, CRC/SMO structure, and dual sponsor/sponsor-investigator tracks.
China GCP (2020 Revision, NMPA/NHC)
China's drug clinical trial GCP — ICH E6(R2)-aligned since 2020, but layered with distinctive requirements (Ethics Committee filing, institution record-filing, Human Genetic Resources approval) with no ICH E6 analogue.
Australia TGA GMP (PIC/S PE009)
Australia's TGA GMP requirements — legally adopts the PIC/S Guide (PE009) via the Manufacturing Principles Determination, with its own annex exclusions, licence/GMP-clearance administrative layer, and edition-currency timing.
New Zealand GMP (Medsafe / NZ Code of GMP)
New Zealand's GMP requirements — Medsafe's near-verbatim PIC/S PE009-14 adoption under the Medicines Act 1981, distinct from but structurally near-identical to Australia's TGA adoption of the same guide.
Middle East
Saudi Arabia SFDA GMP
Saudi Arabia's drug GMP standard — the PIC/S-member SFDA's Guide to Good Manufacturing Practice, which is substantially PIC/S PE009 (EU GMP Vol. 4) text adopted near-verbatim rather than an independently-drafted Saudi instrument.
UAE Drug GMP (Emirates Drug Establishment)
UAE drug manufacturing GMP requirements — now primarily administered by the Emirates Drug Establishment (EDE), not MOHAP, following a 2025 federal reorganisation; MOHAP retains only pharmacy-level (non-manufacturing) licensing.
Africa
South Africa SAHPRA GMP
South Africa's SAHPRA drug GMP framework — wholesale incorporation of PIC/S PE 009 by reference, with SA-specific licensing, a dual-accountability Responsible Pharmacist role, and a codified GMP-reliance pathway (ZAZIBONA/WHO/PIC/S).
Nigeria NAFDAC GMP
Nigeria's NAFDAC drug GMP requirements — Africa's largest pharma market, PIC/S pre-applicant since May 2025, with the counterfeit-vs-GMP-gap distinction explicitly separated per case.
ISO
ISO/IEC 27001:2022 (Information Security Management)
Information security management system requirements — relevant given clinical/patient data.
ISO 9001:2015 (Quality Management Systems)
The generic Quality Management System standard many sector-specific systems build on.
ISO 13485:2016 (Medical Devices QMS)
Medical device quality management system requirements for regulatory purposes.
ISO 14155:2020 (Medical Device Clinical Investigations / GCP)
Good Clinical Practice for clinical investigations of medical devices.
ISO 14644 (Cleanrooms & Controlled Environments)
Cleanroom classification, monitoring, and testing for controlled manufacturing environments.
ISO 10993 (Biological Evaluation of Medical Devices)
Biocompatibility testing framework for medical devices.
ISO 14971:2019 (Medical Device Risk Management)
Risk management process for medical devices, referenced inside ISO 13485 but independently audited.
ISO/IEC 42001:2023 (Artificial Intelligence Management System)
AI management system requirements — the AI-governance counterpart to ISO 27001's security management system, relevant both to pharma/biotech AI adopters and to Regscribe's own AI-tool nature.
PCI
ICH
Data Protection
Supply Chain
Considered, not included
Researched and deliberately excluded, shown here for transparency rather than left unmentioned.
ISO 7101:2023 (Healthcare Organization Management)
Targets healthcare-delivery organizations (hospitals, clinics), not manufacturers or sponsors — no source found mentions pharma/biotech as an intended user, and its certification ecosystem is still an unaccredited pilot programme.
African Medicines Agency (AMA)
Pan-African AU treaty body coordinating joint GMP inspections and product assessments among national regulators — issues non-binding scientific opinions, not its own article-numbered, legally binding GMP standard. National regulators (see South Africa SAHPRA, Nigeria NAFDAC) retain actual licensing/inspection authority.
GCC Unified GMP Framework
The GCC Central Committee for Drug Registration harmonizes drug registration/dossier review and pricing across Gulf states, but no independently-authored GCC GMP technical standard was found — GMP inspection authority and substance remain national. See the Saudi SFDA and UAE GMP rubrics, which already capture the region's actual checkable GMP content.
PDA (Parenteral Drug Association) Technical Reports
A real, credible industry association, but — unlike every other framework here — its substantive technical content (aseptic processing, environmental monitoring, cleaning validation TRs, the exact topics requested) is sold through PDA's own bookstore ($180-325/document), not freely accessible; no primary text of those TRs could be read this session. The one confirmed freely-accessible document (TR 68, Drug Shortages) covers a narrow, different topic — building a 'PDA' entry from it alone would mislabel narrow content as broad coverage. Revisit if genuine TR access (membership, purchase, or a future PDA open-access release) is ever obtained.