The actual US drug manufacturing quality substance — distinct from Part 11's record-keeping rules.
21 CFR Parts 210 & 211 Audit-Readiness Rubric — Regscribe v0
(US Current Good Manufacturing Practice for Finished Pharmaceuticals)
This is distinct from the Part 11 rubric. Part 11 governs electronic records/signatures only. Parts 210/211 are the actual US drug manufacturing GMP substance — the predicate rule that Part 11 findings are so often scored against in the Part 11 rubric (e.g., 211.68(b), 211.180, 211.192, 211.194). Treat the two rubrics as companions: a single customer document (e.g., a batch record or an audit-trail export) can trigger findings in both.
Sources used
Regulatory text (structure, section numbers, section titles):
- eCFR.gov direct fetch was attempted first and blocked (redirected to
unblock.federalregister.gov, a bot-check page — consistent with prior Regscribe sessions per the Part 11 rubric's sourcing note).
- Structure/section-title extraction instead succeeded cleanly from two independent, free, primary/near-primary mirrors that agreed with each other:
- Part 211's structure has been stable for decades (last substantive subpart-level changes date to the 1978/1996 revisions); no reason to flag structural currency risk the way the EU GMP rubric had to for Chapters 4-6.
Enforcement / failure-pattern data (real FDA Warning Letters, 2025–2026):
- Direct fetch of FDA.gov warning-letter detail pages was attempted for four specific letters (Ava Inc., Tower Laboratories, Excelvision Fareva, International Laboratories Corp) and all four returned HTTP 404 to the fetch tool — FDA.gov appears to block or serve differently to automated fetch, the same pattern noted for the 2018 Data Integrity Q&A guidance in the Part 11 rubric. Worked around this the same way the Part 11 rubric's mirror strategy did: via secondary sources that themselves quote FDA Warning Letters verbatim, which is a materially different evidentiary tier than fabrication but weaker than a direct primary fetch — flagged per-citation below.
- Sources used for failure patterns (all consulted via web search/fetch this session):
- gmp-compliance.org / ECA Academy — FDA Warning Letter on missing Audit Trails and Raw Data Review (Aspen Pharmacare Holdings Limited, 24 Feb 2025)
- intuitionlabs.ai — FDA First AI cGMP Warning Letter (Purolea Cosmetics Lab, LLC, 2 Apr 2026)
- qbench.com — Inside 470 FDA Warning Letters From 2025 (aggregate stats across 148 lab-related 2025 letters, plus quoted findings for SV Labs Corporation and Chemspec Chemicals Private Limited)
- klyverity.com — FDA Warning Letters & Data Integrity (Missouri Analytical Laboratories, Laboratorio Magnachem International, Intas Pharmaceuticals)
- FDA.gov warning-letter index pages (titles/dates/docket numbers only, via search snippet, not full-text fetch) confirming the existence and filing dates of: Ava Inc. (721180, 04/14/2026), Lexia LLC (722251, 04/07/2026), CDL Services Inc. dba Technichem (713877, 11/24/2025), International Laboratories Corp (698522, 03/10/2025), Microbiological Testing & Consulting LLC (720374, 03/16/2026), Intas Pharmaceuticals Limited (721151, 03/30/2026), SV Labs Corporation (716503, 12/09/2025), Tower Laboratories Ltd (717456, 12/23/2025), Rhyz Analytical Labs (715298, 11/12/2025), Scientific Protein Laboratories LLC (712578, 10/10/2025), Excelvision Fareva (703245, 05/07/2025) — these are confirmed to exist and confirmed dates/docket numbers, but their full letter text was not independently fetched this session; the specific violation language attributed to them below comes from the secondary sources listed above, not a direct read of the FDA original. Flagged explicitly per-row.
- Statistical claim, flagged as unverified provenance: multiple secondary sources this session repeated the claim that "21 CFR 211.22(d) — failure to follow quality unit procedures — was the single most-cited 483/Warning Letter observation in FY2024, at 184 citations, four years running." This is a widely repeated industry statistic (appears in scilife.io and certaintysoftware.com summaries) but its ultimate primary source (FDA's own 483 Frequently Cited Observations data, or an aggregator's count) was not independently verified this session. Treat as directionally credible, numerically unverified.
- WebSearch budget was exhausted mid-session (200/200 calls used across this environment), which cut off two planned searches for Subpart G (packaging/labeling) and Subpart H (holding/distribution) specific warning-letter examples. Those two subparts below are flagged as using general/representative failure patterns rather than a named, dated 2025-2026 warning letter — do not treat their failure-pattern cells as sourced with the same rigor as the rest of this document.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
Failure-pattern cells are marked:
- [VERBATIM, secondary-sourced] — a real, named, dated 2025-2026 FDA Warning Letter, quoted via an industry secondary source (see Sources above), not independently confirmed against the FDA original this session.
- [REPRESENTATIVE] — a well-established, textbook-level failure mode for that clause, not tied to a specific 2025-2026 letter verified this session. Used only where the WebSearch budget ran out (Subparts G and H) or where a clause is a definitions/reference section with no enforcement history of its own.
PART 210 — General Provisions (brief)
Part 210 has only three sections and exists to establish that Part 211 is legally binding and to scope it. There is nothing to "gap-check" in Part 210 itself — it's the legal chassis Part 211 rides on — but the AI should use it to gate applicability before running any Part 211 check.
| # | Section | Requirement (plain language) | Citation |
|---|
| — | § 210.1 — Status of current good manufacturing practice regulations | Failure to comply with Part 210/211 renders a drug "adulterated" under FD&C Act §501(a)(2)(B), and the person responsible is subject to regulatory action — regardless of whether a drug's finished specifications are otherwise met. This is the clause that gives CGMP its legal teeth. | 21 CFR 210.1(a)-(b) |
| — | § 210.2 — Applicability | Where a drug is also a medical device combination product or other dual-regulated article, Part 211 applies except where it conflicts with more-specific regulations for that product class. | 21 CFR 210.2 |
| — | § 210.3 — Definitions | Defines "batch," "component," "drug product," "lot," "quality control unit," "quarantine," "strength," etc. — used to correctly classify entities before scoring (e.g., is a given material a "component" that triggers Subpart E, or in-process material scoped under Subpart F?). | 21 CFR 210.3(b) |
Scoring gate: confirm the entity is a finished-dosage-form drug manufacturer (or acts as one under contract) before applying Part 211 — Part 211 does not govern APIs (those fall under ICH Q7 guidance, not a CFR part) or dietary supplements (21 CFR Part 111).
PART 211 — Current Good Manufacturing Practice for Finished Pharmaceuticals
Subpart A — General Provisions
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 1 | Scope: Part 211 supplements Part 210 and sets the minimum CGMP for finished pharmaceuticals, including OTC products. | 21 CFR 211.1 | N/A — reference section, use for applicability gating | N/A |
| 2 | Definitions specific to Part 211 (e.g., "lot number," "acceptance criteria" language is inherited from 210.3). | 21 CFR 211.3 | N/A — reference section | N/A |
Subpart B — Organization and Personnel
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 3 | A Quality Control Unit (QCU) must exist with the actual authority (not just nominal responsibility) to approve/reject all components, containers, closures, in-process materials, packaging, labeling, and finished drug products, and to review production records; adequate lab facilities must be available to it. Responsibilities/procedures must be written and followed. | 21 CFR 211.22(a)-(d) | Org chart showing QCU reporting line and independence from Production; written QCU SOP; batch-disposition records showing QCU sign-off preceding release, not after | [VERBATIM, secondary-sourced] Widely reported as the single most-cited CGMP violation in FY2024 (per industry aggregation, ~184 citations, "four years running" — numeric claim unverified this session, see Sources note). Purolea Cosmetics Lab, LLC (WL, 2 Apr 2026): FDA found the firm used AI to draft specifications, procedures, and master batch records without adequate human QCU review, and cited this as a §211.22(c) violation — "If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP. Your failure to do so is a violation of 21 CFR 211.22(c)." When asked why process validation was missing, the firm's own defense was that "the AI agent... never told us [the validation] was required" — FDA rejected this outright. Ava Inc. (WL 721180, 14 Apr 2026, per FDA.gov index — full letter text not independently fetched) reportedly cited inadequate QCU oversight of manufacture/testing/release alongside shared-credential findings (also relevant to §211.68 below). |
| 4 | Personnel must have education/training/experience (or a combination) to perform assigned functions, with continuing training in CGMP as it relates to their job function, conducted by qualified individuals, with frequency sufficient to assure familiarity. | 21 CFR 211.25(a)-(c) | Training matrix mapped to role; CGMP training curriculum + completion records; qualification files (degree/experience) for QC analysts and production staff | [REPRESENTATIVE] Training-record gaps are a near-universal secondary finding attached to nearly every 2025 lab warning letter reviewed this session (SV Labs, Tower Laboratories, Rhyz — see Subpart I/J below) — investigators routinely note inadequate training as compounding the primary investigation/audit-trail failure rather than as a standalone citation. |
| 5 | Personnel must wear protective clothing as necessary, practice good sanitation/health habits, and any person with an apparent illness/open lesion that could adversely affect drug safety must be excluded from direct contact with components/products until the condition is corrected (or under supervisory determination it wouldn't compromise safety). | 21 CFR 211.28(a)-(d) | Gowning SOP + records; health-declaration/exclusion policy; training records on personnel hygiene practices | [REPRESENTATIVE] Common in sterile/aseptic-manufacturing warning letters as a contributing factor to environmental-monitoring excursions, typically cited alongside §211.42/§211.113 rather than standing alone. |
| 6 | Consultants advising on manufacture/processing/packing/holding of drugs must have sufficient education/training/experience to advise on the subject they're retained for, and records must be maintained stating their name, address, and the type of service provided. | 21 CFR 211.34 | Consultant qualification file + signed scope-of-service record; consultant list maintained by QA | [REPRESENTATIVE] Low-enforcement-volume clause — rarely the primary citation in a warning letter, but frequently absent entirely in smaller/newer manufacturers per general industry commentary; worth a binary check (does a consultant register exist at all) similar to how the Part 11 rubric flags the §11.100(c) certification letter as an easy binary check. |
Subpart C — Buildings and Facilities
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 7 | Buildings must be of suitable size/construction/location to facilitate cleaning, maintenance, and proper operations, including specific aseptic-processing design features (air filtration, HEPA systems, airlocks, contamination-prevention design) under §211.42(c)(10). | 21 CFR 211.42(a)-(c) | Facility layout/design documentation; HVAC/HEPA qualification records; airlock/gowning-room design specs for aseptic areas | [VERBATIM, secondary-sourced] Excelvision Fareva (WL 703245, 7 May 2025, per FDA.gov index — text via secondary source): cited for failing "to establish an adequate system for cleaning and disinfecting the room and equipment to produce aseptic conditions and an adequate system for maintaining equipment used to control the aseptic conditions (21 CFR 211.42(c)(10)(v) and 211.42(c)(10)(vi))." Industry-aggregate data (redica.com) reports design/construction (§211.42) as a leading deficiency at roughly 22% of aseptic-facility inspections reviewed, concentrated in sterile manufacturing sites. |
| 8 | Adequate lighting in all working/storage areas. | 21 CFR 211.44 | Lighting spec/lux-level records for QC and production areas | [REPRESENTATIVE] Rarely cited standalone. |
| 9 | Adequate ventilation with air-filtration/heating/cooling equipment as necessary, including for the control of airborne contamination in aseptic areas. | 21 CFR 211.46(a)-(d) | HVAC qualification/requalification records; differential-pressure monitoring logs | [REPRESENTATIVE] Frequently co-cited with §211.42/§211.113 aseptic-processing findings rather than standalone. |
| 10 | Potable water systems; non-potable water/steam not connected in a way that could contaminate; adequate drainage; no backflow into drug-water systems. | 21 CFR 211.48 | Water-system qualification (WFI/purified water validation), backflow-prevention design records | [REPRESENTATIVE] Common in facility-inspection findings for older sites; not among the failure patterns independently confirmed this session. |
| 11 | Adequate washing/cleaning facilities including hot/cold water, soap/detergent, air-driers or single-service towels, and clean toilet facilities easily accessible. | 21 CFR 211.52 | Facility walk-through records; maintenance logs for wash stations | [REPRESENTATIVE] Low enforcement-volume standalone. |
| 12 | Sewage, trash, and other refuse must be disposed of in a safe/sanitary/timely manner. | 21 CFR 211.50 | Waste-disposal SOP + logs | [REPRESENTATIVE] Low enforcement-volume standalone. |
| 13 | Buildings must be free of infestation, maintained in clean/sanitary condition, with written procedures for use of rodenticides/insecticides/fungicides/cleaning agents to prevent contamination of equipment/components/product; sanitation procedures must be followed. | 21 CFR 211.56(a)-(d) | Pest-control contracts/logs; sanitation SOP + cleaning logs; approved-cleaning-agent list | [REPRESENTATIVE] A frequent contributing citation in sterile-facility warning letters, typically bundled with §211.42/§211.113 findings rather than standing alone in the sources reviewed this session. |
| 14 | Buildings must be maintained in good repair. | 21 CFR 211.58 | Facility maintenance/repair work-order records | [REPRESENTATIVE] Low enforcement-volume standalone. |
Subpart D — Equipment
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 15 | Equipment must be of appropriate design/size/location for its intended use, to facilitate cleaning/maintenance, and for its proper function. | 21 CFR 211.63 | Equipment qualification (IQ/OQ) records; equipment layout/design rationale | [REPRESENTATIVE] |
| 16 | Equipment surfaces contacting components/product must not be reactive/additive/absorptive so as to alter drug safety/identity/strength/quality/purity; lubricants/coolants contacting product-contact surfaces must not contaminate. | 21 CFR 211.65(a)-(b) | Materials-of-construction certification; lubricant/coolant approved-list with food/pharma-grade justification | [REPRESENTATIVE] |
| 17 | Written procedures for equipment cleaning/maintenance (including schedules) must exist and be followed; records of cleaning/maintenance/use must be kept per §211.182. | 21 CFR 211.67(a)-(c) | Cleaning/maintenance SOP; equipment cleaning validation (swab/rinse data); equipment log (cross-references §211.182 below) | [REPRESENTATIVE] Cleaning-validation gaps (carryover limits not scientifically justified, no worst-case swab locations) are a recurring theme in redica.com's aggregate 2025 findings on cross-contamination, mirroring the same pattern the EU GMP rubric documents for MHRA — this is a case where the US and EU failure modes converge almost exactly. |
| 18 | Automatic, mechanical, or electronic equipment (including computers) used in manufacturing/processing/packing/holding must be routinely calibrated/inspected/checked per a written program; and if used for production/QC record-keeping, appropriate controls must be exercised over computer/related systems to assure changes are instituted only by authorized personnel, input/output is checked for accuracy, and a backup file of data is maintained except where some data may be unrecoverable (e.g., raw data captured only in a permanent chart form). | 21 CFR 211.68(a)-(b) | Calibration program + records; user-access control matrix (role-based, no shared logins); audit-trail configuration evidence; backup/restore validation | [VERBATIM, secondary-sourced] This is the most consequential single clause of Part 211 for a document-analysis tool, since it's the predicate rule the Part 11 rubric's audit-trail/access-control findings ultimately cite. Aspen Pharmacare Holdings Limited (WL, 24 Feb 2025): cited under §211.68(a)/(b) after operators "selectively recorded and printed only passed filter integrity tests, while omitting negative test results across multiple days," with Production and QA failing to review the electronic raw data and audit trail that would have caught it. Ava Inc. (WL 721180, per index/secondary source): "failed to exercise appropriate controls over computer or related systems to assure that only authorized personnel institute changes in master production and control records... lacked adequate system security and access controls over laboratory equipment used to test drug products" — shared HPLC credentials. Missouri Analytical Laboratories (per klyverity.com, originally a 2021 letter but still commonly cited as the template case): no individual user accounts, "36 electronic data files that had been deleted," quality decisions made on unvalidated spreadsheets. Laboratorio Magnachem International (per klyverity.com, June 2024): failed to maintain "strict control over CGMP electronic data," could not ensure "additions, deletions, or modifications were authorized and properly documented." |
| 19 | Filters for liquid filtration used in manufacture/processing/packing of injectable drugs may not release fiber into the product; asbestos-containing filters are prohibited regardless. | 21 CFR 211.72 | Filter-material certification; validation data showing no fiber-shedding for the specific filter/product combination | [REPRESENTATIVE] Narrow, low-volume clause; primarily relevant to sterile injectable manufacturers. |
Subpart E — Control of Components and Drug Product Containers and Closures
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 20 | Written procedures describing receipt, identification, storage, handling, sampling, testing, and approval/rejection of components and containers/closures must exist and be followed. | 21 CFR 211.80(a)-(d) | Incoming-materials SOP; receiving log with lot-level traceability | [REPRESENTATIVE] |
| 21 | Components/containers/closures must be held under quarantine until sampled/tested/examined and released by the QCU; rejected materials must be identified/controlled to prevent use. | 21 CFR 211.82, 211.89 | Quarantine area/status labeling (physical or electronic system); reject-log with disposition records | [REPRESENTATIVE] |
| 22 | Representative samples must be tested/examined against written specifications for conformity before use; supplier's Certificate of Analysis may substitute for one specific test only if the manufacturer establishes the reliability of the supplier's analyses through periodic validation and an on-site audit. | 21 CFR 211.84(a)-(d) | Sampling plan (statistically valid); supplier-qualification/audit records supporting any CoA-reliance decision | [REPRESENTATIVE] Supplier-qualification failures were reported as the 4th most common lab-inspection deficiency in the qbench.com 2025 aggregate (34 of 148 letters, 23%) — relying on a CoA without the underlying periodic-validation/audit evidence required by 211.84(d) is the specific mechanism behind many of those citations. |
| 23 | Only approved, unexpired components/containers/closures may be used, on a first-in-first-out basis when practical. | 21 CFR 211.86 | Inventory/lot-rotation records | [REPRESENTATIVE] |
| 24 | Approved components/containers/closures held long enough to raise doubt about suitability must be re-examined/re-tested as appropriate. | 21 CFR 211.87 | Requalification/retest SOP tied to a defined holding-time trigger | [REPRESENTATIVE] |
| 25 | Drug product containers/closures must not be reactive/additive/absorptive, must meet USP/NF standards where designated (e.g., light-resistance), and closures must provide adequate protection. | 21 CFR 211.94(a)-(e) | Container/closure qualification/compatibility studies | [REPRESENTATIVE] |
Subpart F — Production and Process Controls
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 26 | Written production/process-control procedures (designed to assure the drug product has the identity/strength/quality/purity it purports) must be followed and documented at the time of performance; any deviation must be recorded and justified. | 21 CFR 211.100(a)-(b) | Master batch records + executed batch records showing contemporaneous entries; deviation log | [VERBATIM, secondary-sourced] Purolea Cosmetics Lab, LLC (WL, 2 Apr 2026): the AI-generated master batch records/specifications lacking required process validation were also framed as a §211.100 gap alongside the §211.22(c) QCU-oversight citation above — the FDA explicitly rejected "the AI agent never told us" as an excuse for a missing validation requirement. Generic FDA finding language repeated across multiple 2025 letters per qbench.com's aggregate: "Your firm failed to establish written procedures for production and process control designed to assure drug products [have the identity, strength, quality, and purity they purport]." |
| 27 | Written procedures for charge-in of components must be followed; identity/status of major equipment must be documented in batch records or by a log. | 21 CFR 211.101, 211.105 | Batch-record component charge-in verification (often a second-person check); equipment-use log | [REPRESENTATIVE] |
| 28 | Actual yields and percentages of theoretical yield must be calculated at appropriate phases and investigated if a discrepancy exceeds a preset limit. | 21 CFR 211.103 | Yield-calculation records in batch record; yield-reconciliation SOP with investigation trigger threshold | [REPRESENTATIVE] |
| 29 | Written procedures for sampling/testing in-process materials must be followed, including monitoring of process-validation parameters, in-process specifications derived from prior acceptable process average/variability, and rejection where results don't meet specs. | 21 CFR 211.110(a)-(c) | In-process control SOP; process-validation report; in-process test data trended against specification limits | [REPRESENTATIVE] |
| 30 | Time limitations for production phases must be established and followed where control of the time itself is a quality factor (e.g., holding times between manufacturing steps). | 21 CFR 211.111 | Hold-time studies/validation; batch-record time-stamps checked against approved limits | [REPRESENTATIVE] |
| 31 | Appropriate written procedures designed to prevent microbiological contamination of drug products purporting to be sterile must exist, including validation of all aseptic/sterilization processes. | 21 CFR 211.113(a)-(b) | Environmental monitoring program + data; aseptic-process simulation (media-fill) records; sterilization-cycle validation | [VERBATIM, secondary-sourced] Excelvision Fareva (WL 703245, 7 May 2025): "failed to establish and follow appropriate written procedures that are designed to prevent microbiological contamination of drug products purporting to be sterile, and that include validation of all aseptic and sterilization processes (21 CFR 211.113(b))" — cited alongside the §211.42(c)(10) facility-design finding above, illustrating how facility-design and process-control gaps compound in a single aseptic-manufacturing letter. |
| 32 | Reprocessing of a batch that does not conform to standards is permitted only per written procedures that include an evaluation confirming reprocessed batches meet all specifications. | 21 CFR 211.115(a)-(b) | Reprocessing SOP + QCU-approved evaluation records for each reprocessing event | [REPRESENTATIVE] |
Subpart G — Packaging and Labeling Control
(WebSearch budget exhausted before a subpart-specific 2025-2026 warning letter search could be run — all failure-pattern cells below are [REPRESENTATIVE], not tied to a named letter verified this session. Flagging this as a follow-up item.)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 33 | Written procedures for examining/using packaging and labeling materials must prevent mix-ups, including physical/spatial segregation of operations for different products/strengths, and destruction of obsolete/superseded labeling. | 21 CFR 211.122(a)-(g) | Label/packaging-material reconciliation records; line-clearance SOP + logs; destroyed-labeling disposal log | [REPRESENTATIVE] Classic industry failure mode: label mix-ups from inadequate line clearance between product changeovers, or obsolete labeling not destroyed/accounted for. |
| 34 | Strict control over issuance of labeling, including reconciliation of labeling issued/used/returned/destroyed, investigated if discrepancies exceed acceptable limits. | 21 CFR 211.125(a)-(e) | Label-issuance/reconciliation log tied to batch record | [REPRESENTATIVE] |
| 35 | Packaging/labeling operations must have adequate controls to ensure only correctly labeled containers proceed, including identifying unlabeled containers held/carried between operations and 100% examination or validated control of labeled units. | 21 CFR 211.130(a)-(e) | Line-clearance and in-process labeling verification records; validated online labeling-inspection system data | [REPRESENTATIVE] |
| 36 | Tamper-evident packaging required for most OTC human drug products, with a labeling statement alerting consumers to the specific tamper-evident feature. | 21 CFR 211.132(a)-(c) | Packaging design spec showing tamper-evident feature; label copy showing the required consumer-alert statement | [REPRESENTATIVE] |
| 37 | Finished product must undergo a visual examination during finishing operations of labeling to confirm conformity. | 21 CFR 211.134 | Finished-goods inspection records | [REPRESENTATIVE] |
| 38 | Expiration date must appear on label, supported by stability testing (per §211.166); where no expiration dating is required, still must have appropriate storage-condition labeling. | 21 CFR 211.137(a)-(g) | Stability data supporting the assigned shelf-life; label copy review | [REPRESENTATIVE] Directly linked to Subpart I's §211.166 stability-testing requirement below — model as one evidence chain. |
Subpart H — Holding and Distribution
(Same WebSearch-budget caveat as Subpart G — failure patterns below are [REPRESENTATIVE].)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 39 | Written warehousing procedures must ensure appropriate storage conditions (temperature/humidity/light as applicable) and quarantine of drug products before release; obsolete/rejected product must be identified/controlled. | 21 CFR 211.142(a)-(b) | Warehouse environmental-monitoring records; quarantine-area status controls | [REPRESENTATIVE] Common failure mode: temperature-excursion events in warehousing not linked to a deviation/CAPA record — directly analogous to the EU GDP cold-chain findings documented in the companion EU GMP/GDP rubric. |
| 40 | Written distribution procedures must exist, including a system for oldest-approved-stock distribution first where feasible, and one that permits recall of any batch. | 21 CFR 211.150(a)-(b) | Distribution/lot-traceability records; documented mock-recall exercise | [REPRESENTATIVE] A firm's inability to trace/recall a specific lot quickly during a mock exercise is the standard way this clause gets tested in practice — directly mirrors the EU GDP Ch.6 recall-effectiveness requirement in the companion rubric. |
Subpart I — Laboratory Controls
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 41 | General requirement for scientifically sound laboratory controls including specifications/standards/sampling plans/test procedures designed to assure components and drug products conform to identity/strength/quality/purity, including any required limits on objectionable microorganisms. | 21 CFR 211.160(a)-(b) | Specification documents; validated test methods; sampling plans with statistical justification | [VERBATIM, secondary-sourced] An August 2025 inspection (per redica.com/industry summary) of a Lynden, Washington facility found the firm "failed to establish scientifically sound and appropriate specifications for objectionable microorganisms," part of a broader §211.160-adjacent microbiological-testing gap. |
| 42 | Any unexplained discrepancy or failure of a batch/component to meet specifications must be thoroughly investigated, whether or not the batch has already been distributed, extending to other batches/products that may be associated with the failure. | 21 CFR 211.192 | OOS/deviation investigation SOP; investigation reports showing root-cause analysis and scope-extension assessment to other batches | [VERBATIM, secondary-sourced] This is the single highest-volume laboratory-controls citation in the 2025 data reviewed (qbench.com: 50 of 148 lab-related letters, 34%, cited failure to investigate OOS/discrepancies). Named examples per FDA.gov index (dates/dockets confirmed; full-text via secondary source): SV Labs Corporation (716503, 9 Dec 2025) — "failure to thoroughly investigate any unexplained discrepancy or failure of a batch or any of its components to meet any of its specifications (21 CFR 211.192)"; Tower Laboratories Ltd (717456, 23 Dec 2025) — same clause, same finding language; Rhyz Analytical Labs (715298, 12 Nov 2025) — same clause cited again. The recurrence of near-identical finding language across three separate, unrelated firms in a two-month window is itself notable and suggests this is FDA's current standard citation template for the clause. Also per qbench.com: in 23 of 148 letters (16%), firms had released batches without conducting or completing required testing at all — a related but distinct failure mode (see §211.165 below). |
| 43 | Each batch must be tested/examined for conformance to specifications before release/distribution (identity test at minimum for each component; full testing for the finished product per validated methods). | 21 CFR 211.165(a)-(e) | Batch release testing records tied to validated test methods; QCU release sign-off | [VERBATIM, secondary-sourced] Directly maps to the qbench.com finding that in 23 of 148 (16%) 2025 lab-related letters, firms released batches without conducting or completing required testing — a release-integrity failure distinct from (but often paired with) the investigation failures under §211.192 above. |
| 44 | Stability testing program must be established to determine appropriate storage conditions and expiration dates, using reliable/meaningful/specific test methods, with reserve samples tested per an approved protocol. | 21 CFR 211.166(a)-(c) | Stability protocol + data (real-time and/or accelerated per ICH); annual stability program schedule | [REPRESENTATIVE] Per qbench.com aggregate: stability testing absent/inadequate was cited in 12 of 148 (8%) 2025 lab-related letters — a real, if lower-volume, 2025 finding category, though no single named-company example was independently pulled through to full text this session. |
| 45 | Special testing requirements for certain dosage forms (e.g., sterility testing for parenterals per USP, pyrogen/endotoxin testing) beyond the general §211.160/165 requirements. | 21 CFR 211.167(a)-(c) | Sterility/endotoxin test records for applicable product types | [REPRESENTATIVE] |
| 46 | Reserve samples of each lot of active ingredient and, for certain products, each lot of finished drug product must be retained for defined periods (generally 1 year past expiration for finished product, 3 years past distribution for active ingredient) in appropriate conditions. | 21 CFR 211.170(a)-(b) | Reserve-sample inventory/retention log with storage-condition monitoring | [REPRESENTATIVE] |
| 47 | Animals used in testing components/products/materials for compliance must be maintained/controlled to assure suitability for intended use, identified, and adequate records maintained. | 21 CFR 211.173 | Animal-testing facility records (rarely applicable outside biologics/certain vaccine contexts) | [REPRESENTATIVE] Narrow applicability; low relevance to most Regscribe finished-pharma customers. |
| 48 | Specific penicillin cross-contamination control requirements — where a facility handles both penicillin and non-penicillin drugs, non-penicillin products must be tested for penicillin contamination if there's a reasonable possibility of exposure. | 21 CFR 211.176 | Penicillin cross-contamination risk assessment + test records (only applicable to facilities handling penicillin-class products) | [REPRESENTATIVE] Narrow, product-class-specific clause. |
Subpart J — Records and Reports
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 49 | General record-keeping: all records required under Part 211 must be retained for at least 1 year past the batch's expiration date (or 3 years past distribution if no expiration date), be readily available for authorized inspection/copying/photocopying at the establishment, and (where records are stored off-site) be retrievable within a reasonable time. | 21 CFR 211.180(a)-(e) | Retention schedule + archive/retrieval SLA documentation; sample record-retrieval test | [REPRESENTATIVE] This is the clause the Part 11 rubric explicitly cross-references (as 211.180(c)/(d)) when scoring Part 11's enforcement-discretion clauses §11.10(b)/(c) — see that rubric's Tier-2 mapping. |
| 50 | Written procedures for equipment cleaning/maintenance schedules must be documented in individual equipment logs, including date/time, product/lot processed, and identity of the person performing cleaning/maintenance. | 21 CFR 211.182 | Equipment cleaning/use log (per-unit, chronological) | [REPRESENTATIVE] Blank or backdated equipment logs are a classic contemporaneous-documentation finding, structurally identical to the "records completed retrospectively" pattern documented under EU GMP Ch.4 in the companion rubric. |
| 51 | Records for each shipment of components/containers/closures received and used, with full lot traceability. | 21 CFR 211.184(a)-(f) | Incoming-materials receipt/usage log with lot genealogy | [REPRESENTATIVE] |
| 52 | Master production and control records for each product/batch size/type must be prepared, dated, signed by one person and independently checked/verified/dated by a second person, and must include complete manufacturing/control instructions. | 21 CFR 211.186(a)-(b) | Master batch record with dual sign-off (author + independent verifier) | [REPRESENTATIVE] Also the clause underlying the Aspen Pharmacare and Ava Inc. §211.68(a) findings above, which specifically concern unauthorized/unreviewed changes to master production and control records. |
| 53 | Batch production and control records must be prepared for each batch, include complete information relating to production/control of that batch, and be checked before issuance to assure accuracy/completeness/current-version status. | 21 CFR 211.188(a)-(b) | Executed batch record; batch-record issuance-control log (version-controlled) | [REPRESENTATIVE] |
| 54 | Batch production/control records (including lab-control records) must be reviewed by the QCU to determine compliance with all written procedures before a batch is released/distributed; any unexplained discrepancy must be investigated per §211.192. | 21 CFR 211.192 | (see row 42 above — same clause governs both the review and the investigation trigger) | (see row 42) |
| 55 | Laboratory records must include complete data from all tests, including a description of methods, dates, and the identity of the individual performing the test; records must include a statement of each method's reliability/accuracy/precision for the intended use. | 21 CFR 211.194(a)-(e) | Complete lab notebook/LIMS records with method validation reference; second-person review documentation | [VERBATIM, secondary-sourced] Per qbench.com, systemic lab-documentation weakness is the near-universal theme across the 2025 dataset ("469 of 470 letters cited documentation, records, or written-procedure violations" across all FDA program areas, not just drugs). SV Labs Corporation's letter framed its violations as reflecting "fundamental weaknesses" spanning laboratory controls, documentation practices, and data-integrity controls together — illustrating how §211.194 findings rarely stand alone from §211.192/§211.68 in practice. |
| 56 | Distribution records must contain enough information to facilitate a recall if necessary (lot number, quantity, name/address of consignee, date/quantity shipped). | 21 CFR 211.196 | Distribution/shipping log with full lot-to-consignee traceability | [REPRESENTATIVE] Directly ties to the §211.150 recall-capability requirement above. |
| 57 | Written procedures for handling written/oral complaints must exist; records of complaints (including those not initially believed to warrant investigation) must be maintained, with defined criteria for when a complaint requires investigation, and complaints involving possible product defect/tampering/safety issue must always be investigated. | 21 CFR 211.198(a)-(b) | Complaint-handling SOP; complaint log with investigation-trigger criteria and disposition | [REPRESENTATIVE] Per qbench.com, complaint-handling failures were cited in 13 of 148 (9%) 2025 lab-related letters — a real, confirmed-volume 2025 finding category, though no single named-company full-text example was pulled through this session. |
Subpart K — Returned and Salvaged Drug Products
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 58 | Returned drug products must be identified/held/(if appropriate) destroyed unless examination/testing/other investigation shows the product meets specifications for identity/strength/quality/purity; if labeling/packaging indicates storage/handling was inadequate, or if there's a possibility the product was subject to improper storage, it may not be salvaged for reprocessing/reintroduction. | 21 CFR 211.204(a)-(c) | Returned-goods disposition SOP; per-batch return evaluation records (chain-of-custody + storage-condition evidence) | [REPRESENTATIVE] Structurally identical to the EU GDP Ch.6 "returns to saleable stock" 5-condition test documented in the companion EU GMP/GDP rubric — worth modeling as a shared evidence node across both rubrics. |
| 59 | Drug products subject to salvaging (e.g., due to a fire/flood/other disaster) may be reprocessed only if there is evidence the products meet all applicable standards; such evidence, including any available stability data, must be part of the record. | 21 CFR 211.208 | Salvage-evaluation report + supporting stability/testing data | [REPRESENTATIVE] Low enforcement-volume; disaster-triggered, situational clause. |
Cross-reference: where 210/211 findings feed the Part 11 rubric
Per the Part 11 rubric's own Tier-2 logic (§11.10(a),(b),(c),(k)(2) discounted under Part 11 itself but scored against the predicate rule), the direct mappings are:
| Part 11 clause | Part 211 predicate clause (this rubric) |
|---|
| §11.10(a) validation | §211.68(a) (equipment/computer system suitability for intended use) |
| §11.10(b) copies for inspection | §211.180(c)/(d) (record availability/retrievability) |
| §11.10(c) retention/retrievability | §211.180(c)/(d) |
| §11.10(d) access control | §211.68(b) (authorized-personnel-only changes to records) |
| §11.10(e) audit trail | §211.68(b) and §211.192/§211.194 (record review, investigation of discrepancies) |
| §11.10(g) authority checks | §211.68(b), §211.22(a) (QCU approval authority) |
Recommendation: extend the Part 11 rubric's shared "Evidence Type" layer (audit_trail_config, access_control_matrix, capa_log, etc.) to reference these Part 211 clause numbers directly, the same way it already models the EU Annex 11 overlap — this rubric is the third leg of that same evidence-sharing model, not a fourth silo.
Gaps / follow-ups before this goes into production scoring
- eCFR.gov fetch was blocked the same way it was for the Part 11 rubric — structure/section-title data instead came from Cornell LII and GovInfo.gov's official XML codification, cross-checked against each other with no discrepancies. Confidence in the structural/citation data (Parts 210/211 section numbers and titles) is high; this is stable, decades-old regulatory text.
- FDA.gov warning-letter detail pages returned HTTP 404 to direct fetch for all four letters attempted (Ava Inc., Tower Laboratories, Excelvision Fareva, International Laboratories Corp). All failure-pattern quotes in this document instead come from secondary sources (ECA/gmp-compliance.org, intuitionlabs.ai, qbench.com, klyverity.com, redica.com) that themselves quote the FDA letters. This is a real gap versus the Part 11 rubric's sourcing, which appears to have achieved cleaner direct FDA.gov fetches in its own session — recommend a follow-up pass that retries direct FDA.gov fetch (possibly via a different user-agent/approach, or manual download) for the ~11 confirmed-real warning letters named above, to upgrade their status from [VERBATIM, secondary-sourced] to primary-verified.
- WebSearch budget was exhausted mid-session (200/200), cutting off targeted searches for Subpart G (Packaging/Labeling) and Subpart H (Holding/Distribution) specific 2025-2026 warning letters. Every failure-pattern cell in those two subparts is marked [REPRESENTATIVE] rather than tied to a real, dated letter — this is the single biggest gap in this rubric relative to the sourcing standard the existing GMP/GDP and Part 11 rubrics hit. Recommend a dedicated follow-up session (with a fresh search budget) targeting: "FDA warning letter 211.122 OR 211.130 label mix-up 2025", "FDA warning letter 211.142 OR 211.150 warehousing distribution recall 2025".
- The "184 citations / four years running" statistic for §211.22(d) is repeated across multiple industry-commentary sites but its ultimate primary source (FDA's own annual 483 "Inspectional Observations" frequency data) was not independently pulled and verified this session. Treat the number itself as unverified even though the underlying claim (§211.22 quality-unit findings are the most common CGMP citation) is corroborated by the volume and severity of 2025-2026 examples independently found in this session.
- Unlike the EU GMP/GDP rubric (which had access to structured MHRA deficiency-count data by chapter) and the Part 11 rubric (clean guidance-document access), this rubric currently has no aggregate frequency/severity table by subpart — only the qbench.com 148-letter aggregate (which spans multiple CFR parts, not Part 211 alone) provides any quantification. If Regscribe wants a severity-weighting model for 210/211 similar to the MHRA-deficiency-driven weighting in the EU rubric, the right next primary source to chase is FDA's own CDER/CBER "483 Inspectional Observations" annual frequency report (published annually, typically as a PDF/dataset on fda.gov) — not yet attempted this session.