What cGMP means
What Is cGMP? Understanding cGMP Meaning and Purpose
Current Good Manufacturing Practice (cGMP) is FDA’s minimum standard for how products are made, tested, stored and released. The “c” means your methods must reflect current practice, not only the rule’s text. A product made outside cGMP is adulterated under the law, even if it tests fine.
Who Must Follow cGMP Standards?
- Pharmaceutical drug manufacturers (prescription, OTC, generics, compounded drugs, and biologics)
- Medical device manufacturers, specification developers, contract manufacturers, sterilizers, and remanufacturers
- Dietary supplement producers, packagers, holders, and own-label distributors
- Food and beverage manufacturers, processors, warehousers, and importers subject to FSMA
- Cosmetic and personal care product manufacturers and responsible persons under MoCRA
- Tobacco product manufacturers, importers, and any establishment producing finished tobacco products
- Blood, plasma, tissue, and biologics establishments
- Active pharmaceutical ingredient (API) and excipient manufacturers
- Contract testing laboratories, repackagers, relabelers, and third-party logistics providers
- Foreign manufacturing establishments shipping product into the U.S. (subject to FDA foreign inspection)
Industries and Corresponding CFR Regulatory Standards
cGMP requirements are codified in Title 21 of the Code of Federal Regulations (CFR). Each regulated industry has its own dedicated part, supplemented by FDA guidance documents, ICH harmonized standards, and — increasingly — international consensus standards such as ISO 13485 for devices. The table below summarizes the regulatory standards that apply to each industry:
| Industry | CFR Citation / Regulatory Standard | Common Reference |
|---|---|---|
| Drugs | 21 CFR Parts 210 and 211 | Drug cGMP |
| Biologics | 21 CFR Parts 600–680, plus 210 and 211 | API GMP |
| Medical devices | 21 CFR Part 820 (QMSR, incorporating ISO 13485:2016) | QSR / QMSR |
| Dietary Supplements | 21 CFR Part 111 | DS cGMP |
| Food (Human) | 21 CFR Part 117, Subpart B | Preventive Controls / cGMP |
| Food (Animal) | 21 CFR Part 507 | Animal Food cGMP |
| Cosmetics | FDA rule required by MoCRA, not yet issued; ISO 22716 is the benchmark | Cosmetic GMP |
| Biologics | 21 CFR Parts 600–680 | Biologics cGMP |
| Tobacco Products | Required by FD&C Act 906(e); FDA's 2023 proposed rule not yet final | Tobacco Manufacturing Practice |
| Blood & Plasma | 21 CFR Parts 606 & 640 | Blood cGMP |
The eight pillars we assess
Detailed Requirements
Quality system and quality unit · Personnel and training · Facilities and equipment · Production and process controls · Documentation and records · Laboratory controls · CAPA, deviations and complaints · Supplier and contractor control
cGMP Standards for Drugs
Regulatory standard: 21 CFR Part 210 (general cGMP) and 21 CFR Part 211 (finished pharmaceuticals), supplemented by ICH Q7 for active pharmaceutical ingredients and ICH Q8, Q9, Q10, and Q11 for product lifecycle and quality risk management.
What it covers: Prescription drugs, OTC drugs, generic drugs, biologics, sterile injectables, compounded drugs (outsourcing facilities under Section 503B), and APIs intended for U.S. drug products.
Core requirements to comply:
- An independent Quality Unit with authority to approve or reject all components, in-process materials, packaging, labeling, and finished products
- Validated manufacturing processes with documented evidence the process consistently delivers product meeting predetermined specifications
- Qualified facilities, utilities (water for injection, HVAC, compressed gases), and equipment with formal IQ/OQ/PQ
- Written master production and control records, with each batch documented in a batch production record
- Identity testing of every lot of incoming components and full identity/strength/quality/purity testing of finished product
- Stability programs supporting expiration dating, with ongoing stability for marketed product
- Investigation of every out-of-specification (OOS), out-of-trend (OOT), and deviation, with documented root cause and CAPA
- Annual Product Quality Reviews (APQRs) and management review of quality metrics
- Lot traceability from incoming raw material through customer distribution to support recalls
cGMP Standards for Medical Devices
Regulatory standard: 21 CFR Part 820 — the Quality System Regulation (QSR) — which the FDA has finalized as the Quality Management System Regulation (QMSR) harmonized with ISO 13485:2016. The QMSR’s phased transition is currently underway, and device manufacturers should already be aligning their QMS to ISO 13485 expectations.
What it covers: Class I, II, and III medical devices, in vitro diagnostics (IVDs), combination products on the device side, and software as a medical device (SaMD).
Core requirements to comply:
- Management responsibility — documented quality policy, quality objectives, and regular management review
- Design controls for Class II and Class III devices: design inputs, outputs, reviews, verification, validation, transfer, and design history file (DHF)
- Document and record controls, including a device master record (DMR) and device history record (DHR) for each batch
- Purchasing controls with formally qualified suppliers and supplier agreements
- Production and process controls with process validation for processes whose output cannot be fully verified by inspection
- Corrective and preventive action (CAPA) system as the backbone of continuous improvement
- Complaint handling, medical device reporting (MDR), and adverse event reporting
- Unique Device Identification (UDI) compliance and labeling controls
- Installation, servicing, and post-market surveillance where applicable
cGMP Standards for Dietary Supplements
Regulatory standard: 21 CFR Part 111. The Dietary Supplement Health and Education Act (DSHEA) established the category, and Part 111 sets out the cGMPs for manufacturing, packaging, labeling, and holding operations.
What it covers: Vitamins, minerals, herbal and botanical products, amino acids, enzymes, probiotics, sports nutrition products, and any other product meeting the DSHEA definition of a dietary supplement.
Core requirements to comply:
- Identity verification of every incoming dietary ingredient — typically by validated methods such as HPLC, FTIR, microscopy, or DNA testing
- Written master manufacturing records (MMRs) for each unique formulation, batch size, and packaging configuration
- Batch production records (BPRs) documenting every step of each batch
- Specifications for components, in-process materials, finished products, and packaging — each with scientifically valid test methods
- Qualified personnel with documented training in cGMP and assigned responsibilities
- Sanitation, pest control, and physical plant requirements appropriate for ingestible products
- Holding and distribution controls with traceability from receipt of components through finished product distribution
- Written procedures for receiving, investigating, and responding to product complaints and serious adverse event reports
- Reserve sample retention for each batch of finished dietary supplement
cGMP Standards for Food
Regulatory standard: 21 CFR Part 117 (Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food) under the Food Safety Modernization Act (FSMA). Animal food is governed by 21 CFR Part 507. Additional rules cover produce safety (Part 112), foreign supplier verification (Part 1, Subpart L), and intentional adulteration (Part 121).
What it covers: All FDA-regulated human food, beverages, ingredients, dietary ingredients prior to incorporation, and animal food including pet food and livestock feed.
Core requirements to comply:
- A written Food Safety Plan including hazard analysis and risk-based preventive controls (HARPC)
- Preventive controls for process, food allergens, sanitation, and supply-chain hazards
- Oversight by a Preventive Controls Qualified Individual (PCQI)
- Written recall plan with mock recalls and traceability one-up/one-back at a minimum
- Sanitation programs, GMP training, employee hygiene, and allergen cross-contact controls
- Environmental monitoring for ready-to-eat foods where contamination is a concern
- Foreign Supplier Verification Programs (FSVPs) for importers of food into the U.S.
- Records demonstrating implementation, monitoring, verification, and validation of all controls
cGMP Standards for Cosmetics
Regulatory standard: Historically governed by FDA guidance (FDA Cosmetic GMP Guideline) and ISO 22716. The Modernization of Cosmetics Regulation Act (MoCRA), signed into law in late 2022, gave the FDA explicit authority to issue binding cosmetic GMP regulations. A proposed federal cosmetic GMP rule is in development and expected to formalize requirements similar to ISO 22716.
What it covers: Skincare, color cosmetics, hair care, fragrances, deodorants, oral care that is not a drug, and other personal care products meeting the FD&C Act definition of a cosmetic.
Core requirements to comply:
- Facility registration and product listing with the FDA (mandatory under MoCRA)
- Designated Responsible Person on product labels
- Adequate safety substantiation records for every marketed cosmetic
- Serious adverse event reporting within 15 business days
- Recordkeeping for adverse events for six years (three years for small businesses)
- Good manufacturing practices for premises, personnel, equipment, raw materials, production, finished products, laboratory, treatment of non-conforming product, complaints, and recalls (consistent with ISO 22716)
- Fragrance allergen labeling consistent with forthcoming FDA rules
- Compliance with applicable color additive, prohibited/restricted ingredient, and labeling requirements
cGMP Standards for Tobacco Products
Regulatory standard: Section 906(e) of the Federal Food, Drug, and Cosmetic Act — added by the Family Smoking Prevention and Tobacco Control Act of 2009 — directs the FDA to establish tobacco product manufacturing practice (TPMP) requirements. The FDA published a proposed Tobacco Product Manufacturing Practice (TPMP) rule and is in the process of finalizing it. In the meantime, manufacturers are subject to registration, product listing, ingredient reporting, and substantial equivalence/premarket review requirements.
What it covers: Cigarettes, cigarette tobacco, roll-your-own tobacco, smokeless tobacco, cigars, pipe tobacco, electronic nicotine delivery systems (ENDS / e-cigarettes), heated tobacco products, hookah/waterpipe tobacco, and nicotine pouches that meet the definition of a tobacco product.
Core requirements to comply:
- Establishment registration and product listing with the FDA Center for Tobacco Products (CTP)
- Ingredient listing and harmful and potentially harmful constituents (HPHC) reporting
- Premarket authorization — Premarket Tobacco Application (PMTA), Substantial Equivalence (SE), or Exemption from SE — before marketing a new tobacco product
- Labeling requirements including required warning statements
- Controls over design, manufacturing, packaging, storage, and installation under the forthcoming TPMP rule
- Documented quality systems, supplier controls, complaint handling, nonconforming product controls, and CAPA
- Testing programs for nicotine content, HPHCs, and product consistency
- Recordkeeping sufficient to support traceability, investigations, and inspections
Is cGMP a Certification? Understanding cGMP Certification
This is one of the most common misconceptions in the industry: cGMP is a federal regulatory standard, not a certification. The FDA does not issue “cGMP certificates” to U.S. manufacturing facilities. There is no certificate to hang on the wall that says “FDA-Certified cGMP.” Any company claiming to sell you an “FDA cGMP certificate” is misrepresenting how the U.S. regulatory system works.
Instead, cGMP compliance is demonstrated three ways:
Free first call (30–45 minutes)
We learn your products, facility and deadline.
On-site visit (1 day or more)
We walk the floor, review records and interview staff, the way an FDA investigator would.
Gap analysis report
An executive summary, each finding cited to the CFR section, and a Critical, Major or Minor rating.
Remediation
SOPs, records, validations, training and a mock inspection to confirm the fixes.
In other words: a third-party certificate may be a useful business credential and a sign of quality maturity, but it does not exempt you from FDA inspection or guarantee compliance with U.S. cGMP regulations.
What Must Manufacturers Do to Comply with cGMP?
Regardless of industry, every cGMP-regulated manufacturer needs to build and maintain certain core systems. The table below summarizes the eight compliance pillars and what each looks like in practice:
| Compliance Pillar | What It Looks Like in Practice |
|---|---|
| Quality Management System | Documented QMS aligned with FDA expectations and, where applicable, ISO 13485, ICH Q10, or NSF/ANSI standards. |
| Personnel & Training | Job descriptions, qualification records, role-based training matrices, and ongoing competency assessments. |
| Facilities & Equipment | Qualified utilities (HVAC, water, compressed air), preventive maintenance, calibration, and contamination controls. |
| Production & Process Controls | Validated processes, written procedures, in-process checks, and segregation of materials and product stages. |
| Documentation & Records | ALCOA+ data integrity, controlled SOPs, batch records, electronic records compliant with 21 CFR Part 11. |
| Laboratory Controls | Validated analytical methods, qualified instruments, stability programs, OOS/OOT investigations. |
| CAPA & Deviations | Risk-based investigation, root cause analysis, and effectiveness verification for every cGMP deviation. |
| Supplier & Material Controls | Approved supplier lists, qualification audits, incoming inspection, and supply-chain risk programs. |
Beyond these pillars, mature manufacturers also embed:
- A formal Quality Risk Management (QRM) framework aligned with ICH Q9
- A pharmaceutical (or product) quality system aligned with ICH Q10
- 21 CFR Part 11 compliance for electronic records and electronic signatures
- Annual self-inspection and internal audit programs
- Mock FDA inspections to identify gaps before the real inspection
- Quality agreements with all contract manufacturers, packagers, and testing labs
- Cross-functional change control governance that prevents unplanned changes from slipping through engineering or procurement channels
Need a cGMP Consultant? We Can Help.
Whether you are preparing for your first FDA inspection, responding to a Form 483 or Warning Letter, scaling production into a new facility, launching in a new regulated category, or restructuring a quality system that has grown faster than its documentation, our cGMP consultants partner with you to build sustainable, audit-ready compliance. We work across drugs, medical devices, dietary supplements, food, cosmetics, and tobacco, and we tailor our approach to your company size, product risk, and regulatory exposure.
What to Expect on Our First Call
The introductory call is a confidential, no-obligation conversation — typically 30 to 45 minutes — designed to understand your situation and answer your questions. We will discuss:
- Your product type, regulatory classification, and intended markets
- Your current manufacturing footprint (in-house, contract, hybrid) and operations scope
- The maturity of your existing quality system and any documented gaps you already know about
- Any recent FDA correspondence — inspections, 483s, Warning Letters, Untitled Letters, or Import Alerts
- Your business objectives, timelines, and constraints (product launches, due diligence, M&A, retail onboarding)
- Your team’s current capabilities and where outside expertise would be most valuable
You leave the call with a clear understanding of scope, recommended next steps, indicative timelines, and pricing options. No high-pressure sales tactics, and no engagement until you are ready.
Our On-Site Facility Visit
Once a mutual NDA is in place, our lead consultant comes on-site — or conducts a hybrid virtual review for smaller scopes — for one to several days, depending on the complexity of your operation. The visit typically includes:
- Opening meeting with leadership to align on scope, objectives, and ground rules
- Guided facility tour covering warehouse, production, packaging, laboratory, sampling, and storage areas
- Observation of live operations (production, sanitation changeover, in-process testing, sampling, line clearance)
- Structured interviews with operators, line supervisors, QC analysts, QA, production management, engineering, and senior leadership
- Document review across the QMS — SOPs, batch records, training files, equipment qualification, validation, calibration, supplier files, complaint files, CAPA, deviation, and change control
- Walkthroughs of critical systems such as water, HVAC, compressed gases, and any environmental monitoring program
- Closing meeting with a verbal summary of preliminary observations and immediate priorities
Gap Analysis and Current Compliance Level
Within an agreed-upon timeframe after the visit, we deliver a detailed Gap Analysis Report that maps your current state against the applicable regulatory standard (21 CFR 210/211, Part 820/QMSR, Part 111, Part 117, Part 700/MoCRA, Part 1100, ISO 13485, ISO 22716, NSF/ANSI 455, or others). Each requirement is rated as Conforming, Partially Conforming, or Non-Conforming, and your overall compliance level is scored so leadership can see exactly where you stand and prioritize investment.
The report also identifies systemic themes — patterns that cut across multiple observations and point to deeper cultural or structural issues — because closing individual gaps without addressing the system that produced them is how Warning Letters happen.
Findings and Non-Conforming Issues
Every observation in the report is documented with:
- The specific regulatory citation (e.g., 21 CFR 211.100(b), 21 CFR 820.100, 21 CFR 111.140(b))
- An objective, factual description of what was observed (not interpreted or editorialized)
- The associated risk — patient or consumer safety, product quality, regulatory exposure, business continuity
- A priority ranking: Critical, Major, or Minor
- Recommended corrective and preventive actions, with estimated effort
- Suggested ownership and reasonable target dates
We deliver the findings in both an executive summary suitable for the board and a detailed working document suitable for the quality team. We never use a generic template — every gap analysis is specific to your products, processes, and risk profile.
How We Help You Address These Issues
We do not hand you a report and walk away. Our remediation support is hands-on and tailored to your team’s bandwidth. Common scopes include:
- Drafting, revising, and harmonizing SOPs, work instructions, and forms
- Building or rebuilding a complete QMS, including document control, training, CAPA, deviation, change control, complaint, and management review systems
- Leading process validation, cleaning validation, computer system validation, and analytical method validation programs
- Establishing supplier qualification and quality agreement programs
- Authoring Warning Letter responses, 483 responses, and FDA meeting briefing documents
- Conducting mock FDA inspections with realistic interview scenarios and document requests
- Training programs — from cGMP awareness for the floor to advanced root cause analysis and inspection readiness for QA leadership
- Mentoring and coaching Quality Unit leadership through challenging investigations or remediation projects
- Ongoing retainer support so compliance continues to mature long after the initial engagement ends
Throughout the engagement, we transfer knowledge to your team so you build internal capability — not dependency on us.
Testimonial
What our clients say about JJCC
Professional, knowledgeable team guided us through FDA registration and complete product listing accurately and efficiently.
Frequently Asked Questions About cGMP
Is cGMP a certification?
No. FDA does not certify cGMP compliance, and no private certificate replaces an FDA inspection. Third-party audits can show customers your status, but only FDA decides compliance.
