What Is CGMP? FDA Current Good Manufacturing Practice Explained

CGMP, Current Good Manufacturing Practice, is the set of FDA regulations that sets the minimum requirements for the methods, facilities and controls used to manufacture, process, pack and hold a drug, so that the product is safe and has the identity, strength, quality and purity it claims. For human drugs the rules sit in 21 CFR Parts 210 and 211; biologics, devices, dietary supplements, food and PET drugs each have their own CGMP part.

FDA checks CGMP compliance by inspection, and a facility that falls short receives a Form 483 at the close of the visit. This guide uses the Atlas Form 483 database (release of August 15, 2026) to show which parts of 21 CFR 211 FDA actually cites: 323 human drug Form 483s issued between January 8 and July 10, 2026, of which 201 cite Part 211.

Key facts:

• FDA defines CGMP as "the Current Good Manufacturing Practice regulations enforced by the FDA", and states that CGMP regulations for drugs contain the minimum requirements.
• A drug made without CGMP compliance is adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, even if the batch meets its specifications.
• 21 CFR 211 has 11 subparts, A to K, covering everything from personnel to returned drug products.
• In the Atlas Form 483 database, 21 CFR 211.22 (quality control unit) appears on 44% of the 201 human drug Form 483s from 2026 that cite Part 211, and 211.192 (investigations) on 42%.
• Device CGMP moved to the Quality Management System Regulation (21 CFR 820, incorporating ISO 13485:2016) on February 2, 2026.
• FDA does not issue CGMP certificates. Compliance is shown inspection by inspection.

What does CGMP stand for, and why "current"?

CGMP stands for Current Good Manufacturing Practice. The "C" means a manufacturer is judged against the technology and systems that are reasonable today, not the ones that were standard when its procedures were written. FDA's Facts About the Current Good Manufacturing Practice (CGMP) page says the "current" requires companies to use technologies and systems that are up to date.

In practice, "current" is how FDA can cite a facility without a new regulation. The text of 21 CFR 211 has barely changed since 1978, yet investigators expect audit trails on chromatography software, continuous environmental monitoring in aseptic areas and risk-based investigations, because those are what a reasonable manufacturer uses now. A practice that was acceptable 15 years ago, such as paper-only logbooks for a computerized system, can be a CGMP gap today.

The regulations are also deliberately flexible. They say what must be controlled, for example that equipment be cleaned "at appropriate intervals", and leave the how to the manufacturer. That is why two compliant facilities can run very different quality systems, and why a written procedure that nobody follows is the most cited problem in the data below.

GMP vs CGMP: what is the difference?

GMP and CGMP describe the same discipline. GMP, Good Manufacturing Practice, is the general term used by the WHO, the EU and most other regulators. CGMP is FDA's legal term, and the added "current" makes the standard move with industry practice. A US drug manufacturer is inspected against CGMP; the same facility shipping to Europe is inspected against EU GMP.

The practical difference is the certificate. EU and many Asian regulators issue a GMP certificate after a successful inspection. FDA does not, so a supplier claiming to be "FDA CGMP certified" is describing its last inspection outcome, which you can check on its facility record.

Which CGMP regulations apply to which products?

CGMP is not one regulation. 21 CFR 210 and 211 cover finished human and animal drugs, and other product types have their own part, sometimes layered on top of 211. The table lists the main ones.

PET drugs show up more often than people expect. Of the 323 human drug Form 483s from 2026 in the Atlas database, 32 cite 21 CFR 212. Another 73 cite 21 CFR 312, which governs clinical investigators rather than manufacturing, a reminder that a "human drugs" 483 is not always a CGMP 483. The device QMSR page on fda.gov covers the device transition.

What are the subparts of 21 CFR 211?

21 CFR 211, "Current Good Manufacturing Practice for Finished Pharmaceuticals", has 11 subparts, A to K. Each covers one part of the manufacturing operation, and every Form 483 observation against a drug manufacturer cites a section inside one of them. The full text is on eCFR.

The figure shows how often each subpart appears on 2026 drug Form 483s. A single 483 usually cites several subparts, so the shares add up to more than 100%.

Subpart J leads because 211.192, the requirement to investigate every unexplained discrepancy and batch failure, sits there. Subparts G, H and K each appear on fewer than one in twenty. FDA's attention is on whether the quality system works, not on the warehouse.

Which 21 CFR 211 sections does FDA cite most?

The sections FDA cites most under 21 CFR 211 are 211.22, the quality control unit, and 211.192, investigations of discrepancies. That holds across three separate cuts of Atlas data. In 2024, 211.22(d) drew 175 citations and 211.192 drew 136, per the Atlas most cited CFR sections analysis. In a late-2025 sample of 90 human drug Form 483s, 211.22 appeared on 32%, 211.160 on 32%, 211.192 on 31%, 211.68 on 17% and 211.84 on 16%.

The 2026 pull is larger. Atlas Form 483 database, release of August 15, 2026: 201 human drug Form 483s issued January 8 to July 10, 2026 that cite at least one Part 211 section.

Within 211.22, 78 of the 88 citations are paragraph (d): procedures for the quality unit "not in writing, not fully followed". The 2025 and 2026 figures use different bases (all sampled drug 483s against those citing Part 211), so read the order, not the exact gap. The order barely moves: a quality unit that does not follow its own procedures, and investigations that stop at the first plausible cause.

The named records in the Form 483 database show what this looks like on paper:

• Eugia Pharma Specialities, Sangareddy, India, February 6, 2026: 11 observations across Subparts B, C, I and J, including 211.22(d), 211.192, 211.113(b) and four laboratory sections.
• American Regent, Shirley, New York, April 21, 2026: 10 observations, among them 211.22(d), 211.192, 211.42(c)(10)(iv) on aseptic area monitoring and 211.67(a) on equipment cleaning.
• Janssen Ortho, Gurabo, Puerto Rico, June 5, 2026: six observations covering 211.100(a), 211.165(a), 211.192, 211.67(a) and 211.68(b).
• Carlsbad Technology, Carlsbad, California, June 30, 2026: three observations, and they are the three most common sections in the table: 211.192, 211.22(d) and 211.67(a).

Large and small manufacturers draw the same sections. For a list of the specific things investigators check under each subpart, see 100 things FDA inspectors look for during inspections.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

What happens when a firm violates CGMP?

A firm that violates CGMP makes adulterated drugs under section 501(a)(2)(B) of the FD&C Act, whether or not the product fails its specifications. Adulteration is a legal status, not a test result, and it is what gives FDA authority to act. The usual sequence runs from a Form 483 to a warning letter, and for repeat failures to court action.

1. Form 483. The investigator lists objectionable conditions at the close-out meeting. A 483 is an inspection finding, not a final agency determination. Our guide to what an FDA Form 483 is covers the document and the 15-business-day response window.
2. Classification. FDA reviews the report and the response and classifies the inspection NAI, VAI or OAI.
3. Warning letter. An OAI usually leads to a warning letter that names the CGMP violations, often asks for a qualified consultant under 21 CFR 211.34, and puts pending applications that list the facility on hold.
4. Import alert. For a facility outside the US, FDA can detain its products at the border.
5. Seizure, injunction or consent decree. For continued violations, FDA goes to court through the Department of Justice. A consent decree is a court order the company agrees to, usually requiring it to stop production until an independent expert certifies compliance. Our piece on consent decrees and their implications covers how those play out.

FDA also notes that a drug made in violation of CGMP may still meet its labeled specifications, so a recall is not automatic. Most inspected firms, in FDA's own words, are found fully compliant.

How is CGMP compliance checked?

CGMP compliance is checked by FDA inspection: pre-approval inspections before a product is approved, surveillance inspections on a risk-based schedule, and for-cause inspections after a complaint, recall or quality signal. There is no FDA certificate and no fixed renewal date; the facility's inspection history is the record.

Three habits separate facilities whose history stays clean. They trend their own deviations against 211.192 before an investigator does. They keep the quality unit's written procedures matched to what people actually do, since 211.22(d) is the most cited paragraph in the 2026 data. And they apply risk management to decide where controls go, which is the subject of ICH Q9 quality risk management.

For a supplier or contract manufacturer, read its last three inspections before you audit. The Form 483 record shows which subparts FDA cited, whether the same section came back, and which investigators wrote them.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe