A quality agreement is a written agreement between a drug owner and a contract facility that states which party performs each CGMP activity, from batch release to change control. FDA recommends one in its final guidance of November 2016. The agreement can split the work, but it cannot move legal responsibility: the owner's quality unit still approves or rejects everything made under contract.
That last point is where inspections bite. In the Atlas Form 483 data (release of August 15, 2026, forms issued to July 2026), 21 CFR 211.22, the quality unit section, is the most cited regulation on 2025 and 2026 human drug Form 483s.
Key facts:
- FDA's guidance Contract Manufacturing Arrangements for Drugs: Quality Agreements was finalized in November 2016 and covers commercial manufacturing of human drugs, veterinary drugs, biologics, APIs and drug constituents of combination products.
- 21 CFR 211.22(a) makes the owner's quality control unit responsible for approving or rejecting drug products manufactured, processed, packed or held under contract by another company.
- 21 CFR 200.10(b) says FDA regards extramural contract facilities as an extension of the manufacturer's own facility.
- The guidance states that quality agreements cannot be used to delegate statutory or regulatory CGMP responsibilities.
- In Atlas data, 354 of 1,033 human drug Form 483s issued from January 2025 to July 2026 with citation detail (34.3%) cite 21 CFR 211.22.
What is a quality agreement?
A quality agreement is a comprehensive written agreement between the parties to contract drug manufacturing that defines how each party will comply with CGMP. The guidance calls the brand or application holder the owner and calls any party performing a manufacturing operation on its behalf a contract facility. A contract facility can also be an owner when it uses its own subcontractor.
"Manufacturing" is read broadly. The guidance includes processing, packing, holding, labeling, testing and quality unit operations, and it lists formulation, fill and finish, chemical synthesis, cell culture, analytical testing, packaging and sterilization as typical contracted work. A contract testing laboratory is a contract facility under this definition.
The guidance excludes medical devices, dietary supplements, Type A medicated articles and medicated feed, and HCT/Ps regulated solely under section 361. It does not formally apply to clinical trial material, though FDA says the same principles are useful before commercial launch.
Quality agreements may be reviewed during inspections under section 704 of the FD&C Act. Representatives of both quality units are expected to take part in drafting.
Is a quality agreement required by FDA?
A quality agreement is not named as a mandatory document in 21 CFR Part 211, and the 2016 guidance is nonbinding. In practice FDA expects one, because 21 CFR 211.22(d) requires quality unit responsibilities and procedures to be in writing, and a written agreement is how an owner shows what its quality unit does about work done elsewhere.
The legal chain is short. 21 CFR 211.22(a) gives the owner's quality unit responsibility for approving or rejecting drug products made under contract, and 21 CFR 200.10(b) treats contract facilities as an extension of the manufacturer's own facility. The contract facility carries its own CGMP duties at the same time. FDA repeats this in warning letters. Its March 11, 2026 letter to OraLabs, Inc. of Parker, Colorado, a contract and own label maker of OTC drugs, states: "FDA regards contractors as extensions of the manufacturer."
| Product area | Rule that applies | Written quality agreement |
|---|---|---|
| Finished human and animal drugs | 21 CFR 211.22(a) and (d); 200.10(b) | Expected; FDA guidance, Nov 2016 |
| Biologics | 21 CFR 211 plus parts 600 to 680 | Expected; same guidance |
| APIs | FD&C Act 501(a)(2)(B); ICH Q7 | ICH Q7 recommends approved written agreements with contractors |
| Medical devices | QMSR, 21 CFR 820, ISO 13485 clauses 4.1.5 and 7.4, in force since Feb 2, 2026 | Required for outsourced processes under ISO 13485 clause 4.1.5 |
| Combination products | 21 CFR 4.3, parts 211 and 820 | Guidance says it can be applied |
Device manufacturers moved from "recommended" to "required" this year. Since the Quality Management System Regulation took effect on February 2, 2026, 21 CFR 820.10 incorporates ISO 13485:2016. Clause 4.1.5 makes controls over outsourced processes include written quality agreements, and clause 7.4 covers supplier evaluation, purchasing information and an agreement that suppliers notify you of changes before implementing them. Note that the 2016 drug guidance still cites the old 21 CFR 820.50 purchasing controls in a footnote; under the QMSR those map to clause 7.4.
What must a quality agreement include?
A quality agreement must cover five parts, according to the guidance: purpose and scope, definitions, resolution of disagreements, manufacturing activities, and the life cycle and revision of the agreement itself. FDA calls manufacturing activities the most important element, and quality and change control the most critical pieces within it.
- Purpose and scope: the services, products and sites covered.
- Definitions: agreed meanings for terms such as "release", "deviation" and "critical change".
- Resolution of disagreements: how quality disputes are escalated and decided.
- Manufacturing activities: quality unit, facilities, materials, product-specific, laboratory, documentation, and change control.
- Life cycle and revisions: when the agreement is reviewed and how it is changed.
The checklist below follows the order of section IV.B of the guidance. Use it to audit an existing agreement line by line.
| Section | What the guidance expects the agreement to state | Common gap |
|---|---|---|
| Quality unit activities | Who approves or rejects each output; owner keeps final release; named contacts; how audits and FDA inspection findings are communicated | No duty to tell the owner about 483 observations at the shared facility |
| Facilities and equipment | Site addresses and services; who validates processes and qualifies and maintains equipment, IT and utilities; cross-contamination controls | Agreement names the company, not the FEI-level site |
| Materials management | Who sets component specs; who qualifies suppliers; sampling and testing; labeling and reconciliation; storage and shipping roles | Transport between contract sites owned by nobody |
| Product-specific | Specifications, batch numbering, expiry dating, lot disposition, process validation, owner access to the facility | Process validation assigned to neither party |
| Laboratory controls | Sampling and testing controls; all results sent to the owner; method transfer; lab equipment audits; who investigates OOS and OOT results | OOS investigation ownership left blank |
| Documentation | Who reviews and approves records; originals or true copies; records available for inspection; electronic records immediately retrievable | Owner has no right to raw data or audit trails |
| Change control | Which changes need prior owner approval, which only notice; validation responsibility; FDA filing awareness; 11 listed change types | Contract facility changes equipment or suppliers without notice |
The 11 change types the guidance lists are components or their suppliers, establishment locations, manufacturing processes, other products on the same line, testing procedures, major equipment, shipping methods, lot numbering, container closure systems, tamper evidence features and product distribution.
Quality agreement vs supply agreement: what is the difference?
A quality agreement defines CGMP responsibilities; a supply agreement or master services agreement defines the commercial deal. FDA says quality agreements should not cover business terms such as confidentiality, pricing, delivery terms or liability limits, and recommends they be separate documents, or at least severable, from commercial contracts.
| Quality agreement | Supply agreement or MSA | |
|---|---|---|
| Purpose | Who does each CGMP activity | Price, volume, delivery, payment |
| Written by | Both quality units | Procurement, legal, business development |
| Governing rule | 21 CFR 211.22, FDA 2016 guidance | Contract law |
| Seen by FDA | May be reviewed on inspection | Not normally requested |
| Typical trigger to revise | Process, site or method change; inspection findings | Commercial renegotiation |
Keeping them apart has a practical benefit. A quality agreement can be shown to an investigator without disclosing prices, and it can be revised after a change without reopening commercial terms.
How often do FDA Form 483s cite the quality unit section, 21 CFR 211.22?
21 CFR 211.22 is the single most cited regulation on recent human drug Form 483s. We pulled every human drug Form 483 in the Atlas directory issued from January 2025 to July 10, 2026 (release of August 15, 2026): 1,078 forms, of which 1,033 carry CFR citations. Of those, 354 cite 211.22, or 34.3%. The share was 36.9% in 2025 (266 of 721) and 28.2% so far in 2026 (88 of 312). That matches the 32% we found in an earlier sample of 90 recent human drug 483s.
| 21 CFR section | Topic | Share of 1,033 human drug 483s, Jan 2025 to Jul 2026 |
|---|---|---|
| 211.22 | Quality control unit | 34.3% |
| 211.192 | Production record review and investigations | 28.7% |
| 211.67 | Equipment cleaning and maintenance | 23.6% |
| 211.100 | Written production procedures | 21.7% |
| 211.160 | Laboratory controls | 20.9% |
Most 211.22 citations, 296 forms, fall under paragraph (d), quality unit procedures not in writing or not followed. Paragraph (a), which holds the approve-or-reject duty and the contract clause, appears on 60 forms; paragraph (c) on 10.
Large contract manufacturers sit close to that average. Across the 12 human drug Form 483s issued in 2025 and 2026 to Catalent, Patheon, Lonza and Jubilant HollisterStier facilities, 4 cite 211.22(d). Examples you can open in our FDA Form 483 database:
- Patheon Pharmaceuticals Inc., Cincinnati, September 26, 2025: three observations citing 211.192, 211.22(d) and 211.67(b).
- Jubilant HollisterStier, Kirkland, Canada, November 3, 2025: 11 observations, including 211.22(d), 211.192, 211.113(b) sterile process validation and 211.42(c)(10) aseptic area controls.
- Catalent Indiana, Bloomington, November 15, 2023: citations of 211.22(d), 211.192, 211.113(b) and 211.160(b). The same facility received a warning letter on November 20, 2025, and its customers felt it: our Regeneron Form 483 analysis traces two 2025 complete response letters to that filler's inspection.
- Medical Products Laboratories, Philadelphia, October 16, 2025: eight observations, including 211.22(a), the approve-or-reject duty.
The same investigators keep returning to contract sites. Nicole E Knowlton, with 239 inspections and 595 observations on record, inspected Patheon Greenville in September 2025, Catalent Greenville in October 2025, International Contract Labs in November 2025, Catalent in Saint Petersburg in January 2026 and CoreRX in February 2026.
AtlasSee what the FDA knows about your next investigator.
30 minutes with the founder. No pitch deck.
Where quality agreements fail in inspections
Quality agreements fail when they are silent on the events that matter most: a change, a failing result, or an FDA finding. The guidance's own five case studies show each one, and recent warning letters repeat them.
Change notification. In Case 5 of the guidance, a contract facility needed the owner's approval to fix a powder segregation problem, the owner refused, and production continued on a flawed process. FDA treats both as out of compliance. An agreement should say which changes need prior approval, how fast the owner must decide, and what happens if it does not.
Data access and laboratory results. In Case 3, a contract lab reported passing results when its analyses failed, and the owner had not run the site audit its own procedure required every two years. The agreement should give the owner access to raw data and audit trails, not only certificates of analysis, and the owner should use it.
OOS investigation ownership. In Case 4, a contract lab using the owner's application method got out-of-specification results and argued the method was the owner's problem. FDA disagreed. Name the party that investigates each OOS and OOT result, the deadline, and who approves the conclusion.
Owner oversight. FDA's February 5, 2025 warning letter to Jagsonpal Pharmaceuticals faulted an API owner for not making sure its contract manufacturer completed process validation and complete master production instructions. Splitting tasks in a contract did not split the liability.
Inspection findings at shared facilities. Contract facilities serve many owners, so the guidance asks agreements to say when, how and what the contractor reports about objectionable conditions found during inspections. Without that clause, an owner can learn about a Form 483 from a complete response letter. If you need to act on a contractor's findings, our guide to the supplier corrective action request process covers the escalation steps, and supplier qualification covers the audit that should come before the agreement is signed.
AtlasFDA Inspection Intelligence Digest
We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.
Frequently asked questions
Yes, it can. The 2016 guidance states that quality agreements may be reviewed during inspections under section 704 of the FD&C Act. Investigators commonly ask for them when a product is made or tested at another facility, to check who holds release, change control and investigation duties. Keeping the quality agreement separate from the commercial contract lets you show it without disclosing pricing.
Written by
Bhavish Agarwal
Founder, Atlas
Bhavish Agarwal is the founder of Atlas and previously worked at Google and Microsoft. He has spent the past several years building regulatory data infrastructure for the pharmaceutical industry.
