Pharmaceutical regulatory compliance is the set of legal and quality obligations that require a drug company to prove, to regulators such as FDA, EMA, MHRA, PMDA and CDSCO, that its products are made, tested, distributed and monitored under written, enforced rules at every stage from laboratory study to post-market safety reporting. In practice that means following GLP, GCP, GMP, GDP and GVP, and keeping the records to show it.
The rules are public; data on where companies fail them is harder to find. This guide uses the Atlas FDA Form 483 directory (release of August 15, 2026, data through July 2026) to show which requirements FDA investigators cite most, where foreign inspections land, and how often a compliance gap ends an application.
Key facts:
- In the US, drug manufacturing compliance is set by 21 CFR Parts 210 and 211; in the EU, by EudraLex Volume 4; internationally, ICH Q7, Q8, Q9 and Q10 harmonize the expectations.
- Of 1,078 human drug Form 483s in the Atlas directory issued from January 2025 to July 10, 2026, 779 cite at least one 21 CFR Part 211 section.
- 21 CFR 211.22, the quality control unit, appears on 45% of those 779 Form 483s, and 21 CFR 211.192, investigations of discrepancies, on 38%.
- In 2025, 681 of 4,584 Form 483s across all FDA programs (14.9%) went to facilities outside the US, and India received 116 of them.
- FDA issued 65 complete response letters in 2024, 48 in 2025 and 17 in the first half of 2026, per the Atlas CRL analytics page.
- India's revised Schedule M was notified on December 28, 2023; the extended deadline for qualifying small manufacturers ran to December 31, 2025.
What is pharmaceutical compliance, and what does it cover?
Pharmaceutical compliance is the discipline of meeting every regulation that applies to a medicine across its life: how it is studied in animals and people, how it is manufactured and released, how it is stored and shipped, and how its safety is tracked after approval. Each stage has its own "good practice" code, and each code is enforced by inspection.
Two things make pharma compliance different from compliance in most industries. First, the burden of proof sits with the company: if a step is not documented, regulators treat it as not done. Second, the rules are mostly principle-based. 21 CFR 211.192 says unexplained discrepancies must be "thoroughly investigated", but it does not say how. The company writes the procedure, and the investigator judges whether it is adequate and whether it was followed.
Who regulates pharmaceutical compliance, and which rulebooks apply?
The main pharmaceutical regulators are FDA in the United States, EMA and the national authorities in the EU, MHRA in the UK, PMDA with the Ministry of Health in Japan, and CDSCO in India, with WHO and ICH setting the shared international standards. A company selling in several markets is inspected against each rulebook, though ICH harmonization means most core expectations overlap.
| Regulator or body | Main rulebook | What it governs |
|---|---|---|
| FDA (US) | 21 CFR Parts 210 and 211 | CGMP for finished pharmaceuticals: quality unit, facilities, equipment, production, laboratory controls, records |
| FDA (US) | 21 CFR Part 314 | NDA and ANDA applications, including field alert reports and annual reports under 314.81 |
| FDA (US) | 21 CFR Parts 600 to 680 | Biologics: licensing, establishment standards, adverse experience reporting (600.80) |
| FDA (US) | 21 CFR Part 11 | Electronic records and electronic signatures |
| EMA and EU member states | EudraLex Volume 4 | EU GMP: Part I for medicinal products, Part II for active substances, annexes such as Annex 1 (sterile) and Annex 11 (computerized systems) |
| MHRA (UK) | Human Medicines Regulations 2012 and the UK GMP and GDP guidance | Manufacturing and wholesale licenses, GMP and GDP inspections in the UK |
| PMDA and MHLW (Japan) | GMP Ministerial Ordinance No. 179 | Japanese GMP and quality management; Japan is a PIC/S member |
| CDSCO (India) | Drugs and Cosmetics Rules, 1945, Schedule M (revised) | Indian GMP. Revised Schedule M was notified December 28, 2023; manufacturers with turnover above Rs 250 crore had six months, and qualifying MSMEs that applied for an extension had until December 31, 2025 |
| WHO | WHO GMP (Technical Report Series) | The baseline many national regulators adopt; used for WHO prequalification |
| ICH | Q7, Q8(R2), Q9(R1), Q10 | Q7: GMP for active ingredients. Q8: pharmaceutical development. Q9: quality risk management. Q10: pharmaceutical quality system |
Our CGMP overview covers Part 211 subpart by subpart.
What are the pharma compliance requirements at each lifecycle stage?
Pharma compliance requirements change with the stage of the product: GLP for nonclinical studies, GCP for clinical trials, GMP for manufacturing, GDP for distribution and GVP for post-market safety. Each stage has its own regulations and its own inspectors.
| Stage | Practice code | Key regulations | What inspectors check |
|---|---|---|---|
| Nonclinical development | GLP | 21 CFR Part 58; OECD GLP principles | Study protocols, raw data, quality assurance unit, archive |
| Clinical development | GCP | ICH E6; 21 CFR Parts 50, 56 and 312 | Informed consent, protocol adherence, investigator oversight, source data |
| Manufacturing | GMP | 21 CFR 210 and 211; EudraLex Volume 4; ICH Q7; Schedule M | Quality unit, batch records, investigations, cleaning, laboratory controls |
| Distribution | GDP | EU GDP Guidelines (2013/C 343/01); US Drug Supply Chain Security Act | Storage conditions, temperature control, supplier and customer qualification, traceability |
| Post-market | GVP | EU GVP modules; 21 CFR 314.80, 314.81 and 600.80 | Adverse event reporting timelines, signal detection, periodic safety reports |
Clinical sites appear in the Form 483 data too. Of the 1,078 human drug Form 483s in our sample, the 299 that cite no Part 211 section are mostly clinical investigator inspections under 21 CFR Part 312.
Which GMP requirements do FDA investigators cite most?
FDA investigators cite the quality control unit, 21 CFR 211.22, more than any other GMP requirement. Across 779 human drug Form 483s citing Part 211 in the Atlas directory (issued January 2025 to July 10, 2026, release of August 15, 2026, measured October 22, 2026), 211.22 appears on 45% and 211.192 on 38%.
| 21 CFR section | Requirement | Share of 779 Form 483s |
|---|---|---|
| 211.22 | Quality control unit responsibilities | 45% |
| 211.192 | Production record review and investigations | 38% |
| 211.67 | Equipment cleaning and maintenance | 31% |
| 211.100 | Written production and process control procedures | 29% |
| 211.160 | Laboratory controls | 28% |
| 211.84 | Testing and approval of components | 22% |
| 211.68 | Automatic, mechanical and electronic equipment | 21% |
FDA investigators rarely cite exotic science. They cite procedures that were never written, were not followed or were not enforced by the quality unit, as two June 2026 forms show.
The June 30, 2026 Form 483 to Carlsbad Technology in Carlsbad, California carries three observations from a four-investigator team: 211.192, 211.22(d) and 211.67(a), three of the top four sections in the table. The Carlsbad Technology facility record lists 17 FDA inspections, eight of which produced a Form 483, including 2016 and 2021.
The June 12, 2026 Form 483 to Epic Pharma in Laurelton, New York cites 211.22(d), 211.67(a), 211.68(b) and 21 CFR 314.81(b)(1)(i), the field alert report requirement. FDA investigators check Part 314 application rules during facility inspections as well as at approval.
You can filter any section in the FDA Form 483 database. For electronic records, our analysis of data integrity citations on Form 483s covers 211.68 and Part 11 in detail. Before your next inspection, check which of these sections the investigator assigned to your facility has cited on recent Form 483s.
AtlasSee what the FDA knows about your next investigator.
30 minutes with the founder. No pitch deck.
Where is FDA finding compliance problems outside the US?
FDA holds foreign facilities to the same 21 CFR rules as US ones. In the Atlas directory, 681 of the 4,584 Form 483s issued in 2025 across all FDA programs, or 14.9%, went to facilities outside the US, spread over 49 countries. India received the most, 116, ahead of Japan with 54.
The 2026 figures, January 1 to July 20, show 322 non-US Form 483s out of 2,533 (12.7%), with India again first at 54. For a company in India, that means two inspection regimes at once: FDA's, often unannounced for foreign sites since 2025, and CDSCO's, now enforcing revised Schedule M. The two are close in substance, since revised Schedule M adds a pharmaceutical quality system, quality risk management and product quality reviews in line with WHO GMP and ICH Q10. Our guide to FDA foreign inspections breaks the counts down by country.
What are the consequences of non-compliance with FDA and EMA regulations?
The consequences of non-compliance escalate from a Form 483 at the end of an inspection to warning letters, import alerts, court-enforced consent decrees and refused approvals. In the EU, the equivalents are a GMP non-compliance statement in EudraGMDP, suspension of a manufacturing authorization, and product recalls. Each step below is public and harder to reverse than the one before.
| Step | Issued by | What it means | What the company does |
|---|---|---|---|
| Form 483 | FDA investigator at close-out | Observations of conditions that may violate the regulations | Respond within 15 business days so FDA considers the response before deciding on escalation |
| Untitled letter | FDA center | Violations below the warning letter threshold | Correct and usually reply; see our FDA untitled letter guide |
| Warning letter | FDA center, posted on fda.gov | FDA considers the violations significant | Respond within 15 business days; pending applications can be held |
| Import alert | FDA | Products can be detained at the border without physical examination | Remediate and petition for removal; common for foreign sites |
| Consent decree | Federal court, on FDA's request | Court-enforced agreement setting conditions to keep or resume operating | Expert oversight, certifications, sometimes disgorgement; see FDA consent decrees |
| Complete response letter | FDA review division | The NDA, BLA or ANDA cannot be approved in its current form | Fix the deficiencies, including facility findings, and resubmit |
The step from 483 to warning letter is the one most companies can still control. Our piece on the 483 vs warning letter response window explains what FDA expects in those 15 days.
The Atlas CRL analytics page counts 65 complete response letters in 2024, 48 in 2025 and 17 in the first half of 2026. Facility and manufacturing findings sit behind a share of them, so a pre-approval inspection at a site with an open 483 puts the launch date at risk as well as the site.
How do you build a pharmaceutical compliance program?
A pharmaceutical compliance program is built in seven steps: map the rules that apply, set up an independent quality unit, write and enforce procedures, run investigations to root cause, control data, audit yourself and your suppliers, and track what regulators cite. The order matters, because each step depends on the one before.
- Map the applicable rules. List every market and product type, then the rulebook for each: 21 CFR 211 for US finished drugs, Part 600s for biologics, EudraLex Volume 4 for the EU, Schedule M for India.
- Give the quality unit real authority. 21 CFR 211.22 requires a quality control unit with the responsibility and authority to approve or reject. It is the most cited section in the table above, often because the unit exists on paper and signs what production gives it.
- Write procedures people can follow, then check that they do. 211.22(d) and 211.100 are cited for the gap between the SOP and the shop floor.
- Investigate to root cause and scope. Every deviation, out-of-specification result and complaint gets an investigation that covers other affected batches, as 211.192 requires.
- Control data from the start. Validated systems, audit trails and access control under Part 11 and 211.68, reviewed by the quality unit rather than IT alone.
- Audit yourself and your suppliers on a risk basis. ICH Q9(R1) sets out quality risk management; written quality agreements with contract manufacturers define who owns each GMP duty.
- Track what regulators cite. Review recent Form 483s, warning letters and EU non-compliance reports for your dosage forms and your inspectors every quarter, and close any gap before the next visit.
A monthly feed of new Form 483s and warning letters shortens the quarterly review in step 7.
AtlasFDA Inspection Intelligence Digest
We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.
Frequently asked questions
GMP and CGMP describe the same requirements. FDA uses CGMP, current good manufacturing practice, to stress that companies must use technologies and systems that are up to date at the time, not those that met the standard when the regulation was written. The EU, WHO and most other regulators use GMP. The underlying rules for drugs are 21 CFR Parts 210 and 211 in the US.
Written by
Bhavish Agarwal
Founder, Atlas
Bhavish Agarwal is the founder of Atlas and previously worked at Google and Microsoft. He has spent the past several years building regulatory data infrastructure for the pharmaceutical industry.
