Implications of Recent Third Circuit Court of Appeals Decision for FDA Drug Approval Framework

This article originally appeared in the Food and Drug Law Journal and is available here via Open Access.


A recent Third Circuit Court of Appeals decision in United States v. Vepuri has the potential to undermine the legal framework for drug approvals in the United States. Specifically, this decision could shield copycat products from U.S. Food and Drug Administration (FDA) enforcement action and allow them to enter the market without FDA pre-approval. The loophole created by this decision is accompanied by concerns about product quality, patient safety, and other issues that would be flagged in a premarket review.

I. Introduction

The ongoing U.S. Fifth Circuit Court of Appeals litigation challenging the U.S. Food and Drug Administration’s (FDA’s) approval of mifepristone has generated a great deal of attention and concern about the implications for FDA drug approval decisions.1 This Article discusses a recent decision by the U.S. Court of Appeals for the Third Circuit that has generated far less attention but also has the potential to undermine the legal framework for FDA drug approvals. The Third Circuit’s decision in United States v. Vepuri2 potentially allows any firm manufacturing a copycat drug to market it without FDA approval and without fear of FDA enforcement action under 21 U.S.C. § 355(a), provided the copycat has the same chemical composition and labeling as a drug specifically approved by FDA pursuant to a new drug application (NDA) or an abbreviated new drug application (ANDA).

II. Background

In July, the Third Circuit Court of Appeals upheld an earlier decision of the district court to dismiss part of a criminal indictment against KVK-Tech, Inc. (“KVK-Tech”) and two KVK-Tech executives (Murty Vepuri and Ashvin Panchal) on the grounds that the conduct alleged in the indictment did not constitute an offense under 21 U.S.C. § 355(a).3 As further discussed below, § 355(a) prohibits a person from introducing a “new drug” into interstate commerce without an effective application in place.4

KVK-Tech manufactured hydroxyzine, a generic prescription drug indicated for the treatment of anxiety and tension.5 KVK-Tech had three approved ANDAs to market different strengths of hydroxyzine.6 Contrary to the ANDAs, KVK-Tech had been introducing hydroxyzine into interstate commerce that KVK-Tech had manufactured using active pharmaceutical ingredient (API) sourced from a facility in Mexico that was not listed in the ANDAs or otherwise approved by FDA.7

KVK-Tech had stated in its ANDAs that the hydroxyzine active ingredient would be sourced from a UCB Pharma, S.A facility in Belgium.8 In 2008, two years after the initial approvals, Panchal appropriately filed an application supplement and obtained approval to source the active ingredient from a different company, a Cosma, S.p.A facility in Italy.9 Despite having two approved options for sourcing API, in October 2010, Vepuri authorized the purchase of three shipments of active ingredient from a Dr. Reddy’s Laboratories (DRL) facility in Mexico not listed in the approved ANDAs.10

FDA only discovered this unauthorized API substitution in June 2013, when it refused to permit a fourth shipment of DRL API to enter the United States on the grounds that KVK-Tech’s ANDA did not list the DRL facility as an approved API source.11 By that time, however, KVK-Tech had already received the three prior shipments of API from DRL’s Mexico facility, which the government alleged was used to manufacture 368,000 bottles of hydroxyzine KVK-Tech distributed to customers.12

Following the border refusal, FDA inspected KVK-Tech, and Panchal made several false statements to FDA about where KVK-Tech was sourcing its API. For example, during a 2013 inspection, Panchal told FDA investigators that KVK-Tech had not received prior shipments of API from Mexico.13 When confronted with photographs to the contrary, Panchal indicated that he was not aware that UCB (the approved API manufacturer) shipped API from Mexico.14 In several communications with FDA during and after the 2013 inspection, Panchal and Vepuri falsely blamed the use of the unapproved DRL API on the incompetence of a former employee and made other false statements to FDA.15

As further discussed in the underlying district court decision, FDA had issued a warning letter to DRL’s Mexican facility for violations of Current Good Manufacturing Practices (CGMP) in June 2011.16 The warning letter was based on violations discovered during an FDA inspection of the DRL facility conducted in November 2010, and was unrelated to the API shipments to KVK-Tech.17 The CGMP violations were serious enough that, the following month, FDA also placed the facility on import alert, thereby authorizing the detention of all DRL API shipped to the United States.18 The three shipments of DRL API utilized by KVK-Tech in the hydroxyzine it distributed occurred in January, March, and May of 2011, shortly before the import alert was issued in July 2011.19 The import alert remained in effect until July 2012.20

The defendants were indicted on several offenses. One of the offenses was a criminal conspiracy with several identified objects (or goals) of the conspiracy, including “with the intent to defraud and mislead, introducing or delivering for introduction, and causing the introduction or delivery for introduction, into interstate commerce of unapproved new drugs in violation of Title 21 United States Code, Sections 331(d) and 355(a)[.]”21 The district court struck down this portion of the indictment, and the Third Circuit upheld that decision.22

III. Decision by the Third Circuit

The Third Circuit’s ruling hinges on a somewhat complicated interpretation of the term “new drug” as it is used in § 355(a), which provides: “No person shall introduce or deliver for introduction into interstate commerce any new drug, unless an approval of an application filed pursuant to subsection (b) [concerning NDAs] or (j) [concerning ANDAs] is effective with respect to such drug.”23

To determine the meaning of “new drug” in § 355(a), the Third Circuit looks to the definition of the term at 21 U.S.C. § 321(p). The court parses the statutory language and finds, in relevant part, that § 321(p) defines “new drug” as “‘any drug . . . the composition of which is such that such drug is not’ . . . generally recognized among experts as safe and effective for the use ‘suggested in the labeling thereof.’”24 The court concludes, therefore, “[t]he text of § 321(p) . . . defines a ‘new drug’ in terms of its composition and labeling.”25 Additionally, a new drug under § 321(p) cannot be a grandfathered drug under the Food and Drugs Act of June 30, 1906, but this provision was not at issue in the case.26

The Third Circuit notes that the Federal Food, Drug, and Cosmetic Act does not define the word “composition,” but explains in a footnote that “FDA has long interpreted the term to refer only to a drug’s chemical makeup—the ‘name and amount of each active and inactive ingredient.’ And, a drug’s ‘composition’ does not include the location or identity of the manufacturer of those ingredients.”27

To support the position that the alleged conduct did constitute an offense under § 355(a), the government’s first theory was that because the API was sourced from a facility not listed in the ANDAs, the hydroxyzine KVK-Tech distributed was not the same “new drug” as the one with an effective approval.28 Relying on the reasoning discussed above, however, the Third Circuit disagreed, holding that because the hydroxyzine manufactured with the API from Mexico “has the same [chemical] composition and labeling as the hydroxyzine for which an approval of an ANDA is effective, the government could not rely on the premise that the two drugs are different.”29 Accordingly, the government’s argument that they were two different drugs did not state an offense of conspiracy to violate § 355(a).30

Although FDA had issued a warning letter to DRL for producing adulterated API and placed the company on an import alert, the government did not argue that the composition of the KVK-Tech hydroxyzine was not the same “new drug” because of the use of the adulterated API. Presumably this was because the government did not think it needed to show adulteration to successfully seek unapproved drug charges under § 355(a). As a result of the government’s silence on the issue of adulteration, the court did not consider that the source of API could, in fact, have an effect on the “composition” of the drug, if, for example, the API were adulterated, as was the case with the DRL API substituted by KVK-Tech. Although we do not endorse the Third Circuit’s very narrow interpretation of the term “new drug,” we would argue that adulterated API almost certainly alters the composition of the drug and therefore creates a “new drug” even under the Third Circuit’s reasoning.31 The government, however, understandably omitted discussion of adulteration in the § 355(a) charges, because that section does not mention adulteration in the plain language of the provision.32

The government’s second theory of liability was that “because . . . the ‘new drug’ was manufactured at a facility not included in the approved ANDA[,] . . . the approved ANDA stopped being ‘effective’ with respect to that drug.”33 Relying on the Supreme Court’s decision in Weinberger v. Hynson, Westcott & Dunning, Inc.,34 the Third Circuit rejected this second theory of liability as well, holding that “the approval of an NDA or ANDA ceases being effective only when it has been withdrawn or suspended.”35

IV. Broader Implications of the Vepuri Decision

The Vepuri case has potentially wide-ranging implications for FDA’s regulation of drugs approved under either an NDA or an ANDA.

For example, the Third Circuit decision undermines the statutory framework requiring applicants to file supplements for approval of certain changes to approved applications. Under 21 U.S.C. § 356a, “a drug made with a major manufacturing change may be distributed only if, before the distribution of the drug as so made, the holder involved submits to the [FDA] a supplemental application for such change and the [FDA] approves the application.” Other non-major changes to an application require notification to FDA either in a supplemental application or in the annual report filed to the application.36

To further expound on this point, a supplement for a major change, e.g., the change of an API supplier, provides the agency with information about the quality of the new API to ensure it has the same physicochemical properties as the approved ingredient. A new source for an active ingredient has the potential to significantly impact the impurity profile of a drug substance. The supplement should demonstrate the API supplier’s ability to produce the product as specified and should also provide stability data. A supplement also serves as a notification to FDA to conduct surveillance inspections of the facility to ensure compliance with applicable regulations, including but not limited to CGMP.

A sponsor could rely on the reasoning in the KVK-Tech case to make changes to a drug subject to an approved application without ever filing a supplement, claiming that those changes do not affect the composition or labeling of the drug. The sponsor could argue that those changes do not create a “new drug” and thus the approved application is still in effect, obviating any reason to file a supplement to the application. If this were the case, FDA would never be made aware of all manner of changes to an approved application, including major differences such as changes to API suppliers that could result in poor quality, contaminated, or adulterated drug product affecting patient safety.

Conveniently, the Third Circuit brushes over § 356a in a footnote, stating that “despite its apparent relevancy,” the court declined to further consider it because the government did not “rely on § 356a to establish that the defendants conspired to violate § 355(a).”37 The district court, for its part, explicitly cited § 356a in support of that court’s “[ready acknowledgment] that the place of manufacture of a drug is critical” and its belief that “the [district court’s] ruling will not deprive the FDA of its ability to remedy this type of noncompliance.”38 And yet those statements by the district court do not seem to hold true under the Third Circuit’s reasoning, which appears to render those statutory requirements voluntary, or at least challengeable by a sponsor as just described.

Also troubling, relying on the Third Circuit decision, companies could entirely forego submitting an application to FDA, claim that they are manufacturing drugs with chemical compositions and labeling identical to approved NDA and ANDA drug products, and argue that they were not introducing unapproved new drugs into interstate commerce in violation of 21 U.S.C. § 355(a). Ultimately, if this copycat tactic proved to be successful, it would serve as a serious disincentive for companies to file an ANDA. Why do so, if you could qualify under an existing NDA or ANDA by simply distributing a product with identical chemical compositions and labeling? Similarly, companies could also be dissuaded from conducting clinical research supporting an NDA if other companies could quickly begin distributing a drug product with an identical chemical composition and labeling under the umbrella of the very same approved NDA. In this latter case, private litigants could bring patent infringement suits to help ward off copycat products, but FDA would be powerless to do so.

V. Conclusion

After balancing the implications of letting the decision stand with the likelihood of success on appeal, the government did not file a petition for a writ of certiorari with the Supreme Court.39 Overturning the decision would certainly have been beneficial, but losing the appeal would have created precedent for all federal courts, extending the reach, and the consequences, of a very unfortunate decision that is limited currently to the Third Circuit.

Rather than appeal, the agency may be planning to seek a legislative solution to this loophole for future applications. Our suggested fix is to amend the language of § 355(a) to read “No person shall introduce or deliver for introduction into interstate commerce any new drug unless an approval of an application filed pursuant to subsection (b) or (j) is effective with respect to such drug and such drug conforms to the approved application.” The Third Circuit gives a nod to this option in the decision itself, stating that “to the extent that our decision has identified a gap in the FDA’s ability to regulate the drugs that are introduced into interstate commerce, Congress has the tools necessary to fill it.”40


1. See All. for Hippocratic Med. v. U.S. Food & Drug Administration, 78 F.4th 210 (5th Cir. 2023).

2. 74 F.4th 141 (3d. Cir. 2023).

3. Id. at 143–44.

4. 21 U.S.C. § 355(a)

5. 74 F.4th at 143.

6. Id. at 144.

7. Id.

8. Id.

9. Id.

10. Id.

11. Id.

12. Id.

13. Id.

14. Id.

15. Id.

16. United States v. Vepuri, No. CR 21-132, 2022 WL 541772, at *2 (E.D. Pa. Feb. 23, 2022).

17. FDA Warning Letter: Dr. Reddy’s Laboratories (June 3, 2011), 58679.htm (last visited Nov. 10, 2023).

18. 2022 WL 541772 at *2.

19. Id.

20. Id.

21. 74 F.4th at 145.

22. Id.

23. 21 U.S.C. § 355(a) (emphasis added).

24. 74 F.4th at 147 (emphasis original).

25. Id.

26. See 21 U.S.C. § 321(p)(1).

27. Vepuri, 74 F.4th at 150, n.8 (quoting U.S. FOOD & DRUG ADMIN., GUIDELINE FOR THE FORMAT AND CONTENT OF THE SUMMARY FOR NEW DRUG AND ANTIBIOTIC APPLICATIONS—GUIDANCE FOR INDUSTRY (Feb. 1987) and 21 U.S.C. § 355(b)(1)(A)) (citations omitted).

28. Id. at 149.

29. Id. at 150.

30. Id.

31. The warning letter to DRL cited the facility for not validating the analytical methods used to test its APIs and for the failure of its quality unit to ensure the APIs manufactured met intended specifications for quality and purity, among other violations. These violations not only rendered the API adulterated but raise such serious questions about the chemical composition of the API itself, that it could not reasonably be considered identical to the approved sources of API identified in the ANDAs. See FDA Warning Letter, supra note 17.

32. Separate provisions under 21 U.S.C. § 331 prohibit introducing into interstate commerce an adulterated drug (or causing a drug already in interstate commerce to become adulterated). 21 U.S.C. § 331(a) and (b).

33. 74 F.4th at 150.

34. 412 U.S. 609, 633 (1973).

35. 74 F.4th at 151.

36. 21 U.S.C. § 356a(d). See also 21 C.F.R. § 314.70.

37. 74 F.4th at 145, n.3.

38. 2022 WL 541772 at *7.

39. See Sup. Ct. R. 13 (a timely petition for certiorari must be filed within 90 days after entry of judgment).

40. 74 F.4th at 149, n.7.

Ashley, D., Auchincloss, K., and Oestreich, E. Implications of Recent Third Circuit Court of Appeals Decision for FDA Drug Approval Framework. Food and Drug Law Journal. 2023. Vol. 78, no. 3. p. 257-262.

Implementing MoCRA: FDA Releases New Draft Guidances on Insanitary Conditions for Tattoo Ink and Cosmetic Product Registration and Listing

This article was originally published in the Food and Drug Law Institute’s Update magazine, Winter 2023, and is shared with permission.

Since enactment of the Federal Food, Drug, and Cosmetic Act (FDCA) in 1938, the evolution and technological innovation of cosmetic products in the U.S. market have presented the Food and Drug Administration (FDA) with unique regulatory challenges. These challenges, along with commercial globalization and limited resources and enforcement authorities, created a need for a broader and more modern cosmetics regulatory framework.

To meet this need, in December 2022, Congress enacted and President Biden signed into law the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) as part of the Consolidated Appropriations Act, 2023.[1] This marked the first major update to FDA’s cosmetics oversight since 1938. MoCRA reforms reflected the challenges of regulating a modern cosmetics industry with increasingly diverse products, including a shift towards greater safety and quality for cosmetics, bringing cosmetics regulation more in line with FDA regulation of other types of regulated products. For example, MoCRA provides FDA with new authorities related to adverse event reporting, good manufacturing practices (GMPs), facility registration and product listing, labeling, recordkeeping, and mandatory recall authority. To implement these requirements, new FDA guidance and regulations for the cosmetics industry are forthcoming.

In that vein, FDA recently released two draft guidances to implement MoCRA, both of which are discussed in this Article.[2]

I. Key Takeaways from FDA’s New Tattoo Ink Draft Guidance

In June 2023, FDA announced the availability of Draft Guidance for Industry: Insanitary Conditions in the Preparation, Packing, and Holding of Tattoo Inks and the Risk of Microbial Contamination (“Tattoo Ink Draft Guidance”).[3] When finalized, the guidance will represent FDA’s current thinking on “insanitary conditions of tattoo ink preparation, packaging, or holding that may render the inks injurious to health because of microbial contamination.”[4]

FDA regulates tattoo inks as cosmetics under the FDCA. The FDCA defines “cosmetic” by reference to a product’s intended use(s). The term “cosmetic” means “articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body or any part thereof for cleansing, beautifying, promoting attractiveness, or altering the appearance . . . .”[5] Tattoo inks are cosmetics because they are articles intended to be introduced into or otherwise applied to the human body for beautifying, promoting attractiveness, or altering the appearance.[6]

The FDCA prohibits the introduction of an adulterated cosmetic into interstate commerce.[7] Under the FDCA, a cosmetic is deemed to be adulterated if it “has been prepared, packed, or held under insanitary conditions whereby it may have become contaminated with filth, or whereby it may have been rendered injurious to health.”[8] FDA issued the Tattoo Ink Draft Guidance to assist tattoo ink manufacturers and distributors in identifying situations in which a tattoo ink may become contaminated and potentially injurious to health, thus resulting in the adulteration of the tattoo ink.

While the draft guidance is intended for tattoo ink manufacturers and distributors, the cosmetic industry at large can benefit from reviewing the draft guidance. Key takeaways in the draft guidance for the larger cosmetic industry are discussed in more detail below.

FDA Is Preparing to Implement New Regulatory Requirements Applicable to Cosmetics Established by MoCRA

Issuing the Tattoo Ink Draft Guidance is among the first actions that FDA has taken to implement its new regulatory authorities under MoCRA. Indeed, FDA stated in the Tattoo Ink Draft Guidance that it “intend[s] to conduct rulemaking to establish good manufacturing practice regulations as part of the implementation of [MoCRA], which requires FDA to establish good manufacturing practice regulations that, to the extent practicable and appropriate, are consistent with national and international standards.”[9] FDA also held a public meeting in June 2023 to receive input from stakeholders on topics related to cosmetic GMPs.[10] In addition, FDA recently issued Draft Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products (“Cosmetic Registration & Listing Draft Guidance”), which “provides recommendations and instructions to assist persons submitting cosmetic product facility registrations and product listings to FDA.”[11]

As FDA’s recent guidance documents and its commitment to conduct rulemaking indicate, the agency has begun transitioning the cosmetic industry from a period of voluntary compliance, with regulatory controls designed to ensure the safety and quality of cosmetic products, to an era of mandatory compliance under the framework established by MoCRA.

FDA Is Still Attempting to Clearly Distinguish Between the Definitions of “Cosmetic,” “Drug,” and “Device”

Historically, FDA has struggled to draw a clear line between cosmetic and drug/device claims. This effort remains evident in the Tattoo Ink Draft Guidance.

The FDCA defines “cosmetic,” “drug,” and “device” by reference to the product’s intended use(s).[12]

  • As previously stated, “[t]he term ‘cosmetic’ means (1) articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body or any part thereof for cleansing, beautifying, promoting attractiveness, or altering the appearance . . . .”[13]
  • “The term ‘drug’ means . . . articles intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease in man . . . ; and . . . articles (other than food) intended to affect the structure or any function of the body of man . . . .”[14]
  • “The term ‘device’ . . . means an instrument, . . . implement, . . . or other similar or related article . . . intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man . . . , or . . . intended to affect the structure or any function of the body of man . . . .”[15]

Because the regulatory requirements for cosmetics vary considerably from those for drugs and devices, accurately distinguishing between claims that reflect the intended use of a “cosmetic” versus a “drug” or “device” is critical.[16] For example, cosmetics and cosmetic ingredients—with the exception of color additives—do not require FDA review or approval prior to marketing. In contrast, cosmetics marketed with drug or device claims are considered to be drugs or devices and may require approval or clearance prior to commercialization. However, the line between a “beautifying” (cosmetic) claim and a “therapeutic” or “structure/function” (drug or device) claim can often be ambiguous, given that many beautifying products affect the body to some extent.

To clarify this distinction, FDA has previously suggested that “products that are represented to have only ‘physical’ effects on the skin are cosmetics, while those for which a ‘physiological’ effect is asserted are drugs.”[17] FDA has interpreted “physical” effects as “mechanical” changes that “cover” the skin (e.g., makeup) or affect “the outermost layers of the skin” (e.g., by softening or moisturizing).[18] FDA has interpreted “physiological” effects as those which cause biochemical or deep-tissue changes, or which “influence the functioning of cells.”[19]

In the Tattoo Ink Draft Guidance, however, FDA did not follow this approach. The Tattoo Ink Draft Guidance treats tattoo inks as a cosmetic, despite FDA historically treating such products as drugs and devices due to their deep insertion in the skin below the epidermis (affecting more than the outermost layers). Moreover, the Tattoo Ink Draft Guidance also contradicted FDA’s relatively recent application of this approach as set forth in Guidance for Industry and FDA Staff: Regulatory Considerations for Microneedling Products (“Microneedling Guidance”).[20] Table 1 below compares the differing approaches in the Tattoo Ink Draft Guidance and Microneedling Guidance.

Table 1.

Tattoo Ink Draft GuidanceMicroneedling Guidance
·       “Tattoo inks bypass the body’s primary physical barrier against pathogens, because they are inserted below the epidermis.”[21]
·       “Tattooing involves puncturing the epidermis about 100 times per second with needles and depositing ink 1.5 to 2 millimeters below the surface of the skin, deep into the dermis . . . .”[22]
“FDA considers claims or statements that indicate penetration or some effect beyond the stratum corneum into living layers of skin by such products to be evidence of a firm’s intent to affect the structure or function of the body. The stratum corneum is a dead layer of skin that is naturally shed through the desquamation process. Therefore, claims or statements regarding the removal of the stratum corneum are not considered an intent to affect the structure or function of the body. In contrast, explicitly or implicitly claiming or stating that a microneedling product penetrates living layers of skin (e.g., epidermis and dermis) would be considered an intent to affect the structure or function of the body.”[23]

Thus, the approach in the Tattoo Ink Draft Guidance is inconsistent with FDA’s approach in the Microneedling Guidance because the tattoo inks are injected well below the stratum corneum. According to the Microneedling Guidance, penetration beyond the stratum corneum would cause a product to be a drug or device.

II. Key Takeaways from Registration & Listing Draft Guidance

As discussed above, under MoCRA, certain owners and operators of facilities engaged in the manufacturing or processing of a cosmetic product for distribution in the United States must now register their facilities (FDCA § 607(a)) and list their products (FDCA § 607(c)) (“Section 607 Requirements”). To help facilitate implementation of these requirements, FDA recently issued Draft Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products (“Cosmetic Registration & Listing Draft Guidance”).[24]

The Cosmetic Registration & Listing Draft Guidance outlines elements of the Section 607 Requirements, including descriptions of who must register and list their products, what information must be submitted as part of registration and listing, and when registration and listing submissions must be made. The Cosmetic Registration & Listing Draft Guidance also provides information about how submissions can be made, whether combination drug/cosmetic products are subject to Section 607 Requirements, and the extent to which registration and listing information may be publicly disclosed. The comment period for initial feedback on the Registration & Listing Draft Guidance closed on September 7, 2023, but cosmetics industry stakeholders should remain engaged and look for future opportunities to provide input.[25]

Registration & Listing Elements Look Familiar; They Are Not Dissimilar from the Now-Discontinued Voluntary Cosmetic Registration Program (VCRP)

As part of its development of the new registration and listing system, FDA ended the former Voluntary Cosmetics Registration Program (VCRP) earlier this year.[26] The Cosmetic Registration & Listing Draft Guidance notes that information in the VCRP will not be transferred into the new system, and previous submissions will not satisfy the new Section 607 Requirements.[27]

The VCRP was a voluntary program implemented via regulations found at 21 C.F.R. Parts 710 and 720. The new Cosmetic Registration & Listing Draft Guidance provides more detail than parts 710 and 720, but those who are familiar with the VCRP will notice similarities to the new, mandatory program and should not have trouble meeting the required registration and listing requirements.

Who Must Register and List

The Registration & Listing Draft Guidance adopts statutory definitions of terms relevant to Section 607 Requirements[28] (i.e., “cosmetic product,”[29] definitions for “facility,”[30] “responsible person,”[31] and “small businesses”[32]), but also sets forth new definitions[33] for several terms/phrases not defined by the statute (i.e., “contract manufacturer,” “manufacturing or processing of a cosmetic product,” and “DUNS number”).

Generally, every person that owns or operates a facility engaged in the manufacturing or processing of a cosmetic product must register with FDA, pursuant to Section 607(a)(1). The Cosmetic Registration & Listing Draft Guidance defines cosmetic manufacturing or processing as “engaging in one or more steps in the making of any cosmetic product by chemical, physical, biological, or other procedures, including manipulation, sampling, testing, or control procedures applied to the product.”[34] An entity that “solely performs” (re)labeling, (re)packaging, holding, and/or distributing of cosmetics,[35] is excluded from the statutory definition of facility, and from the registration requirements restated in the draft guidance. “Packaging” and “repackaging” do not, however, include filling a product container, and thus, product filling would necessitate facility registration.[36] Additionally, beauty shops, salons, and retailers are excluded from the statutory definition of facility, and do not need to register with FDA unless they also manufacture or process a cosmetic product.[37]

With respect to a contract manufacturer’s obligation to register their facility, the Cosmetic Registration & Listing Draft Guidance notes (consistent with the statute) that only a single registration is required per facility, even for those that manufacture cosmetic products for more than one responsible person and/or those that manufacture cosmetic products of their own.[38] Alternatively, a responsible person whose products are manufactured or processed at a contract manufacturing facility may also submit the facility registration on behalf of that facility, alleviating the contract manufacturer’s need to register their own facility. In other words, either the contract manufacturer or the responsible person (i.e., the entity whose name appears on the product label) must register a single manufacturing facility, but not both.[39]

For product listing, the responsible person must submit the required information, pursuant to Section 607(c)(1). As defined in Section 604(4), the responsible person is the manufacturer, packer, or distributor whose name is on the label of the product.[40] Additionally, certain small businesses, as defined in Section 612(b), are not required to register facilities and list cosmetic products.[41] However, four exceptions to this exemption may apply, depending on the nature of the cosmetic product.[42]

What Information Must Be Submitted

The first step in a facility’s registration submission process involves obtaining a facility registration number (i.e., the FDA Establishment Identifier (FEI)).[43] Facility owners or operators can request a new FEI number, or determine whether a facility has an existing FEI number through the “FEI Search Portal”[44] available on FDA’s website. Once they obtain an FEI number, facility owners must provide FDA with the following data as part of a registration submission, pursuant to Section 607(b)(2) and as outlined in the Cosmetic Registration & Listing Draft Guidance:[45]

  • Name of the owner and/or operator of the facility;
  • Facility’s name, physical address, email, telephone number (for foreign facilities, the contact information for the U.S. agent);
  • FEI number;
  • All brand names of cosmetic products manufactured or processed at the facility;
  • Applicable cosmetic category;[46] and
  • Type of submission being made (i.e., initial registration, content update (annual), or abbreviated renewal).

The Cosmetic Registration & Listing Draft Guidance also restates language from the statute as to the data that must be included in a product listing submission, including:[47]

  • All relevant FEI numbers (i.e., facilities where the responsible person’s cosmetic products are manufactured or processed);
  • Name and contact information of the responsible person;
  • Name of the cosmetic product as it appears on the label;
  • Applicable cosmetic category;
  • List of ingredients in the cosmetic product (including fragrances, flavors, or colors);
  • Product listing number (if any) assigned by FDA; and
  • Type of submission being made (i.e., initial, content update, or abbreviated renewal).

Although Section 607 requires that the “applicable cosmetic category” be included in both registration and listing submissions, the statute does not describe more precisely what those categories are. In the Cosmetic Registration & Listing Draft Guidance, FDA has developed an initial list of various cosmetic product categories, included in Appendix A.[48] The appendix includes many recognizable categories of cosmetic products, such as lotions, sprays, oils, and serums, but also contains other less standard products, such as “nail extenders.”[49]

Significantly, the system for categorizing types of cosmetic products laid out in Appendix A is similar to the system that FDA’s Center for Devices and Radiological Health (CDRH) now uses for organizing various device types—medical device classification product codes.[50] FDA likely will use these cosmetic categories for some of the same purposes for which it uses device product codes. CDRH has explained that it uses product codes “to obtain quality and reliable data, and perform analyses that are often reported to Congress, the Government Accountability Office (GAO), the general public, the media, and industry.”[51] Device product codes also have several other important uses, including tracking medical device adverse event reports, imports and exports, and recalls.[52] Therefore, aside from purposes related to registration and listing, FDA could use cosmetic product categories for many of the same reasons, including tracking adverse event reporting, imports/exports, and recalls. Given the many possible uses for these cosmetic product categories, industry feedback on them will be essential to ensuring that the organizational system for cosmetics is appropriate and effective. FDA seems to recognize the importance of this feedback and specifically requested comments on these product categories.[53]

Through the Cosmetic Registration & Listing Draft Guidance, FDA also requests various optional data be submitted as part of registration and listing submissions, beyond what is required under Section 607 Requirements.[54] These items include the parent company name, the facility Data Universal Numbering System (DUNS) Number, Unique Ingredient Identifiers (UNIIs), and any additional contact information relevant to the specific submission, among others.[55]

When Must Registration and Listing Submissions Occur

The statutory deadline for fulfilling Section 607 Requirements is December 29, 2023; this applies to owners and operators of facilities engaged in the manufacturing or processing of cosmetic products prior to December 29, 2022,[56] and to responsible persons engaged in the marketing of cosmetic products prior to December 29, 2022.[57] However, in November 2023, FDA announced in Guidance for Industry: Compliance Policy for Cosmetic Product Facility Registration and Cosmetic Product Listing (“Cosmetic Registration & Listing Compliance Policy”) that it would delay enforcement of Section 607 Requirements for six months, or until July 1, 2024.[58] This delayed enforcement also applies to owners and operators of facilities engaged in manufacturing or processing of cosmetic products after December 29, 2022, as well as for responsible persons engaged in the marketing of cosmetic products after December 29, 2022; they too now have until July 1, 2024 to meet registration and listing requirements.[59]

The Cosmetic Registration & Listing Draft Guidance also describes timing requirements, consistent with those in Section 607, for submitting amended facility registration information (i.e., within 60 days of a change), as well as updated listing information (i.e., annually).[60] Distinct from the statute, the draft guidance recommends that submissions involving updated information include changes resulting in a registration cancellation or a discontinued product.[61] For purposes of renewals, the draft guidance again adheres to the statutory language and calls for facilities to renew their registration with FDA on a biennial basis (i.e., every two years), even if registration information remains unchanged since their most recent past submission (FDA intends to provide an abbreviated renewal registration submission option for unchanged renewals).[62]

The Draft Guidance Continues to Emphasize That the Cosmetic Registration & Listing Requirements Do Not Apply to Cosmetic Products That Are Also Drugs

The Cosmetic Registration & Listing Draft Guidance notes that Section 607 Requirements do not apply to cosmetic products that are also drugs, nor do they apply to the facilities that manufacture such products (unless the facility also manufactures or processes a product that is solely a cosmetic).[63] This is partly consistent with Section 613 of the FDCA, which states that “a cosmetic product or facility that is also subject to the requirements of subchapter V shall be exempt from” Section 607 Requirements.[64]

Interestingly, subchapter V in the statute sets forth regulatory requirements applicable to both drugs and devices, indicating that “a cosmetic product or facility that is also subject to the requirements” applicable to drugs or devices “shall be exempt from” Section 607. However, the Cosmetic Registration & Listing Draft Guidance only mentions drugs, stating that certain requirements do not apply to cosmetic products that are also drugs.[65] That being said, this may be an area where clarity is needed as to FDA’s expectations with respect to registration and listing exemptions for cosmetics that are also devices.

In addition, the same electronic submission process used to register an establishment and list a drug will be available for cosmetic facility registration and product listing. The consistency between these processes is intended to streamline the submission of registration and listing information for cosmetics facilities and products for entities that also submit drug establishment and listing information.[66]

FDA is developing an electronic portal for submitting cosmetic facility registration and product listing information, called Cosmetics Direct.[67] Additionally, pursuant to the Structured Product Labeling (SPL) Implementation Guide with Validation Procedures, cosmetics facility registrations and product listings are now included within the SPL framework, and Cosmetics Direct will be an FDA-provided SPL authoring tool.[68] The Cosmetic Registration & Listing Draft Guidance notes that a paper form (i.e., Forms FDA 5066 and 5067)[69] will also be accepted as an alternative submission method; however, FDA is “strongly” encouraging electronic submissions for more efficient data management.[70] Both submission tools (i.e., use of the electronic portal and the paper form) will be accessible on FDA’s webpage once developed.[71]

Limited Disclosure of Cosmetic Registration & Listing Information

The Cosmetic Registration & Listing Draft Guidance notes that FDA will only publicly disclose cosmetic product facility registration and listing information to the extent permitted by law.[72] Pursuant to Section 607(d), product listing numbers will not be made available for public disclosure.[73] Additionally, pursuant to Section 607(e), brand names from facility registration submissions or facility registration numbers from product listing submissions will not be made available in response to requests made under the Freedom of Information Act, 5 U.S.C. § 552.[74]


Both the Tattoo Ink Draft Guidance and the Cosmetic Registration & Listing Draft Guidance are important for members of the cosmetics industry. The draft guidances indicate that FDA is on its way to implementing MoCRA. Therefore, cosmetics industry stakeholders should take full advantage of the comment process for the draft guidances, as well as future public meetings and commenting opportunities, to ensure their valuable input is considered during FDA’s implementation efforts.

In addition, although the modern regulatory framework for cosmetic products is in its infancy, the Cosmetic Registration & Listing Draft Guidance demonstrates how the new cosmetic regulatory framework draws from existing regulatory concepts and requirements (like facility registration and product listing) that exist for drugs and devices. Thus, in addition to paying attention to what already exists for cosmetics (e.g., the VCRP), the cosmetics industry could also benefit from close review of regulatory frameworks for drugs and devices for more clues as to how FDA may implement MoCRA.

Finally, the Tattoo Ink Draft Guidance shows how MoCRA has not fixed all problems with respect to regulation of cosmetic products. The jurisdictional ambiguity related to distinguishing a drug or device from a cosmetic has been a long-standing issue for FDA, and the Tattoo Ink Draft Guidance further demonstrates that clearly distinguishing between cosmetics and drugs/devices remains challenging.

[1] See Consolidated Appropriations Act, 2023, Pub. L. No. 117-328, §§ 3501–3508 (2022).

[2] This Article was finalized in November 2023 and does not include FDA policy updates or announcements that have occurred since then.

[3] Draft Guidance for Industry: Insanitary Conditions in the Preparation, Packing, and Holding of Tattoo Inks and the Risk of Microbial Contamination (June 2023), [hereinafter Tattoo Ink Draft Guidance]; 88 Fed. Reg. 38,516–18 (June 13, 2023).

[4] 88 Fed. Reg. at 38,516.

[5] FDCA § 201(i), 21 U.S.C. § 321(i) (emphasis added).

[6] See Tattoo Ink Draft Guidance, supra note 3, at 3.

[7] FDCA § 301(a), 21 U.S.C. § 331(a).

[8] FDCA § 601(c), 21 U.S.C. § 361(c).

[9] Tattoo Ink Draft Guidance, supra note 3, at 7.

[10] Public Meeting: Good Manufacturing Practices for Cosmetic Products, June 1, 2023, also Docket No. FDA-2023-N-1466

[11] Draft Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products at 3 (Aug. 2023),

[12] “Intended use” may be inferred from a manufacturer’s promotional claims. Specifically, “FDA may consider, among other things, any written or oral claims or statements in any label, labeling, advertising, and/or promotion of a . . . product by or on behalf of a firm in determining whether a . . . product is intended to cure, mitigate, treat or prevent disease or affect the structure or function of the body.” Guidance for Industry and FDA Staff: Regulatory Considerations for Microneedling Products at 7 (Nov. 10, 2020), [hereinafter Microneedling Guidance].

[13] FDCA § 201(i), 21 U.S.C. § 321(i) (emphasis added).

[14] FDCA § 201(g)(1), 21 U.S.C. § 321(g)(1) (emphasis added).

[15] FDCA § 201(h)(1), 21 U.S.C. § 321(h)(1) (emphasis added).

[16] See also Compliance Program Guidance Manual § 7329.001, “Cosmetics Program; Import and Domestic,”

[17] E.g., FDA, Cosmetic Labeling Guide (Oct. 1991) (“one may say that a cosmetic is a product intended to exert a physical, and not a physiological, effect on the human body”).

[18] Letter from Cosmetics Manufacturers to John M. Taylor, Associate Commissioner for Regulatory Affairs at 3–4 (Sept. 11, 1987) (describing FDA’s interpretation of the distinction).

[19] Id.

[20] Microneedling Guidance, supra note 12, at 7–8.

[21] Tattoo Ink Draft Guidance, supra note 3, at 5.

[22] Id. at 4.

[23] Microneedling Guidance, supra note 12, at 7.

[24] Draft Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products (Aug. 2023), [hereinafter Cosmetic Registration & Listing Draft Guidance].

[25] 88 Fed. Reg. 53,490–92 (Aug. 8, 2023), Although the comment period has closed, an interested party can submit comments at any time. See 21 C.F.R. § 10.115(g)(5). To ensure that FDA considers comments on a draft guidance before it begins work on the final version, it is best practice to submit comments before the comment period closes.

[26] Constituent Update: FDA Has Stopped Accepting Submissions to the Voluntary Cosmetic Registration Program (Mar. 27, 2023),

[27] See Cosmetic Registration & Listing Draft Guidance, supra note 24, at 4.

[28] See id. at 4–6.

[29] FDCA § 604(2), 21 U.S.C. § 364(2); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 5.

[30] FDCA § 604(3), 21 U.S.C. § 364(3); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 5.

[31] FDCA § 604(4), 21 U.S.C. § 364(4); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 6.

[32] FDCA § 612(b), 21 U.S.C. § 364h(b); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 6.

[33] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 4–6.

[34] Id. at 6.

[35] FDCA § 604(3)(B)(viii), 21 U.S.C. § 364(3)(B)(viii); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 5.

[36] FDCA § 604(3)(C), 21 U.S.C. § 364(3)(C); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 6.

[37] FDCA § 604(3)(B), 21 U.S.C. § 364(3)(B); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 6.

[38] FDCA § 607(a)(3), 21 U.S.C. § 364c(a)(3); Cosmetic Registration & Product Listing Draft Guidance, supra note 24, at 7.

[39] Id.

[40] See also Cosmetic Registration & Listing Draft Guidance, supra note 24, at 6.

[41] Id.

[42] FDCA § 612(b), 21 U.S.C. § 364h(b); see also Cosmetic Registration & Listing Draft Guidance, supra note 24, at 6.

[43] See Cosmetic Registration & Listing Draft Guidance, supra note 24, at 8, fn 3.

[44] FEI Search Portal,

[45] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 8.

[46] See id. at 12–15.

[47] FDCA § 607(c)(4)(A), 21 U.S.C. § 364c(c)(4)(A); Cosmetic Registration & Listing Draft Guidance, supra note 24, at 8–9.

[48] Id.

[49] Id.

[50] See Guidance for Industry and FDA Staff: Medical Device Classification Codes (Apr. 11, 2013), [hereinafter Medical Device Classification Codes Guidance]; see also FDA Product Code Classification Database,

[51] Medical Device Classification Codes Guidance, supra note 50.

[52] Id.

[53] See Cosmetic Registration & Listing Draft Guidance, supra note 24, at 12, fn 6.

[54] See id. at 8–9.

[55] The Data Universal Numbering System (DUNS) number is a unique, site-specific identification number assigned to a facility’s physical location. The UNIIs are generated based on scientific identity characteristics in accordance with ISO 11238 and can be searched through FDA’s UNIIs search service, Global Substance Registration System (GSRS). See FDA’s GSRS,

[56] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 10; see also FDCA § 607(a)(1)(A), 21 U.S.C. § 364c(a)(1)(A).

[57] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 11; see also FDCA § 607(c)(2)(B), 21 U.S.C. § 364c(c)(2)(B).

[58] Guidance for Industry: Compliance Policy for Cosmetic Product Facility Registration and Cosmetic Product Listing (Nov. 2023),; 88 Fed. Reg. 77,323–24 (Nov. 9, 2023).

[59] Cosmetic Registration & Listing Compliance Policy, supra note 24, at 4.

[60] See Cosmetic Registration & Listing Draft Guidance, supra note 24, at 10–11; see also FDCA § 607(a)(4) & (c)(5), 21 U.S.C. § 364c(a)(4) & (c)(5).

[61] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 10–11.

[62] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 10; see also FDCA § 607(a)(2), 21 U.S.C. § 364c(a)(2).

[63] See Cosmetic Registration & Listing Draft Guidance, supra note 24, at 11; see also FDCA § 613, 21 U.S.C. § 364i.

[64] FDCA § 613, 21 U.S.C. § 364; see also 21 U.S.C. §§ 351–360fff-8.

[65] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 11.

[66] Id.

[67] In September 2023, FDA requested comments on its newly developed draft electronic submission portal (Cosmetics Direct) along with paper forms (Forms FDA 5066 and 5067). See 88 Fed. Reg. 63,960–63 (Sept. 18, 2023), also Draft Cosmetics Direct: Electronic Submissions Portal Screenshots for Commenting (Sept. 2023),

[68] See Structured Product Labeling (SPL) Implementation Guide with Validation Procedures (Oct. 2023), also Cosmetics Constituent Update: FDA Issues Update on Cosmetic Product Facility Registration and Cosmetic Product Listing (Nov. 2023),

[69] See 88 Fed. Reg. 63,961.

[70] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 4.

[71] Id. at 10.

[72] See id. at 9.

[73] Id.see also FDCA § 607(d), 21 U.S.C. § 364c(d).

[74] Cosmetic Registration & Listing Draft Guidance, supra note 24, at 9; see also FDCA § 607(e), 21 U.S.C. § 364c(e).

Important Recent Updates to DOJ Policy on Voluntary Self-Disclosure and Corporate Compliance Programs

This article was published in the Summer 2023 issue of the Food and Drug Law Institute’s Update magazine, pages 3 through 7. It can be downloaded through the link at right or read online.

In February and March of 2023, the U.S. Department of Justice (DOJ) announced significant policy updates affecting a broad range of businesses, including those regulated by the U.S. Food and Drug Administration (FDA). The first concerns the specific circumstances under which DOJ will not seek a guilty plea from a company that voluntary self-discloses misconduct. The second addresses how, when evaluating the adequacy of corporate compliance programs, DOJ assesses executive compensation structures as well as company policies on the use of messaging applications and personal devices to conduct company business. Both updates implement revisions to DOJ’s corporate criminal enforcement policies first announced in a September 2022 memorandum by Deputy Attorney General Lisa Monaco (Monaco Memorandum).

The authors recommend that FDA-regulated entities become familiar with DOJ’s newly announced “carrots and sticks,” and consider incorporating them into their own policies and procedures.

CTP Programmatic Update

Greenleaf regulatory compliance expert Elizabeth Oestreich captured an update on programmatic activities at the FDA’s Center for Tobacco Products, as presented by Center Director Dr. Brian King during the 2023 Food and Drug Law Institute (FDLI) Annual Conference in May 2023. The update was published in the Summer 2023 issue of FDLI’s Update magazine (pages 57-58), which can be downloaded through the link at right or read online.

Trends in FDA FY2022 Inspection-Based Warning Letters

This article originally appeared as a guest column in Outsourced Pharma.

The COVID-19 pandemic continued to impact FDA’s inspection activities in FY2022 despite efforts to shift more of the agency’s focus beyond the public health emergency. This article will analyze FDA warning letters issued in FY2022 (Oct. 1, 2021, to Sept. 30, 2022). Specifically, this article will review certain inspection-based warning letters issued to drug manufacturers and offer reflections on current trends and predictions for the upcoming year.

FDA inspection activities began to normalize in 2022, despite years of COVID-19 related disruptions. FDA initially paused all inspections in March 2020 due to the COVID-19 public health emergency, but soon thereafter resumed limited domestic inspections in July 2020 based on priority. The agency then resumed prioritized foreign inspections in October 2020. COVID-19 variants continued to delay the regular course of inspection activities throughout 2021 and into 2022, including a short return to only mission critical inspections from Dec. 29, 2021, to Feb. 7, 2022. Although most of FY2022 saw a return to regular domestic inspection operations, FDA did not resume all foreign inspections until April 2022.

Based on our review, we observed some continued trends from the COVID-19 era, as well as signs that the agency may be expanding its focus beyond the pandemic, shifting its operations back to a more regular course. FDA notably took an interest in repeat violations observed during inspections, OTC drug products including hand sanitizers, responsibilities for contract manufacturers, and testing of incoming components and raw materials. This article discusses each of these themes before examining what this may mean for FDA’s drug GMP enforcement focus in 2023 and beyond.

In FY2022, FDA issued 165 drug product warning letters. Of the 165, 74 were based on observations from an on-site inspection, 16 letters stemmed from tested samples, and three from a records request under section 704(a)(4) of the Federal Food, Drug and Cosmetic Act (FD&C Act) (referred to as 704(a)(4) requests in this article).1 The remainder of the warning letters were generally the result of review of product labels, registration materials, and/or websites.2

Of the 74 letters following on-site inspections, seven followed bioresearch monitoring (BIMO) inspections,3 eight focused on human cell, tissue, or cellular products (HCTP),4 two followed good laboratory practice (GLP) inspections,5 nine were issued to pharmaceutical compounding firms,6 and one was issued to a PET drug manufacturer.7 This article excludes warning letters following GLP inspections, those issued to pharmaceutical compounding firms, and the warning letter issued to the PET drug manufacturer in an effort to focus our analysis on the most relevant 62 warning letters prompted by violations observed during an on-site inspection.

BIMO Inspections

BIMO inspections are designed to evaluate the conduct of FDA-regulated research to ensure the quality and integrity of data submitted to the agency in support of marketing applications and to protect the rights, safety, and welfare of human subjects. In FY2022, the FDA primarily observed failures associated with study execution and inappropriate enrollment of human subjects. The majority of the letters were issued to firms within the U.S. (five). One warning letter was also issued to a firm in Ukraine and one was issued to a firm in Canada. Three of the seven warning letters cited failure to conduct investigations according to an investigational plan pursuant to 21 CFR 312.60.8 Specifically, the FDA voiced concern about investigational plan deviations to enroll subjects who did not meet eligibility criteria, which jeopardizes subjects’ safety and welfare and raises concerns about the validity and integrity of the data collected.9 FDA also found lack of adherence to safety-related testing requirements by Joseph A. Zadra for failing to complete tests at specific timepoints. Smitha C. Reddy also failed to follow protocols for randomizing specific groups and appropriately blinding studies to prevent bias among staff.

Two letters cited failure to submit an Investigational New Drug (IND) application for clinical investigations with an investigational new drug, per 21 CFR 312.2(a).10 Two of the seven letters found improper usage of an institutional review board (IRB), as set forth in 21 CFR 56, for review and approval of the proposed clinical study protocol.11 Additionally, two letters included observations for failure to obtain informed consent from participants in accordance with 21 CFR 5012 and failure to retain documentation for two years pursuant to 21 CFR 312.13

Human Cell and Tissue Products (HCTPs)

The FDA issued eight warning letters to U.S. firms manufacturing HCTPs in FY2022. Of the eight, four observed insufficient evaluation or testing for communicable disease in samples.14 The FDA’s website includes information about tests that are currently recommended to adequately and appropriately reduce the risk of transmission of relevant communicable disease agents and diseases, including a complete list of donor screening assays and specific requirements for donor testing. This is a top consideration in the agency’s approach to HCTP safety and availability for all patients but especially for fertility-focused products for which donor history is relevant to preventing sexually transmitted disease.

The remaining four letters cite 21 CFR 1271.3(f)(1), the requirement for minimal manipulation of HCTPs, and warn companies with products that have been processed to the point where the original characteristics have been altered.15 The statute defines minimal manipulation of HCTP products to mean (1) processing that does not alter the original relevant characteristics of the tissue relating to the tissue’s utility for reconstruction, repair, or replacement, and (2) for cells or non-structural tissues, processing that does not alter the relevant biological characteristics of cells or tissues.16 If a product is more than minimally manipulated, it does not qualify as an HCTP, and is instead subject to premarket review and approval as a drug or biologic under a biologics license application (BLA).17

The agency also cited five of the eight HCTP manufacturers for failure to establish written procedures designed to prevent microbiological contamination. All concern the failure to validate processes for products purporting to be sterile. The failure to establish and follow written procedures has been a theme across all inspection-based warning letters; the agency typically views these types of issues as “low-hanging fruit” indicative of an immature quality system. Interestingly, these warning letters do not include a recommendation to engage a third-party consultant to assist with GMP compliance as is included in most inspection-based drug warning letters analyzed below.

Drug Products

The remaining 47 inspection-based warning letters issued to drug manufacturers are less geographically diverse than in years past, with three firms located in India, two in China, and one each in Germany and Spain. The remaining 40 warning letter recipients are in the U.S. (including one from Puerto Rico). This is not surprising, given the limited ability of FDA to conduct foreign inspections for a significant portion of FY2022.

A majority of the letters went to OTC manufacturers (32 in total), which includes the sole homeopathic product manufacturer, as well as one company that manufactures OTC drugs and medical devices.18 The remaining warning letters went to six finished prescription drug manufacturers and nine API manufacturers.19 FDA also noted that three recipients were contract testing laboratories (one contract testing lab tested OTC products, one tested API, and one tested finished pharmaceuticals).20

Notably, 16 warning letters were for hand sanitizer products, and another five were for topical skin lightening products.21 As we discuss later in the article, the focus on hand sanitizers is directly related to the COVID-19 pandemic and FDA’s regulatory efforts to expand the available supply of hand sanitizer while ensuring the safety of the product.

Other general trends identified across analyzed warning letters are also worth highlighting. For example, a large majority of warning letters (42) included a recommendation for the retention of an expert consultant to assist firms in their remediation efforts, a trend that has become increasingly standard in recent years.

Moreover, although inspections in 2021 and 2022 were far less numerous than in non-pandemic years, investigators were prompt in issuing letters. All but one of the 47 warning letters were issued within 12 months of the last day of an inspection.22 Of these, the shortest turnaround time was just shy of four months, with the inspection concluding on Nov. 19, 2021, and receipt of the warning letter occurring on March 14, 2022.23 This timeframe is impressive given the agency’s pandemic workload.

Finally, although much has changed since 2019 and early 2020, FDA hasn’t forgotten about violations that predate the pandemic, with 19 of the 47 warning letters specifically calling out repeat observations.

Key Emerging Themes

Component Testing

Concerns surrounding component product quality was a particular theme in FY2022 warning letters. Overall, 13 warning letters included component testing observations: nine hand sanitizer product warning letters included this language, as well as one skin lightening product and three non-hand sanitizer OTC products. The agency observed companies relying on certificates of analysis (COAs) for identification of product components and raw materials (without first establishing the reliability of those COAs), rather than performing the appropriate testing to ensure the product met required acceptance criteria for use in manufacturing. The agency noted that those firms relying on COAs had no assurance that the product conforms with appropriate specifications for identity, strength, quality, and purity.

For example, the Premier Trends LLC letter articulated the need to test incoming API and components of a product. In it, FDA explained:

“Though you receive raw materials with a certificate of analysis from your suppliers, you have not performed appropriate incoming analysis of component lots upon receipt, including confirming the identity prior to use in production of your finished drug product. You also relied on your supplier’s certificate of analysis without establishing the reliability of your component supplier’s test analyses at appropriate intervals.”24

Not surprisingly, this observation was frequently included in warning letters for hand sanitizer products, specifically due to the presence of methanol and other harmful impurities found in products tested at the border. For example, language was included in the letter to Yusef Manufacturing Laboratories for failing to test API used for its hand sanitizer product:

“You failed to adequately test your incoming components for identity before using the components to manufacture your over-the-counter (OTC) drug products. Additionally, you relied on [COAs] from unqualified suppliers for specifications such as purity, strength, and quality. By not adequately analyzing your components for identity, purity, strength, and quality, you failed to ensure your incoming components meet appropriate specifications.”25

Contract Manufacturing Responsibility and Accountability

Another theme observed in FY2022 warning letters was the close attention paid to contract manufacturers and contract testing laboratories, a possible product of the agency’s more recent whole supply chain focus. Overall, letters issued in FY2022 drive home the twin requirements that: (1) contract manufacturers are subject to cGMPs and quality requirements just like other manufacturers; and (2) the product sponsor is responsible for the finished product and has a duty to oversee its contractors and suppliers. The agency included contract manufacturing or testing language in 18 warning letters.

Notably, 11 of those 18 warning letters included a separate section for this information at the bottom of the letter. The title for this section varied, but the placement of this language at the end of a warning letter, similar to recommendations to engage a third-party cGMP expert or calling out specific concerns surrounding data integrity, shows the agency’s desire to clearly communicate the significance of this message, including the need for effective quality agreements.

For example, Sanitizer Supply produced hand sanitizers as a contract manufacturer. FDA found that Sanitizer Supply failed to test incoming components and also failed to validate and establish the reliability of their component supplier’s test analyses at appropriate intervals (21 CFR 211.84(d)(1) and (2)). In this case, even though Sanitizer Supply is a contract manufacturer, FDA points out that they are still required to manufacture drugs in conformance with cGMP, regardless of any agreements with product owners. FDA included the following paragraph emphasizing this point at the end of its letter to Sanitizer Supply.

“Responsibilities as a Contractor

Drugs must be manufactured in conformance with cGMP. The FDA is aware that many drug manufacturers use independent contractors such as production facilities, testing laboratories, packagers, and labelers. The FDA regards contractors as extensions of the manufacturer.

You are responsible for the quality of drugs you produce as a contract facility regardless of agreements in place with application sponsors and product owners. You are required to ensure that drugs are made in accordance with section 501(a)(2)(B) of the FD&C Act for safety, identity, strength, quality, and purity. See the FDA’s guidance document Contract Manufacturing Arrangements for Drugs: QualityAgreements at”26

This reminder also appears in the letters sent to Sanitor Corporation, NDAL Mfg Inc., Vitae Enim Vitae Scientific Inc., and Sterling Pharmaceutical Services, among others. In the case of Sterling, the firm, acting as a contract manufacturer, received findings related to sterility failures. Specific incident investigations into contamination risks, which included microorganisms recovered from ISO 5 areas, routinely identified poor aseptic behaviors among manufacturing personnel, despite the company’s findings that there was a “very low” contamination risk posed to drug products.

Warning letters to other firms contained language emphasizing the firm’s responsibility for oversight of its contractors, such as the letter to Specialty Process Labs LLC stating:

“Your firm’s quality unit (QU) failed to perform routine QU functions to ensure drug manufacturing operations were adequate. For example, your QU failed to:

  • Establish and maintain adequate evaluation procedures for third-party laboratories that are utilized for finished drug testing, such as fat analysis, inorganic iodides and residual solvents. Your quality unit has not qualified or evaluated any of the contract laboratories used for these tests.”27

Failure to Cooperate With the FDA for Inspection

Interestingly, two warning letters were issued to companies that failed to cooperate with FDA for the purpose of facility inspection. Mexican firm Glicerinas Industriales, S.A de C.V., refused entry to FDA (via phone) for a planned inspection at their manufacturing site scheduled to occur in May 2022 and, as a result, received a warning letter that drugs manufactured at the facility were adulterated.28 A domestic contract testing lab, Green Wave Analytical LLC, also failed to cooperate with FDA. Green Wave delayed FDA’s on-site inspection for three days by falsely representing that the firm did not perform cGMP testing of finished drug products under contract. FDA’s warning letter to Green Wave states that because of the partial refusal, its products are adulterated.29

In addition, Global Sanitizers was subject to an on-site inspection after it twice refused to respond to a 704(a)(4) records request. FDA noted the refusals in the warning letter, reminding the firm that failure to respond to a 704(a)(4) request is a prohibited act under the FD&C Act, and then cited the company for several significant cMPG violations based on the on-site inspection.30

FDA expends significant resources to complete inspections in a timely manner and utilizes a risk-based site selection model to prioritize on-site inspections, thus it is not surprising that firms that were unwilling to cooperate with the agency received warning letters.31

Heightened FDA Scrutiny on Two Key Product Types

Hand Sanitizer Products

Hand sanitizer products continued to be an area of heightened interest in FY2022, again demonstrating the agency’s continued focus on safeguarding the public against COVID-19-related products. As threats of the public health emergency continued and many returned to daily in-person activities, the public relied on masking and hand sanitization as a way to limit transmission of the disease. Hand sanitizer products flooded the market beginning in 2020 and continuing into 2022.

An extensive review of FDA’s approach to the regulation of hand sanitizers during the pandemic as a whole is beyond the scope of this article. Suffice it to say that after issuing a guidance providing flexibility for manufacturing hand sanitizer to meet growing public demand, FDA began to notice a significant uptick in safety concerns with such products, including contamination with methanol, a toxic and potentially lethal substance that resulted in several poisonings and deaths.32 While many hand sanitizer warning letters were issued following detention and testing at the U.S. border, 16 warning letters were issued to hand sanitizer manufacturers after an on-site inspection.

Artnaturals33 stands out as an example of FDA’s diligence in ensuring violative products are removed from the market. Artnaturals offered a variety of hand sanitizing products that included a scent-free hand sanitizer product found to be contaminated with benzene, acetaldehyde, and acetal impurities. In this case, FDA repeatedly attempted to reach the manufacturer regarding violative sample results. After the company failed to respond, FDA issued a public notification. The company subsequently voluntarily recalled the product in October 2021. They were inspected in the months following the recall. In light of the concerns regarding contamination and impurities, numerous other manufacturers of hand sanitizers were issued warning letters with citations for failure to adequately test components or finished drug product to ensure they met standards for identity, strength, and purity.34

Global Sanitizers was similarly unresponsive to two attempts to request records under 704(a)(4) and other information from the company before their Las Vegas, NV, facility was inspected in February 2021. Global Sanitizer served as a repackager and relabeler of bulk consumer hand sanitizing products. FDA tested product samples from the facility and found two products contained methanol. Medically Minded Hand Sanitizer Gel Antimicrobial Formula contained an average of 58% methanol, and Medically Minded Hand Sanitizer Gel Antimicrobial with Vitamin E & Moisturizer contained an average of 32% ethanol and an average of 7.4% methanol. Both products were labeled to contain 70% of the active ingredient ethanol. As noted above, methanol is toxic and can cause dermatitis and transdermal absorption with systemic toxicity when absorbed by the skin and can be more injurious if consumed orally.

American Cleaning Solutions is another blatant example of cGMP failures by a domestic hand sanitizer manufacturer. This company manufactures insecticides and industrial cleaners in addition to hand sanitizing products and failed to establish and follow written procedures for cleaning and maintenance of equipment (21 CFR 211.67(b)). FDA noted in the warning letter that “[i]t is unacceptable as a matter of CGMP to continue manufacturing drugs using the same equipment that you use to manufacture pesticides or other non-pharmaceutical products due to the risk of cross-contamination.”35 FDA also found that the active ingredient isopropanol was substituted wholly or in part with ethanol and cited the company for inadequate release testing, among other violations.

In addition to GMP failures, unapproved drug claims were another common observation made among violative hand sanitizer products. For example, the Spartan Chemical Company’s hand sanitizer product claims to be “effective in shortening the duration of infection and preventing infection or disease from the novel coronavirus that causes COVID-19.”36 The agency found this language concerning because it goes beyond merely describing the general intended use of a topical antiseptic.

In short, FDA acted quickly and decisively when it came to hand sanitizer products in FY2022, particularly those containing acetaldehyde, which appears to be genotoxic (and potentially carcinogenic), methanol, and other impurities that may pose risk to consumers and those that made unapproved drug claims.

Skin Lightening Products

Another interesting trend in FY2022 was FDA’s focus on products in the beauty industry. Specifically, topical OTC products like sunscreens and skin lightening products were significantly represented, with five warning letters issued to companies manufacturing skin lightening products.37 This may signal that the agency intends to shift toward products that may have flown under the radar during the pandemic, especially OTC drugs popularized by advertising and promotion. These products caused serious and permanent skin damaged and often made unapproved drug claims.

Notably, a warning letter sent to Generitech Corporation encompasses many of the key themes of FY2022. FDA found that the firm’s “quality system for investigations is inadequate and does not ensure consistent production of safe and effective products.”38 It also found that it failed to conduct adequate testing for components and API used for the production of the skin lightening products, including the salicylic acid API used in the product. Instead, the firm relied on COAs from suppliers. Without adequate testing, there is no assurance that a final product conforms to appropriate specifications. Additionally, and significantly, this was a repeat observation from an untitled letter sent in January 2014.

Predictions for 2023 and Beyond

As our analysis demonstrates, in FY2022 COVID-19 remained an issue for FDA, although the agency has shown signs that it is shifting toward regular business — for example, circling back on repeat offenses, holding firms accountable up and down drug supply chains, and enforcing against non-COVID-19 related products, such as skin bleaching agents.

We expect COVID to continue to have effects on enforcement and inspections in 2023, but we also predict that the agency will operate under more typical conditions in 2023. This almost certainly means more oversight of foreign entities now that COVID-era restrictions have been lifted and more foreign inspections are taking place. Given the pandemic inspection pauses of the past few years, it’s possible we may see an uptick in inspection-based warning letters in the years to come.

That said, certain policy changes and shifts in enforcement priorities made during the pandemic are likely here to stay. For example, we expect FDA to continue to focus on OTC products and to pay close attention to enforcement activities across different types of manufacturers, including contract testing labs and CMOs, as part of its broader efforts to enhance entire supply chain resiliency and to prevent drug shortages. And perhaps most notably, we anticipate FDA will seek to understand lessons learned from the pandemic and how to apply those lessons moving forward, including how to best leverage alternatives to on-site inspections, such as 704(a)(4) records requests, voluntary remote regulatory assessments, mutual reliance on inspectional findings from foreign authorities, product sampling and testing, and other tools. The agency will also need to implement the inspection-related provisions of the Food and Drug Omnibus Reform Act (FDORA), attached to the FY2023 omnibus appropriations bill that was enacted in December 2022. Many of the FDORA provisions relate to FDA’s use of alternative tools.

Although we have centered this article on inspection-based drug warning letters, it is worth noting that several warning letters falling outside that narrow scope shed light on the potential areas of focus for FY2023. For example, in FY2022 FDA issued the first warning letter for a delta-8 THC product, in the midst of the exploding market for cannabis- and hemp-derived products.39 FDA will also almost certainly continue to monitor websites, online labeling, and marketing materials, as we saw this year, and issue warning letters citing unapproved drug charges (for both COVID- and non-COVID-related products). In FY2022 FDA sent warning letters to three companies marketing skin tag and mole removing products that are unapproved new drugs. Notably, one of the three was issued to online retailer giant Amazon, which could signal further attempts to regulate similar large third-party sellers.40

Finally, although not a warning letter, a recently issued untitled letter again points to the agency’s focus on whole supply chain accountability and resiliency. The letter, issued to Valisure, LLC on Dec. 5, 2022, cited the analytical laboratory for problems with its contract testing services, which are aimed at fulfilling drug manufacturers’ cGMP requirements, as well as for violations under the Drug Supply Chain Security Act41 (DSCSA). Although it came after our FY22 timeframe, the letter is worth mentioning because, in this case, the agency held the firm responsible for potentially causing downstream cGMP violations due to their inadequate testing methods. Moreover, the letter notably calls out the firm’s DSCSA violations, an area that has yet to see much enforcement focus to-date. With DSCSA requirements coming into full effect in November 2023, greater emphasis on similar violations moving forward is another reason manufacturers should be aware of their responsibilities to the drug supply chain as a whole.


  1. Cosmo Bio Co., Ltd., Dr Retter Ec Wladyslaw Retter, and Guangzhou Orchard Aromatherapy & Skin Care Co., Ltd. (all OTC manufacturers) received warning letters based on a 704(a)(4) records request.
  2. One company, Glicerinas Industriales, S.A. de C.V., received a warning letter on June 13, 2022, for refusing to allow FDA entry to conduct an on-site inspection.
  3. Warning letters issued following BIMO inspections include Daniel C. Tarquinio, Daniel Fred Goodman, Joseph A. Zadra, Richard J. Obiso, Sabine S. Hazan, Smitha C. Reddy, Vasyl Melnyk.
  4. BioLab Sciences, Inc.; Surgenex LLC; Cooper Institute; Smart Surgical, Inc. dba Burst Biologics; OsteoLife Biomedical I LLC; Re-Gen Active Lab, Inc.; Zhang Medical P.C. dba New Hope Fertility Center; and Vitti Labs, LLC.
  5. This includes GLP Warning Letters issued to Toxikon Corporation/LabCorp Bedford LLC on Feb. 10, 2022, and Valley Biosystems on Aug. 3, 2022.
  6. Texas Longhorn RX, LLC; Hybrid Pharma, LLC; New Vitalis, LLC dba New Vitalis Pharmacy; Age Management Institute Santa Barbara; Med Shop Total Care, Inc.; Advanced Nutriceuticals, LLC dba The Guyer Institute of Molecular Medicine; Empower Clinic Services, LLC dba Empower Pharmacy; Sagent Pharmaceuticals, Inc.; and Innoveix Pharmaceuticals Inc.
  7. Brigham and Women’s Hospital, Inc.
  8. Daniel C. Tarquinio, D.O./Center for Rare Neurological Diseases, Joseph A. Zadra, M.D., and Smitha C. Reddy, M.D./ACRC Studies, LLC.
  9. Daniel C. Tarquino, D.O./Center for Rare Neurological Diseases, April 5, 2022.
  10. Richard J. Obiso, PhD dba Avila Herbals, LLC and Daniel Fred Goodman, M.D./Goodman Eye Center.
  11. Richard J. Obiso, PhD dba Avila Herbals, LLC and Sabine S. Hazan, M.D. See also 21 CFR 312.66.
  12. Daniel Fred Goodman, M.D./Goodman Eye Center.
  13. Vasyl Melnyk, M.D.
  14. Cooper Institute, OsteoLife Biomedical, LLC, Smart Surgical, Inc dba Burst Biologics, and Zhang Medical P.C. dba New Hope Fertility Center.
  15. BioLab Sciences, Inc., Re-Gen Active Lab, Inc., Surgenex LLC and Vitti Labs, LLC.
  16. 21 CFR 1271.3(f).
  17. 21 CFR 1271.10; 21 CFR 1271.3.
  18. OTC homeopathic drug manufacturer Sterling Pharmaceutical Services, LLC and Dental Technologies Inc., an OTC drug and device manufacturer, are included in this category.
  19. This includes Fagron Group B.V., which operates as a repackager and relabeler of API product.
  20. Miami Univ (contract testing API); Green Wave (contract testing finished Rx); Accu-Biochem (contract testing OTC); Sterling (contract manufacturer).
  21. Sanitor Corporation manufactures both hand sanitizer and skin lightening products and thus is included in the count for both categories.
  22. Custom Research Labs Inc., an OTC manufacturer of hand sanitizer products, received a warning letter on July 8, 2022, approximately 13 months following the end of an inspection on June 4, 2021.
  23. Ultra Seal Corporation’s facilities in New Paltz, NY, were inspected between Aug. 16, 2021, and Nov. 19, 2021, and a warning letter was issued on March 14, 2022.
  24. FDA Warning Letter to Premier Trends LLC, Mar. 14, 2022.
  25. FDA Warning Letter to Yusef Manufacturing Laboratories, Feb. 8, 2022
  26. FDA Warning Letter to Sanitizer Supply LLC, Sept. 2, 2022.
  27. FDA Warning Letter to Specialty Process Labs, LLC, May 3, 2022.
  28. FDA Warning Letter to Glicerinas Industriales, S.A. de C.V., Jun. 13, 2022.
  29. FDA Warning Letter to Green Wave Analytical LLC, Aug. 19, 2022.
  30. FDA Warning Letter to Global Sanitizers LLC, Nov. 8, 2021.
  31. The agency recently updated is guidance on Circumstances that Constitute Delaying, Denying, Limiting or Refusing a Drug or Device Inspection. The new draft was issued in December 2022 to include device firms as well as drug facilities. See,
  32. See e.g., and
  33. Virgin Scent Inc. dba Artnaturals.
  34. See e.g., Yusef; Agropharma Laboratories, Inc.; American Cleaning Solutions; Custom Research Labs Inc.; Fresh Farms LLC; Froggy’s Fog LLC; Sanitizer Supply LLC; and Global Sanitizers LLC.
  35. FDA Warning Letter to American Cleaning Solutions, Sep. 6, 2022.
  36. FDA Warning Letter to Spartan Chemical Company, Inc., Dec. 15, 2021.
  37. The five firms include Monarch PCM, LLC, Sanitor Corporation (which manufacturers both hand sanitizing products and skin lightening products), Generitech Corporation, Clinical Resolution Laboratory Inc., and Bi-Coastal Pharma international. 
  38. FDA Warning Letter to Generitech Corporation, Mar. 1, 2022.
  39. FDA Issues Warning Letters to Companies Illegally Selling CBD and Delta-8 THC Products, May 4, 2022,
  40. FDA Warning Letter to, Inc., Aug. 4, 2022.
  41. The DSCSA establishes a system for the electronic, interoperable tracking and tracing of certain prescription drugs at the package-level in the U.S. FDA has been implementing DSCSA requirements in a phased manner since the law’s enactment in November 2013. These requirements apply to all trading partners involved in the exchange of prescription drugs along supply chains, including manufacturers, repackagers, distributors, and dispensers.

The 8 Key Takeaways for FDA Inspections in the Food And Drug Omnibus Reform Act

This article was originally published as a guest column in Outsourced Pharma.

With President Biden’s signature, the Food and Drug Omnibus Reform Act of 2022 (FDORA), part of the larger Consolidated Appropriations Act of 2023 (Public Law 117-328), became law on Dec. 29, 2022. FDORA expands and modifies the inspection authority of the FDA in several key areas, including alternative tools to inspection, mutual recognition agreements, bioresearch monitoring, and unannounced foreign inspections.

1. Expanding the Availability of Alternative Tools to Inspection

FDORA expands FDA’s authority to make mandatory requests to industry for “records and other information” in advance, or in lieu, of an inspection. Section 704(a)(4) of the Food Drug and Cosmetic Act (FDCA) had previously limited use of this authority to drug establishments.1 Section 3611 of FDORA expands this authority to include device establishments and Section 3612 expands this authority further to bioresearch monitoring (BIMO) sites and facilities.

In guidance issued during the pandemic, FDA began to refer to section 704(a)(4) requests directed to drug establishments as a mandatory “remote regulatory assessment” (or RRA).2 Similar requests directed to non-drug establishments were categorized as voluntary RRAs, given the lack of a statutory basis to make a mandatory request. Despite this absence of specific statutory authority, CDER has made very robust use of voluntary RRAs seeking records and other information as part of its BIMO program.3 That practice should not only continue but increase, as responding to these requests will no longer be voluntary on the part of regulated industry.

Balanced against these expansions of agency authority under Section 704(a)(4), Section 3611 includes a new requirement that, whenever making a Section 704(a)(4) request, FDA must include a “rationale for requesting” the records and other information sought. In addition, by December 2023, the agency is required to issue guidance on the use of Section 704(a)(4) requests, including electronic processes for responding to such requests and the factors the FDA will use to determine whether requested records are provided within a reasonable timeframe and within reasonable limits, considering resource and other limitations, including for small businesses.

Arguably, FDORA’s most significant inspection related change is that Section 3613(b) now permits the FDA to rely on records and other information collected pursuant to Section 704(a)(4) “to satisfy requirements that may pertain to a preapproval or risk-based surveillance inspection, or to resolve deficiencies identified during such inspections, if applicable and appropriate.” This new authority is welcome news to those in industry advocating that FDA increase the use of inspection alternatives. How the agency utilizes this new permissive authority remains to be seen.

We predict this new provision will prove most useful in the area of risk-based surveillance, as Section 3613(b) removes the barrier that previously prevented FDA from relying on records and other information collected pursuant to Section 704(a)(4) to satisfy surveillance inspection requirements. The agency is required to inspect (“shall inspect”) drug establishments in accordance with a risk-based surveillance schedule pursuant to FDCA Section 510(h)(3). The agency has also interpreted the definition of inspection under FDCA Section 704(a)(1) to require a physical entry into the inspected establishment. Consequently, the agency’s view was that it could not satisfy surveillance inspection requirements in any manner short of a physical inspection. Given the nature of risk-based surveillance inspections and the backlog of such inspections resulting from the pandemic, we predict the agency will make great use of this new authority in the surveillance arena. 

While Section 3613(b) also applies to pre-approval inspections and warning letter follow-up inspections, there was never a legal requirement to rely on an inspection in either of those two contexts. In fact, the agency frequently determines it is not necessary to conduct a pre-approval inspection when considering a drug application and has also used “remote interactive evaluations” in lieu of pre-approval inspections during the pandemic.4 Regarding warning letter follow-up inspections, FDA has never taken the position that verification of post-warning letter corrections requires an inspection in all cases.5 The big question is whether the agency will amend its practice of steadfast reliance on re-inspections of drug establishments that have received warning letters. There may be some slight movement here, but the Section 3613(b) change is permissive only and FDA is very likely to maintain its strong preference for post-warning letter inspections based on historical post-warning letter inspection results. Historically, more than 50% of drug facilities have failed their post-warning letter re-inspections, despite having provided records and other information to the agency in advance of the inspection purporting to show that the firm had adequately remedied past violations at the facility and was ready to be re-inspected. 

2. Clarifying the Statutory Basis for Bioresearch Monitoring Inspections

In addition to extending Section 704(a)(4) to BIMO sites and facilities, FDORA Section 3612 establishes a specific statutory basis clarifying FDA’s authority to conduct BIMO inspections.6 Section 3612 provides a comprehensive framework describing the sites and facilities subject to BIMO inspections, the permitted purposes of such inspections, as well as the records and other information subject to inspection, including electronic information systems holding such information. In case you were wondering, this new statutory language also notes that it should not be inferred that FDA previously lacked the authority to conduct BIMO inspections. FDA is required to issue draft guidance describing the processes and practices applicable to BIMO sites and facilities by June 2024.

3. Recognition of Foreign Government Inspections

FDORA Section 3613(c) promotes further FDA use of mutual recognition agreements with foreign counterparts in two ways. It amends FDCA Section 809 to expressly permit FDA to include pre-approval inspections within the scope of foreign mutual recognition agreements. Section 3613(c) also adds a new provision to Section 809 requiring the agency to periodically assess whether additional mutual recognition agreements are appropriate and to report to Congress the results of those assessments every four years. The existing mutual recognition agreements with the EU and the U.K. are considered a great success in the agency. A new mutual recognition agreement was also just signed between the FDA and Switzerland on January 12. FDA is already routinely considering additional such agreements, but this new legislation should encourage further action in this area. Interestingly, the EU, U.K., and Swiss agreements already permit FDA to ask a treaty partner to conduct a pre-approval inspection.7 In the case of the agreement with the EU, FDA reports that implementation of the pre-approval inspection provision in the treaty has been held up by delays in developing a U.S.-EU joint work plan for pre-approval inspection capability assessments.8

4. Regional Compliance History Added as a Surveillance Inspection Criterion

In 2012, the Food and Drug Administration Safety Innovation Act (FDASIA) eliminated the requirement to inspect domestic drug facilities every two years and directed the FDA to remove any distinction between foreign and domestic facilities when determining surveillance inspection frequency. FDORA Section 3613(a) can be seen as a bit of backtracking on this point, as it directs the agency to now consider the compliance history of establishments in a particular country or region when determining the schedule for risk-based inspections of facilities located there. Some are also criticizing the provision for fear that it will work to the detriment of a facility with a good compliance history that happens to be in a country with a relatively poorer rate of compliance. However, we think these concerns are overblown, as decisions on surveillance inspection frequency are based on several factors, one of the most important of which is the compliance history of the specific facility being considered for inspection, which will surely be weighed more heavily by FDA than the overall compliance history of the region or country where the facility is located. Interestingly, one result of Section 3613 is that, everything else being equal between two facilities, a U.S. based facility may now be flagged by FDA for a surveillance inspection more frequently than a comparable European facility, as the data indicates that facilities in Europe have a lower overall level of Official Action Indicated (OAI) classifications than do those in the U.S.9  

5. GAO Directed to Prepare Report on Alternative Tools Used by FDA and Foreign Counterparts

FDORA Section 3614 directs the U.S. Government Accountability Office (GAO) to prepare a wide-ranging report on how the FDA and foreign counterparts use alternative tools to inspection, no later than June 2024.  Among other factors, the report must cover:

  • what alternative tools, including remote inspections/evaluations, other countries are using to facilitate inspections;
  • how frequently trusted foreign regulators conduct inspections that FDA could review in lieu of conducting its own inspections;
  • how frequently FDA is using mutual recognition agreements (MRA) and whether use of such agreements could be expanded;
  • whether FDA has accepted reports of inspection of facilities in China and India conducted by FDA’s MRA partners; and
  • what other countries has FDA considered and rejected for a possible MRA treaty. 

6. Expect More Unannounced Foreign Inspections

Foreign drug establishments should expect more unannounced FDA inspections due to FDORA Section 3615. Prior to the pandemic, FDA inspections of domestic drug establishments were almost always unannounced, while foreign establishments generally received advanced notice of their inspections. This disparity in treatment raised concerns, including within Congress and the GAO, that foreign facilities were being given the opportunity to fix problems before FDA investigators arrived. So much so, in a report accompanying FDA’s fiscal year 2021 appropriation, the House Appropriations Committee directed FDA to begin piloting the use of unannounced and short notice inspections in India and China and provided FDA funding to implement those pilots.10 In April 2022, FDA reported that unannounced foreign inspections had begun in India but had not yet begun in China due to local pandemic-related restrictions.

Section 3615 doubles down on direction to FDA in this area, requiring for the first time in statutory language that FDA conduct a pilot program to “increase[] the conduct of unannounced surveillance inspections of foreign human drug establishments[.]” Section 3615 further directs FDA to evaluate the observed differences between announced and unannounced inspections under the pilot, including the violations identified, costs, benefits, and any other significant differences, among other factors. Finally, FDA must produce a report on its findings and recommendations within 180 days after completion of the pilot. 

​​7. Previously Sunset Provisions to Prevent Shortages in Enforcement Cases are Revitalized

In 2012, FDASIA established new statutory requirements in the FDCA to help prevent drug shortages, including FDCA Sections 506(D)(b),(c), and (e) requiring, before FDA takes an enforcement action or issues a warning letter that could reasonably be anticipated to lead to a drug shortage: 1) advance coordination with CDER’s Drug Shortage Staff; and 2) an evaluation of the relative risks associated with the violations at issue and the likely patient impact resulting from the anticipated shortage. Pursuant to FDASIA’s original sunset provision, however, these coordination requirements ceased to be effective in July 2017. FDORA Section 3616 reestablishes and makes permanent those coordination requirements. It is worth noting that coordination efforts on drug shortages have remained strong within FDA since July 2017, despite these provisions having sunset. Nevertheless, permanently building these coordination requirements into the statute is a welcome development. In addition, Section 3616 inserts a new provision, FDCA Section 506D(g), directing FDA to ensure timely and effective coordination between ORA, CDER Compliance, and CDER’s Drug Shortage Staff concerning the review of inspection reports and follow-up actions taken in response to those reports, concerning inspections of facilities that raise potential drug shortage implications. 

8. Annual Report on Inspections

FDORA Section 3617 amends the requirements, first established in 2017 by Section 902 of the FDA Reauthorization Act (FDARA) (Public Law 115-52), for the FDA’s annual report on human drug and device inspections. Previously, the required report focused exclusively on inspections of facilities necessary to approve a drug or device, including: 1) the time it took to begin a requested facility inspection, as well as the timing for compliance actions following completion of the inspection (e.g., warning letters); and 2) the number of application approvals delayed or withheld because of these inspections. The Section 3617 amendments include a requirement to track the same information for drugs on the FDA shortage list as well as to convert the report from an annual to a fiscal year basis.


  1. FDCA Section 704(a)4) was previously limited to requests directed to “a person that owns or operates an establishment that is engaged in the manufacture, preparation, propagation, compounding, or processing of a drug[.]”
  2. See Conducting Remote Regulatory Assessments, Questions and Answers, Draft Guidance for Industry, July 2022,
  3. In fiscal year 2021, CDER conducted 133 BIMO RRAs. See FDA Bioresearch Monitoring (BIMO) Fiscal Year 2021 Metrics,
  4. See Remote Interactive Evaluations of Drug Manufacturing and Bioresearch Monitoring Facilities During the COVID-19 Public Health Emergency, Guidance for Industry, April 2021. During the pandemic, CDER conducted remote interactive evaluations using livestreamed video of operations as well as remote, live interactions with facility personnel to assess manufacturing facilities named in marketing applications,
  5. See Regulatory Procedures Manual, Section 4-1-8 (“Usually, the standard for verifying that corrections have been implemented will be a follow-up inspection.”) (emphasis added),
  6. FDORA Section 3612 adds new Section 704(a)(5) to the FDCA concerning the authority to conduct BIMO inspections.
  7. See e.g., United States – European Union Amended Sectoral Annex For Pharmaceutical Good Manufacturing Practices (GMPs), Article 11,
  8. See Frequently Asked Questions – [U.S./EU] Mutual Recognition Agreement, Question 13,
  9. As of May 2020, only two percent of EU based drug manufacturing facilities were classified as OAI as compared to seven percent of U.S. based facilities. See FDA Testimony before the U.S. Senate Committee on Finance (Judith McMeekin), June 1, 2020, Figure 6,
  10. See House Committee on Appropriations Report 116-446, Agriculture, Rural Development, Food and Drug Administration, and Related Agencies Appropriations Bill FY21, p. 86,

One Year Out, Where Do We Stand on DSCSA Implementation?

This article was originally published as a guest column in Outsourced Pharma.

This month kicks off the final year of a decade-long process to enhance overall security of the U.S. prescription drug supply chain under the Drug Supply Chain Security Act (DSCSA).1 To foster enhanced security, the DSCSA outlines steps to build a fully interoperable, electronic system for tracking and tracing drug products at the package level. In so doing, the law, enacted in 2013, has called upon the FDA and the full spectrum of supply chain trading partners — from manufacturers to repackagers to distributors to dispensers — to align on key implementation requirements by Nov. 27, 2023. The FDA, for its part, has been phasing in pertinent guidance documents to support DSCSA implementation.2  (For a summary of 2021’s guidances, see “Navigating DSCSA Implementation: Key Requirements & 4 New FDA Guidances.”)

Now, ongoing questions of whole industry readiness remain a mixed bag as the law’s November 2023 deadline comes into sight, although some progress has been observed.3 This article looks at this year’s DSCSA implementation efforts, before examining where implementation currently stands and what gaps and challenges remain.

2022 DSCSA Implementation Advances

Despite 2021 efforts, a lack of clarity on trading partner and product tracing standards meant that implementation hesitancy persisted.4 While 2022 brought resolution to some outstanding questions, others remain open.

In February 2022, the agency issued long-awaited licensing standards for wholesale distributors (WDs) and third-party logistics providers (3PLs).5 The following month saw revised draft guidance on verification systems, which granted trading partners more time to respond to requests for verifying suspect or illegitimate products.Then, in July 2022, the FDA issued revised draft guidance on identifying authorized trading partners, as well as revised draft guidance on electronic tracing standards.7

National Licensing Standards for WDs & 3PLs

Early this year, the FDA issued a proposed rule setting forth licensing standards for WDs and 3PLs, as it is mandated to do under the DSCSA.8 Significantly, in guidance describing the impact of the proposed rule on product tracing, the FDA said that section 585(b)(1) of the Federal Food, Drug, & Cosmetic Act (FDCA) preempts state licensing laws that establish stricter standards.9 This means that states may only continue licensing WDs and 3PLs if they match federal requirements, promoting industry-wide uniformity and clarifying expectations among trading partners. Prior to the proposed rule, manufacturers across states had to navigate a patchwork of state licensing regulations to ensure their trading partners were appropriately authorized, burdening compliance with a key DSCSA requirement.

Stakeholder comments made in response to the proposed rule were largely supportive of the FDA’s preemption position, since uniformity of national requirements is consistent with DSCSA principles for enhancing supply chain security.10 Concurring with these comments, the Healthcare Distribution Alliance (HDA) also called for uniformity between licensing standards for WDs and 3PLs, explaining that even “minor differences may distract both the regulated and the regulators from whether the difference is meaningful and intended, mandated by differences in the DSCSA, or simply a drafting artifact.”11

Additionally, revised draft guidance issued in July 2022, Identifying Trading Partners Under the DSCSA, addresses previously unclear statuses of trading partners involved in product tracing (i.e., private-label distributors, salvagers, and returns processors and reverse logistics providers), along with confusion around certain drug distribution scenarios.12 The revised draft guidance also clarified the licensure status of 3PLs prior to the effective date of the new licensure regulation. Taken together, the new proposed rule and draft guidance helps clarify who exactly trading partners should be engaging with, particularly among interstate trading partners, in fulfilling another key DSCSA requirement.

Electronic Tracing Standards

In July 2022, the FDA also issued revised draft guidance, DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs, clarifying expectations for complying with electronic standards for tracing products.13 Most significantly, this draft guidance recommends that trading partners use GS1’s Electronic Product Code Information Services (EPCIS) standard when exchanging and maintaining transaction information and transaction statements. GS1 is a widely recognized nonprofit organization that designs and maintains global standards for business communications.14 While the previous iteration of the draft guidance recommended the use of GS1, it also allowed for the use of other methods and standards. This created confusion as to what the agency considered to be adequately harmonized standards and led many trading partners to refrain from adopting any standard before a final recommendation was made clear.

This newer version of the guidance is consistent with the DSCSA requirement that the FDA make standard recommendations that are consistent with those of widely recognized international organizations.15 An August 2021 report from the International Coalition of Medicines Regulatory Authorities (ICMRA) endorsed GS1 as an appropriately accepted international standard for data exchange as part of global track and trace systems.16 Additionally, GS1’s EPCIS standard had been most supported by industry and was being used as the basis of the interoperable system built to date.17 Thus, the recent, more direct recommendation from the FDA, to use the GS1 standard alone, aligns with industry calls and ICMRA’s endorsement, and will hopefully activate its more fulsome adoption.

One Year Out: Progress Observed, But Challenges Remain

With one year to go before DSCSA requirements for electronic, package-level traceability and verification are enforced, strong evidence suggests that industry readiness may be coming into focus, at least for some trading partners.18 That is according to a recent HDA report detailing results of its annual Serialization Readiness Survey, in which 48 manufacturers and 29 distributors shared their perspectives on current system capabilities. Although many of the survey participants appear to be in good shape for 2023 compliance, the report also showed signs of a supply chain that still demonstrates “uneven readiness” as a whole. Additionally, the FDA and industry remain apart on data management expectations, a key mechanism for ensuring whole system interoperability.19

Manufacturer Readiness

In a sign of progress, the HDA survey found that 75% of manufacturers plan to send all serialized data with shipments by November 2023, with nearly a quarter of manufacturers aiming to do so sooner (i.e., by the end of 2022). Additionally, over 57% of manufacturers are already aggregating data for all their products, up from 45% last year, and another 6% plan to aggregate by the end of 2022. Aggregation of unique product data at the package level must take place before data can be exchanged with other trading partners, so it’s good news that a majority of manufacturers have already taken this initial step, or soon will. Also encouraging is news that most manufacturers (87%) currently use the latest 1.2 version of the FDA recommended EPCIS standard. Nearly all of the remaining participants indicated they use earlier versions of EPCIS, with most planning to transition to the newer version by 2023. Even further, 84% of manufacturers said they don’t have any concern about their ability to support the distributors’ saleable returns verification requirement.  

Despite progress, less promising is the 36% of manufacturers that say they won’t begin aggregating data until sometime in 2023, as well as the 2% that are usure when they will be in the position to send serialized data to distributors at all.

Distributor Readiness

Of course, in terms of 2023 interoperability, manufacturers’ ability to send serialized data means little if distributors are unable to receive it. Fortunately, according to the HDA, 62% of distributors reported having current capabilities on this front, with nearly two-thirds of the rest looking to do so by the end of 2022. Interestingly, despite a significant number of manufacturers and distributors anticipating being able to send and receive serialized data by 2023, 46% of distributors said they aren’t receiving any serialized data with transactions, and another 46% said they are receiving serialized data with only 1–5% of transactions.

Additionally, unlike their manufacturer counterparts, more distributors (45%) had concerns with their ability to meet the saleable returns verification requirement, citing challenges such as complete availability of master data, accuracy and completeness of data exchange, and challenges receiving EPCIS files, among others.

Remaining Challenges

Trading Partner Collaboration Challenges

Perhaps more insightful were survey datapoints highlighting the major challenges that manufacturers and distributors still face in terms of meeting their requirements. Per the HDA report, manufacturers cited collaboration with trading partners, governance of the interoperable system, and differences in interpretation of the law as top hurdles for 2023 compliance. Distributors similarly cited collaboration with trading partners as chief among challenges, in addition to technical challenges, establishing standards, and connectivity and related security. Thus, in its final year of implementation, collaboration among trading partners, and with the FDA, continues to be a key rallying cry for all those aiming to achieve 2023 interoperability.

Data System Management Challenges

One discrepancy left unresolved in 2022 has been industry–FDA incongruence on an envisioned traceability data system architecture.20 The FDA recommends that industry adopt a distributed or semi-distributed data system architecture, which allows trading partners to maintain control over their own data in local databases.21 In contrast, a centralized data system manages supply chain-wide traceability data in a central repository or database. While industry and the FDA align on a distributed or semi-distributed management approach, they misalign on the capabilities of such a system.

For example, FDA draft guidance describes its recommended “enhanced system” as one that “should enable trading partners to share relevant data…upon request by an authorized trading partner, the FDA, or other appropriate Federal or State official.” Such a system suggests direct interface of regulatory authorities with individual trading partner systems (i.e., something leaning more toward a semi-distributed structure). Industry has asserted that such a system does not exist, nor can it feasibly be built in time for 2023.22 Additionally, industry has expressed concern about the degree of access the FDA’s system, as articulated, could afford the agency and state authorities.23 Instead, industry views the enhanced system being built as a network of independent trading partner systems and processes, not as a single system or technology (i.e., something leaning more towards a true distributed structure). Under this system, access to traceability data as part of interoperable exchanges is not viewed as direct access, but rather, is intermediated by individual trading partners through request and response functionalities.

This misalignment does not bode well for 2023 interoperability aspirations. Particularly in scenarios when trading partners may manage their data inconsistently from one another, risking technical challenges and interoperability breakdown when they go to exchange requested data. To better harmonize, stakeholders have called for more guidance on the management of traceability data at facilities.24 Better equipping trading partners with information on data management may be a huge part of actualizing interoperability of the whole system. Thus, information from the FDA in this regard will be something to look for down the 2023 stretch. 


The path to DSCSA implementation has been a long and winding one. While signs of readiness have been observed, it’s also clear that many trading partners are still lagging in bringing together their capabilities in order to meet 2023 interoperability goals. Interoperability means a system that is wholly connected and cohesive — any missing links in the system will not only run counter to the intent of the DSCSA but could also stymie broader efforts to increase supply chain resiliency and to prevent drug shortages in the face of ongoing public health emergencies. Collaboration between and among trading partners and the FDA continues to top challenges faced in DSCSA implementation — both in working out technical issues at the local level, and in deepening stakeholder understanding about roles and responsibilities throughout supply chains. Additionally, greater insight into data management at facilities may help trading partners zero in on how traceability data should be transferred to, or accessed by, other trading partners or regulating authorities as part of the overall enhanced system.


  1. Title II of Public Law 113-54, “Drug Supply Chain Security,” (November 2013), available at See also, FDA Webpage, “Drug Supply Chain Security Act (DSCSA)”, available at
  2. FDA DSCSA Guidance & Policies Webpage, available at
  3. HDA Research Foundation, “Serialization Readiness Survey: Executive Summary”, (October 2022) available at
  4. Docket, FDA-2020-D-2024, available at See also, Regulatory News, “Industry calls for withdrawal of FDA electronic tracing guidance” (September 2021), available at
  5. FDA Announcement, “FDA announces proposed rule: National Standards for the Licensure of Wholesale Drug Distributors and Third-Party Logistics Providers” (February 2022), available at See also, Docket, FDA-2020-N-1663, available at
  6. FDA Draft Guidance, “Verification Systems Under the DSCSA for Certain Prescription Drugs,” (March 2022), available at
  7. See, Regulatory News, “FDA publishes two critical DSCSA draft guidances” (July 2022), available at
  8. See supra, n.5.
  9. FDA Final Guidance, “Drug Product Tracing: The Effect of Section 585 of the FD&C Act Q&A,” (February 2022), available at
  10. Docket (FDA-2020-N-1663), available at
  11. HDA Comments, Docket (FDA-2020-N-1663-0033), (September 2022), available at
  12. FDA Revised Draft Guidance, “Identifying Trading Partners Under the DSCSA,” (July 2022), available at
  13. FDA Draft Guidance, “DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs,” (July 2022), available at
  14. GS1 US Webpage, About GS1 US, available at
  15. FD&C Act, Sect. 582(h)(4)(A)(i).
  16. ICMRA Report, “Recommendations on common technical denominators for traceability systems for medicines to allow for interoperability” (August 2021), available at
  17. FDA Event, “Public Meeting on Enhanced Drug Distribution Security at the Package Level Under the DSCSA” (November 2021), available at
  18. See supra, n.3.
  19. See supra, n.18.
  20. See, Regulatory News, “Industry calls for withdrawal of FDA electronic tracing guidance” (September 2021), available at
  21. FDA Draft Guidance, “Enhanced Drug Distribution Security at the Package Level Under the DSCSA,” (July 2021), available at
  22. HDA Comments, Docket, FDA-2020-D-2024, available at See also, Regulatory News, “Industry calls for withdrawal of FDA electronic tracing guidance” (September 2021), available at
  23. See supra, n.18.
  24. See supra, n.18.

The Drug Supply Chain Security Act (DSCSA): Current Implementation Update

Greenleaf Regulatory Landscape Series

In the seventh year of implementation of the Drug Supply Chain Security Act (DSCSA), trading partners involved in manufacturing, repackaging, distributing, and dispensing pharmaceuticals in the U.S. (industry) continue to grapple with its requirements. The goal of the DSCSA, which was enacted in November 2013 under Title II of the Drug Quality and Security Act,1 is to produce a system that enhances national pharmaceutical supply chain security by implementing a fully interoperable and electronic system for securing and tracing products by November 2023.2 Trading partner authorization, product tracing, verification, and product identification (including serialization) are four key components needed to achieve this goal.3

Since enactment of the DSCSA, two phases of implementation have been imposed. In the first phase, traceability requirements at the lot level were implemented beginning in 2015. In the second phase, interoperability requirements allowing for product tracing at the package level are scheduled to become effective in November 2023. Once in place, the interoperability requirements will involve: the exchange of transaction data by authorized trading partners; the ability of trading partners to verify products at the package level; and the maintenance of product tracing processes such that transaction data going back to the manufacturer can be provided upon request.4

The interoperability requirements, as opposed to the traceability requirements, are not clearly defined by the DSCSA, and yet, are particularly complex due to their electronic interconnectedness across the various industry sectors.5 As such, industry stakeholders have reported slow uptake of requirement testing and implementation thus far, which has been fueled by a lack of consistency, clarity, and awareness among trading partners, as well as added burdens related to the pandemic.6 Specifically, important testing of data systems by some manufacturers has not occurred at rates needed to ensure requirements are in place by 2023. Needed collaboration with trading partners, greater system governance, consistent DSCSA legal interpretation, and missing standards are all additional challenges weighing down implementation efforts.

Figure 1

FDA Efforts to Support Industry Readiness

To help enhance industry’s overall readiness ahead of 2023, the Food and Drug Administration (FDA or Agency) released four guidance documents in June 2021 aimed at providing clarity and understanding around various DSCSA requirements.7 These guidance documents are summarized in Figure 2 below. The Agency also hosted multiple webinars in 2021 outlining key DSCSA requirements and explaining its new guidance documents and how they fit into the overall 2023 implementation scheme.8

Figure 2 9

Additionally, in February 2022, the FDA issued a proposed rule setting forth licensing standards for wholesale distributors and third-party logistics providers (3PLs), as mandated by the DSCSA.10 A national licensing system for distributors and 3PLs falls under the law’s key requirement that trading partners involved in the exchange of prescription drugs must be authorized such that they are appropriately registered or licensed to receive or transfer products.11 Establishment of national licensing standards eliminates an existing patchwork of state standards and is meant to provide industry-wide uniformity to better ensure all trading partners along supply chains are appropriately qualified to distribute prescription drugs. Diverging from its initial position issued in a 2014 draft guidance, the FDA’s proposed rule preempts state licensing laws that establish stricter standards, meaning that states can only continue licensing distributors and 3PLs if they match federal requirements.12 Once the rule is finalized, wholesale distributors will have two years, and 3PLs will have one year, before requirements take effect. Stakeholders have until June 2022 to comment on the proposed rule.13

Remaining Implementation Challenges: A Need for Further Clarity and Alignment

Despite new guidance and key implementation updates provided by the Agency, industry has continued to call for stronger alignment and the provision of more information around interoperability requirements. At a November 2021 public meeting,14 industry stakeholders called for the finalization of draft guidance on standards for secure, interoperable exchanges of product data and the endorsement of the global GS-1 standard for creating and sharing transaction data, or Electronic Product Code Information Services (EPCIS).15 The FDA has given assurance that finalized guidance is forthcoming.16 The Federal Food, Drug, and Cosmetic Act, as amended by the DSCSA, mandates17 that the FDA recommend data exchange standards that comply with those of widely recognized international organizations in order to facilitate the adoption of secure, interoperable, electronic data exchange along pharmaceutical distribution supply chains.18 Draft guidance released in November 2014 recommended the use of EPCIS, but also mentioned other methods and standards that could be used as well.19 The lack of a finalized standard recommendation has made many in industry reticent to begin implementing and testing data exchange systems, which are essential for ensuring systems are ready to go live in November 2023

Additionally, in Fall 2021, a number of industry stakeholders submitted comments expressing concern for perceived inconsistencies between the track and trace system put forth in new draft guidance and the plain language of the DSCSA, as well as a lack of other important information about requirements for 2023 compliance.20 The new draft guidance, “Enhanced Drug Distribution Security at the Package Level Under the DSCSA,” sets out the Agency’s decision as to whether data security system structures should be centralized or distributed, backing a distributed/semi-distributed model based on the idea that this approach allows trading partners to maintain control over their own data.21 Industry and other stakeholders disagree, however, as to whether this is the right approach for achieving interoperability. An August 2021 report from the International Coalition of Medicines Regulatory Authorities (ICMRA) promoted a centralized model as the “most efficient and simple” design for storing and reporting traceability data from multiple entities (although, the report also noted that “it is perfectly possible […] to design a system with distributed databases where each originator stores their own data”).22 In comments submitted to the new draft guidance docket, the Healthcare Distribution Alliance (HDA) stated that it did not believe a distributed or semi-distributed model is feasible, noting that what currently exists is “an ecosystem … of thousands of privately owned and maintained systems that are all different” (emphasis added).23

Other comments submitted to the docket reiterated HDA’s concerns with the new draft guidance, and also addressed concerns related to the sharing of proprietary information between trading partners and government authorities/other trading partners.24 In calling for the withdrawal of the draft guidance, and noting discussed challenges and concerns, HDA and other stakeholders expressed uncertainty as to industry’s ability to meet implementation requirements of the proposed electronic system in time for the 2023 deadline.25 Despite this looming deadline, the FDA has maintained that its planned electronic, interoperable track and trace system will go live in November 2023.26


The FDA has stressed that a system for enhancing drug distribution security will need to be robust, yet flexible.27 The Agency has also said it will leverage a range of coordinated mechanisms, such as: standardized data; standardized data exchanges; data analyses; investigations of suspect and illegitimate products; and other compliance guidance documents and enforcement tools.28 The complexity involved in achieving full implementation of the DSCSA is apparent and has been exacerbated in recent years by the COVID-19 pandemic. Thus, greater industry understanding about requirements through additional guidance and communication from the FDA will be an important part of breaking down remaining challenges to full DSCSA implementation in 2023.

  1. H.R. 3204, Sec. 201, “Drug Supply Chain Security,” (November 2013), available at See also, FDA Webpage, “Drug Supply Chain Security Act (DSCSA)”, available at
  2. CDER SBIA Virtual Compliance Conference, Connie Jung, RhP, PhD, “Enhancing Drug Distribution Security under DSCSA” (January 2021), available at
  3. Id.
  4. Partnership for DSCSA Governance, “DSCSA 2023 Requirements,” available at
  5. Id.
  6. RAPS Focus, “Panelists: Sluggish pace of DSCSA testing is worrisome” (May 2021), available at
  7. FDA In Brief, “FDA provides new guidance to further enhance the security of prescription drugs in the U.S. supply chain” (June 2021), available at
  8. See, CDER SBIA Virtual Compliance Conference, Connie Jung, RhP, PhD, “Enhancing Drug Distribution Security under DSCSA” (January 2021), available at; and CDER SBIA Webinar, Connie Jung, RhP, PhD, “Enhanced Drug Distribution Security in 2023 Under the DSCSA,” (October 2021), available at
  9. See, FDA Draft Guidance, “Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act,” (June 2021), available at; FDA Final Guidance, “Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification” (June 2021), available at; FDA Revised Draft Guidance, “Definitions of Suspect Product and Illegitimate Product for Verification Obligations Under the DSCSA” (June 2021), available at; and FDA Final Guidance, “Product Identifiers Under the DSCSA Questions and Answers” (June 2021), available at
  10. FDA Announcement, “FDA announces proposed rule: National Standards for the Licensure of Wholesale Drug Distributors and Third-Party Logistics Providers” (February 2022), available at
  11. See, supra n.8.
  12. Docket, FDA-2020-N-1663, available at
  13. Id.
  14. FDA Event, “Public Meeting on Enhanced Drug Distribution Security at the Package Level Under the DSCSA,” (November 2021), available at
  15. RAPS Focus, “FDA urged to endorse EPCIS to spur manufacturers’ uptake of DSCSA” (November 2021), available at
  16. FDA Draft Guidance, “Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act,” (June 2021), available at at p.6.
  17. FD&C Act, Sect. 582(h)(4)(A).
  18. See, supra n.16.
  19. Id.
  20. Docket, FDA-2020-D-2024, available at See also, RAPS Focus, “Industry calls for withdrawal of FDA electronic tracing guidance” (September 2021), available at
  21. FDA Draft Guidance, “Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act,” (June 2021), available at
  22. ICMRA Report, “Recommendations on common technical denominators for traceability systems for medicines to allow for interoperability” (August 2021), available at
  23. See, supra n.20.
  24. Id.
  25. Id.
  26. RAPS Focus, “FDA official: Agency will not extend 2023 DSCSA interoperability deadline” (August 2021), available at
  27. See, supra n.2.
  28. Id.

Navigating DSCSA Implementation: Key Requirements and 4 New FDA Guidances

This article was originally published as a guest column in Outsourced Pharma.

In its seventh year of implementation, trading partners involved in manufacturing, distributing, and dispensing prescription drugs in the U.S. (Industry) continue to grapple with requirements of the Drug Supply Chain Security Act (DSCSA), working to set up a fully interoperable electronic system for securing and tracing products across Industry sectors by November 2023. The goal of the DSCSA is to produce a system that enhances national pharmaceutical supply chain security; achieving this goal has required two phases of implementation. In the first phase, traceability requirements at the lot level were implemented beginning in 2015. In the second phase, interoperability requirements allowing for product tracing at the package level are scheduled to become effective in November 2023.

Interoperability requirements involve the exchange of transaction data by authorized trading partners, the ability of trading partners to verify products at the package level, and the maintenance of product tracing processes such that transaction data going back to the manufacturer can be provided upon request.[1] These requirements, as opposed to the traceability requirements, are not clearly defined by the DSCSA and yet are particularly complex due to their electronic interconnectedness across the various Industry sectors.[2] This lack of clarity around the requirements has created concern regarding how Industry can even begin to prepare to meet the requirements in time to meet the 2023 deadline.[3]

On June 3, 2021, the Food and Drug Administration (FDA or Agency) released four key guidance documents aimed at helping Industry sectors understand certain requirements and assist trading partners in becoming DSCSA compliant; these included:[4]

  • A final guidance on product identifiers;
  • A final guidance on identification and notification of suspect products;
  • A revised draft guidance on verification obligations for suspect and illegitimate products; and
  • A new draft guidance on the distribution security system attributes necessary for enabling secure product tracing at the package level.

This article first provides an overview of the four key implementation components of the DSCSA and the corresponding FDA guidance to assist trading partners in becoming compliant. The article next takes a deeper look at the four new FDA guidances released on June 3, 2021, as well as the significance of new information provided in each. Lastly, the article discusses Industry challenges and what more is needed before full DSCSA implementation can be achieved.

Key DSCSA Requirements and Corresponding FDA Guidance  

DSCSA has four key requirements: (1) trading partner authorization; (2) product tracing; (3) verification; and (4) product identification (including serialization).[5] Under Section 582 of the Federal Food, Drug, and Cosmetic Act (FD&C Act), these requirements apply to pharmaceutical manufacturers, repackagers, wholesale distributors, third-party logistic providers (3PLs), and dispensers (i.e., pharmacies). Each requirement is briefly reviewed below.[6] 

Trading Partner Authorization

Any trading partner involved in the transfer of prescription drugs “where a change of ownership occurs” must be authorized such that they are appropriately registered or licensed to receive or transfer products.[7] For manufacturers and repackagers, entities must be validly registered with the FDA; this can be confirmed through FDA’s drug establishment current registration site (DECRS) database.

For wholesale distributors and 3PLs, entities must have a valid state or federal licensure; at the state level, this can be confirmed by checking state databases or FDA’s wholesale distributor and 3PL database for self-reported information and respective state licensure.[8] Under the DSCSA, the FDA is required to issue new federal wholesale distributor and 3PL licensure standards in order to eliminate the current patchwork of state standards and enhance supply chain-wide uniformity. While the FDA has acknowledged the importance of these standards in supporting implementation and enhancing supply chain security, it has also acknowledged that it is still working on developing this policy.[9]

An August 2017 FDA guidance lays out the various entity requirements related to trading partner authorization and is intended to help Industry and state governments understand what activities require licensure and annual reporting and provide specific clarifications as to requirements for each trading partner.[10]

Product Tracing

Product tracing requirements involve receiving and providing product tracing data, including transaction history (TH), transaction information (TI), and the transaction statement (TS).[11] Product tracing data must be provided with each transaction (i.e., at the sale of prescription drugs) and only prescription drugs accompanied by the required product tracing data should be accepted or received by trading partners. In the event of a product recall or request to investigate a suspect or illegitimate product, trading partners must respond with product tracing data and, thus, are required to store this information for at least six years. Additionally, products can only be returned to the trading partners from which they were initially received.[12]

Currently, these requirements apply at the lot level, and TI, TS, and TH can be provided in either paper or electronic formats. However, by November 2023, product tracing requirements must apply at the package level and be provided only in electronic format.[13]

There are two FDA guidances related to product tracing standards. A November 2014 guidance establishes standards for interoperable information exchange and provides examples of data exchange methods.[14] A March 2018 guidance also provides information on standardizing TI, TS, and TH, as well as various documentation practices regarding when various product tracing information should be provided.[15]


Verification requirements under the DSCSA set forth practices for properly handling suspect and illegitimate products.[16] DSCSA requirements with respect to suspect products include investigation and quarantine to determine if they are illegitimate. Investigations of suspect products should include validating relevant transaction information and verifying the lot number and product identifier once a product has been serialized. Once determined to be illegitimate, trading partners must notify the FDA and relevant trading partners (the DSCSA requires notification occur within 24 hours) to ensure products do not reach patients. Additionally, information pertaining to investigations and dispositions of suspect and/or illegitimate products must be kept on record for at least six years.[17]

As will be discussed further below, the FDA recently updated two guidances focused on the identification of suspect products, steps for executing notification, and clarifying suspect and illegitimate product definitions for purposes of establishing trading partners’ verification obligations.[18]

Additionally, an October 2018 guidance provides further information for developing a robust verification system and addresses verification of saleable returns to the package level for product identifiers.[19] 

Product Identifier

Product identifier information includes a National Drug Code (NDC), unique serial number, lot number, and expiration date and must be made available in both human- and machine-readable formats.[20] Manufacturers have been required to encode the smallest saleable units of their products with this information since November 2018. Some drugs are excluded from these requirements or are grandfathered out of the requirements due to preexisting presence in the supply chain. Moreover, waivers, exceptions, or exemptions may also be granted by the Agency, depending on the individual product.[21]

Final FDA guidance on product identifier requirements was also among recently released DSCSA guidances and is discussed more fully below.[22]

Key Updates From Newly Released DSCSA Guidances

The four recently released DSCSA guidances provide further clarity and information in response to public comment and calls from Industry. A description of what’s new to each guidance, along with a brief overview of each, is provided below.

New Draft Guidance: Enhanced Drug Distribution Security at the Package Level Under the DSCSA

Most notably, this new draft guidance sets out the Agency’s decision as to whether data security system architectures should be centralized or distributed, weighing expressed Industry preferences and practices in its support of distributed and semi-distributed models so that trading partners can maintain control over data validation and management. [23]

Overall, the guidance provides information regarding enhanced drug distribution system attributes, product tracing, and verification needed for enabling secure product tracing at the package level. Missing from this guidance, however, are standards for secure, interoperable data exchanges, which the document notes will be addressed in forthcoming guidance.

Final Guidance: Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification

New to this final guidance is the Agency’s interpretation of “immediate trading partner” under Section 582, which requires trading partners to notify FDA and certain immediate trading partners that a product in their possession was determined to be illegitimate.[24] While unspecified in its previous iteration, the final guidance explains that immediate trading partners, in this context, are those that the notifier has “reason to believe may have received the illegitimate product.” The guidance also replaces “suspicious” with “questionable” when describing scenarios that could increase the risk of a suspect product entering the supply chain, ensuring that trading partners understand the full context under which suspect products may be found. 

Additionally, the new version of the guidance clarifies that, when investigating a suspect product, trading partners should confer with manufacturers and consider whether the product has been subject to a public alert for quality issues. Lastly, the guidance points out that while notification of a suspect product is not generally required, it is required when a high-risk factor is present.[25] Each of these meant to increase the likelihood that suspect products are identified along distribution supply chains and are investigated for their legitimacy.

Overall, this final guidance provides several examples of heightened risk for suspect products entering the supply chain for the purpose of enhancing identification. The guidance also notes the process for notifying FDA about a product determined to be illegitimate using Form FDA 3911.

Revised Draft Guidance: Definitions of Suspect Product and Illegitimate Product for Verification Obligations Under the DSCSA

New to this revised draft guidance is the FDA’s understanding of what a “stolen” product is, which it says is “any product in its entirety (i.e., the prescription drug and its packaging) that has been taken or removed without permission of the owners of the product.”[26] The revised draft guidance also revises the definition of a product that is “unfit for distribution,” aligning it with language set out in the DSCSA such that it is now interpreted to mean a product that is “reasonably likely to result in serious adverse health consequences or death” based on “a reason to believe or credible evidence.”[27]

Additionally, the new version of the guidance notes scenarios that are unlikely to result in “diverted” products, carving out from the previously stated definition cases in which a product is obtained through a surveillance activity or by a patient outside the U.S. pharmaceutical distribution supply chain, through an FDA regulatory action to address a drug shortage, or where an emergency use authorization is in place. Lastly, the guidance expands the definition of the term “fraudulent transaction” such that it now includes situations where information has been “knowingly” falsified.[28]

Overall, this revised draft guidance defines key terms for determining suspect and illegitimate products for the purpose of assisting trading partners in complying with their verification obligations under the DSCSA.

Final Guidance: Product Identifiers Under the DSCSA Questions and Answers  

New to the final guidance on product identifiers are updates for Industry’s awareness in terms of technical data. [29] Key changes include an explanation of the importance of the NDC to patient safety and a clarification on how to adequately affix multiple bar codes on the label to avoid scanning errors. The new version of the guidance also recommends changes to the expiration data format, such as use of a hyphen or forward slash between day, month, and year, as opposed to a space.[30]

Overall, this guidance provides recommendations for standardizing human- and machine-readable formats of product identifiers and examples of when the product identifier and other information should be included on product packaging.

Industry Implementation Concerns

Industry stakeholders have reported slow uptake in rolling out new data systems that align with the 2023 requirements.[31] As mentioned above, product tracing data (i.e., TI, TS, and TH) exchanged between trading partners and tracked along pharmaceutical supply chains are aimed at achieving the DSCSA’s fully interoperable and electronic traceability function. Manufacturer testing of such data systems is an important step in overcoming technical challenges and ensuring compliant traceability systems will be fully interoperable by November 2023. Notably, a recent Healthcare Distribution Alliance (HDA) panel expressed concern that proactive testing of data systems by some manufacturers is not occurring at needed rates.[32] HDA panelists described this lack of testing as a potential major hurdle to achieving full implementation of applicable requirements on time, explaining that smaller manufacturers are at a higher risk of falling behind on necessary testing.

A November 2020 HDA survey on serialization readiness additionally found that collaboration with trading partners, system governance, variation in DSCSA legal interpretation, and standards are all additional challenges burdening implementation of an interoperable system.[33] The survey explained that understanding of DSCSA requirements across Industry is generally inconsistent and, thus, establishing stronger alignment and understanding across the various sectors will be important to enhancing overall readiness.

That being said, the newly released draft guidance Enhanced Drug Distribution Security at the Package Level Under the DSCSA covers some of the Agency’s expectations for enhanced (interoperable) drug distribution security systems needed for enabling secure product tracing at the package level. However, as discussed above, the FDA still leaves standards for secure, interoperable data exchanges for forthcoming guidance, so Industry will have to wait even longer for the clarification it needs in order to timely implement all of DSCSA’s requirements.[34]


The FDA has stressed that a system for enhancing drug distribution security will need to be robust, yet flexible, and that FDA will leverage a range of coordinated mechanisms, such as standardized data and data exchange, analyses, interoperability, investigations of suspect and illegitimate products, and other compliance guidance documents and enforcement tools.[35] The complexity involved in achieving full implementation of the DSCSA is certain and has been exacerbated in the past year by the COVID-19 pandemic. However, greater understanding around requirements across Industry sectors through additional guidance and communication from FDA will be an important part of breaking down remaining implementation hurdles moving forward. 

[1] Partnership for DSCSA Governance, “DSCSA 2023 Requirements,” available at

[2] Id.

[3] RAPS Focus, “Panelists: Sluggish pace of DSCSA testing is worrisome” (May 2021), available at

[4] FDA In Brief, “FDA provides new guidance to further enhance the security of prescription drugs in the U.S. supply chain” (June 2021), available at

[5] CDER SBIA Virtual Compliance Conference, Connie Jung, RhP, PhD, “Enhancing Drug Distribution Security under DSCSA” (January 2021), available at

[6] Additional information can be found in Dr. Jung’s January 2021 webinar presentation at the CDER SBIA Compliance Conference. See, supra note 5.

[7] See, supra note 5.

[8] Id.

[9] Id.

[10] FDA Procedural Guidance, “Identifying Trading Partners Under the DSCSA” (August 2017), available at

[11] See, supra note 5.

[12] Id.

[13] Id.

[14] FDA Draft Guidance, “DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs: How to Exchange Product Tracing Information” (November 2014), available at

[15] FDA Draft Guidance, “Standardization of Data and Documentation Practices for Product Tracing” (March 2018), available at

[16] See, supra note 5.

[17] Id.

[18] See, supra note 4.

[19] FDA Draft Guidance, “Verification Systems Under the DSCSA for Certain Prescription Drugs” (October 2018), available at

[20] See, supra note 5.

[21] Id.

[22] See, supra note 4.

[23] FDA Draft Guidance, “Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act,” (June 2021), available at

[24] FDA Final Guidance, “Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification” (June 2021), available at

[25] Id.

[26] FDA Revised Draft Guidance, “Definitions of Suspect Product and Illegitimate Product for Verification Obligations Under the DSCSA” (June 2021), available at

[27] Id. at p.5.

[28] Id.

[29] FDA Final Guidance, “Product Identifiers Under the DSCSA Questions and Answers” (June 2021), available at

[30] Id.

[31] HDA 2021 Traceability Webinar Series, “Foundational Elements of 2023: Master Data and Data Exchange” (April 2021).

[32] Id.

[33] HDA Executive Summary, “Serialization Readiness Survey” (November 2020), available at

[34] FDA Draft Guidance, “Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act,” (June 2021), available at

[35] See, supra note 5.

FDA Drug Manufacturing Oversight During COVID-19: The GAO Report on the Inspections Backlog and Steps FDA is Taking to Address It

This article was originally published in the Summer 2021 issue of FDLI’s Update magazine. The full issue can be dowloaded using the link at right.

To date, restrictions put in place in light of the COVID-19 pandemic continue to impact the ability of the Food and Drug Administration (FDA or the agency) to inspect drug manufacturing facilities, which has generated a growing backlog of inspections, as well as a range of backlog-related concerns expressed by both the pharmaceutical industry (Industry) and Congress. Consequentially, on March 4, 2021, a Subcommittee of the U.S. House of Representatives’ Committee on Appropriations held a hearing to better understand the inspections backlog and what could be done to address it.

The focus of this hearing was the January 28, 2021 report by the Government Accountability Office (GAO) entitled COVID-19: Critical Vaccine Distribution, Supply Chain, Program Integrity, and Other Challenges Require Focused Federal Attention (the GAO Report).[1] The GAO Report provides insight into the depth of inspectional challenges faced by FDA during COVID-19, as well as possible next steps the agency could take to address these challenges. Testimony given by GAO Health Care Director Mary Denigan-Macauley at the hearing offered an update to the earlier more detailed findings conveyed in the GAO Report.[2] In addition, GAO more recently reiterated the importance of the GAO Report recommendations regarding FDA drug manufacturing inspections through release of a new document called Priority Open Recommendations to the Department of Health and Human Services (HHS) (Priority Recommendations).[3] In this latest update, GAO acknowledged that while FDA has made some improvements in its inspection planning process, FDA must continue to ensure that its inspection plans for future years “identify, analyze, and respond to the issues presented by the backlog of inspections that could jeopardize the goal of risk-driven inspections.”[4]

Since publication of the GAO Report and corresponding congressional testimony, FDA has released two other noteworthy documents related to inspections. First, on April 14, 2021, FDA released a guidance entitled Remote Interactive Evaluations of Drug Manufacturing and Bioresearch Monitoring Facilities During the COVID-19 Public Health Emergency, which introduced a new tool for conducting remote inspectional work during the pandemic.[5] Second, on May 5, 2021, FDA issued its Resiliency Roadmap for FDA Inspectional Oversight to provide further transparency around adaption of the agency’s inspectional work during the pandemic.[6]

In this article, we first review GAO’s most recent findings on the state of the inspections backlog and its causes. We then review GAO’s recommendations to FDA on addressing the backlog and FDA’s response to those recommendations. Last, we review recent FDA efforts to address the backlog and potential permanent changes FDA may make going forward regarding oversight of drug manufacturing facilities.

GAO’s Findings on the State of the Drug Manufacturing Inspections Backlog and its Impact on FDA Oversight

In March 2020, as the spread of COVID-19 became an established threat around the world, FDA suspended most foreign[7] and domestic[8] inspections of facilities that manufacture drugs intended for the U.S. market, continuing only with its “mission critical” activities. In July 2020, on-site, prioritized domestic inspections resumed, but only on a limited basis (i.e., depending on the local risk of COVID-19 infection), meaning that the agency’s on-site inspections capability remained very limited.[9]

Even before the current pandemic, GAO had existing “long-standing concerns about FDA’s ability to oversee the increasingly global pharmaceutical supply chain.”[10] GAO reported that prior to COVID-19, FDA conducted pre-approval, surveillance, and for-cause inspections at all facilities that manufacture drugs intended for the U.S. market, amounting to about 1,600 inspections of approximately 4,200 facilities each year. Close to 60% of these facilities were located overseas, a third of which were in China and India.[11] Given the backlog created by COVID-19, the GAO Report made clear that FDA now faces an even bigger challenge in overseeing the global pharmaceutical supply chain.

GAO Found a Sizeable Backlog of FDA Inspections

Notably, FDA’s inspection metrics for 2020 pale in comparison to the same metrics reported in previous years. GAO reported that FDA was unable to complete more than 1,000 of its planned inspections in Fiscal Year (FY) 2020,[12] leaving the total number of inspections of foreign and domestic facilities 56% lower than each of the previous two fiscal years.[13] For domestic facilities, FDA conducted 52 inspections between March and October 1, 2020, but conducted about 400 inspections during the same time period in each of the two previous years. Foreign facilities experienced an even more drastic decrease, with FDA conducting only three inspections between March and October 1, 2020, compared to more than 600 inspections during the same time period in each of the previous two years.[14]

GAO Found That the Inspections Backlog May Lead to Future Delays in Drug Approvals 

In addition to quantifying the backlog, GAO expressed concerns that the agency will face challenges in carrying out its preapproval and surveillance oversight responsibilities in the future if the inspections backlog remains unaddressed. Specifically, the GAO Report noted that while FDA has not yet experienced serious delays in meeting user fee goal dates, the impact on approvals from delayed inspections may become more evident in the future.[15]

While FDA reported that it was operating above its 90% on-time action performance goal for approval decisions as of November 2020, the GAO Report noted that the inspections pause had not yet had a significant impact on the agency’s drug approval performance, because preapproval inspections typically occur months in advance of approval. Additionally, GAO noted that two of the Industry associations it spoke with expressed concern about this issue. Consequentially, GAO concluded that “[a] continued pause in preapproval inspections may lead to future delays in FDA drug approvals.”[16] 

GAO Found That the Inspections Backlog May Require FDA to Alter Its Risk-Based Inspection Model for Surveillance Inspections

FDA conducts surveillance inspections according to a risk-based model that prioritizes the highest risk facilities for inspection in any given fiscal year, based on mandatory factors (sites that have never before been inspected or have not been inspected within the last five years) and other risk-based factors such as type of drug manufactured, length of time since last inspection, and previous compliance history.[17] As noted above, FDA was unable to complete more than 1,000 of the approximately 1,500 planned surveillance inspections for FY20. These inspections will roll over into the site selection model for future fiscal years; thus, GAO found that the backlog could potentially threaten FDA’s “strategic goal of shifting toward exclusively risk-driven surveillance inspections” if the agency does not make changes to the model.[18]

GAO Found That FDA’s Current Use of Alternative Tools is Not a Comprehensive Solution to Addressing the Inspections Backlog

GAO also noted that to keep up with some of its inspectional work during COVID-19, FDA adopted a range of alternative tools, such as use of inspections conducted by foreign regulators, use of statutory authority to request and review facility records remotely, and use of sampling and testing drug products imported from foreign manufacturers. GAO reported that despite FDA’s vastly expanded use of such tools, this was not enough to avoid a backlog of mandatory on-site inspections. The GAO Report discussed each of these alternative tools and the concerns related to their longer-term utility.

FDA Use of Information From Inspections Conducted by Foreign Regulators

The first tool reviewed by GAO was use of information from inspections conducted by foreign regulators. GAO reported that FDA found information from inspections conducted by foreign regulators statutorily satisfies FDA inspectional requirements in some instances, but not in all. For example, inspections conducted in Europe by the 28 European regulators privy to the Mutual Recognition Agreement (MRA) have been deemed an acceptable substitute for an FDA inspection. Additionally, in light of COVID-19, FDA expanded recognition to inspections conducted outside of Europe by European regulators under the MRA, but only for 19 out of the 28 European regulators. No framework similar to the MRA exists to extend formal recognition of inspections conducted by regulators among the Pharmaceutical Inspection Cooperation Scheme (PIC/S), including Australia, Canada, Japan, and South Africa. Thus, information from inspections conducted outside of Europe by the other nine European regulators and by PIC/S members can only be used for purposes of “surveillance-level oversight” to inform the risk-based site selection model and are not acceptable substitutes for an FDA inspection. Moreover, like FDA, all relevant foreign regulators have also slowed their foreign inspection programs during COVID-19, limiting the ability of any regulatory authority to engage in on-site inspections. 

Furthermore, FDA is most in need of information about facilities located in China and India; FDA conducted more inspections than any other foreign regulator in those countries prior to COVID-19. These countries, however, are not party to the MRA or other reliance agreements. Thus, although information from European and certain other foreign regulator inspections can substitute for FDA inspections, this information is either not available or does not qualify as a sufficient substitute for all needed inspections.

FDA Use of Records Requests “in Advance of or In Lieu of” an Inspection

The second tool reviewed by GAO, and the tool on which FDA relied most heavily during the pandemic, was use of FDA’s authority to request records from facilities “in advance of or in lieu of” an inspection under Section 704(a)(4) of the Federal Food, Drug, and Cosmetic Act (FD&C Act). A records request is not an inspection, but FDA was able to satisfactorily assess the compliance status of many facilities named in drug product applications by reviewing their records, and thus, was able to meet many user fee goal dates. However, FDA told GAO that “only FDA in-person inspections and European regulator reports can satisfy the Agency’s statutory requirements for surveillance reports.”[19] GAO concluded that this tool has limited capability in mitigating the backlog of surveillance inspections, unless FDA’s statutory authority is expanded or interpreted to include use of records requests as a true substitute for surveillance inspections (as opposed to merely providing supplemental information in advance of such an inspection to inform FDA’s risk-based site selection model).

FDA Use of Information from Sampling and Testing of Product Obtained at the U.S. Border

The last tool reviewed by GAO was FDA’s sampling and testing of drug products obtained at the U.S. border. GAO noted that FDA adjusted use of this tool during the pandemic to specifically target high risk drugs manufactured at foreign facilities where inspections had been postponed. Significantly, FDA pointed out that sampling and testing alone will not confirm if a manufacturing facility is meeting quality standards. Thus, this tool can only supplement an FDA inspection, but can never act as a substitute for one. 

GAO’s Recommendations to FDA for Improving Its Drug Manufacturing Oversight

The GAO Report made two recommendations intended to help FDA adapt its inspections program to most effectively carry out its drug manufacturing oversight responsibilities.

GAO Recommendation to Assess Use of Alternative Inspection Tools

GAO recommended that FDA “fully assess the agency’s alternative inspection tools and consider whether these tools or others could provide the information needed to supplement the agency’s regular inspection activities or help meet its drug oversight objectives when inspections are not possible in the future.”[20] Although listed second in the GAO Report, this recommendation captured the interest of Industry and Congress.

GAO observed that while FDA has substantially increased its use of Section 704(a)(4) records request authority, “the agency has not yet finalized a policy for how it can use this information to supplement its inspection activities.”[21] Note, however, that on January 29, 2021, one day after the GAO published its report, FDA issued revised guidance outlining its new interim process for communicating issues identified following a Section 704(a)(4) records request issued “in advance of or in lieu of” a pre-approval inspection.[22] The revised guidance also provides information about FDA’s expanded recognition practice under the MRA, as discussed earlier, which includes use of European regulators’ inspection reports for facilities located outside of Europe.

GAO also noted that “FDA has not assessed whether inspections conducted by PIC/S members are equivalent to FDA inspections.”[23] GAO did not explicitly address any of the difficulties FDA would face in trying to implement a mutual recognition framework with those authorities. However, the report acknowledged that such an assessment would not be a quick solution, noting that it took FDA five years to complete a capability assessment of each European regulator in order to establish the MRA in the first place. We also note that in addition to the five-year timeline that accrued when conducting capability assessments in initial development of the MRA, the MRA also required a years-long negotiation between FDA and European regulators before assessments could even begin. Thus, while there may be agreement as to the concept, establishing additional mutual recognition agreements with other regulators could take many years to implement.

Most significantly, GAO recommended that FDA assess whether there are “additional tools” the agency should be using, specifically pointing to virtual inspections. GAO reported that four of five Industry associations it spoke with mentioned successful implementation of virtual inspections by foreign regulators, explaining that these regulators have used a range of virtual technologies to remotely conduct facility inspections. FDA reported to GAO that “the agency is in the process of assessing the potential use, including its authority to use, other tools to serve as supplements to FDA inspections, including using remote video and other remote and live interactions with establishment staff and records to evaluate drug manufacturing operations.”[24]

GAO Recommendation to Develop a Plan for Addressing the Inspections Backlog

Second, GAO recommended that FDA ensure “inspection plans for future fiscal years identify, analyze, and respond to the issues presented by the backlog of inspections that could jeopardize its goal of risk-driven inspections.”[25] In particular, GAO explained that FDA should adapt the risk-based model it uses to select inspection sites in order to loosen its definition or prioritization of “mandatory surveillance inspection.” FDA’s model, as of the date of the GAO Report, defined never-inspected facilities or facilities not inspected within the past five years as “mandatory surveillance inspections” because they present significant risks to pharmaceutical quality.[26] Historically, FDA has prioritized mandatory surveillance inspections and used its remaining resources for inspections of other high risk facilities identified through the risk-based model. [27] In its report, GAO expressed concern that unless more resources are allocated to the drug inspection program, the backlog of mandatory surveillance inspections would “dominate” FDA’s surveillance inspection program, creating a situation where other high risk facilities would not be inspected.[28] 

Recent FDA Efforts Aimed at Addressing the Drug Manufacturing Inspections Backlog and Possible Longer-Term Oversight Changes

FDA made clear in its response to GAO that it would consider both recommendations as it assesses how to address the inspections backlog, although its ongoing pandemic response, and preexisting statutory and resource limitations, continue to burden implementation of significant change. Significantly, since release of the GAO Report in January and GAO congressional testimony in March, FDA has issued two documents that provide further transparency around how it will address inspectional concerns highlighted in the GAO Report. We review those documents below.

FDA Announces a New Tool Called Remote Interactive Evaluations

On April 14, 2021, FDA released a guidance entitled Remote Interactive Evaluations of Drug Manufacturing and Bioresearch Monitoring Facilities During the COVID-19 Public Health Emergency, introducing a new tool for conducting remote inspectional work during the pandemic.[29] In the guidance, FDA describes a Remote Interactive Evaluation (RIE) as “any combination of [various remote] interactive tools” used to evaluate a drug or biologic manufacturing facility.[30] RIEs apply to all drug inspection programs, including pre-approval or pre-licensing inspections; post-approval, routine surveillance inspections; follow-up and compliance inspections; bioresearch monitoring (BIMO) inspections; and inspections of 503B outsourcing facilities.

Importantly, however, RIEs are not outright inspections, and thus, the start and close of an RIE will not trigger issuance of FDA Form 482s and Form 483s. RIEs are instead intended to provide information to meet user fee commitments, update FDA’s relevant internal databases, and inform the risk-based surveillance inspection site selection model. FDA will follow several similar inspection procedures in carrying out an RIE, such as holding closeout meetings and providing a written list of observations in which the facility will have 15 business days to respond. FDA will also issue final “remote interactive evaluation reports” in closing out an RIE.[31]

RIEs are meant to complement other remote tools used by FDA during the pandemic. For example, an RIE may precede a request for information, possibly under Section 704(a)(4), in order to most efficiently conduct the RIE.[32] Additionally, FDA will apply “risk management tools” to determine the need to conduct an RIE, similar to its approach taken with respect to other types of evaluations throughout the pandemic.[33]

FDA’s adoption of virtual technologies as a component of RIEs and other remote evaluations is encouraging news for Industry, which sees this approach as a more meaningful way to address the inspections backlog. However, since FDA caveated in discussions with GAO, as well as in the RIE guidance, that any remote evaluation is not a substitute for an on-site inspection under its current statutory authority, questions still remain as to how the agency will manage the inspections backlog in the longer-term. These questions will likely persist across Industry until more information is provided.

FDA Publishes Its Resiliency Roadmap for FDA Inspectional Oversight Moving Forward

On May 5, 2021, FDA issued a report entitled Resiliency Roadmap for FDA Inspectional Oversight (the Resiliency Roadmap).[34] This report, which covers inspectional activities for all FDA-regulated commodities, provides updated information regarding FDA’s inspectional activities during the pandemic and a roadmap for how it intends to prioritize its inspectional work as the pandemic continues.

Of particular interest, FDA provided updated statistics regarding delayed applications. According to the Resiliency Roadmap, FDA received more than 13,500 applications for all medical product approval/authorization between March 2020 and March 2021, and determined that of those applications, approximately 600 needed inspectional oversight of some type before action could be taken on the application.[35] FDA reported that only 48 drug products were delayed solely because a GMP inspection could not be conducted. FDA noted that only six of the 48 delayed products were considered mission critical and that it had scheduled the inspections for those six mission critical products to occur by September 30, 2021.[36]

FDA also reported on its queue of for-cause domestic inspections that are follow-up compliance actions after a previous domestic inspection resulted in “official action indicated” (OAI) classification. FDA reported that it was able to complete 90% of these OAI follow-up inspections in FY20 and noted that it had 79 OAI follow-up inspections still to be conducted for human and animal drug domestic facilities in FY21.[37] However, FDA did not provide any statistics related to the number of OAI follow-up for-cause inspections in its queue for foreign inspections.

For surveillance inspections, FDA indicated that it was able to use remote tools to provide oversight on the relative risk of some establishments. As a result, when reassessing facility risk to create the surveillance site selection list for FY21, some facilities that were included in the FY20 model are no longer included in the FY21 model.[38] FDA did report that it had 857 remaining surveillance inspections for drug facilities planned for FY21, with the majority being domestic facilities.[39]

In addition to providing inspectional statistics during the pandemic, the Resiliency Roadmap also includes an outline of FDA’s plans for conducting inspections going forward, while noting that these plans will depend heavily on the course of the COVID-19 pandemic. In general, FDA will first conduct mission critical inspections (Tier 1) and then prioritize PAI/PLI inspections and for-cause inspections (Tier 2).[40] Lower priority inspections that do not meet these criteria (Tier 3) may be postponed, which could include some routine surveillance inspections. FDA said that it will continue to use risk-based measures going forward, with longer intervals occurring between non-priority surveillance inspections. FDA is clear that the volume of surveillance work presents a significant challenge even in the best case scenario, and that as a result, FDA will continue to use remote alternative tools whenever possible.[41]

Notably, the workload estimates focus on domestic inspections and the small number of foreign inspections that can be accomplished by in-country FDA investigators, assuming that FDA will continue to prioritize mission critical foreign inspections, but that travel restrictions and other limitations will prevent FDA travel for foreign routine surveillance inspections. FDA also assumes that foreign authorities will conduct 25% of remaining medical product inspections.[42]


In sum, the GAO Report captured concerns about the impact of the pandemic on FDA’s inspections backlog and the risk it poses to the agency’s oversight capabilities in the foreseeable future. Congressional testimony, as well as mounting calls from Industry, set the stage for FDA’s recent adoption of certain additional oversight tools, as well as its longer range plans for use of other tools with more complex implementation requirements. FDA has made significant progress in implementing the GAO recommendations with its use of more innovative inspection alternatives, such as RIEs and the increased transparency provided in the Resiliency Roadmap. GAO subsequently acknowledged that FDA made some improvements, but reiterated its concern that FDA should continue to prioritize addressing inspection delays caused by the pandemic. Thus, while FDA’s adoption of some additional tools to address the inspection backlog has been positively received, all eyes still will remain on FDA as it moves forward with implementing its use of these new tools and potentially adopts newer approaches to its drug manufacturing oversight in the future.

[1] GAO Report, “COVID-19: Critical Vaccine Distribution, Supply Chain, Program Integrity, and Other Challenges Require Focused Federal Attention” (January 2021), available at This report was the GAO’s fifth installment in its series of reports to fulfill the mandate imposed by the CARES Act to monitor and report on the federal response to the coronavirus pandemic (COVID-19).

[2] Statement of Mary Denigan-Macauley, Testimony before the Subcommittee on Agriculture, Rural Development, Food and Drug Administration, and Related Agencies, Committee on Appropriations, House of Representatives, “Drug Safety: FDA’s Future Inspection Plans Need to Address Issues Presented by COVID-19 Backlog” (March 2021), available at

[3] GAO, “Priority Open Recommendations to the Department of Health and Human Services” (May 2021), available at

[4] Id.

[5] FDA Guidance, “Remote Interactive Evaluations of Drug Manufacturing and Bioresearch Monitoring Facilities During the COVID-19 Public Health Emergency” (April 2021), available at

[6] FDA Report, “Resiliency Roadmap for FDA Inspectional Oversight” (May 2021), available at

[7] See supra note 1 at 150, citing “Coronavirus Disease 2019 Update: Foreign Inspections” (March 2020), available at

[8] See supra note 1 at p. 151, citing “Coronavirus Update: FDA Focuses on Safety of regulated Products While Scaling Back Domestic Inspections” (March 2020), available at’re%20announcing%20that,domestic%20routine%20surveillance%20facility%20inspections.

[9] Id.citing “Coronavirus Update: FDA prepares for resumption of domestic inspections with new risk assessment system” (July 2020), available at

[10] Id. at p. 148.

[11] Id. at p. 149.

[12] Id. at 155.

[13] Id. at p. 149.

[14] Id. at p. 151.

[15] Id. at p. 154–55.

[16] Id. at p. 155.

[17] Id.

[18] Id.

[19] Id. at p. 154.

[20] Id. at Executive Summary.

[21] Id. at p. 157.

[22] FDA Updated Guidance, “Manufacturing, Supply Chain, and Drug and Biological Product Inspections During COVID-19 Public Health Emergency Questions and Answers” (January 2021), available at

[23] See supra note 1 at p. 157.

[24] Id.

[25] Id. at Executive Summary.

[26] Id. at p. 155.

[27] Id.

[28] Id. at p. 156.

[29] See supra note 5.

[30] Id.

[31] Id.

[32] Id.

[33] Id.

[34] See supra note 6.

[35] The 13,500 applications included human drugs, animal drugs, devices, biologics, BIMO, and tobacco. FDA did not breakdown the number of applications by commodity.

[36] See supra note 6 at p. 8.

[37] Id. at p. 9.

[38] Id. at p. 11.

[39] Id. at p. 12.

[40] Id. at p. 13–15.

[41] Id.

[42] Id.

12 records
  • 1
  • 2