FDA Regulation of Biologics Manufacturing: 21 CFR 600–610, BLA CMC Expectations, Pre-License Inspections, and Common Enforcement Findings

How FDA regulates biologics manufacturing: 21 CFR 600–610, BLA CMC, pre-license inspections, and the most common enforcement findings

Biological products sit at the intersection of two regulatory regimes. They are licensed under section 351 of the Public Health Service (PHS) Act, and they are simultaneously drugs subject to the Federal Food, Drug, and Cosmetic Act. That dual status shapes everything about how their manufacturing is controlled: a biologics manufacturer must satisfy the biologics-specific standards in 21 CFR Parts 600–680 and the drug cGMP regulations in Parts 210/211, with the two frameworks explicitly supplementing rather than superseding each other ¹⁸⁸¹⁹⁵. This article walks through the regulatory architecture, what FDA expects in the CMC section of a biologics license application (BLA), how pre-license and pre-approval inspections work, and where manufacturers most often get cited in warning letters and Form 483s.

The regulatory architecture: how Parts 600–680 and 210/211 interlock

The starting point is that the two rule sets stack. 21 CFR 210.2 states that Parts 210/211 (as they pertain to a drug) and Parts 600 through 680 (as they pertain to a biological product for human use) "supplement, not supersede, each other," and that where a conflict exists, the more specifically applicable regulation controls ¹⁹⁵. 21 CFR 211.1(b) says the same thing from the drug-cGMP side: biologics that are also drug products for human use remain subject to the applicable biologics regulations in Parts 600–680, and those requirements supplement Part 211 rather than replacing it; in a conflict, the regulation specifically applicable to the product supersedes the more general one ¹⁸⁸.

This interlock is not abstract. Both 21 CFR 601.2 and 601.20 spell out that the applicable requirements for establishments manufacturing a licensed biological product "include, but are not limited to," the cGMP requirements in Parts 210, 211, 600, 606, and 820 ¹²²¹²³. In other words, a BLA is approved only if the product and its establishments meet the biologics standards and the drug cGMP standards (and, for blood products or device constituents, Parts 606 and 820).

21 CFR Part 600: general provisions and establishment standards

Part 600 is FDA's general part for biological products. It carries the core definitions and the establishment-level obligations.

Definitions (21 CFR 600.3). Part 600 defines the vocabulary the rest of the framework runs on: manufacturer (any legal entity engaged in the manufacture of a licensed product, including an applicant that assumes responsibility for compliance with product and establishment standards), manufacture (all steps in propagation or manufacture and preparation, including filling, testing, labeling, packaging, and storage), establishment (the same meaning as "facility" under section 351 of the PHS Act, spanning all locations), and standards (the specifications and procedures established in the subchapter or in the BLA to ensure continued safety, purity, and potency) ²³².

Physical establishment, equipment, animals, and care (21 CFR 600.11). The part imposes controls on the physical plant and, where animals are used, on quarantine, animal health, disease reporting, and necropsy examination ²³⁵.

Records (21 CFR 600.12). Manufacturers must keep records of manufacture and distribution that permit traceability, including sterilization records and, where applicable, animal necropsy records, and must account for divided manufacturing responsibility ²³⁰.

Biological product deviation reporting (21 CFR 600.14). A manufacturer that held the license and had control of the product when a deviation occurred must report deviations in manufacturing, testing, processing, packing, labeling, storage, holding, or distribution if the event may affect safety, purity, or potency and involves a distributed product ²⁰¹.

Postmarketing adverse experience reporting (21 CFR 600.80). Part 600 requires applicants to promptly review adverse experience information from any source (foreign or domestic), submit 15-day Alert reports for each serious and unexpected adverse experience, submit periodic safety reports for other events, and retain adverse experience records for 10 years ^226227228229.

21 CFR Part 601: licensing and the content of the BLA

Part 601 governs how a biological product becomes licensed. No product may be marketed under section 351 of the PHS Act without a biologics license, and the operative sections are 601.2 (application), 601.20 (standards for approval), and 601.4 (issuance) ^121123125.

What the BLA must contain (21 CFR 601.2). At a minimum, the application must include ¹²¹:

• Data from nonclinical and clinical studies demonstrating that the product meets the prescribed standards of safety, purity, and potency;
• For each nonclinical study, a statement of compliance with the good laboratory practice regulations in Part 58 (or an explanation for noncompliance);
• For each clinical investigation, a statement of compliance with the IRB regulations in Part 56 (or applicable exemption) and the informed-consent requirements in Part 50;
• A full description of manufacturing methods;
• Stability data through the proposed dating period;
• Representative samples of the product, plus summaries of lot test results;
• Specimens of labels, enclosures, containers, and any required Medication Guide;
• The address of each manufacturing location;
• Financial certification/disclosure for clinical investigators under Part 54; and
• An environmental assessment under Part 25 (or a claim of categorical exclusion).

FDA will not treat the application as filed until all pertinent information and data are received ¹²¹.

Standards for approval (21 CFR 601.20). A BLA may be approved only after FDA examines the product and determines it complies with the standards in the application and applicable regulations (including the cGMP requirements in Parts 210, 211, 600, 606, and 820); confirms the product is available for examination and available for inspection during all phases of manufacture; determines that the manufacturing process does not impair assurances of continued safety, purity, and potency; and inspects the listed establishment(s) and finds them in compliance ¹²³. Section 601.4 restates that a license issues only on FDA's determination that both the establishment(s) and the product meet applicable requirements ¹²⁵.

What a license authorizes. The license authorizes the manufacturer to market the product subject to the approved terms and continued regulatory compliance ¹²¹¹²⁵. Under 601.22, a license covering all locations can also authorize certain other persons and places to perform initial or partial manufacturing for shipment solely to the licensed manufacturer in short-supply situations, if registered and approved ¹²⁴.

21 CFR Part 610: general biological product standards and lot release

Part 610 sets the general product standards that every licensed biologic must meet, and it is the home of the release testing that distinguishes biologics from small-molecule drugs.

• Release / equivalent methods (21 CFR 610.9). Any modification of a required test method or manufacturing process is permitted only if the applicant submits evidence that the modification provides assurances of safety, purity, potency, and effectiveness equal to or greater than the specified method, and receives written FDA approval ⁸⁹.
• Sterility (21 CFR 610.12). Manufacturers must perform sterility testing on each lot's final container material (or another approved material). The test must be appropriate, validated, and supported by written procedures and appropriate sampling, with defined records and repeat-test rules. Certain products are exempt, and FDA may determine sterility testing is unnecessary where the BLA data show it is not needed to assure safety, purity, and potency ⁸⁵⁸⁶.
• Purity (21 CFR 610.13). Products must be free of extraneous material except that which is unavoidable in the approved process. Dried products must be tested for residual moisture, and injectables for pyrogenic substances, unless exempted ⁸⁷.
• Identity (21 CFR 610.14 / 610.18). Cultures used in manufacturing must be clearly identified as to source strain; seed lots must be identified by lot number and date; and cell lines must be identified by history and characterized ⁸⁸.
• Potency (21 CFR 610.10 / 610.15). Potency requirements run through the part: preservatives must not reduce potency below the acceptable minimum during the dating period, adjuvants may not be introduced without evidence they do not adversely affect potency, and any modified method must preserve potency assurance ⁸⁹⁹⁰.
• General safety and constituent materials (21 CFR 610.15). Ingredients, preservatives, diluents, and adjuvants must meet generally accepted standards of purity and quality; preservatives must be sufficiently nontoxic; multiple-dose containers generally must contain a preservative (with listed exceptions); aluminum limits apply; and cell lines must be tested for detectable microbial agents ⁸⁸⁹⁰.

Part 610 is why "lot release" is a defining feature of biologics regulation: each lot must be shown to meet identity, purity, potency, sterility, and general-safety standards before distribution, and certain products additionally undergo official lot release with samples and protocols submitted to FDA.

BLA CMC expectations: what Module 3 must demonstrate

FDA expects the CMC/Module 3 section of a BLA to carry enough quality information to assess the drug substance, the drug product, the control strategy, and manufacturing readiness for licensure ¹⁶⁰¹⁶⁸. The recurring expectations are:

• Drug substance (Module 3.2.S): general information, manufacturer information, characterization (structure and physicochemical/biological properties), control of the drug substance (specifications with validated/verified analytical methods), reference standards/materials, and container closure system ¹⁶⁰¹⁶⁸.
• Drug product (Module 3.2.P): description and composition, batch formula for each strength, a complete manufacturing process description with flow charts and master batch/packaging records, identification of critical steps and intermediates, control of excipients and materials, controls of the drug product, and process validation or evaluation ¹⁷¹.
• Control of materials. For purchased components, FDA expects adequate specifications plus assurance of conformance, supported by inspections, sampling and testing, certificates of analysis, historical data, and/or supplier audits ¹⁶⁹.
• Characterization. The drug-substance package should establish structure and characteristics and identify/list impurities ^158160168.
• Stability. The application should present stability data and a stability strategy supporting the proposed shelf life or retest period ^155166168.
• Comparability. Where manufacturing processes or facilities changed during development, the application must demonstrate that the product to be marketed is comparable to the material used in clinical trials, and may use a comparability protocol/PACMP supported by data ^152155156169.

Underlying all of this, FDA expects the Module 3 to reflect a robust change-management and quality system, because changes to product, process, controls, equipment, facilities, and materials must be managed and reported through the appropriate post-approval mechanism ^152154164.

Process validation as a lifecycle

FDA expects a three-stage lifecycle approach to process validation for biologics manufacturing ⁹¹:

1. Process design (Stage 1). Development work (design of experiments, risk analysis, laboratory/pilot and scale-up studies) should define the relationships between process inputs and outputs, equipment limits, and sources of variability, and should be documented so process knowledge carries into later stages ^9193112.
2. Process performance qualification (Stage 2). A written PPQ protocol must be reviewed and approved by the appropriate units (including the quality unit) before execution, specifying manufacturing conditions, controls, testing, and acceptance criteria. The PPQ report must document adherence to the protocol, whether criteria were met, any justified changes, and whether the process is in a state of control ⁹²⁹³.

• Continued process verification (Stage 3). The manufacturer must provide ongoing assurance that the commercial process stays in control, monitoring for drift and shifts with statistical tools, investigating emerging trends, and evaluating whether additional design or qualification studies are needed after any process change ^9296105.

Pre-license and pre-approval inspections (PLI / PAI)

Before a biologics license issues, FDA inspects the establishments named in the application. A pre-license inspection (PLI) supports review of an original BLA; a pre-approval inspection (PAI) supports a prior-approval supplement involving a major or significant change ²³⁶²⁵³. The purpose is to confirm that the establishment and product comply with applicable requirements and that the data submitted in the application are accurate and complete, so that FDA can decide whether a license (or a significant change) can be granted ^183236238.

Timing and notice. The inspection should be scheduled while the establishment is operating, coordinated to the manufacturing schedule and, where applicable, user-fee timeframes. For original applications, FDA's goal is to notify the applicant of intent to inspect at least 60 days before the inspection and no later than mid-cycle, though FDA may inspect at any time during the assessment cycle ²³⁹.

Scope. The inspection follows a systems approach plus specific areas identified in the compliance program. For CBER-regulated biologics, it may cover all establishments associated with the submission, including drug-substance and finished-product manufacturing and control-testing laboratories; for CDER-regulated biologics, it covers drug-substance and drug-product manufacturers and evaluates the ability to perform the operations described in the application ^183253254. In practice the team reviews the relevant application sections, manufacturing operations, control strategy, batch records, facility and equipment information, and laboratory controls ^254255259.

What the team evaluates. Three objectives sit at the center, and they are shared with the general preapproval-inspection compliance program 7346.832 ³⁰:

1. Manufacturing readiness/capability — whether the establishment has a quality system able to control the facility and commercial operations, covering manufacturing and laboratory capability, sampling/testing/release, contamination controls, batch release, and change management, and whether the proposed commercial process and batch record are feasible and scientifically justified ^32334344.
2. Conformance to the application — whether the formulation, manufacturing methods, analytical methods, and batch records match the CMC section, including exhibit/biobatches, pivotal clinical batches, and the proposed commercial-scale process ^32334549.
3. Data integrity audit — verification of raw data to confirm that CMC data in the application are accurate, complete, and reliable, including comparison of raw laboratory and manufacturing records against submitted summaries and attention to missing records or unexplained inventory losses ³⁷⁴⁶⁵¹.

Facility selection is risk-based. FDA performs a preapproval facility evaluation using an integrated quality assessment team, weighing each facility's role in the application, prior inspection history and compliance status, manufacturing complexity, and information from alternative tools such as records requests or remote assessments; some inspection elements are covered every time while others are triggered only by risk factors (prior deficiencies, new buildings or equipment, major changes, or no prior inspection coverage) ^2930363850.

The most common enforcement findings

Warning letters and Form 483 observations at biologics and sterile-injectable facilities cluster into a predictable set of themes. Because most biologics are aseptically processed sterile products, sterility assurance dominates, followed by data integrity and quality-system failures.

Sterility assurance and aseptic processing

This is the single largest category of citations at sterile biologics facilities ^{208210211212217222224}. Recurring findings:

• Inadequate airflow / smoke studies. Firms fail to demonstrate unidirectional airflow in ISO 5 zones under dynamic conditions. Examples include turbulence in laminar-airflow units where aseptic connections are made with no dynamic simulation of the intervention, smoke studies that omit setup activities or actual interventions, and studies run only under static conditions ^209210211224.
• Poor aseptic technique / interventions that disrupt first air. Operators reach over open vials and stoppers, touch product-contact surfaces during setup, insert gloved hands to remove sterile material, or use forearms to move sterile apparatus ^210214215224.
• Unrealistic media fills. Process simulations fail to incorporate routine interventions, actual duration, or actual batch intensity; some firms run too few media fills (in one case a single media fill after years of sterile production) or ship product before completing media fills and smoke studies ^211214218221.
• Weak environmental and personnel monitoring. Monitoring is too infrequent, misses high-risk locations, uses poorly placed probes, or applies inappropriate alert/action limits; personnel monitoring is inadequate or allows excessive CFU limits ^{212213217221222}.
• Facility/equipment design flaws. Open processing lines with no barrier protection, non-cleanable surfaces, and layouts that force operators to reach into critical zones make the operation inherently unable to maintain asepsis, so that retrospective review cannot compensate ^208215222.
• Inadequate sterilization of product-contact materials. Equipment contacting sterile constituents is only cleaned/disinfected rather than sterilized, and non-sterile wipes or gloves are used in ISO 5 areas ^215219223.

The parallel Form 483 record shows the same pattern: aseptic technique and gowning failures, environmental-monitoring weaknesses (including recurring mold, gram-negative, and objectionable-organism recoveries in cleanrooms adjacent to ISO 5), unqualified sterilization/depyrogenation equipment, and incomplete aseptic process validation ^{264265267270272274277287}.

Data integrity

Data integrity is the second dominant theme, concentrated in laboratory computerized systems ^{57585961656771757880}:

• Missing, disabled, or unreviewed audit trails — audit-trail functionality not enabled, enabled only just before an inspection, or never reviewed before batch release ⁵⁷⁵⁹⁸⁰.
• Shared or over-privileged system access — shared "admin" logins, no unique user IDs, and all analysts holding full administrator rights, including the ability to create or modify validated methods ⁶¹⁷⁴⁷⁸.
• Ability to delete, alter, overwrite, or backdate data — setting the instrument clock back to hide failing results, deleting original injections, and finding raw data in the recycle bin ^58717577.
• Poor retention/backup of raw data — electronic raw data deleted to free space, no backup of injection sequences or audit trails, or only paper printouts retained ⁶⁵⁶⁷⁷⁸.
• Manual manipulation of chromatography — re-integrating peaks until results pass, with no predefined procedure, to convert OOS results into passing ones ⁶⁷⁷⁵⁸¹.

Quality system, investigations, and OOS handling

The third cluster is systemic quality failure ^123511142022:

• Weak quality-unit oversight — the quality unit lacks the authority or does not exercise it to ensure deviations are investigated and to prevent release of non-conforming or contaminated product ²⁷²⁵.
• Inadequate deviation investigations / root-cause analysis — investigations that do not identify a scientifically justified root cause or do not expand appropriately when integrity lapses are found ²³⁹.
• Improper OOS handling — OOS results invalidated without adequate scientific justification, "testing into compliance" by retesting until a passing result is obtained, and batches released on passing retests without an assignable root cause ¹¹¹⁴¹⁶.
• Failure to broaden scope to affected lots — investigations that do not assess other potentially affected batches or products ¹⁵¹⁷¹⁹.
• Ineffective CAPA — recurrence of the same findings, prompting FDA to demand retrospective independent reviews of all invalidated OOS results and comprehensive CAPA plans ¹³²².

Practical implications

For a biologics manufacturer, the framework translates into a few durable priorities. The BLA's Module 3 must tell a complete, internally consistent CMC story (drug substance and drug product characterization, control strategy, a validated process backed by PPQ, stability, and comparability across manufacturing changes), because the pre-license inspection exists precisely to confirm on-site that the facility can make the product as described and that the submitted data are real ^183254255. The lot-release standards of Part 610 (sterility, purity, potency, identity, general safety) apply to every lot, not just at licensure ^85878890. And the enforcement record is a standing checklist of where programs fail: dynamic airflow and aseptic-behavior control, realistic media fills, meaningful environmental monitoring, computerized-system data integrity, and a quality unit with genuine authority over investigations, OOS decisions, and CAPA ^{2082172225780214}. A reader planning a specific program (for example, a first-in-CBER PLI readiness plan, a comparability protocol for a manufacturing-site transfer, or a data-integrity remediation strategy) can drill into any of these threads in a follow-up.