What GMP is, and when it starts applying: lessons from FDA's enforcement record

GMP in one paragraph

Good manufacturing practice (GMP), which FDA calls current good manufacturing practice (CGMP), is the body of requirements that govern how a drug or biologic is made, tested, packaged, stored, and released so that each unit has the identity, strength, quality, and purity it is represented to have. For finished pharmaceuticals the core rules sit in 21 CFR Parts 210 and 211; for biologics they are layered with the Public Health Service (PHS) Act. The statutory hook is section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic (FD&C) Act: a drug is deemed "adulterated" if the methods, facilities, or controls used to manufacture it do not conform to CGMP. FDA uses that exact formulation in enforcement letters, telling firms their product "is adulterated within the meaning of section 501(a)(2)(B)" whenever manufacturing controls fall short ¹²⁴¹²⁸¹³⁶. In practice GMP is less a checklist than a functioning quality system: a quality unit with real authority, controlled and validated processes, documented batch records, stability data, contamination control, and investigation of anything that goes wrong.

The question that trips up early-stage companies: when does it start?

The common assumption is that GMP is a commercial-launch problem: something you build out once an NDA or BLA is on the horizon. The enforcement record says otherwise. GMP obligations attach as soon as a product meets the statutory definition of a drug or biologic and is made for administration to humans, which includes material made for clinical investigation, well before any approval exists. The obligation is "phase-appropriate," meaning the depth of validation and control scales with the stage of development, but it is never zero.

The EU frames the same principle explicitly, which is useful for contrast. EU GMP requires investigational medicinal products (IMPs) to be manufactured under GMP from the clinical-trial stage onward, with a quality system meant to protect trial subjects and preserve the reliability of clinical data, batch certification by a Qualified Person, and controls that are "flexible and appropriate to the stage of development" and become more defined as knowledge increases ⁴⁸⁴⁹⁵⁰⁵²⁵⁴⁵⁷. FDA's expectation is the same in substance: the earlier the phase, the more the controls are risk- and knowledge-based, but the foundational quality system must exist before you put product into a human.

The clearest illustration of "GMP does not wait for approval" is how FDA treats products that never had approval at all. When a firm manufactures an unapproved or investigational drug or biologic and its controls are deficient, FDA does not excuse the deficiency because the product is pre-approval. It cites the product as adulterated under CGMP anyway. FDA applied section 501(a)(2)(B) to CGMP deficiencies at US Stem Cell Clinic, LLC ¹²⁰, and at Berkeley Biologics, LLC it stacked the citations: unapproved new drug/biologic under section 351(a)(1) of the PHS Act and section 505(a) of the FD&C Act, plus CGMP adulteration for the drug product ¹²¹. The message is that being pre-approval is not a shield; it is often the reason FDA is looking.

What FDA has actually cited early-stage and development-stage manufacturers for

Cell, gene, and tissue products administered to patients before approval

The richest set of examples comes from cell-therapy, tissue, and exosome firms whose products were being given to patients or studied clinically without the manufacturing foundation in place. These are the closest analogues to a modern early-stage biotech making its own clinical material.

StemGenex Biologic Laboratories, LLC was cited for significant CGMP deviations in its stromal vascular fraction (SVF) product used in humans: unvalidated manufacturing processes, an uncontrolled environment, lack of control over components, and insufficient product testing, including sterility and endotoxin testing ⁶⁷. FDA specifically questioned whether each lot was tested for sterility and flagged that the endotoxin specification appeared to have been loosened after a validation failure, leaving results above acceptable limits for many patients ¹¹¹.
TCA Cellular Therapy, LLC was cited for administering investigational products to patients not enrolled in the IND studies, using allogeneic cells where the protocol required autologous cells, treating patients while studies were on clinical hold, and donor-eligibility and communicable-disease testing failures. In specific instances a subject received the wrong investigational product and another received allogeneic donor cells instead of their own stem cells ⁷⁷.
Safari Stem Cell, LLC was cited for lack of validated manufacturing processes, failure to perform sterility testing on batches of stem-cell product administered intravenously or intrathecally, and no environmental monitoring in the aseptic processing area ¹¹²¹¹³.
EUCYT Laboratories LLC was cited for unvalidated aseptic processes for products including XOsomes and VidaStem, deficient environmental and personnel monitoring, inadequate control of incoming umbilical-cord components, and sterility failures that were not thoroughly investigated ¹¹⁴.
Dynamic Stem Cell Therapy and Supreme Rejuvenation, LLC were cited for marketing unapproved biologics (an umbilical-cord product and exosome products, respectively) with no IND and no BLA, against a backdrop of FDA safety concern after serious adverse events tied to exosome products ⁶⁹⁷⁶.

The common thread is not exotic. These firms skipped the basics that GMP requires from the first human dose: a validated process, a controlled aseptic environment, sterility and endotoxin testing on every lot, component control, and real investigation of failures.

Sterility and aseptic processing in clinical and small-batch sterile production

Sterile products carry the highest patient risk, and FDA's Form 483 observations show the same aseptic deficiencies whether the site is a large manufacturer, a compounding pharmacy, or a 503B outsourcing facility. For any early-stage company making a sterile injectable for a trial, these are the recurring failure modes FDA documents:

Media fills that do not simulate worst-case aseptic operations, including realistic staffing, unit counts, interventions, and batch size (cited at outsourcing and sterile-production facilities such as ProRx LLC, Nephron sterile compounding sites, AnazaoHealth, and Mandell's Clinical Pharmacy) ⁸¹⁸⁴⁸⁹⁹⁵⁹⁷.
Weak environmental and personnel monitoring: no monitoring during production, no dynamic (in-operation) sampling, inadequate glove monitoring, and action levels without justification ⁸²⁸⁸⁹⁰⁹¹.
Inadequate cleaning and disinfectant-efficacy validation, including failure to use a sporicidal agent and missing organisms or surfaces in efficacy studies ⁹³⁹⁷¹⁰³.
Insufficient sterility and endotoxin testing of finished sterile product, with testing frequency and acceptance criteria never established (cited at Clinical Apothecaries and Pinnacle Compounding, among others) ⁸⁶⁸⁸⁹³.

The foundational quality-system gaps small and new manufacturers repeat

Across warning letters to small, new, or development-stage manufacturers, FDA cites the same structural absences, the systems a startup is tempted to defer:

No adequate quality unit, or a quality unit with no written responsibilities and no real authority over release ²⁴²⁵³⁰³³³⁴³⁷³⁹⁴⁰⁴³.
No stability program and no representative batches on stability, so shelf-life claims are unsupported ²⁴²⁷³⁹.
No validated aseptic process and inadequate environmental controls ²²³⁹.
Inadequate batch records, master production records, and complete laboratory data ²³²⁶³¹³³³⁵³⁶³⁷⁴⁰⁴¹⁴³.
No process validation, change control, or written procedures ²³²⁶³⁰³¹³⁵³⁶⁴²⁴³.
Failure to investigate deviations, out-of-specification results, and complaints, with weak or absent CAPA ²³²⁶²⁸³⁰³¹³²³³³⁵³⁸⁴¹⁴².

Sanofi Pasteur, for example, was cited for aseptic process simulations that omitted pre-filtration and cleaning operations, an unvalidated microbiological method, and no integrity testing of sterile vent filters ²². Stemell Inc was cited for no stability program, no calibrated or monitored cold storage, no complaint procedures, and no quality-control unit ³⁹.

483s tied directly to clinical trial material

FDA investigators have also documented deficiencies that reach the clinical-supply chain specifically. Ohm Laboratories, Inc. was cited when a validation batch of Oxcarbazepine Suspension was converted to a trial batch despite prior failed validation batches, with no documented transfer procedure, undocumented critical viscosity steps, operator-dependent manual additions, and no established process controls ¹⁴. Beacon Hill Medical Pharmacy was cited for sterile-injectable component and closure controls: components not tested or released before use, missing identity and endotoxin testing, and no container-closure integrity testing ¹⁵. These are the kinds of observations that surface when a company treats early batches as informal and only "gets serious" about controls later.

The practical takeaway for regulatory and CMC teams

GMP is not a launch milestone; it is a condition of putting product into a human. The controls are phase-appropriate, so a Phase 1 program is not held to the full commercial validation burden, but the enforcement record shows FDA expects the load-bearing elements to exist from the first clinical batch: an empowered quality unit, defined and controlled processes, complete batch records, stability data, contamination control for anything sterile, and genuine investigation of failures. The firms FDA cites are overwhelmingly those that treated these as post-approval concerns. For companies making their own clinical material, the pattern is a checklist of what to have in place before, not after, the first patient is dosed.

GMP Basics and When FDA Expects Compliance: Lessons From the Enforcement Record