CGMPs, or Current Good Manufacturing Practices, are a set of FDA regulations that establish minimum quality standards for manufacturing drugs, medical devices, dietary supplements, and certain food products. They cover everything from how a facility is designed and maintained to how workers are trained, how ingredients are tested, and how records are kept. If a company makes something you put in or on your body, cGMP rules govern how that product must be produced.
What the “Current” Actually Means
The “c” in cGMP is the part most people overlook, but it carries real weight. It means companies can’t simply meet the standards that existed when the regulations were first written. They’re expected to use technologies and systems that are up to date. Equipment that was considered top of the line 10 or 20 years ago may no longer be adequate. The FDA built this flexibility into the rules deliberately: rather than prescribing one exact way to manufacture a product, the regulations let each company decide how to implement controls using scientifically sound methods, as long as those methods reflect current capabilities.
This is what separates cGMP from a static rulebook. A pharmaceutical company that still relies on paper logbooks and manual quality checks when validated digital systems are the industry norm could be found out of compliance, not because the old method was always wrong, but because it no longer meets the “current” standard.
Which Industries Follow cGMP
The FDA applies cGMP requirements across several product categories, each governed by its own section of the Code of Federal Regulations (Title 21):
- Finished pharmaceuticals fall under 21 CFR Part 211, which is the most well-known set of cGMP rules. These cover prescription drugs, over-the-counter medications, and drugs for both humans and animals.
- Biological products like vaccines and blood-derived therapies are regulated under 21 CFR Part 600 and related sections.
- Dietary supplements have their own cGMP framework under 21 CFR Part 111, with specific requirements for identity testing of ingredients.
- Medical devices follow what’s now called the Quality Management System Regulation (QMSR), which updated the older Part 820 rules in February 2026 to align with the international standard ISO 13485:2016.
The FDA describes all of these as “current good manufacturing practices,” but the specific requirements differ by product type. A pill manufacturer faces different contamination risks than a surgical implant maker, so the regulations are tailored accordingly.
What cGMP Covers in Practice
For pharmaceuticals, which have the most detailed cGMP framework, the regulations set minimum requirements for the methods, facilities, and controls used in manufacturing, processing, and packing a drug product. In practical terms, this breaks down into several areas.
Facilities must be designed to prevent contamination and mix-ups. This includes controlling air quality, temperature, humidity, and airflow patterns in production areas. Cleanrooms used for sterile products have especially strict requirements, with specifications for airborne particulate levels and pressure differentials that keep contaminants from drifting into sensitive zones.
Personnel must be adequately trained for their specific roles, and there must be enough qualified staff to carry out and supervise each step of the process. Equipment must be properly maintained, calibrated, and cleaned according to written procedures. Raw materials and components must be tested and verified before they’re used in production.
Every batch of product goes through defined testing procedures to confirm it meets specifications for identity, strength, purity, and quality before it’s released for distribution.
Why Documentation Matters So Much
One of the most demanding aspects of cGMP is the documentation requirement. There’s a saying in the pharmaceutical industry: “If it wasn’t documented, it didn’t happen.” The FDA expects every critical action, measurement, and decision to be recorded in a way that can be reviewed and verified later.
The standard the FDA uses for evaluating records is called ALCOA+, an acronym that spells out exactly what good data looks like. Each record must be attributable (traceable to the person who created it), legible (readable and permanent), contemporaneous (recorded at the time the work was performed), original (the first-captured version of the data), and accurate (complete, consistent, and truthful). Four additional elements round out the framework: records must be complete enough to recreate and understand what happened, consistent in how they’re dated and sequenced, enduring so they remain intact for the full retention period, and available for access whenever needed.
This isn’t just bureaucratic box-checking. When a product recall happens or a patient reports an adverse reaction, investigators trace the problem back through batch records, equipment logs, and test results. If those records are incomplete or unreliable, there’s no way to determine what went wrong or how far the problem extends.
Dietary Supplement Requirements
Dietary supplements operate under a separate but related cGMP framework. The rules require manufacturers to establish identity specifications for every dietary ingredient they use and to conduct at least one appropriate test or examination to verify each ingredient’s identity before it goes into a product. For finished supplements, manufacturers must set product specifications covering identity, purity, strength, and composition, then test batches to confirm they meet those specifications.
These requirements exist because the supplement industry has historically faced problems with mislabeled ingredients and contamination. Unlike prescription drugs, supplements don’t need FDA approval before going to market, which makes the manufacturing standards the primary quality safeguard consumers rely on.
Medical Devices and Global Harmonization
Medical device cGMP requirements took a significant step forward in 2026 when the FDA replaced its older Quality System Regulation with the new QMSR. The updated rule incorporates the international standard ISO 13485:2016 as its foundation, which means device manufacturers who sell globally can now work from a single quality management framework rather than juggling separate U.S. and international requirements.
The harmonized standard specifically requires risk management throughout a device’s lifecycle, from design through production and post-market monitoring. If any part of ISO 13485 conflicts with the Federal Food, Drug and Cosmetic Act, the U.S. law takes precedence.
What Happens When Companies Fall Short
The FDA conducts routine inspections of manufacturing facilities and issues findings when companies aren’t meeting cGMP standards. Minor issues might result in an observation on a Form 483, which gives the company a chance to correct the problem. More serious or repeated violations can lead to warning letters, import alerts (blocking foreign-made products from entering the U.S.), or consent decrees that force a facility to shut down until it comes into compliance.
Products manufactured in violation of cGMP are considered “adulterated” under federal law, regardless of whether the final product actually tests as defective. In other words, even if a batch of pills turns out fine, making them in a facility that doesn’t meet cGMP standards is itself a violation. The logic is preventive: the regulations exist to ensure quality is built into every step of the process, not just confirmed at the end.