21 CFR is Title 21 of the Code of Federal Regulations, the collection of rules governing food, drugs, medical devices, cosmetics, tobacco products, and controlled substances in the United States. It spans nearly 1,400 numbered parts and is primarily enforced by two federal agencies: the Food and Drug Administration (FDA) and the Drug Enforcement Administration (DEA). If you manufacture, distribute, import, or even label any of these products, 21 CFR contains the rules you’re legally required to follow.
How Title 21 Is Organized
The Code of Federal Regulations is the official publication containing all permanent rules issued by federal agencies. Title 21 is one of 50 titles, and it’s divided into two main chapters. Chapter I (Parts 1 through 1299) belongs to the FDA, which sits under the Department of Health and Human Services. Chapter II (Parts 1300 through 1399) belongs to the DEA, which operates under the Department of Justice.
Within Chapter I, the regulations are grouped into subchapters by product type. There are separate subchapters for food, drugs, medical devices, biologics (like vaccines and blood products), cosmetics, tobacco, and radiological health products. Each subchapter contains numbered “parts,” and each part addresses a specific topic. For example, Part 101 covers food labeling, while Part 820 covers quality management for medical devices. When someone references “21 CFR 211,” they’re pointing to a specific set of rules within this structure.
Drug Manufacturing Standards
Parts 210 and 211 lay out what are known as Current Good Manufacturing Practice (cGMP) regulations for pharmaceutical products. These rules interpret the Federal Food, Drug, and Cosmetic Act and related statutes, translating broad legal authority into specific manufacturing requirements. They dictate how drug makers must design their facilities, test raw materials, control production processes, and release finished products. Every batch of medication sold in the U.S. must be produced under these standards, whether it’s a prescription drug or an over-the-counter pain reliever.
The “current” in cGMP matters. It signals that companies are expected to keep pace with modern quality practices, not just meet a static checklist from decades ago. FDA inspectors evaluate facilities against both the written regulations and the evolving expectations of the industry.
Medical Device Quality Requirements
Part 820 governs the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished medical devices intended for human use. Manufacturers of Class II and Class III devices, along with certain Class I devices, must maintain a documented quality management system.
A major update took effect here: in February 2024, the FDA issued a final rule harmonizing U.S. device manufacturing requirements with the international standard ISO 13485. This change, which becomes effective February 2, 2026, means device makers will need to align their quality systems with a globally recognized framework rather than following a purely U.S.-specific regulation. The goal is to reduce duplication for companies that sell devices in multiple countries while maintaining the same level of safety oversight. Manufacturers must also report certain complaints and product issues to the FDA under Parts 803 and 806.
Food Labeling and Safety
Part 101 is where you’ll find the rules behind every nutrition facts panel and ingredient list on packaged food. All ingredients must be listed by their common name in descending order of weight. Spices, flavorings, colorings, and chemical preservatives have their own disclosure requirements. If a preservative is added, the label must include both the ingredient’s name and a description of what it does, such as “preservative” or “to retard spoilage.”
Nutrition labeling is required for virtually all food products intended for human consumption and offered for sale, with narrow exemptions. The regulations specify how the principal display panel (the part of the package most likely to face the consumer on a shelf) must be used, and where mandatory information like nutrition facts and allergen declarations must appear.
Controlled Substance Schedules
Chapter II is the DEA’s territory. Part 1308 establishes the five schedules of controlled substances, ranging from Schedule I (highest restriction, substances deemed to have high abuse potential and no accepted medical use) through Schedule V (lowest restriction). These schedules were originally created by Section 202 of the Controlled Substances Act, and the DEA uses Part 1308 to maintain, update, and republish them.
The DEA can move substances between schedules or add new ones based on evidence of abuse potential, following scientific and medical evaluation. In urgent situations, the agency can temporarily place a substance into Schedule I without the usual review process if it determines there’s an imminent public safety hazard. Anyone who manufactures or handles controlled substances generally needs to be registered under the Act and comply with security requirements, though certain exempt chemical preparations are excluded once they reach their final form.
Electronic Records and Signatures
Part 11 is one of the most frequently referenced sections for companies using digital systems in regulated environments. It sets the rules for when electronic records and electronic signatures can legally replace paper documents and handwritten signatures. Any company that creates, modifies, or stores regulated records electronically, whether that’s batch production records for a drug or design history files for a medical device, needs to comply with Part 11.
The core requirements focus on data integrity. Systems must be validated to ensure accuracy and reliability. Every change to an electronic record must be captured by a secure, computer-generated, time-stamped audit trail that cannot obscure previous entries. This audit trail must be retained at least as long as the records themselves and be available for FDA review.
For electronic signatures, the rules are equally specific. Each signed record must display the signer’s printed name, the date and time the signature was executed, and the meaning of the signature (whether it indicates review, approval, responsibility, or authorship). Signatures must be linked to their records in a way that prevents them from being copied or transferred to falsify a different record. Non-biometric electronic signatures must use at least two distinct identification components, such as a user ID and password.
What Happens When Companies Violate 21 CFR
The FDA enforces compliance primarily through facility inspections. When an investigator observes conditions that may violate the Federal Food, Drug, and Cosmetic Act or related regulations, they issue a Form 483 to the company’s management at the end of the inspection. A Form 483 is not a final determination that a violation has occurred. It’s a list of observations, essentially a notice that something looked wrong.
After the inspection, the FDA reviews the Form 483 alongside the full inspection report, any evidence collected on-site, and the company’s written response. Based on all of that, the agency decides what action to take. Options range from no further action (if the company’s response is satisfactory) to a formal Warning Letter, which puts the company on notice that continued violations could result in legal consequences like product seizure, injunctions, or criminal prosecution. The escalation path gives companies an opportunity to correct problems before facing the most serious penalties, but repeated or egregious violations can move quickly to enforcement.