Questions from my most recent workshop on Master Validation Planning - The Unwritten Requirements
I attended the Master Validation Plan for FDA cGMP Compliance workshop today and have a few follow up questions. I am new to cGMP and the company I work for but have been tasked with getting our new product cGMP "certified". It is not a medical device, it falls more into the pharmaceutical realm.
- Will a kit that has potential to be bought by pharmaceutical companies to make biologics have to be FDA cGMP?
- Does the validation and verification model also apply to general cGMP following 21 eCFR 211?
Here's my responses:
- There is no FDA CGMP "certification". A medical product destined for sale in the US is either "cleared" under the FDA's 510(k) or De Novo, or "approved under a PMA. Independent companies or consultants may "certify", but that's not recognized by the FDA. Notified Bodies hired by you for inspections for product to be sold outside the US may issue certificates for other regulatory entities, e.g., EU, Asian countries, etc., if they've been qualified to do so. However, their certifications are not recognized by the US FDA in lieu of FDA inspections, e.g., for ISO 13485 compliance by companies selling devices in the US.
- The FD&C Act under which the FDA operates defines what is a device, a combination product, pharmaceutical, etc., is in the US.
- I can't say for certain without examining your product in detail, a "kit"/ or...? (a separate, consulting project), but if it is a biologic or pharmaceutical, or other medical product, it more than likely will have to be manufactured under the appropriate CGMPs (21 CFR 211 - Drugs, 21 CFR 820 - Devices, 21 CFR 4 - Combo products, or another CFR), with CGMP compliance proven by your QMS documentation; with your company registered with the FDA as a spec developer, manufacturer, or similar, and subject to periodic US FDA inspections, if the product is being sold in the US.
- The basic principles of V&V apply to all the CGMPs as far as production and test equipment and medical devices are concerned. However specific functions, cybersecurity, AI/ML, and product characteristics, etc., may also have ISO, USP, or other specific test requirements that also need to be addressed / V&V'd.
Hope that helps.
-- jel@jelincoln, August 21, 2026
