21 CFR Part 211 and its 5 linked instruments

US CGMP rules for finished pharmaceuticals. Section 211.68 allows computers and automated equipment in manufacture if they are routinely checked under a written program. It requires controls so only authorised people change master records, checks on input and output, and a backup of data.

FDA compliance policy on computers in drug manufacturing. Under CGMP, hardware is generally treated as equipment and applications software as records, and the system's use decides which sections apply. The series also covers vendor responsibility, source code for process control, input and output checking, and identifying persons on batch records.

FDA guidance to help manufacturers use modern quality systems and risk management to meet the CGMP regulations in 21 CFR parts 210 and 211.

FDA's question-and-answer guidance on data integrity in drug manufacturing: ALCOA, audit trail review, access controls, shared logins and when electronic data are CGMP records.

FDA draft guidance proposing a risk-based credibility framework for AI models whose output supports regulatory decisions about drugs and biologics. Still a draft (docket FDA-2024-D-4689).

Described as FDA's first CGMP enforcement on AI misuse: the firm used AI to generate specifications and procedures without adequate review. FDA said AI-generated documents must be reviewed for accuracy.

• 29 Sep 1978 Published at 43 FR 45077

• 19 Oct 1984 Sec. 425.100 originally issued
• 4 Sep 1987 Sec. 425.100 revised

• 2 Oct 2006 Final guidance issued

• ~1 Dec 2018 Final guidance published (Dec 2018)

• 7 Jan 2025 Draft guidance published (comments closed 7 Apr 2025)

• 2 Apr 2026 Warning letter 320-26-58 issued (2 Apr 2026)