What is the FDA?
The FDA (U.S. Food and Drug Administration) is the federal regulator of the United States that decides whether food, medicines, biological products, medical devices, cosmetics and tobacco are safe enough to enter, and stay on, the US market. The FDA sits within the Department of Health and Human Services (HHS) and oversees products that together account for roughly twenty cents of every dollar spent by US consumers. For companies outside the US the FDA matters just as much as for American ones: anyone exporting to the US must meet the same quality, documentation and traceability requirements, and those requirements reach directly into MES, LIMS, SCADA and historians.
The FDA decides whether a product may enter the US market, and expects you to prove with reliable data how it was made.
🕰️ How did the FDA come about?
The FDA traces its roots to a single chemist appointed to the US Department of Agriculture in 1862. Its modern role began with the Pure Food and Drugs Act, signed on 30 June 1906, which banned the interstate transport of adulterated or misbranded food and drugs. The Act was enforced by the Bureau of Chemistry; in 1927 that task moved to a separate agency, which has been called the Food and Drug Administration since 1930.
| Year | Milestone | Significance |
|---|---|---|
| 1906 | Pure Food and Drugs Act | First federal law against adulterated food and drugs |
| 1938 | Federal Food, Drug, and Cosmetic Act (FD&C Act) | Drug safety must be shown before marketing; still the core statute |
| 1976 | Medical Device Amendments | Risk classes I, II and III for medical devices |
| 1997 | 21 CFR Part 11 | Requirements for electronic records and signatures |
| 2011 | Food Safety Modernization Act (FSMA) | Shift from responding to food incidents to preventing them |
| 2013 | UDI rule and Drug Supply Chain Security Act | Unique device identification and electronic tracing of medicines |
| 2022 | FDORA and MoCRA | Cybersecurity requirements for medical devices; registration for cosmetics |
| 2026 | QMSR in force (2 February) | ISO 13485 becomes the basis of the US quality system for devices |
🎯 What does the FDA do?
The FDA is organised in centres per product group. On 1 October 2024 the agency completed its largest reorganisation in decades: the food centre CFSAN was folded into the new Human Foods Program, and the field organisation ORA was renamed the Office of Inspections and Investigations (OII).
| Area of oversight | Centre | Examples of regulation |
|---|---|---|
| Medicines | CDER | Market approval via an NDA (new drug) or ANDA (generic), cGMP under 21 CFR 210/211 |
| Biological products | CBER | Vaccines, blood products and cell therapies via a BLA |
| Medical devices | CDRH | Risk classes I–III, clearance via 510(k), De Novo or PMA, UDI and QMSR |
| Food & supplements | Human Foods Program | Preventive controls under FSMA, labelling, traceability |
| Cosmetics | Human Foods Program | Since MoCRA: facility registration, product listing and serious adverse event reporting; no premarket approval |
| Veterinary medicines and animal feed | CVM | Approval and feed safety |
| Tobacco | CTP | Under FDA oversight since 2009 |
Medicines and most medical devices need approval or clearance before they are sold. Food and cosmetics do not: there the FDA mainly acts after the fact, through inspections, registration and import controls. In every case the aim is consumer and patient safety, efficacy and quality.
🔐 What does the FDA require of IT and OT systems?
The FDA does not regulate systems as such, but it does regulate the records they produce. As soon as a batch record, calibration certificate or release decision is captured digitally, requirements apply that shape your architecture directly:
- 21 CFR Part 11 - rules for electronic records and electronic signatures, in force since 20 August 1997
- Validation - systems must demonstrably do what they are meant to do; in practice following GAMP 5 and, for device manufacturers, the FDA’s final Computer Software Assurance (CSA) guidance of September 2025, whose principles pharmaceutical companies also adopt
- Audit trail - every change to GxP data is logged with who, what, when and why
- Access Management - per-user permissions, no shared accounts and Logging of who does what
- Data integrity (ALCOA+) - data must be attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available
- Device cybersecurity - since 29 March 2023, section 524B of the FD&C Act requires manufacturers of cyber devices to submit a plan for vulnerabilities, updates and an SBOM
The FDA’s December 2018 guidance on data integrity shows what investigators look for: disabled audit trails, shared passwords and overwritten test results. The same weaknesses appear in OT environments, for example an HMI with a single operator account.
🧭 Which plant systems are affected by FDA rules?
| System | FDA relevance | Typical requirement |
|---|---|---|
| LIMS | Sample registration and release of raw materials or finished products | Audit trail on results, electronic signature on approval |
| MES | Production records, batch tracking, electronic signatures | Electronic batch record under Part 11 and 21 CFR 211 |
| SCADA | Logging of process values for release or deviation management | Validated alarms and setpoint changes with audit trail |
| Historian | Continuous storage of production conditions to support audit trails | Synchronised time, protected storage, retention periods |
| ERP | Inventory, batch numbers and recalls | Traceability from lot to customer |
Not every system falls under Part 11. What counts is whether the record replaces a legally required record, or whether you rely on it for a GxP decision. Document that assessment per system in a risk analysis.
🍎 What does the FDA mean for food manufacturers?
For the food industry, FSMA, signed on 4 January 2011, shifted oversight towards prevention. Companies need a food safety plan with hazard analysis and preventive controls, comparable to HACCP but broader in scope. Every facility that manufactures, packs or holds food for the US, including those in the Netherlands and elsewhere in Europe, must register with the FDA and renew that registration free of charge between 1 October and 31 December of every even-numbered year.
The Food Traceability Rule (FSMA section 204) requires, for foods on the Food Traceability List, recording Key Data Elements at Critical Tracking Events such as harvesting, cooling, packing, shipping, receiving and transformation. On request you must provide that data within 24 hours, and during an outbreak as an electronic sortable spreadsheet. The original compliance date of 20 January 2026 has moved: Congress directed the FDA not to enforce the rule before 20 July 2028. For OT and MES this mainly means linking production data to lot numbers and making it quickly retrievable, for example through GS1 coding.
🛠️ How do you prepare a plant for an FDA inspection?
When an FDA inspection finds problems, it ends with a Form 483: a list of the investigator’s observations. That is not yet a final verdict, but a late or inadequate response (the common practice is within 15 business days) can lead to a warning letter, an import alert that stops your products at the border, or a withheld approval. A practical approach:
- Inventory which systems create GxP-relevant records and document which of them fall under Part 11.
- Validate based on risk following GAMP 5 and CSA: extensive testing for critical functions, less for supporting ones.
- Check access and audit trails on every HMI, SCADA and historian system; eliminate shared accounts.
- Synchronise time via NTP, so records from different systems line up.
- Control changes with change management and version control of PLC and recipe code.
- Keep your quality system current in a QMS, covering calibration, deviations and CAPA.
- Run a mock inspection, including showing an audit trail to an investigator straight away, without preparation.
In Europe not every plant has to expect an FDA investigator for medicines: since July 2019 the EU and the US have recognised each other’s GMP inspections for human medicines, with exceptions such as vaccines and plasma-derived products. An inspection by the Dutch Health and Youth Care Inspectorate (IGJ), for example, can then suffice. That agreement does not cover medical devices or food.
🌍 How does the FDA differ from the European approach?
| FDA (US) | EU |
|---|---|
| Applies to the US market, including foreign facilities | Applies to products on the EU market |
| 21 CFR Part 11 for electronic records | Annex 11 of the EU GMP guidelines (EudraLex Volume 4) |
| One federal authority that both approves and inspects | EMA assesses, the European Commission grants central authorisation, national inspectorates (such as IGJ) inspect |
| Devices: 510(k), De Novo or PMA by the FDA itself | Devices: CE marking under the MDR via a notified body |
| Device cybersecurity via section 524B and an SBOM | MDR requirements, and for other products the Cyber Resilience Act |
❓ Frequently asked questions
Does a European company need to register with the FDA?
Yes, if it manufactures, packs or holds food, medicines, medical devices or cosmetics for the US market. Foreign facilities must register with the FDA and appoint a US agent. Food facilities renew that FDA registration every even-numbered year between 1 October and 31 December.
Does every computer system in a pharmaceutical plant fall under FDA rules?
No, FDA rules apply to systems that create GxP-relevant records or that you rely on for quality decisions. An office system with no product impact is out of scope, while an MES with electronic batch records is in scope. Document per system in a risk analysis whether 21 CFR Part 11 applies.
What is the difference between a Form 483 and a warning letter?
A Form 483 is the list of observations an FDA investigator leaves at the end of an inspection, without a final determination. A warning letter follows later if the FDA concludes there are violations of regulatory significance, often because the response to the 483 fell short. A warning letter is published and can lead to an import alert.
Does the FDA recognise European GMP inspections?
For human medicines, yes: since July 2019 the FDA and all EU member states have recognised each other’s GMP inspections under a mutual recognition agreement. No such agreement exists for medical devices or food. In those areas the FDA may still inspect European plants itself.
What cybersecurity requirements does the FDA set for medical devices?
Since 29 March 2023, manufacturers of devices with software that can connect to the internet must submit a plan for monitoring and fixing vulnerabilities, including an SBOM, as part of their premarket submission. The FDA set out its expectations in a guidance updated in June 2025. Without that information the FDA can refuse to accept the submission.
When does the FDA Food Traceability Rule apply?
The FDA Food Traceability Rule was due to take effect on 20 January 2026, but Congress directed the FDA not to enforce it before 20 July 2028. The content is unchanged: you must be able to provide traceability data for foods on the Food Traceability List within 24 hours. That is why it pays to start linking production and lot data now.
📌 In summary
The FDA is the US regulator for food, medicines and medical technology, and its requirements apply to everyone who supplies the US market. For IT/OT systems, this means stricter requirements around validation, Logging, data integrity and Audit trail - essential when producing for the US market.
The FDA governs market approval, inspections and traceability through the FD&C Act and Title 21 of the Code of Federal Regulations. On the plant floor this translates into 21 CFR Part 11, GMP, GxP validation and traceability down to lot level. Building compliance into MES, LIMS, SCADA and historian, rather than documenting it afterwards, puts you in a stronger position at every inspection.