What FDA compliance means
FDA compliance means meeting the requirements the US Food and Drug Administration sets for the products it regulates: drugs, biologics, medical devices, food, cosmetics and tobacco. In practice it means three things: following the regulations for your product type, keeping records that prove it, and being ready for FDA to inspect at any time.
The stakes are rising. FDA conducted “more than 17,000 domestic and international inspections” in fiscal year 2025 (FDA), and CDER warning letters rose 50% that year (RAPS).
The core FDA regulations by product type
| Product | Key regulations | Highlights |
|---|---|---|
| Drugs | 21 CFR 210 and 211 (CGMP) | Quality unit authority, written procedures, investigations, laboratory controls, records |
| Biologics | 21 CFR 600 to 680, plus 210 and 211 | Product-specific standards and licensing |
| Medical devices | 21 CFR 820 (QMSR), 803 (MDR reporting), 806, 807, 830 (UDI) | ISO 13485:2016 incorporated by reference since February 2, 2026 |
| Electronic records (all) | 21 CFR Part 11 | Audit trails, electronic signatures, system controls |
| Clinical research | 21 CFR 50, 56, 312, 812 | Informed consent, IRBs, investigational products |
Part 11 applies across product types. It “set[s] forth the criteria under which the agency considers electronic records” trustworthy and reliable (eCFR).
What changed in 2025 and 2026
- The QMSR took effect for devices on February 2, 2026, incorporating ISO 13485:2016 and opening internal audit and management review records to inspection (FDA QMSR FAQ).
- Unannounced foreign inspections expanded. In May 2025, FDA Commissioner Makary said, “For too long, foreign companies have enjoyed a double standard,” announcing more unannounced inspections abroad (FDA).
- Enforcement rose. Reed Smith counted 327 warning letters between July 1 and December 3, 2025, 73% more than the prior-year period (Reed Smith).
- FDA is using AI. FDA’s Elsa tool is used to “identify high-priority inspection targets” (FDA).
- AI use by companies is now an enforcement topic. An April 2026 warning letter required that AI outputs “be reviewed and cleared by an authorized human representative” (FDA).
- Software validation got lighter where risk is low. FDA finalized its Computer Software Assurance guidance in September 2025 and updated it in February 2026; Hogan Lovells summarizes that “The level of validation effort should be commensurate with the risk posed to product quality and patient safety” (Hogan Lovells).
Building an FDA compliance program
- Map your obligations. List every regulation and guidance that applies to each product, site and activity.
- Build a QMS that meets them, with procedures that state how each requirement is met.
- Control records and data integrity, including Part 11 controls for electronic records.
- Validate systems proportionately, using a risk-based approach for production and QMS software.
- Manage suppliers and contract manufacturers, since FDA holds you responsible for outsourced work.
- Run internal audits and management review that look for problems before FDA does.
- Handle complaints, deviations and CAPA rigorously; these remain the most-cited areas in inspections.
- Track regulatory change and assess the impact on procedures and products.
- Prepare for inspections continuously, not just when FDA calls.
What FDA compliance software should do
“FDA compliance software” covers several tool types. Most companies combine them.
| Tool type | Purpose | Key FDA-related capabilities |
|---|---|---|
| eQMS | Document control, training, CAPA, change, audits, suppliers, complaints | Part 11 audit trails and e-signatures, validation support |
| LIMS and lab systems | Samples, tests, results | Data integrity, audit trail review |
| Regulatory information management | Submissions, registrations, commitments | Tracking of obligations and deadlines |
| Regulatory intelligence | Monitoring new rules and guidance | Change alerts and impact tracking |
| AI document assessment | Checking documents against requirements | Gap findings with cited evidence and human review |
When evaluating any of them, ask how they support Part 11, how the vendor supports risk-based validation, how data is protected, and, for AI features, whether every output cites its source and requires human approval.
FDA compliance checklist
- Applicable FDA regulations mapped by product, site and activity
- QMS procedures address each requirement explicitly
- Part 11 controls in place for electronic records and signatures
- Systems validated proportionate to risk
- Supplier and contract manufacturer controls documented
- Complaints, deviations and CAPA trended and effective
- Internal audits and management review written to be inspection-ready
- Regulatory change monitored with documented impact assessments
- AI tools used in GMP work controlled with human review
- Inspection readiness plan maintained
Check documents against FDA requirements, with evidence
Much of FDA compliance comes down to whether your documents say the right things and your records prove them. AskDona assesses procedures, records and responses against FDA regulations, ISO 13485 or your own checklist and cites the passage behind every finding, so your team can verify and act.
Run a sample FDA compliance assessment on one procedure. AskDona shows the evidence; your team decides.
FAQ
What is FDA compliance? Meeting FDA’s regulatory requirements for your products, keeping records that prove it and being ready for inspection.
What regulations cover FDA compliance for devices? Mainly 21 CFR 820 (QMSR), plus reporting, registration, UDI and Part 11 rules.
What is FDA compliance software? Tools such as eQMS, LIMS, regulatory information systems and AI document assessment that help companies meet and prove FDA requirements.
Does FDA certify software as compliant? No. Companies remain responsible for validating software for its intended use.
How does FDA check compliance? Mainly through inspections, as well as reviews of submissions, reports and records.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA Voices: Inspectional enterprise | Regulator | Aug 3, 2026 | Inspection volume |
| RAPS: CDER warning letters up 50% | Professional body | Dec 4, 2025 | Enforcement |
| eCFR: 21 CFR 11.1 | Regulation | Current | Part 11 scope |
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | QMSR |
| FDA: Unannounced foreign inspections | Regulator | May 6, 2025 | Foreign inspections |
| Reed Smith: FDA inspections in 2025 | Law firm | Dec 2025 | Warning letters |
| FDA: Elsa launch | Regulator | Jun 2, 2025 | AI targeting |
| FDA: AI warning letter | Regulator | Apr 2, 2026 | AI controls |
| Hogan Lovells: CSA final guidance | Law firm | Sep 29, 2025 | Validation effort |