Welcome to Insider issue #48.

Also, hello to the 412 life science professionals who joined us last month. If you haven’t already upgraded to a paid subscription to unlock our in-depth analysis issues like this one, you can do so here. Read our past deep dives here.

This month brings a guidance document that pharma manufacturers have needed for years. Judson Russell walks through the FDA’s finalized guidance on responding to Form 483 observations, a document that started development in 2019 and now provides the clearest template the agency has ever published for structuring your response. This guidance should directly inform your readiness and response playbook.

Jesse Hart tackles the finalized weight loss device guidance that landed on March 13, 2026. After years of inconsistent review outcomes for this device category, the FDA has produced a structured benefit-risk framework with defined indication categories, clinical thresholds, and evaluation matrices.

Our warning letter analysis examines a letter to the maker of an autonomous insulin delivery device that independently determines and commands insulin doses. Michel Moravia dissects the citations across CAPA, risk management, complaint handling, and supplier controls, and explains why this letter signals a new standard of scrutiny for AI-driven medical devices.

Download our slide decks to use any way you’d like:

Read more

This breakdown is available for paid subscribers. Only paid subscribers get regular full access to our breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.

Want to stay out of our warning letter breakdowns? Contact us to access our global network of 3,750+ consultants and 325+ former FDA employees. We run audits, mock inspections, and remediation for 17 of the top 25 life science firms.

On March 25, 2026, CDRH issued a warning letter to a large medical device manufacturer after an inspection conducted on December 1–12, 2025, at a division facility in New York that manufactures cardiovascular procedure kits, including angiographic control syringes and manifolds used for intra-arterial and intravenous administration of radiographic contrast media.

Read the full warning letter

We thought this one deserves a close read because the central finding isn’t a typical missing procedure or an undocumented deviation, but a CAPA that the firm’s own verification-of-effectiveness (VOE) data showed was failing for three consecutive quarters. During that time, according to the warning letter, the firm didn’t route the CAPA back to a previous phase, didn’t open an additional CAPA earlier, and didn’t show the kind of risk/containment response its procedure contemplated when effectiveness checks failed.

The device products in question had a documented failure mode (disconnection from manifolds) that the firm’s own design FMEA identified as carrying “air embolism” as its highest-severity consequence.

The letter also gives an example of a cleanroom cleaning program that didn’t require cleaning the tops of manufacturing equipment, and a design verification exercise for ISO 80369-7 luer connector compliance that tested a single connector to represent a product family without a documented rationale.

Let’s break this one down.

Why this letter has lessons for device firms

Three threads in this letter are worth pulling on before getting into specifics.

1. The CAPA failure described here is one we see pretty often. And it’s the exact failure mode that every CAPA procedure is supposed to prevent: an ineffective corrective action that stays in place because the VOE feedback loop didn’t trigger reentry into the CAPA process. The firm’s SOP required routing back to a previous phase (or opening a new CAPA) when effectiveness checks failed. The trending data showed complaints-per-million exceeding the established threshold in Q1, Q2, and Q3 of 2025. The CAPA was not routed back or supplemented when Q1–Q3 2025 VOE data exceeded the threshold, and the firm did not acknowledge ineffectiveness and open CAPA-02612 until its January 13, 2026 response.

2. The severity calibration issue is important to call out. The firm’s Health Hazard Evaluation rated the risk “low,” but the design FMEA for the same failure mode identified air embolism as the highest-severity outcome. One of the 177 MDRs filed during the complaint window involved air injected into a patient. Another involved biohazard exposure to a clinician. A “low” HHE conclusion sitting alongside a dFMEA that flags the same failure as maximum-severity is the kind of internal inconsistency that tends to unravel the more attention FDA gives it.

3. The QMSR transition language at the end of the letter is worth noting given QMSR is live. The inspection occurred under the old QS regulation, but the FDA explicitly states that any corrective actions the firm proposes or implements must now be pursuant to QMSR requirements that took effect February 2, 2026. This is one of the first warning letters we’ve seen that formalizes this bridging expectation, and it’s a preview of how the agency plans to handle facilities inspected just before the QMSR effective date.

A CAPA that trending data flagged as ineffective for nine months

Let’s run through the sequence here:

• The original CAPA (CAPA-01872 in this case) was opened in June 2023 after a spike in complaints about the subject syringes disconnecting from manifolds, which the firm attributed to excess silicone migrating to the luer connector. The corrective actions were limited: scrapping inventory and increasing the cleaning frequency of a piece of equipment. No design change or field action at that point.

• Between opening the CAPA and the inspection, the firm received 221 complaints and filed 177 MDRs tied to this failure mode including one MDR involving air injected into a patient and one involving biohazard exposure to a clinician.

• The VOE plan, set to start on January 15, 2025, established a threshold of 15.98 disconnection complaints per million (CPM). The actual CPM data for the product manufactured post-corrective action:

  • Q1 2025: 16.90 CPM

  • Q2 2025: 16.44 CPM

  • Q3 2025: 26.81 CPM

• All three quarters exceeded the threshold. The total rate (including pre- and post-corrective-action product) was 39.95, 31.62, and 59.27 CPM for those same quarters.

The firm’s CAPA SOP required that when an effectiveness check fails, or additional root causes are identified, the CAPA “may be routed back to a previous phase or an additional CAPA may be opened,” and that “risk and containment activities must be considered when moving the CAPA to a previous phase.”

But according to the warning letter, none of that happened. The CAPA stayed closed, and no additional CAPA was opened or containment. The FDA noted this explicitly.

The HHE didn’t match the dFMEA

The June 2024 HHE (Qual-124366) concluded the risk was “low.” The design FMEA (RA2022047, Rev. 4) identified “air embolism” as the highest-severity issue for loose connections.

The FDA calls this inconsistency out directly in its letter. It’s the kind of finding that carries implications way beyond this one CAPA because an HHE that doesn’t reconcile with the design risk file undermines every downstream decision that depends on it (like field action scope, notification decisions, recall classification, and CAPA action commensurability).

In this case, the “low” HHE supported corrective actions that the FDA ultimately determined were not commensurate with the actual risk: inventory scrapping and increased cleaning, rather than design change or field action.

“Field notice” to removal, and an HHE that still doesn’t line up

The firm’s January 13, 2026, response acknowledged that the corrective action was ineffective, closed the original CAPA, opened a new one (CAPA-02612), and proposed a field correction with a safety notice rather than a full product removal. The rationale offered was effectiveness of prior communications, an upcoming alternative solution, and the prevention of market shortage.

By February 27, 2026, the firm had revised its plan to a removal, following discussions with the agency. An 806 report was submitted on March 13, 2026.

But the updated HHE (Qual-156459, approved February 26, 2026) still has problems the FDA flags:

• The manufacturing quantities documented in the HHE fall short of the quantities the firm’s own Senior Director of Quality stated during the inspection had actually been manufactured.

• The HHE doesn’t define the manufacturing start date of affected products.

• The HHE specifies a corrective action start date of June 2024, while the warning letter indicates the corrective action began in mid-April 2024 under CAPA-01872.

• No assurance was provided that the removal scope includes devices manufactured both before and after the (ineffective) corrective action.

For CAPA-02612 specifically, the letter says the firm didn’t commit to a timeline for the root cause investigation of the disconnections.

For CAPA-02627 (the systemic CAPA review opened to address the procedural failure), the firm didn’t identify actions that would make sure employees actually route CAPAs back to earlier phases when VOE data shows corrective actions are failing. That’s the procedural gap that allowed the original failure to happen, and it has not been closed.

A cleaning procedure didn’t cover the tops of the equipment

The second observation is narrower in scope but instructive, as we see it in various forms fairly frequently in our own audit and mock inspection work.

The firm’s manufacturing cleaning procedure required top-to-bottom cleaning of controlled environments and cleaning of “all equipment not routinely cleaned by operators.” The associated sign-off sheets listed vents, ceiling lights, walls, benches, cabinets, and fixtures, but didn’t include specific instructions to clean the tops of manufacturing equipment.

On December 1, 2025, the FDA investigator observed visible particulate accumulation on the tops of multiple pieces of manufacturing equipment in cleanrooms. The FDA notes approximately 114 complaints regarding foreign matter or hair in the package or device from December 2023 through at least December 1, 2025.

The firm’s response included ad-hoc cleaning, updated procedures, training, and a determination that validation of the cleaning process wasn’t required.

The FDA’s response is pointed here — pay attention! No corrective actions were identified to assess the impact on products in the field and in inventory manufactured in these cleanrooms since the last documented cleaning of equipment tops on November 26, 2023, nor to review the manufacturing dates of products associated with the 114 foreign-matter complaints as part of those complaint investigations.

This is a retrospective assessment gap. Even if the cleaning procedure is now adequate going forward, the population of products manufactured during the period when equipment tops weren’t being cleaned has not been evaluated, and the complaints associated with that population have not been reinvestigated in light of the new information.

Design verification that tested one connector to represent a family

The third observation is around design verification for ISO 80369-7 compliance across the polycarbonate female luer connector components of the fluid management product lines: stopcock, manifold, disposable transducer, Y adaptor, and so on.

• The design verification protocol listed multiple connectors in its scope but tested only one.

• The protocol contained no documented rationale for why testing a single connector was representative of the others.

• The tested connector was not included in the final version of the design change analysis form that captured all affected connectors.

The firm’s response revised the design verification procedure, added template fields for part-selection rationale, and amended the design change file to include a justification.

The FDA’s assessment of the justification: the “unit rationale” provided fails to explain how design verification testing of the newly cited part covers anything beyond the manifold product family, and does not explain why that part number was not listed in the final design change analysis form that was supposed to capture all luer connectors affected by this design change.

The deficiency here is straightforward and still open in the letter: when a design verification tests a subset to represent a population, the rationale for representativeness has to be documented at the time, grounded in dimensional and functional equivalence, and reconcilable with the design change records.

A retrospective justification that doesn’t actually cover the families in scope doesn’t close the gap.

A few key takeaways

Some important things to consider in light of this letter that has import into similar operations:

• The VOE feedback loop is (arguably) the most important control in a CAPA system, and it only works if the trigger is enforced! The firm had a threshold (15.98 CPM). It had data showing three consecutive quarters above that threshold. It had an SOP that said the CAPA “may be routed back” when effectiveness fails. The permissive language “may” rather than “shall” combined with no enforcement mechanism meant the feedback loop existed on paper but not in practice.

Read more

There are over 400 phase three oncology programs running right now. For dialysis, a therapy that roughly 550,000 Americans depend on three times a week, there’s one.

That’s not a data problem or a science problem. It’s a system design problem, and it sits at the intersection of regulatory uncertainty, a reimbursement structure that discourages innovation, and an investment community that has, reasonably, followed the incentives elsewhere.

Our Nick Capman recently had the privilege of sitting down with John Butler, President and CEO of Akebia Therapeutics, to unpack how the life science industry can overcome the dual challenges of regulatory uncertainty and reimbursement barriers that are stifling innovation and investment in kidney disease drug development (and what recent FDA, CMS, and congressional momentum might mean for the path forward).

John has been working in dialysis and kidney disease since 1991. He joined Amgen in a commercial role shortly after the introduction of Epogen and saw firsthand the impact that innovation could have on the lives of dialysis patients. He spent 13 years at Genzyme, much of it leading the renal division and later running the rare disease business.

He’s led Akebia as CEO for over 12 years, bringing two commercial products to market for dialysis patients: Auryxia, a phosphate binder, and Vafseo, an HIF-PHI for anemia in chronic kidney disease. He chaired the American Kidney Fund (and remains on its board) and chaired Kidney Care Partners, a coalition of manufacturers, providers, physician groups, and patient organizations that has driven the kidney innovation policy agenda on Capitol Hill.

He testified before the House Ways & Means health subcommittee in late March 2026 on dialysis innovation and reimbursement reform. Watch his testimony below.

Apple Podcasts | Spotify | YouTube | Web + Others

John's key insights and practical takeaways

If you’re short on time, here are the most important lessons from the discussion.

• Kidney disease innovation is a tale of two cities. On the rare kidney disease side, there’s been a genuine surge in investment and development over the past five to ten years. IgA nephropathy is the poster child. There was virtually no development activity previously, but once the FDA worked with industry and academics to define a clear path to approvability (including proteinuria as an endpoint), the floodgates opened. There are now four or five approved products and more in late-stage development. A similar dynamic is emerging for FSGS through the Parasol group. On the dialysis side, it’s a desert. One phase three program, compared to 400-plus in oncology. The investment community has followed the incentives, and right now, those incentives point away from dialysis.

• Regulatory clarity is the single biggest driver of rare kidney disease investment. Fifteen years ago, the investment wasn’t there because the regulatory path wasn’t clear. Was proteinuria truly an approvable endpoint? Were you looking at very long, very large trials that made it difficult to justify the capital? The transformation came when the FDA worked with industry, academics, and groups like the Kidney Health Initiative (a partnership between ASN and the FDA) to define clearer endpoints and more pragmatic paths to approval. John gives the FDA significant credit: that clarity is what gave investors the confidence to fund programs, and it’s why the rare kidney disease space is now seeing a level of activity it has never had before.

• Investors are willing to take clinical risk, but they need a clear path to approval and to payment. This is the core tension. When the science works, investors want to believe two things: that there’s a defined regulatory path, and that there’s a sustainable reimbursement mechanism. In rare kidney diseases, both of those are increasingly in place. In dialysis, neither one has been reliable. That asymmetry is a major reason investment has shifted upstream toward rare and pre-dialysis kidney disease.

• The dialysis bundle is structurally hostile to innovation. Dialysis reimbursement is unlike anything else in medicine. Since 2010, all services, supplies, and drugs associated with dialysis have been bundled into a single Medicare payment of about $280 per session. For four hours of intense medical care, three times a week. Dialysis providers have to deliver everything within that number, and introducing an innovative drug on top of it is, as John describes it, functionally impossible. The system incentivizes giving patients as little innovation as possible, because that’s how providers stay in business. In John’s words, dialysis is the only area of medicine where treating everyone the same is the most cost-efficient approach. That’s at odds with every other aspect of medicine today.

• The Corsuva story is a cautionary tale for the entire ecosystem. CMS created TDAPA (Transitional Drug Add-on Payment Adjustment) around 2020 to allow innovative drugs to be used outside the bundle on an ASP basis for two years. The first drug through was Corsuva, from Cara Therapeutics, for uremic pruritus (severe, debilitating itching affecting roughly 50,000 dialysis patients). It was priced reasonably at about $27 per session. But physicians wouldn’t prescribe it during the two-year TDAPA window because they couldn’t start a patient on a therapy and then take it away when the payment mechanism expired. After the two years, the dollars were spread (”peanut buttered”) across every dialysis session nationwide, resulting in an add-on of $0.11 per session. A provider with 60 patients would need to dialyze 250 patients at that rate to cover treating one. Cara Therapeutics essentially wound down the business and reverse-merged. That outcome sent a clear signal to the investment community about the risks of developing for dialysis.

• K-CAPA could be the first real step toward fixing dialysis innovation economics. The Kidney Care Access Protection Act, introduced in both the Senate and House, would make two critical changes to TDAPA: extending the window from two years to three (consistent with every other Medicare special payment program, and reflecting the reality that physicians don’t figure out how to use a product in two years), and shifting from the peanut butter model to a pay-per-use model where providers only receive payment when they actually administer the drug, at a discount. The total cost to the government doesn’t change; the same pot of dollars is just allocated differently. John testified in support of K-CAPA at a House Ways & Means health subcommittee hearing in late March 2026, the first congressional hearing focused on dialysis in at least 20 years. He described the reception as encouraging.

• FDA and CMS coordination is a delicate issue, and John thinks they’re generally better when they don’t try to coordinate. FDA decisions should be based on science and benefit-risk, not on potential costs to the system. What John wants to see is more pragmatism from the FDA — and he’s seeing it. He pointed to the oncology division as one that has always been pragmatic, and noted that the cardiorenal division under Elisa Thompson is increasingly engaged with ASN, KHI, and industry. On the CMS side, the challenge is the uniqueness of the dialysis market: 80% of patients dialyzed by two providers, a payment structure that hasn’t been fundamentally revisited since 1972, and a system that most people involved would like to redesign from scratch but lack the appetite to do so.

• Akebia’s own experience illustrates both the problem and the available remedies. When John joined Akebia in 2013, the company was only developing Vafseo for the non-dialysis population because the board didn’t know how a dialysis product would get paid for. John pushed to expand to dialysis patients, arguing you can’t have a product available before dialysis and not after. Vafseo then went through a Complete Response Letter from the FDA that Akebia disagreed with, and they successfully used the formal dispute resolution process (which John notes he didn’t even know existed after 30 years in the business) to ultimately get the product approved. The experience underscored both the regulatory challenges in dialysis and the tools available when sponsors believe their data support approval.

• Another regulatory friction point: Vafseo, a nephrology drug for anemia, is reviewed by the non-malignant hematology division, not cardiorenal. Having hematologists who don’t specialize in dialysis reviewing a drug for dialysis patients makes the process significantly more challenging. It’s a structural mismatch that adds complexity beyond the science itself.

• The science and the investment landscape are moving upstream, and that’s both good and necessary. Companies, including Akebia, are increasingly investing in rare kidney disease and pre-dialysis interventions. SGLT-2 inhibitors and GLP-1s are showing growing impact on slowing progression to dialysis. Dialysis growth rates are lower than historical norms, partly due to disproportionate COVID mortality among the sickest patients and partly because of genuine therapeutic progress upstream. From a venture and development standpoint, the rare kidney space is attracting more early-stage investment than at any point in the past. John describes it as a golden age of investment in kidney disease therapeutics, driven by the FDA’s work to define approvable endpoints with clarity.

• The whole community needs to keep pushing and there’s a model for how. Kidney Care Partners, which John chaired for four years, brings together manufacturers, dialysis providers, physician groups (ASN, RPA), and patient organizations under one umbrella. When KCP brings something to Congress, it carries the weight of the entire community’s endorsement. Patient advocacy groups — American Kidney Fund, NKF, AAKP, Renal Support Network — are critical not just for financial aid and patient services, but for being present in the legislative process and advocating for policy changes like K-CAPA.

• John is cautiously optimistic about the next decade. The rare kidney disease path is working. The brainpower and capital being committed to kidney disease drug development are at their highest levels ever. If K-CAPA passes and a permanent, innovation-friendly payment is established for dialysis, more products will follow. Emerging science (porcine kidney transplants at Mass General, wearable kidneys, home hemodialysis advances) could further reshape the landscape. The future for kidney disease patients, John believes, has never been brighter. At least since 1972.

John Butler is President and CEO of Akebia Therapeutics, where he has led the company for over 12 years, bringing two commercial products to market for dialysis patients: Auryxia and Vafseo. He has worked in dialysis and kidney disease since 1991, beginning at Amgen after the launch of Epogen and spending 13 years at Genzyme, where he served as President of the Cardiometabolic and Renal Disease division and President of Rare Diseases. John chaired the American Kidney Fund (one of the nation’s largest kidney patient advocacy organizations) and remains on its board, and chaired Kidney Care Partners, a coalition of kidney community stakeholders that has driven innovation policy on Capitol Hill.

Connect with John on LinkedIn here.

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on staff augmentation, auditing, remediation, QMS, and other specialized project work in Quality Assurance, Regulatory Affairs, and Clinical Operations.

With over 3,750 resources worldwide, over 325 of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee.

Here’s why 17 of the top 20 life science firms access their consulting and contractor talent through us:

• Resources in 75 countries and 48 states.

• 26 hours average time to present a consultant or candidate.

• Exclusive life science focus and expertise.

• Dedicated account management team.

• Right resource, first time (95% success).

• 97% client satisfaction rating.

Talk to us when you're ready for a better talent resourcing experience and the peace of mind that comes with a partner whose commitment to quality and integrity reflects your own.

Subscribe to The Life Science Rundown:

Apple | Spotify | YouTube | Web + Others

Check out our newly launched AI-powered QMS audit tool, AICA (the Audit Intelligence Compliance Assistant).

A quick heads up before you dive in: This is a long, in-depth post. Some email providers (including Gmail) may clip it in your inbox. If that happens, just click “View entire message” or “Read on Substack” to see the full article.

Once a quarter, we publish an analysis of the trends we’re seeing in our audit work for clients, so (if you’re a paid subscriber) you can learn and act proactively on what we’re finding across the industry. In this issue, we’re looking at audit reports finalized in Q1 of 2026. Browse past reports here and here.

If you’re a free subscriber, we’ll be cutting off the findings list and a list of questions every firm should be able to answer with documentary evidence at hand. Graduate to a paid subscription here.

Over the first quarter of 2026, our auditors wrapped up a diverse set of engagements spanning sterile pharmaceutical manufacturing, biologics and ADC production, contract testing laboratories, GLP oversight, clinical packaging and storage, medical device contract manufacturing, and computer systems assurance programs, all across five countries.

What struck us this quarter (as it has in the past) wasn’t the severity of individual findings. It was how consistently the same categories of deficiency showed up across completely different facility types, regulatory frameworks, and geographies.

A sterile ophthalmic manufacturer in India, a biologics CDMO in China, and a computer systems assurance program at a U.S. biotech all struggled with the same fundamental challenge: making sure that the documentation presented for inspection accurately reflects what the underlying systems actually contain.

This report synthesizes those findings into practical guidance. We’ve anonymized every example, but we’ve preserved enough operational context that you should be able to see yourself (or your suppliers, or your CMOs) in these scenarios.

Talk to us if you need auditing, mock inspection, remediation, or other RA/QA/Clinical support.

What’s in this dataset

This trends report draws from nine distinct audit engagements completed (or with reports finalized) during January through March 2026. The set includes:

• Routine GMP Vendor Audits (Contract Labs and CDMOs): On-site audits of contract testing laboratories and sterile manufacturing CDMOs in the United States, evaluated against 21 CFR Parts 11, 210, 211, and 820 for analytical services and Blow-Fill-Seal sterile ophthalmic manufacturing.

• Supplier Qualification Audits (Sterile Pharma): First-time qualification audits at sterile injectable and ophthalmic manufacturing sites in India, focusing on aseptic processing, quality management systems, and supply chain oversight under 21 CFR Parts 11, 200, 210, and 211.

• Biologics/ADC CDMO Qualification Audits: On-site qualification audits at biologics and cell bank manufacturing facilities in China providing ADC drug substance, drug product, and cell bank services, assessed against US FDA 21 CFR Parts 11, 210, and 211 as well as EU EMA EudraLex Vol. 4 and associated Annexes.

• GLP Oversight Audits: Remote audits evaluating sponsor oversight of GLP activities delegated to contract research organizations, assessed against 21 CFR Parts 11 and 58.

• Computer Systems Assurance (CSA) Internal Audits: Remote internal audits of CSA programs at U.S. biotechs, evaluated against 21 CFR Part 11, EU GMP Annex 11, and ICH E6(R3).

• Medical Device Mock FDA Inspections: Remote mock inspections of contract manufacturers producing non-sterile medical devices, assessed against 21 CFR Part 820, ISO 13485:2016, and EU MDR 2017/745.

• Routine Monitoring Audits (Clinical Packaging): On-site monitoring audits of clinical and commercial packaging and storage operations at U.S. facilities, evaluated against 21 CFR Parts 11, 210, and 211.

Again, no company or site names are used in the trend descriptions below, and we haven’t added any facts beyond those in the reports. Confidentiality is paramount to us.

Stats and trends at a glance

The dataset:

• 9 audits analyzed across January–March 2026

• 5 countries: United States, India, China, Malaysia, Switzerland (remote)

• Audit types include GMP vendor qualification, supplier qualification, biologics CDMO qualification, GLP oversight, internal CSA audit, medical device mock inspection and routine monitoring.

• Regulatory frameworks include 21 CFR 210/211, 21 CFR 820, 21 CFR 58, 21 CFR Part 11, EU GMP Annex 11, EudraLex Vol. 4, ISO 13485, EU MDR 2017/745, and ICH E6(R3).

Finding severity breakdown:

• Critical findings: 0 (0%)

• Major findings: 10 (20%)

• Minor findings: 20 (40%)

• Recommendations: 20 (40%)

Top finding categories (by % of audits affected):

• Documentation, data integrity, and inspection readiness — 78% (7 of 9 audits)

• Environmental monitoring and contamination control strategy — 44% (4 of 9)

• Aseptic process simulation/media fill deficiencies — 33% (3 of 9)

• Change control and procedural governance — 33% (3 of 9)

• Vendor and supply chain oversight — 33% (3 of 9)

• Training and personnel competency — 22% (2 of 9)

• Facility upkeep and equipment traceability — 22% (2 of 9)

• Batch record and production documentation — 22% (2 of 9)

Repeat findings:

• One audit elevated a Minor finding to Major specifically because it was a repeat finding from the prior audit cycle that had not been corrected.

• Root cause: CAPA from the prior audit was either not implemented or not verified for effectiveness.

Geographic performance:

• United States: Strongest outcomes overall. Four U.S.-based or U.S.-focused audits produced low finding counts and no Major findings related to fundamental system failures. Established CDMOs and contract labs demonstrated mature quality systems. Findings were primarily recommendation-level procedural refinements.

• China: Highest risk. Two biologics/ADC qualification audits at Chinese facilities accounted for 6 of the 10 Major findings (60%) and 19 of 50 total findings (38%). Deficiencies concentrated in clean room design and qualification, environmental monitoring, aseptic process simulation, and cross-contamination control strategy. One facility was assessed as high-risk requiring CAPA submission plus re-audit.

• India: Moderate risk. The sterile ophthalmic manufacturer produced 10 findings including 2 Majors focused on sterilization assurance gaps in the primary packaging supply chain and inadequate buffer preparation controls. Other findings were recommendation-level.

• Malaysia: The medical device mock inspection produced 1 Major and 4 Minor findings. Change control governance, documentation integrity, incoming material controls, training, and CAPA effectiveness were all flagged.

A few patterns of problems:

• Initial supplier qualification audits at emerging-market sterile/biologics facilities carry the highest risk. The three qualification audits at facilities in China and India accounted for 29 of 50 total findings (58%) and 8 of 10 Majors (80%).

• A PDF report rendering from electronic validation systems can create ALCOA+ gaps even when the underlying data is correct.

• Contamination control strategy documentation is lagging behind EU Annex 1 (revised 2023) expectations at multiple facilities.

• Repeat findings are being escalated in severity. Sponsors and auditors are treating unresolved prior observations as Major.

• SOPs referencing obsolete system names or platforms create unnecessary procedural compliance failures.

What’s working:

• Zero critical findings across the entire dataset.

• One audit (GLP oversight) produced zero findings of any kind (clean across all categories).

• Strong contamination control strategies at established U.S. sterile CDMOs.

• Mature data integrity governance and audit trail review programs at validated electronic systems.

• Well-structured validation lifecycle management platforms demonstrating scalable risk-based approaches to computer systems assurance.

• Open, responsive engagement from audit hosts at closing meetings.

Below, we expand on the themes we actually saw in the reports. For each, you’ll find: what we observed, how often, representative examples (generalized to protect identity), and prescriptive actions you can take.

1. Documentation, data integrity, and inspection readiness were the biggest gaps (again)

This cluster of problems sits at the top of the list every time we trend this data. This time, it was a problem in 7 of the 9 audits. If there’s one consistent message from the issues we see here, it’s that the gap between “the data is correct” and “the data is inspection-ready” remains wider than most teams realize.

This came up all over the place: sterile manufacturers, biologics CDMOs, contract testing labs, and even at a mature U.S. biotech with an otherwise well-designed validation lifecycle management program.

And to be clear, the underlying systems of record were generally sound. What broke down was the layer between those systems and the artifacts an auditor or inspector actually reviews. The printed PDFs, the exported spreadsheets, the attached printouts in batch records, and the SOPs that describe how all of this is supposed to work.

The specific failures took different forms depending on the facility, but they generally shared a common root cause: nobody had stress-tested whether what came out of the system would hold up under scrutiny, even when what was in the system was complete and accurate.

It’s the kind of gap that doesn’t surface as much during routine operations because internal users know the workarounds. It usually only becomes visible when someone external, like an auditor, an investigator, or a new customer, asks for evidence and discovers that the evidence has problems the facility had grown accustomed to ignoring.

What we found:

• Truncated PDF outputs from electronic systems: At one facility, PDF exports from a validation lifecycle management platform consistently produced data tables that were cut off. The reports were generated in portrait format, but the tables within them were landscape, resulting in truncated and obscured data across all seven system periodic review reports provided during the audit. A traceability matrix had an entire column cut off. Executed test scripts had comments fields left blank instead of recording “N/A.” The underlying system of record showed the data as complete, but the rendered PDFs (the artifacts an inspector would actually review) failed ALCOA+ requirements. This was graded as Minor only because the system of record was intact, but the auditor explicitly noted that an inspector requesting only PDF exports would encounter incomplete evidence.

• Unreviewed raw data provided as audit evidence: At the same facility, spreadsheet exports were provided to the auditor in raw form with no evidence of review or approval. One exported worksheet was so large it couldn’t even be previewed, displaying only a message that the sheet was “too large to be previewed” and directing the user to download the file. Providing unreviewed raw data as audit evidence, rather than reviewed and approved reports, creates both a data integrity risk and an inspection-readiness gap. (We’ve seen this before.)

• Blank fields in batch records and production documentation: At a sterile drug manufacturer, assembly and packing batch records contained numerous blank fields within in-process inspection and quantity reconciliation sections, making it unclear whether activities were performed or were simply not applicable. At a medical device CMO we audited, the same pattern emerged: operators used a “–” symbol in unused fields, but its meaning wasn’t defined anywhere in the document control procedures. These are the kinds of findings that individually seem minor, but collectively paint a picture of documentation discipline that an investigator will likely notice.

• Weighing slips without equipment traceability: At one sterile pharma site, weighing slips didn’t carry the balance identification number, and a weighing balance was not set up with LIMS despite site presentations claiming that all balances were integrated. Without a balance ID on the slip, the data isn’t fully attributable to a specific, calibrated piece of equipment (a basic ALCOA+ failure).

• SOPs referencing obsolete systems: At a contract testing lab, a training SOP still referenced the legacy QMS by name, even though the electronic learning management system had been transitioned to a different platform. The training itself was being conducted correctly on the new system, but the SOP was wrong. It’s a procedural compliance failure that’s trivially easy for auditors and the FDA to document if they find it.

• Batch record printouts not properly attached or initialed: At a sterile CDMO, air filter test result printouts were found loose and not appropriately attached to the executed batch record sections where they belonged. The printouts also weren’t initialed and dated across the attachment pages per Good Documentation Practice. The auditor flagged this as a potential data integrity issue: if these raw data printouts were ever lost, the batch record would be incomplete!

• Outdated Site Master File layouts: At one biologics facility undergoing qualification, the floor layouts in the Site Master File were outdated, reflecting an earlier facility configuration rather than the current state.

Both auditors and actual FDA investigators routinely cross-reference what’s in the system of record against what appears in printed reports and batch records. A facility whose underlying data is good but whose outputs are truncated, incomplete, or improperly attributed creates the impression of weakness that can color an entire inspection outcome. Don’t give them strings to pull on!

A few recommendations:

• Make sure every PDF rendering from your electronic systems (validation platforms, LIMS, ERP, document management) produces complete, legible outputs that meet ALCOA+ requirements. Don’t assume that because the system of record is correct, the PDF exports are too. Print every report format your system can generate, and check it visually if needed.

• Establish a clear policy: raw data exports are never provided as audit or inspection evidence unless they have been formally reviewed and approved. All evidence packages should consist of approved reports or approved exports with documented review. This is basic good practice we see teams stumble on often.

• Reinforce GDP training with emphasis on “why” rather than just “what.” Operators should understand that blank fields create traceability gaps, not just procedure violations. Where fields are not applicable, require “N/A” entries per your SOP and enforce it during batch record review.

• Audit your SOP-to-system alignment at least annually. Every SOP that references a system, template, or platform by name should reference the current system. When systems are migrated, add SOP updates to the migration project plan, not as an afterthought.

2. Environmental monitoring and contamination control strategies showed broad vulnerability

The four audits that flagged EM/CCS issues accounted for most of the Major findings in the dataset. And while “only” four audits flagged EM or CCS issues, those four were concentrated in exactly the facility types where these controls matter most: sterile injectables, ophthalmic preparations, and biologics drug product manufacturing.

The pattern across these audits points to something a little bigger than isolated procedural lapses. EU Annex 1 was substantially revised in August 2023, raising expectations for formal contamination control strategy documentation, dynamic monitoring approaches, and risk-based justification of clean room design choices.

The facilities we audited here (particularly those undergoing initial qualification) hadn’t fully closed the gap between their existing programs and the revised expectations.

In some cases, the strategies existed but were incomplete. In others, the monitoring approaches predated the revised guidance and had not been updated. And in a few cases, core design choices had been made without the documented risk-based rationale that current expectations require.

That all boils down to facilities with otherwise functional aseptic operations, as documented and justified in design, even when their day-to-day execution looks reasonable.

What we found:

• Incomplete contamination control strategy: At a biologics CDMO, the cross-contamination control strategy for the drug product area was not fully implemented. There was no documented justification for an atypical pressure-differential configuration in the filling area. The configurations were unusual and would require explicit risk-based justification, but none was available.

• Clean room design not aligned with Annex 1: At a cell bank manufacturing facility, the liquid-filling clean room was constructed as Grade-A with a Grade-C background, not aligned with Annex 1's expectation for Grade-A within Grade-B for aseptic processing. Also:

  • The CCS strategy did not address airborne cross-contamination in both powder- and liquid-media filling areas.

  • Wall and ceiling joints were not fully sealed, leaving uncleanable crevices. There was no concept of bioburden or equivalent testing at the site.

  • EM monitoring stands in the sterility test lab were positioned above working height, making the monitoring results unrepresentative of the actual working environment.

• Routine requalification gaps: At that same facility, routine requalification for Grade-A areas did not include tests for pressure differentials, viable particulate counts (VPC), clean-up rate, or air volume, and none of the testing that was conducted was performed under dynamic conditions. The requalification frequency for Grade-C was set to yearly, even though it supports Grade-A areas.

• APQR missing water and EM trend reviews: At a sterile drug manufacturer, the Annual Product Quality Review did not address WFI test results for any of the batches produced during the review period. Trends concerning WFI, Purified Water, and Pure Steam were not reviewed in the APQR. Environmental monitoring trends were also absent. For preparations where WFI is a critical component, this was a significant gap in product quality trending.

• Pure steam condensate not evaluated: At the same site, during the qualification of steam sterilizers, the pure steam condensate was not evaluated for compliance with WFI quality standards after sterilization. Because pure steam comes into direct contact with critical surfaces, its condensate must meet pharmacopoeial WFI requirements to ensure sterility assurance.

EU Annex 1 Section 4 now requires a formal, documented Contamination Control Strategy! Facilities that haven’t completed their CCS, or whose CCS doesn’t cover pressure differential rationale, clean room design justification, and EM approaches under dynamic conditions, are exposed.

• If you haven’t already, complete a formal Contamination Control Strategy document that covers every element listed in EU Annex 1, Section 4. Don’t limit it to aseptic areas; include your supporting Grade-C and Grade-D environments, your clean room design rationale, and your pressure cascade justification.

• Make sure your EM program includes dynamic monitoring. Static-only requalification data is insufficient for Grade-A areas per current Annex 1 expectations. Verify that monitoring locations, including EM stand heights, represent actual working conditions.

• Incorporate WFI, Purified Water, Pure Steam, and EM trending into your APQR. If these aren’t explicitly required by your APQR template, revise the template now.

• Validate pure steam condensate quality against WFI pharmacopoeial standards during sterilizer qualification. This should be part of your standard sterilizer qualification protocol.

3. Aseptic process simulation (media fill) deficiencies kept coming up

Media fill findings showed up at three different facilities across three different countries this quarter, which is worth pausing on.

The sites that struggled here ranged from a newly qualified cell bank operation to an established ophthalmic manufacturer to a biologics drug product CDMO. What they had in common was a willingness to treat aseptic process simulation as a procedural exercise rather than a genuine challenge of worst-case conditions.

This raises a question that every aseptic manufacturer should ask: Does our media fill program actually simulate the conditions, operators, interventions, and materials used in routine production, or does it simulate an idealized version of those things?

The specific deficiencies we found (operator participation gaps, smoke studies under static rather than dynamic conditions, container-closure systems that didn’t match production) all share the same underlying pattern. The simulation was easier or cleaner than reality, which means the simulation didn’t actually validate reality. Regulatory expectations on this point have been consistent for years, and the FDA knows how to look for the specific gaps that distinguish a rigorous APS from a procedural one. (Keep in mind they read this newsletter, too, so we’re bringing these things to both sides’ attention.)

What we found:

• Operator participation gaps in media fills: At a cell bank manufacturing facility, not all qualified operators participated in the aseptic process simulation exercise, and not all routine interventions were included or challenged. Approved intervention times weren’t defined either. These kinds of gaps undermine the purpose of the media fill: demonstrating that all operators can perform all routine interventions within defined timeframes without compromising aseptic conditions.

• Smoke study deficiencies: At the biologics CDMO, the smoke study for a filling isolator wasn’t conducted under dynamic conditions — only under static conditions during OQ (when not even all equipment was installed). The smoke generator handle was also too small, requiring the operator to enter the filling area to pump smoke. On top of that, the smoke concentration was low, and the flow pattern at the bottom of the filling area was unclear. We didn’t see any critical interventions challenged during the smoke study, and the timelines for interventions weren’t being clearly tracked for start and end times.

• Container mismatch between media fill and routine production: At the sterile manufacturer, the media fill validation used primary packaging containers from one supplier, while routine production used containers from a different supplier. A mismatch here raises questions about the representativeness of the simulation: the container-closure system affects fill parameters, sealing characteristics, and handling during aseptic processing. Regulatory expectations generally require that media fill use the same type and source of containers used in routine production, with documented risk assessment and justification if they differ.

The FDA’s process validation guidance and EU Annex 1 both emphasize that aseptic process simulation should be representative of actual manufacturing conditions. Media fills that don’t include all qualified operators, all routine interventions, and the actual container-closure system used in production are vulnerable to challenge.

• Require that every qualified aseptic operator participate in at least one media fill per campaign or per defined interval. Track participation and flag anyone who’s overdue.

• Define and document your approved intervention types and maximum allowable intervention times in your aseptic processing SOP. Media fill protocols should explicitly list which interventions will be simulated and the acceptance criteria for timing.

• Run your smoke studies under dynamic conditions with all equipment installed and operational. Document smoke concentration, flow patterns, and intervention challenges with video evidence.

• Align your media fill container-closure system with routine production. If you have to use a different supplier’s containers, perform and document a formal risk assessment justifying the deviation and demonstrating material equivalence.

4. Change control and procedural governance gaps were consequential

Change control findings appeared across very different operational contexts this quarter in three of the nine audits: a medical device CMO, a clinical packaging facility, and a U.S. biotech’s internal computer systems assurance program.

But the underlying weaknesses, again, were strikingly similar. In each case, the change control framework existed and was generally followed, but the governance around the framework had gaps that allowed changes to slip through with insufficient rigor or to persist longer than intended. Again, something is written, but not actually operationalized.

Read more

These RA/QA news rolls are available in full only to paid subscribers. Upgrade here.

This is our biweekly recap of news and industry happenings curated for our paid subscribers. Our goal is to bring you the headline news and the stories, research, and insights that might be harder to find.

If you haven’t upgraded to a paid subscription yet, you can do so here. Also, make sure to follow us on LinkedIn and catch the latest episodes of our podcast, The Life Science Rundown.

Here are some key items from the past couple of weeks.

💊 = Pharma, biologic, and biotech.
💉 = Medical device, medtech, diagnostics, and digital health.

FDA Leadership and Administration

• MAHA poll puts pressure on Makary and Kennedy — A new POLITICO poll found that 41% of Trump voters believe the president has not done enough to advance the Make America Healthy Again agenda, compared to 40% who feel he has. Overall, 52% of all respondents felt Trump had not done enough. The results are likely to put pressure on HHS officials, including Secretary Kennedy and Commissioner Makary, to take more visible action on MAHA-related issues, though such actions could risk angering traditional Republican constituencies opposed to increased regulation.

• HHS Chief Counselor acknowledges FDA turnover concerns — At the STAT News Breakthrough Summit East, HHS Chief Counselor Chris Klomp offered notable remarks on turmoil at the FDA, stating that high-performing teams require trust built over time. He acknowledged that if the agency’s staff “replenishment rate” is exceeded, it takes longer for teams to work well together and drive reform. His comments suggest that HHS leadership is aware that senior-level turnover is affecting the FDA’s ability to meet reform objectives.

• Washington Times editorial board has it out for Makary — The Washington Times’ editorial board published a scathing editorial pointing to a lengthy list of managerial issues that it says are undermining public confidence in the agency and not meeting the needs of President Trump.

• FDA rushes compounding information collection through White House 💊 — The White House signed off on an extension of an information collection related to 503A and 503B compounding pharmacies after the FDA acknowledged that staffing adjustments had significantly impacted its ability to publish documents in the Federal Register on time, an unusual admission of procedural disruption caused by workforce reductions.

FDA General

• Public hearing announced for CNPV program 💊 — The FDA announced it will hold a public hearing on June 12 to solicit feedback about the Commissioner’s National Priority Voucher program. A Federal Register notice provided additional details, including that the one- to two-month review targets do not include prefiling reviews. Requests to speak are due May 1, and comments will be accepted through June 29. Given the significant scrutiny this program has received, the hearing is expected to draw substantial public interest.

• FDA pushing mass transition to nonprescription drugs 💊 — The FDA is signaling that efforts to move prescription drugs to over-the-counter status are likely to accelerate. On April 23, the agency will host a public meeting at the National Press Club on increasing access to nonprescription drugs, seeking input from drug developers, healthcare professionals, and consumers on practical considerations that shape nonprescription drug access.

• FDA reclassifies melanoma detection devices 💉 — The FDA announced it is reclassifying optical skin lesion analyzers for detecting melanoma from Class III to Class II, allowing the devices to be marketed through the less burdensome 510(k) pathway rather than Premarket Approval. The devices are also being renamed as “software-aided adjunctive diagnostic devices for use on skin lesions.”

• AI to accelerate drug filing reviews by up to 25% 💊 — Commissioner Makary indicated at the American Health Insurance Providers conference that the FDA plans to use artificial intelligence to dramatically shorten the two-month “filing review” period that precedes the formal review of new drug applications. An FDA spokesperson confirmed that a successful pilot demonstrated this step could be reduced from months to minutes, potentially accelerating standard drug approvals by roughly 17% (from 12 months to 10) and priority approvals by 25% (from eight months to six).

• OMUFA facility fees drop by nearly 50% 💊 — Facility fees under the FDA’s Over-the-Counter Monograph User Fee Program for fiscal year 2026 are decreasing by approximately 49% compared to the prior year. Monograph drug facilities will be assessed $19,188, while contract manufacturing organizations will be assessed $12,792. The decrease is driven by the removal of supplementary adjustments that were initially intended to launch the program.

• New nonanimal testing guidance released 💊 — The FDA published a new draft guidance on New Approach Methodologies (NAMs), titled “General Considerations for the Use of New Approach Methodologies in Drug Development.” The guidance describes how drug developers can validate the use of non-animal testing approaches, including defining a test’s context of use, biological relevance, and fitness for purpose. Notably, the guidance does not apply to biologics. Separately, the NIH announced a $150 million investment to develop and scale NAMs.

• FDA proposes reclassification of tuberculosis diagnostic tests 💉 — The FDA proposed reclassifying two types of tuberculosis diagnostic tests — cell-mediated immunity tests and cell-mediated immune response enzyme-linked immunospot tests — from Class III to Class II, which would allow them to be marketed through the 510(k) pathway.

• FDA classifies blood irradiator devices 💉 — The FDA proposed classifying blood irradiator devices under Class II for products intended to prevent transfusion-associated graft-versus-host disease and Class III for those intended to prevent metastasis.

• New guidance on topical drug product characterization 💊 — The FDA published a final guidance on physicochemical and structural (Q3) characterization of topical drug products submitted in abbreviated new drug applications. The guidance describes how generic drug developers can demonstrate sameness, similarity, or difference in Q3 attributes between test products and reference standards, particularly for topical products, where achieving the same look and feel as a reference product can be challenging.

• Revised Q&A guidance on pyrogen and endotoxin testing 💊 — The FDA issued a revision to its 2012 final Q&A guidance on pyrogen and endotoxin testing, updating the agency’s expectations in line with revised U.S. Pharmacopeia publications and offering recommendations on reagents not derived from animals. The revision aligns with the FDA’s broader push to reduce reliance on animal testing.

• Patient preference guidance clears White House review 💉 — The FDA’s long-awaited update to its 2016 guidance on the regulatory use of patient preference information was s published on March 27. The guidance, a commitment under MDUFA V, provides updated recommendations for companies that want to provide the FDA with information on patients’ treatment preferences, including how to design studies, obtain FDA feedback, and include that information in device labeling.

• Final guidance on weight-loss devices published 💉 — The FDA published a final guidance combining two earlier draft documents on premarket considerations for medical devices with indications for weight loss, with updates touted as part of the Make America Healthy Again agenda.

• CBER director position posted 💊 — With CBER Director Vinay Prasad set to step down in April, the FDA posted the position on USAJobs, with a salary range of $301,825 to $400,000 per year. Applications are open through April 3.

• Top infectious disease regulator departing 💊 — Adam Sherwat, director of CDER’s Office of Infectious Diseases, is set to leave the FDA on April 4. Andrew LeBoeuf, CDER’s associate director for regulatory strategy, will also depart in early April.

• Generic drug approvals for February 💊 — The FDA’s Office of Generic Drugs approved 64 new generic drugs in February, the highest monthly total so far this fiscal year, including six first-time generics. Another 26 generics received tentative approval.

• FDA’s real-time surveillance wish list 💊 💉 — A new contracting notice from the FDA indicates the agency is seeking commercial capabilities for real-time or near-real-time safety signals to complement its existing surveillance systems, including Sentinel and the Adverse Event Reporting System. Commissioner Makary has indicated that enhanced surveillance capabilities could support faster approvals using single-trial approaches.

• Ideas for the plausible mechanism pathway 💊 — A new paper authored by former FDA Commissioner Scott Gottlieb and Morgan Lewis law partner Maarika Kimbrell argues that the FDA should better define regulatory boundaries for grouping multiple genetic variants under a single approval within the plausible mechanism pathway. They also call for greater clarity around manufacturing personalized therapies and more information about how the FDA plans to extrapolate safety and efficacy beyond submitted data.

• FDA rejects superhuman drug pathway and one-year cancer trial limit 💊 — The FDA rejected two citizen petitions from Age Reversal Unity’s Ali Afshar, one requesting a regulatory pathway for drugs intended to produce “superhuman” enhancements and another seeking to limit all cancer clinical trials to a maximum of one year. The agency said its current regulatory pathways are sufficient to evaluate drugs with structure/function claims and that a one-year trial limit would be contrary to public health.

• De Novo authorization for choking rescue device 💉 — The FDA granted a De Novo request for the LifeVac device as a second-line treatment for choking, establishing a new Class II device category. The authorization was accompanied by an FDA safety communication reminding the public of established choking rescue protocols, specifying that anti-choking devices should be used only after unsuccessful basic life support measures.

• FDA says alternative funding programs cannot import drugs 💊 — The FDA responded to a 2024 citizen petition, clarifying that so-called “alternative funding programs” — third-party companies that partner with employer-sponsored health plans to require employees to import prescription drugs from outside the U.S. — are not permitted to import drugs under the agency’s importation programs.

• FDA conference on innovative regulatory strategies — The FDA announced it will hold a conference on May 19-20 focused on innovative regulatory strategies to advance medical products, covering advanced drug manufacturing, artificial intelligence, digital health technologies, and analytical methods for benefit-risk determinations.

• Upcoming webinar on blood and plasma applications 💊 — The FDA announced plans to hold a webinar on May 12 focused on its review of biologics license applications for blood and source plasma.

Compliance and Enforcement

• Unannounced foreign inspections increased 45% in FY 2025 💊 💉 — In response to questions from POLITICO’s AgencyIQ, the FDA reported that it conducted 233 unannounced foreign inspections in fiscal year 2025, approximately 45% more than the 161 conducted in FY 2024. Despite the increase, about 90% of the agency’s 2,370 foreign inspections in FY 2025 were still declared beforehand. Inspections took place in at least 21 countries, including China and India, though about three-quarters involved food or cosmetics facilities.

• Warning letters now include photographic evidence 💊 💉 — A warning letter to Patcos Cosmetics of India referencing an unannounced inspection included photographic evidence of unsanitary conditions at the facility, something not previously seen in FDA warning letters. While the photos were partially redacted, the inclusion signals that the agency sees value in releasing visual evidence in select enforcement actions.

Read more

We recently published an explainer on how embedding a QA consultant can be a more attractive alternative to hiring an FTE for a long-term project need. Today, we’re publishing the companion piece to that: a real-world case study of that model in action.

Here’s a look at what staff augmentation actually looks like in practice:

About two years ago, a biologics manufacturing facility was scaling production to meet surging demand. New personnel were coming on fast, but the training and oversight to support that growth weren’t keeping pace. The deviation log swelled to 80 open events. Extensions started piling up, and regulators took notice.

It’s a pattern we see regularly across the industry, and the path back to control often requires dedicated, experienced resources that the internal team simply doesn’t have bandwidth to provide.

Learn more about our staff augmentation services »

The problem

The biologics facility was struggling with its deviation program. The site was an older facility that had changed hands multiple times and was now manufacturing injectable products. The increase in production brought in a wave of new floor personnel, but again, the Quality infrastructure didn’t keep pace.

By the time the firm acknowledged it had a problem, the deviation log had ballooned to roughly 80 open deviations at any given time, with more opening almost daily. Extensions were common, creating a backlog that was compounding.

The volume and extensions had drawn the attention of regulatory authorities. There were no warning letters or official sanctions, but the message was clear: you have too many open deviations and too many extensions. Get this under control.

What was driving the problem

The deviation backlog, we came to learn, was the product of several systemic problems reinforcing each other:

• Training was inadequate. The facility had expanded production and brought in a large number of new manufacturing personnel, but the training had not kept up. Staff were creating avoidable deviations because they didn’t fully understand the processes or their documentation responsibilities. Supervisors weren’t consistently present on the manufacturing floor to prevent those issues.

• There weren’t enough trained deviation writers. The people who could actually investigate and write up deviations were a small group, and the workload overwhelmed them.

• There was no agreed-upon process for handling deviations. No standardized timelines, no stage gates, little to no metrics, and no daily accountability. Deviations would often get opened and then sit, sometimes because the writer didn’t have the batch records or documentation needed to investigate, sometimes because no one was tracking where things stood.

• Deviation management was ad hoc. Getting essential documentation (batch records, personnel interviews, photos) required individuals to chase down staff on their own, with no system for escalation or follow-up.

The combination of all of these issues created a self-reinforcing cycle: new deviations piled on top of old ones, the backlog prevented CAPAs from being initiated, and without CAPAs addressing root causes, the same problems kept generating new deviations.

Our approach and solution

The firm decided to form a dedicated deviation team: a group pulled from different parts of the organization, supplemented by external contractors, whose sole job was to attack the backlog.

Through us, they brought in a senior Quality consultant with over 30 years of experience across medical devices and pharma, including deviation management, complaint handling, root cause analysis, and regulatory operations at multiple large manufacturers.

He was writing deviations by day three, initially working on-site full-time.

As relationships deepened and he built fluency with the site’s systems, the arrangement shifted to a hybrid schedule: a few days on-site, a few days remote. The engagement ran from start to finish for nearly two years, marked by several extensions.

The work projects

Our consultant’s first priority was getting organized. The deviation program lacked basic structure, so he helped build it:

• A stage gate system was established to track each deviation through defined stages: initial information gathering, classification as major or minor, investigation, peer review, QA review and approval, and closure. Each stage had specific timeframes within a 35-day target. Minor deviations were expected to be ready for QA approval by day 10. Majors by day 20. The remaining days provided a buffer for revisions.

• A daily management meeting was implemented. If a deviation was on schedule, the writer didn’t need to attend. If it was behind, the writer had to report, not for punishment, but for support. The meeting’s purpose was to remove roadblocks: Do you have the batch records you need? Do you need to interview someone on the night shift? Can someone else take one of your assignments? The posture was “how can we help,” not “why aren’t you done.”

• Getting the right information to deviation writers faster turned out to be one of the most consequential improvements. The consultant estimated that 10-20% of the 35-day timeline was being consumed just getting the initial documentation needed to understand what had happened. Batch records were missing. Photos were not taken. Details from the manufacturing floor were incomplete or vague. So, he put in place a system to surface these needs in the daily meeting and assign someone to deliver them, rather than leaving each writer to chase information independently.

• Extensions, which had previously been granted almost automatically, now required the writer to present to the VP and senior staff with a formal explanation. Legitimate reasons, like waiting for lab results from an external facility or pending stability data, were accepted, while solvable reasons were addressed.

• Manufacturing support personnel and QA were put on call on the production floor alongside manufacturing staff. When something went wrong, they were there immediately, intervening early, before a small issue became a formal deviation. This was preventive, not reactive, and it reduced the rate of new deviations entering the system.

The deviation work itself spanned the full range of issues that arise in a biologics manufacturing environment. Some were serious, such as leaks that caused contamination events requiring large-scale decontamination of the production suite.

Others were systemic: an external cleaning contractor mixing solutions to the wrong concentrations, requiring a multi-month look-back across every formulation they had handled. Or equipment calibration records that had lapsed, forcing a retrospective review of every batch manufactured since the last verified calibration, using ancillary data like conductivity and pH to confirm the product was within specification.

And many were seemingly minor, but important indicators of a need for improvement: a missed signature, a calculation error, a verifier who did not sign off. Simple to describe, but each one still consumed a day or more of a trained deviation writer’s time to properly investigate and close. They were expensive mistakes, and many were preventable with better training and floor supervision.

The results

Over the course of the engagement, the facility’s deviation posture changed materially:

• The number of open deviations at any given time fell from roughly 80 to around a manageable 20. The number of extensions dropped dramatically, and those that remained were justified by legitimate external dependencies (lab results, stability studies, outside testing), not by internal delays or disorganization.

• The stage gate system and daily management meeting that the consultant helped establish were adopted by senior leadership and formalized across the organization, with specific timeframes codified for each stage of the deviation lifecycle. What started as an improvised structure within the deviation team became the facility’s standard operating approach.

• Manufacturing support and QA personnel on the production floor reduced the rate of new deviations being generated. CAPA implementation and follow-up improved as the deviation backlog cleared and freed up bandwidth for preventive work. The internal team had more trained deviation writers, a clearer process, and a management structure that held people accountable without creating a “punitive” culture.

• The consultant outlasted several different managers during his time at the facility — a reflection of the organizational turbulence common at fast-growing companies and the stabilizing effect of having a consistent, experienced practitioner embedded in the work. Client feedback throughout the engagement was consistently positive. When the organization conducted a large-scale restructuring and released most of its contractors, he was one of the last to leave.

The takeaway

This staff augmentation engagement illustrates a situation that many manufacturers find themselves in: a quality system that was adequate at one production volume is no longer adequate at a higher one, and the internal team does not have the bandwidth or, in some cases, the specialized experience to dig out from under the deviation accumulation while also running day-to-day operations.

Bringing in an external practitioner (someone free of internal politics, institutional baggage, and organizational typecasting) provided the facility with both the technical capacity to clear the backlog and the fresh perspective to identify and address the systemic issues that created it.

Rather than “advising from the outside,” he was embedded in the operation: writing deviations, attending daily meetings, and building the relationships necessary to get things done inside a complex organization.

Critically, he also became a certified trainer and mentor to both internal staff and other contractors, transferring investigation methodologies, writing standards, and root-cause analysis techniques to on-site full-time employees. That knowledge transfer expanded the pool of capable deviation writers at the facility, directly reducing the burden on the small group of overloaded investigators who had been carrying the program before his arrival. The technical capacity he brought was immediate. The expertise he left behind was lasting.

Firms in this situation sometimes hesitate to bring in outside help because they view it as an admission of failure. In practice, it’s exactly the opposite!

Recognizing that a compounding problem requires dedicated, experienced resources (and acting on that recognition quickly) is what we see separate organizations that regain control from those that let the backlog define them.

We regularly deploy senior Quality, Regulatory, and Compliance consultants to life sciences organizations through staff augmentation engagements that integrate strategic practitioners directly into operations. To discuss whether this model fits your situation, contact our team.

Staff augmentation services

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.

With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.

Share The FDA Group's Insider Newsletter

We’re currently working on a new client case study that charts the path of a consultant we embedded in a pharma company for over a year to address a backlog of deviations and the problems that allowed it to emerge in the first place.

Long story short, a large pharma was scaling production of a high-demand drug and found that deviations were outpacing the internal team’s capacity to close them. We embedded a senior deviation specialist on-site, focused on the most complex major deviations requiring thorough root cause analysis.

Over a year, he cleared the critical backlog, became the de facto trainer for other staff on the deviation program, and outlasted multiple different managers at the site. By the time he wrapped up, the system was running smoothly, and the site had regained control.

While we work on telling that story, we first want to talk about this model in general, since it’s worked so well for situations like these across hundreds of firms.

There’s typically a pattern we see over and over in pharma and device manufacturing:

1. A product goes to market.

2. Demand surges.

3. Production scales up.

4. And then the quality system starts to buckle. Not because anything is fundamentally broken, but because the sheer volume of manufacturing activity generates more deviations, more CAPAs, more investigations than the existing team was ever sized to handle.

A backlog quietly grows and fires start: Major deviations sit open longer than they should, while root cause analyses get delayed. Regulatory risk compounds in the background. And the Quality leadership team, already stretched managing day-to-day operations, doesn’t have the bandwidth or frontline people-power to dig out.

We’ve now supported dozens of teams through exactly this scenario. And one of the most effective interventions we’ve seen (arguably the fastest path back to control) is embedding a senior Quality consultant directly into the operation through staff augmentation (a full-time contractor).

This is not a team of auditors parachuting in for a week, nor is it a gap assessment with a slide deck. It’s a single, highly skilled practitioner or small team who show up, integrate into your team, and start closing deviations on day one.

Learn more about our staff augmentation services »

What "embedding" a consultant actually looks like

Staff augmentation isn’t new in the life sciences, but the mechanics of how it works in practice are worth spelling out because the model is different from typical project-based consulting.

When we embed a consultant, they functionally become part of the client’s RA/QA organization.

• They report to an on-site manager who has contact with one of our project managers.

• They follow the SOPs.

• They attend the team’s meetings and use the systems.

• From the outside, they’re generally indistinguishable from an internal employee, except they bring a depth of specialized experience that’s extremely hard to recruit for on a permanent basis.

The engagement typically starts with a full-time on-site presence. In manufacturing environments, that matters! When you’re investigating a deviation tied to a batch record issue or an equipment failure, being able to walk down to the production floor, talk to the operators, and see the process firsthand is very different than trading emails over the course of a week thousands of miles away.

As the consultant builds relationships and becomes fluent in the site’s systems, the arrangement might shift to a hybrid model, depending on the work: a few days on-site, a few days remote, which keeps institutional knowledge flowing while giving the consultant focused time for investigation, writing and root-cause work.

Our contract structure is straightforward: an initial engagement period of typically three to six months, with extensions as the scope of work evolves. In our experience, extensions are the norm rather than the exception.

Once teams see the impact of having an experienced specialist embedded in their operation, the conversation shifts from “when does this end?” to “how do we keep this going?” There’s almost always more work to do that lends itself to having an outside expert working inside the department.

A few other use case examples

While deviation backlogs are the most common trigger, the same approach applies across a range of Quality challenges. Here are a few examples from our recent project history:

• Building a Quality department from scratch. A mid-size pharma company with a multi-subsidiary structure needed to stand up an entire Quality function across multiple business units. We started with one Quality lead and scaled to three embedded consultants covering QA, clinical support, supplier qualification, QMS implementation, and training. The team functioned as the company’s Quality department for over three years with zero turnover, adapting as subsidiaries were acquired or divested.

• Filling a sudden QA leadership gap. A small biopharma lost its QA manager abruptly. Vendor management was incomplete, SOPs were missing, and there was no formal training system. We deployed a senior QA consultant who, within weeks, stood up a vendor qualification program, began revising SOPs, and built the company’s first electronic training system. Five months later, she transferred knowledge to the permanent hire and stepped out with an overlap period that ensured continuity.

• Large-scale backlog remediation with a deployed team. When the backlog is big enough, we deploy teams! One pharma had roughly 150 open deviation investigations growing at 20 per day, with recurring deviations compounding because the backlog was preventing the CAPAs needed to address root causes. We put 17 resources on it: 10 for investigations, 7 dedicated to CAPAs, because clearing deviations without resourcing the downstream CAPA work just moves the bottleneck. The team was delivering results by week two and followed a structured methodology: sample analysis, categorization by expertise, risk-based prioritization, and weekly milestone tracking.

Different scales, different triggers — same underlying model: deploy experienced practitioners who integrate into the operation and do the work while the internal team keeps the day-to-day running.

Why this works so well for so many teams

There are a few reasons the embedded model punches above its weight, and most of them, we’ve come to learn, have nothing really to do with the technical work itself.

Here’s what we’ve seen and heard, having done this for years now:

• Speed to impact. A senior consultant who has spent years working on deviations across multiple manufacturing environments doesn’t need a six-month ramp-up period. They’ve seen the patterns before! Batch record errors, bioprocessing deviations, equipment-related issues, process failures. They know what a good root cause analysis looks like. They know what regulators expect to see in a closed investigation. They can start contributing meaningful work almost immediately.

• Mentorship as a side effect. This is the benefit that rarely shows up in a statement of work but consistently shows up in the feedback we get when an engagement wraps. When you put a seasoned practitioner alongside less experienced Quality staff, knowledge transfer happens organically. We’ve seen consultants become de facto trainers and mentors for junior team members and newer managers — not because anyone asked them to, but because that’s what good practitioners do. They coach as they work and explain the “why” behind the investigation approach. They model what thorough documentation looks like. For organizations where rapid growth has outpaced internal development, this informal mentorship can be as valuable as the deviation closures themselves.

• Continuity through “organizational turbulence.” Fast-growing companies are, almost by definition, volatile. Reporting structures change, managers rotate, layoffs and restructurings happen, and internal teams get reshuffled. Through all of that, an embedded consultant can be a refreshingly stabilizing presence. You have someone there for a few months who maintains institutional knowledge of open investigations and keeps the deviation program moving forward even when leadership is in flux. We’ve had consultants outlast three or four different managers at the same client and still keep their work on track, because their mandate is tied to the work itself, not to any one internal sponsor.

• Flexibility that matches the work. Manufacturing deviation backlogs don’t typically shrink on a nicely predictable timeline. As soon as you clear five major deviations, three new ones might land on your desk. An embedded consultant model accommodates this reality in a way that fixed-scope project engagements can’t. Extensions are simple; the scope can flex. And when the backlog is finally under control (when the system is running smoothly and the team can sustain it internally), the engagement winds down naturally. (In some cases, our clients have offered FTE opportunities to our consultants to keep them on permanently.)

Backlogs (and similar problems) tend to be capacity issues

The vast majority of backlog root causes we’ve identified are genuine capacity problems, which is why the embedded model is so well-suited to addressing them. It almost never has anything to do with the team's competence. Some of the most impressive teams we’ve ever worked with deal with backlogs.

In reality, most Quality teams are sized to handle a specific volume of production. When production ramps dramatically or something else affects the team, the ratio of Quality resources to manufacturing output gets thrown off. Deviations are the downstream symptom.

Hiring permanent staff to close the gap takes months, sometimes the better part of a year, when you factor in recruiting, onboarding, and ramp-up time for roles that require regulatory knowledge and site-specific training. And there’s a legitimate question about whether you even want to permanently expand headcount for what might be a temporary surge.

That’s the sweet spot for staff augmentation: You need experienced people now. You need them integrated into the operation, not advising from the outside. And you need the flexibility to scale the support up or down as conditions change. An embedded consultant (or a small team of them) fills that gap in weeks, not quarters.

What makes a good embedded consultant

Not every consultant or subject matter expert who works on contract is suited for this kind of work. Staff augmentation demands a specific temperament alongside technical expertise.

• The best embedded consultants are, first and foremost, practitioners. They’ve done the work themselves. They’ve written the investigations, performed the root cause analyses, and closed the deviations. They’re not just strategists who can solve problems. They’re people who can sit down and do the job, too.

• Beyond that, they need to be adaptable. Every site has its own culture, its own SOPs, its own political dynamics. A consultant who can’t read a room, build trust with operators and managers, and adjust their approach to fit the client’s way of working will struggle regardless of how strong their technical skills are.

• And frankly, the best people function as what you might call “organizational connective tissue.” They build relationships across departments. They keep their project managers informed. They flag risks and opportunities that go beyond their immediate scope. One of our consultants once

One of our consultants often describes the role using a metaphor about bees carrying pollen from flower to flower, leaving something beneficial at every stop. It’s a funny image, but it captures something real about what happens when you put a well-connected, well-intentioned practitioner inside a complex organization. They bring their best practices with them and deposit them inside the org.

When to consider staff augmentation

If any of the following sound familiar, an embedded senior Quality consultant may be exactly what you need:

• Your deviation backlog is growing faster than your team can close it.

• You have major deviations that have been open for months without a clear path to closure.

• Your Quality team is spending so much time on day-to-day firefighting that proactive work has stalled.

• You’ve recently scaled production significantly, and your Quality infrastructure hasn’t caught up.

• You’ve been through a reorganization or layoffs and lost institutional knowledge in the Quality function.

These are the situations we get called into regularly. And the embedded model is consistently one of the most effective and efficient ways to regain control. If you’re dealing with a Quality capacity challenge and want to explore whether staff augmentation is the right fit, learn more about how we use the model and get the conversation started.

Staff augmentation services

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.

With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.

Share The FDA Group's Insider Newsletter

This guidance breakdown is available in full to paid subscribers. Only paid subscribers get regular full access to our guidance breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.

The FDA just issued its final guidance, Incorporating Voluntary Patient Preference Information over the Total Product Life Cycle, replacing the original 2016 guidance on patient preference information (PPI) for medical devices.

The draft was issued back in September 2024, and this final version fulfills a commitment the FDA made under MDUFA V (Section V.E., in case you’re interested).

If you work in medical device regulatory strategy, clinical affairs, or quality (or if you’re a sponsor weighing whether to invest in patient preference studies) this document deserves your attention. We pulled out a few of the key takeaways that were most salient to us.

The scope expanded well beyond PMAs, HDEs, and De Novos!

The 2016 guidance focused on PPI submitted in support of premarket approval applications (PMAs), humanitarian device exemption (HDE) applications, and De Novo classification requests. The new guidance explicitly extends the FDA’s consideration of PPI across the total product life cycle, including:

• Investigational device exemption (IDE) applications

• Requests for Breakthrough Device designation

• PMAs, HDEs, and De Novo requests (carried over from 2016)

• Premarket notifications (510(k)s)

• Administrative, enforcement, and other FDA actions

That last bullet is notable! The FDA is now saying that patient preference data can be a factor in compliance and enforcement decisions, not just marketing authorization.

PPI remains entirely voluntary (no new burden on sponsors)

The guidance is clear here: submission of PPI is not required. The FDA is not changing any standards for marketing authorization or premarket review, and the document explicitly states it does not create any new burden on device sponsors.

That said, the guidance strongly encourages sponsors and other interested parties (patient groups, academia) to consider collecting and submitting PPI where it may be relevant, particularly for devices where patient decisions are “preference sensitive.”

The FDA defines when PPI is most useful

The guidance identifies several characteristics that make a device a strong candidate for PPI:

• Devices with a direct patient interface

• Devices intended to yield significant health or appearance benefits

• Devices that directly affect health-related quality of life

• Life-saving but high-risk devices

• Devices developed for unmet medical needs or rare diseases

• Devices offering alternative benefits to those already marketed

• Devices with novel technology

• Devices where key endpoint experiences are subjective

The guidance also flags situations where its own staff may find PPI particularly valuable, for example, when patients may value benefits and risks differently from healthcare professionals, when population-level differences in patient perspectives aren’t well understood, or when there is a significant public health impact.

“Preference sensitive” decisions get a clearer definition

The guidance articulates when patient decisions are considered preference sensitive:

• Multiple treatment options exist, and none is clearly superior for all patients.

• Evidence supporting one option over others is considerably uncertain,

• Patients’ views about the most important benefits and acceptable risks vary considerably or differ from those of healthcare professionals,

This framing matters because it signals where the FDA sees PPI adding the most value to its own benefit-risk assessment.

Section V gives detailed study quality recommendations

Section V outlines 12 qualities the FDA considers when reviewing PPI studies. These aren’t new regulatory requirements, but they represent the FDA’s clearest articulation to date of what makes a PPI study credible for decision-making purposes.

To run through them quickly:

1. Patient-centeredness — the patient, not the clinician, should be the central focus.

2. Relevance to patients — benefits, risks, and uncertainty should be clinically relevant and align with clinical study endpoints.

3. Study conduct — trained administration or adequate self-administration with tutorials and comprehension quizzes.

4. Appropriate methods — qualitative, quantitative, or both, matched to the research question and product life cycle stage.

5. Representative study population — enrollment should reflect the full spectrum of the intended use population.

6. Heterogeneity — studies should account for the variability of patient preferences across disease severity, experience, demographics, etc..

7. Appropriate attribute and level selection — attributes should be relevant to FDA decision-making, mutually exclusive, and not include attributes (like cost) that could skew results.

8. Effective communication of benefit, risk, and uncertainty — with specific recommendations on numeracy, format, and framing.

9. Study comprehension with minimal cognitive bias — design should minimize framing, anchoring, and ordering effects.

10. Logical soundness — internal validity tests for logic and consistency.

11. Robustness of analysis — statistical rigor, confidence intervals, sensitivity analyses.

12. Adherence to good research practices — following guidelines from recognized professional organizations like ISPOR.

The FDA strongly encourages early engagement via Q-Subs

One of the most practical messages in this guidance is to engage with the FDA early and often during PPI study development. The guidance recommends seeking FDA alignment via Q-Sub on a few particular points:

• The scientific research question(s) and study objectives.

• The intended patient sample and enrollment criteria.

• Proposed attributes and attribute levels (including submitting an attribute table).

• The survey instrument before it’s finalized.

• Recruitment and sampling strategies.

• Identification of clinically relevant subgroups.

The FDA frames this as an iterative process, not a single checkpoint. Sponsors are encouraged to submit draft protocols, pre-field test survey instruments, and pre-testing results for review.

PPI can support subset approvals

The guidance makes clear that PPI may help identify a subset of patients for whom probable benefits outweigh probable risks (even when the data doesn’t support that conclusion for the broader study population).

One hypothetical example in the guidance describes a knee implant where overall study data showed smaller-than-expected improvement, but pre-specified subgroup analysis showed greater benefit for patients with the highest pain and functional limitation. PPI confirmed that those patients found the benefits acceptable given the risks. The FDA could approve the device with the indication limited to that subgroup.

This is a meaningful signal about how the FDA views PPI as a tool for enabling access (not just for broad population approvals, but for targeted ones).

PPI won’t override a negative benefit-risk determination

The guidance includes a clear counterexample, too: a scenario where PPI shows some patients would accept higher risks, but FDA concludes the device poses an unreasonable risk that could be addressed through design and manufacturing improvements. In that case, the FDA may decline to approve despite a favorable PPI.

The point is that PPI is one input among the totality of evidence. It doesn’t function as a patient-demand override of the FDA’s safety determination.

Read more

Getting a product approved in one region is hard enough. Getting it approved across the US, Europe, and Japan (ideally within months of each other) requires strategic planning, relationship-building with regulators, and cultural fluency that most development teams underestimate until they’re in the middle of it.

The three major ICH regulators share the same goal of bringing safe, effective products to patients. But they operate through very different lenses, ask fundamentally different questions, and interpret the same data differently.

Sponsors who assume that a technically harmonized dossier equals regulatory alignment across regions are setting themselves up for misalignment, rework, and delays.

Our Nick Capman recently sat down with AJ Acker, Senior Vice President of Regulatory, Quality & Clinical Safety at Annexon Biosciences, to walk through practical strategies for navigating global filings with the FDA, EMA, and PMDA.

AJ brings about 30 years of experience in pharma with a deep focus on rare diseases. He has led global regulatory programs that secured approvals across all three ICH regions and has direct experience negotiating with the FDA, EMA, and PMDA.

Prior to Annexon, AJ served as Senior Vice President of Global Regulatory Affairs at Zogenix (where he also served as President of Zogenix Japan K.K.), and held regulatory leadership roles at Bioskin, Santen, and BioMarin, building a career defined by rare disease programs and multi-regional regulatory strategy.

Apple Podcasts | Spotify | YouTube | Web + Others

AJ’s key insights and practical takeaways

If you’re short on time, here are the most important lessons from the discussion.

• FDA, EMA, and PMDA share the same goal but ask fundamentally different questions. AJ frames it simply: The FDA asks, “Does this work and can patients get it quickly?” EMA asks, “Is this meaningfully better than what we already have?” And PMDA asks, “Can this truly be developed and sustained for Japanese patients?” These different lenses show up everywhere: from orphan designations (FDA is the most flexible with early decisions and limited data sets; EMA requires potential significant benefit over existing therapies and reassesses orphan status during approval; Japan requires a credible development plan just to qualify) to clinical data requirements (FDA and EMA accept global data sets more readily, while Japan still typically requires local Japanese data, despite recent guidances adding flexibility).

• ICH harmonization provides a common scientific foundation, not regulatory alignment. The ICH has aligned scientific and technical standards across the three regions, reducing redundant studies, standardizing dossier formats, and enabling multi-regional clinical trials. But a fully ICH-compliant program may still face divergent regulatory questions, different post-marketing obligations, and varying approval pathways across regions. Technical alignment and regulatory alignment are not the same thing. Sponsors who treat ICH compliance as a substitute for region-specific regulatory engagement are making one of the most common pitfalls in global development.

• Start planning for all three regions early (especially Japan). Late engagement with any region creates misalignment that leads to rework and delayed approvals. This is especially true for Japan. PMDA will specifically ask sponsors why Japan was or was not included in early development, and they consider that question as part of the submission package. Early engagement also unlocks accelerated pathways: orphan designations, accelerated and conditional approval mechanisms, and alignment on endpoints. If you’re considering accelerated approval by the FDA based on a surrogate endpoint, you need to discuss that endpoint with EMA and PMDA to determine whether it’s clinically meaningful in their regions and whether it can support approval there.

• Expect different regulators to want different primary endpoints from the same data. AJ shared an example from a pivotal program where FDA and EMA each wanted a different primary endpoint for the same study. The solution: the protocol listed the FDA’s preferred endpoint as the primary and the EMA’s preferred endpoint as the first key secondary, with different statistical analysis plans between regions. That approach required early conversations with both agencies to gain alignment before the study design was locked. Without those conversations, the study could have been designed in a way that satisfied one regulator but not the other.

• Japan’s regulatory landscape is changing, but the bar remains high. Japan has historically required Japanese clinical or bridging data, even for rare diseases. Recent guidances have added flexibility, including pathways for approval without Japanese data and conditional approval mechanisms. But AJ notes the bar is still quite high: he’s only aware of two products that have gone through approval without Japanese data, and two that have used the conditional approval pathway. The opportunity is real, but sponsors need to engage PMDA early to understand whether their program qualifies. The regulatory space in Japan is actively evolving, and sponsors who plan prospectively for Japan rather than treating it as an afterthought have a significant advantage.

• Local regulatory experts are essential and should be used strategically. Local experts and consultants play a decisive role in bridging the gap between a globally aligned data package and region-specific regulatory expectations. Their value isn’t in producing more data; it’s in shaping the credibility, timing, and interpretability of data at the regional level. They also serve as early warning systems, identifying where a global trial design might clash with regional norms, where an endpoint might be challenged, or where post-marketing commitments might diverge. AJ also recommends using ex-regulators as higher-level strategic advisors rather than day-to-day consultants — they’ve seen many approaches to success and can help navigate challenges like maintaining orphan designation in the EU.

• Simultaneous or closely timed filings are becoming the norm, but resource planning is critical. Sequential region-by-region submissions are no longer the default, especially for orphan and accelerated programs. AJ has filed with the FDA and EMA on the exact same day. But simultaneous filings create a significant resource burden: FDA sends responses on a rolling basis, EMA and PMDA have more structured question timelines, and inspections from all three regions can overlap. Sponsors need to align with their commercial teams on launch sequencing (which often influences filing order) and make sure the organization is resourced to handle parallel review cycles. Filing strategy should also account for the asset’s maturity, disease context, data robustness, and whether Japan was planned for early enough.

• Plan for questions before you get them. No program gets through a clean review without questions. Sponsors know their data best and should know where the gaps are, where results aren’t entirely clear, and where regulators are likely to push. AJ’s advice: start planning responses to anticipated questions before submissions go out. Have a response team identified and ready. Get internal alignment on trade-offs for post-marketing commitments, conditional approval requirements, and other obligations that may vary by region. The preparation that starts early in development (not at submission) is what determines how smoothly the review process goes.

• Building trust with regulators is a long game that pays off at the critical moment. The trusting relationship you build with regulators throughout development is what matters most during the review and approval process. If you’ve built that relationship, they’ll take more time to work with you and listen more carefully. Communication style matters: EMA is more direct and expects transparency; PMDA is less direct, especially in person, and wants to understand the “why” behind decisions; FDA is the most flexible in terms of communication format. AJ also stressed the importance of building relationships with key opinion leaders in the disease area. Regulators will check what sponsors say against KOL perspectives, so alignment in tone and substance across both channels strengthens the submission.

• AI is becoming a strategic tool for sharpening submissions. AJ shared a concrete example: before filing with EMA, his team used AI to review their clinical summary against five specific strategic points they wanted to make. AI identified that four of five points were clearly supported by data, but the fifth was backed mostly by hypotheticals rather than actual evidence. The team went back and added data to support that point, something that likely wouldn’t have been caught as easily through traditional review. He also noted that regulators are starting to use AI themselves, which means sponsors should begin thinking about how their documents and questions will be processed by AI tools on the regulatory side.

• The future may be a “living dossier.” Looking ahead, AJ expects FDA, EMA, and PMDA to continue harmonizing standards and data formats, but regulatory judgment and lifecycle management obligations will remain distinct. He sees the traditional dossier model evolving: as real-world data registries and long-term follow-up become more integrated into development programs, the line between a development dossier and a lifecycle management dossier may blur. Approval might happen in the middle of a continuous, living submission rather than at the end of a discrete filing process.

One thing to bring back to your team

Look at your current global development strategy and ask whether you’re treating ICH compliance as regulatory alignment (because they’re not the same thing). Consider:

• Have you engaged all three regions early enough, or is Japan being treated as an afterthought?

• Do you know whether FDA, EMA, and PMDA would accept the same primary endpoint, or are you assuming alignment that hasn’t been tested?

• Are you using local regulatory experts and ex-regulators strategically (for credibility, timing, and early warnings) or just for document production?

• Have you started planning responses to the questions you know regulators will ask, before submissions go out?

• Is your organization resourced to handle parallel review cycles across three regions simultaneously?

The companies that achieve tight global filing timelines are the ones that planned for regional differences from the beginning, engaged regulators early and often, and built the relationships and internal readiness to move through review without losing months to avoidable misalignment.

AJ Acker is Senior Vice President of Regulatory, Quality & Clinical Safety at Annexon Biosciences, where he leads regulatory strategy for the company’s rare disease programs. He has about 30 years of experience in the pharmaceutical industry with a sustained focus on rare diseases and global regulatory approvals across the FDA, EMA, and PMDA.

Prior to Annexon, AJ served as Senior Vice President of Global Regulatory Affairs at Zogenix, where he also served as President of Zogenix Japan K.K. and led successful NDA, MAA, and Japan NDA filings and approvals. He has held regulatory leadership roles at Bioskin, Santen, and BioMarin. AJ is an Oregon State University alumnus based in Napa, California.

Connect with AJ on LinkedIn here.

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on staff augmentation, auditing, remediation, QMS, and other specialized project work in Quality Assurance, Regulatory Affairs, and Clinical Operations.

With over 3,750 resources worldwide, over 325 of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee.

Here’s why 17 of the top 20 life science firms access their consulting and contractor talent through us:

• Resources in 75 countries and 48 states.

• 26 hours average time to present a consultant or candidate.

• Exclusive life science focus and expertise.

• Dedicated account management team.

• Right resource, first time (95% success).

• 97% client satisfaction rating.

Talk to us when you're ready for a better talent resourcing experience and the peace of mind that comes with a partner whose commitment to quality and integrity reflects your own.

Subscribe to The Life Science Rundown:

Apple | Spotify | YouTube | Web + Others

Check out our newly launched AI-powered QMS audit tool, AICA (the Audit Intelligence Compliance Assistant).

This breakdown is available for paid subscribers. Only paid subscribers get regular full access to our breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.

Yesterday, the FDA issued a warning letter to a biologics developer, citing alleged violations of federal advertising regulations in a TV advertisement and an appearance by company President Richard Adcock and Executive Chairman Patrick Soon-Shiong in a January 2026 podcast hosted by former White House Press Secretary Sean Spicer.

The letter, issued by the Office of Prescription Drug Promotion (OPDP), takes particular issue with what it calls a "misleading impression that Anktiva," ImmunityBio's drug product, "can cure and even prevent all cancer" and the omission of all risk information associated with the drug.

The letter references prior Untitled Letters sent to the company's wholly owned subsidiary, Altor Bioscience, requesting that ImmunityBio develop a "comprehensive plan of action to disseminate truthful, non-misleading, and complete corrective communication(s) about the concern(s) discussed in this letter."

This is one of the more “aggressive” promotional enforcement letters we’ve seen OPDP issue in recent memory, and it's worth reading carefully for what it signals about how the FDA reviews promotional activity that extends beyond traditional advertising into earned media, executive interviews, and podcast appearances.

The drug and its approved indication

Anktiva (nogapendekin alfa inbakicept-pmln) is an IL-15 receptor agonist approved for intravesical use in combination with Bacillus Calmette-Guérin (BCG) for the treatment of adult patients with BCG-unresponsive non-muscle invasive bladder cancer (NMIBC) with carcinoma in situ (CIS) with or without papillary tumors.

That indication is narrow by design: the efficacy data come from QUILT-3.032, a single-arm, multicenter trial.

Two details from the approved labeling matter for understanding this letter.

• First, Anktiva is approved for use only in combination with BCG, a cohort evaluating Anktiva as a single agent in the same disease setting was stopped early for futility.

• Second, the dosage and administration section of the prescribing information states explicitly that Anktiva is for intravesical use only and should not be administered by subcutaneous, intravenous, or intramuscular routes.

What the FDA found

The warning letter here addresses two specific promotional communications: a direct-to-consumer TV advertisement and a podcast episode titled “Is the FDA BLOCKING Life Saving Cancer Treatments?” that aired on The Sean Spicer Show on January 19, 2026, and was also accessible through ImmunityBio’s website.

Sean Spicer’s show is also hosted here on Substack:

The Sean Spicer Show

Is the FDA BLOCKING Life Saving Cancer Treatments? | Ep 631

Dr. Patrick Soon-Shiong has been a pioneer, leading the way in cancer research. As the Founder, Executive Chairman, Global Chief Medical & Technology Officer at ImmunityBio, Dr. Soon-Shiong is changing the paradigm in how to treat cancer. Our body needs a strong, healthy immune response to overcome cancer. Chemotherapy weakens the immune system signifi…

Listen now

3 months ago · 2 likes · The Sean Spicer Show

The FDA identified violations across several categories. Let’s walk through them.

1. False or misleading efficacy claims

The FDA’s core concern is that both the TV ad and podcast contain representations that misleadingly suggest Anktiva can cure cancer, prevent cancer, and treat all cancers, none of which is supported by the approved labeling or the clinical data.

The letter cites specific statements from the podcast. Dr. Soon-Shiong described Anktiva as “the most important molecule that could cure cancer,” stated that the drug is “approved for bladder cancer, but it actually can treat all cancers,” and called it “the therapy to prevent cancer if you were exposed to radiation.”

In the TV ad, statements about the ability to “treat the tumor, and it doesn’t come back” were presented alongside images of Anktiva vials.

The FDA explains why these claims are unsupported:

• QUILT-3.032 was a single-arm study with no comparator arm, which means DFS results are not interpretable due to the single-arm design and lack of a comparator arm.

• You cannot determine whether the lack of recurrence is attributable to the drug or to other factors, like the natural history of the disease.

• The study does not support claims that Anktiva can cure cancer. The claim that Anktiva can prevent cancer in people exposed to radiation is not supported by any data the FDA is aware of. And the repeated characterization of Anktiva as a “cancer vaccine” is, according to the FDA, false according to the FDA, which notes Anktiva is an IL-15 receptor agonist, not a vaccine.

The FDA also flagged that references to Anktiva as a “single jab” and “a little vial that you inject subcutaneously” misleadingly suggest the drug has a treatment effect as a monotherapy. Again, the single-agent cohort of QUILT-3.032 was stopped for futility. The efficacy data apply only to Anktiva in combination with BCG.

2. Misleading route of administration

Both the TV ad and podcast include representations (visual and verbal) suggesting that Anktiva is administered by injection.

• The TV ad shows footage of a vial being removed from its carton, a healthcare practitioner preparing to administer a dose, a patient in a chair after an injection, and another patient being injected in the arm with a syringe.

• Dr. Soon-Shiong refers to the drug as a “little vial that you inject subcutaneously” in the podcast.

Anktiva is approved for intravesical use only (instilled directly into the bladder via catheter). The prescribing information explicitly states it should not be administered subcutaneously, intravenously, or intramuscularly. The FDA characterizes these representations as “particularly alarming from a public health perspective,” given that the safety and efficacy of Anktiva via routes other than intravesical are unknown.

3. Omission of risk information

The TV ad presents risk information only after the screen fades to black, which, as the FDA notes, typically signals the close of a presentation, with no signal to alert the viewer that important risk information follows.

The podcast contains no risk information at all. The FDA states that this omission creates a misleading impression about the drug’s safety.

4. Omission of the full approved indication

The FDA, in its letter, says neither the TV ad nor the podcast communicates the full approved indication.

• The TV ad references nonmuscle invasive CIS bladder cancer but does not specify that Anktiva is indicated for use in combination with BCG for adult patients with BCG-unresponsive NMIBC.

• The podcast suggests use for bladder cancer generally.

• The full indication does appear at the end of the TV ad, but again, only after the screen fades to black.

5. Promotion of unapproved uses

Based on the claims in the podcast (that Anktiva “can treat all cancers,” can rescue patients who fail checkpoint inhibitors in lung cancer, and can prevent cancer in people exposed to radiation) the FDA concluded that these provide evidence the drug is intended for new uses for which it lacks approval and for which its labeling does not provide adequate directions for use.

6. Failure to submit the podcast under Form FDA 2253

Federal regulations require that promotional labeling and advertising be submitted to the FDA at the time of initial dissemination. The podcast was not submitted under Form FDA 2253 as required.

Not the first time

The letter explicitly notes that OPDP previously sent two Untitled Letters (September 9, 2025, and January 7, 2026) to Altor BioScience, ImmunityBio’s indirect wholly-owned subsidiary, addressing “presentations of Anktiva that were, in certain respects, similar to presentations in the TV ad and podcast addressed in this letter.”

Those Untitled Letters cited misleading efficacy representations based on the QUILT-3.032 study data.

The escalation from Untitled Letters to a Warning Letter, with the FDA noting that “ImmunityBio continues to promote Anktiva in a similarly misleading manner,” is significant. It signals that OPDP views this as a pattern rather than an isolated compliance lapse.

Practical considerations for industry teams

This letter raises a number of issues that go well beyond ImmunityBio’s specific situation.

Read more

This a special free edition of our biweekly news piece. These RA/QA news rolls are available in full only to paid subscribers. Upgrade here.

This is our biweekly recap of news and industry happenings curated for our paid subscribers. Our goal is to bring you the headline news and the stories, research, and insights that might be harder to find.

If you haven’t upgraded to a paid subscription yet, you can do so here. Also, make sure to follow us on LinkedIn and catch the latest episodes of our podcast, The Life Science Rundown.

Here are some key items from the past couple of weeks.

💊 = Pharma, biologic, and biotech.
💉 = Medical device, medtech, diagnostics, and digital health.

FDA Leadership and Administration

• White House considered replacing FDA chief operating officer — The Washington Post reports that Chris Klomp, the new HHS Chief Counselor, was briefly pitched by the White House to serve as the FDA’s chief operating officer before he declined the position. Administration officials had sought Klomp for management counsel to help stabilize operations at the FDA after several resignations and policy shifts, which puts additional context behind FDA Chief Operating Officer Barclay Butler’s recent decision to retire from public service.

• HHS counselor influences vaccine policy timing — The Washington Post piece also reports that Chris Klomp was responsible for delaying a planned vaccine announcement out of concern it would create political headaches and overshadow other priorities. The report indicates that outgoing CBER Director Vinay Prasad was among officials under Klomp’s “broadened purview” who are set to exit HHS.

• Prasad's departure creates a second leadership void at CBER 💊 — The FDA announced that CBER is seeking not only a replacement for departing Director Vinay Prasad but also an additional deputy director position. The agency spokesperson confirmed this hiring is for an additional deputy director to join CBER’s current deputy director, Katherine Szarama, as Prasad prepares to leave around the end of April.

• Kennedy signals peptide compounding changes coming 💊 — HHS Secretary Robert F. Kennedy Jr. told Joe Rogan’s podcast that the FDA will likely reverse the majority of Biden administration restrictions on bulk compounding of 26 peptide products within weeks. Kennedy indicated the FDA plans to allow “about 14” types of peptides to be compounded, citing concerns about high consumer demand driving people to order from unregulated Chinese or Indian labs.

• Anthropic AI restriction affects FDA’s Elsa tool — President Trump’s decision to prohibit Anthropic from doing government business impacts the FDA’s generative AI tool Elsa Enterprise, which leverages Claude’s “Sonnet” model. HHS disabled staff Claude accounts while the FDA implements “phased transition to remove Claude Sonnet from Elsa,” while ensuring “functionality and capabilities are uninterrupted.”

FDA General

• Major adverse event monitoring system consolidation launched — The FDA announced the official launch of its Adverse Event Monitoring System (AEMS), consolidating product-specific systems including FAERS, VAERS, and AERS into a unified platform. The agency expects to save approximately $120 million over five years from the integration of systems that collectively cost $37 million annually to operate.

• National Drug Code system expands to 12-digit format 💊 — The FDA published a final rule adopting new standards for National Drug Codes to address the imminent shortage of available 10-digit numbers. The regulation includes a seven-year implementation timeline plus three additional years, allowing existing products to add leading zeroes to their current NDCs, and also permits nonlinear barcodes.

• VRBPAC unanimously endorses WHO flu strain selections 💊 — The FDA’s Vaccines and Related Biological Products Advisory Committee endorsed the World Health Organization’s recommendations updating all three trivalent vaccine components for the 2026-2027 influenza season.

• FDA escalates war of words with uniQure over Huntington’s therapy 💊 — A senior FDA official called uniQure’s AMT-130 a “failed therapy” and accused the company of lying about prior interactions during a background call with news organizations. The agency reaffirmed its demands for a randomized, double-blind study with a sham surgery control, despite the company’s external control group data from a three-year analysis.

• Makary continues pushing OTC expansion agenda 💊 — Speaking at the HHS inaugural women’s health conference, Commissioner Makary repeated his interest in moving prescription drugs to over-the-counter status, specifically mentioning plans for vaginal estrogen. Makary emphasized the need to “get away from paternalism and trust women and trust Americans” while referencing his broader “mass transition” vision.

• FDA publishes new guidance on Form 483 responses 💊 — The agency released draft guidance explaining how drug companies should respond to good manufacturing practice inspection findings, emphasizing thorough investigation, risk assessment, appropriate actions like recalls, and root cause identification to prevent Warning Letter issuance.

• FDA softens approach to desiccated thyroid medications 💊 — The agency announced plans to issue draft guidance by August 2026 regarding compliance priorities for unapproved animal-derived thyroid medications, marking a retreat from former CDER Director George Tidmarsh’s aggressive removal timeline. The FDA committed to ensuring patient safety “while manufacturers are working toward FDA approval.”

• Leucovorin approval is dramatically narrower than earlier promises 💊 — The FDA approved an expanded indication for leucovorin calcium only for adult and pediatric patients with cerebral folate deficiency who have confirmed FOLR1 gene variants, a far cry from Commissioner Makary’s earlier claim that “hundreds of thousands of kids will benefit” from autism spectrum disorder treatment.

• FDA rejects accelerated pathway for aging-related therapies 💊 — The agency denied Age Reversal Unity citizen petition requesting a nine-month expedited clinical trials framework for aging therapeutics, stating it “does not believe issuing such a one-size-fits-all framework is scientifically appropriate or in the best interests of public health.”

Compliance and Enforcement

• Massive GLP-1 compounding crackdown begins 💊 — The FDA sent 30 Warning Letters to telehealth companies for making false or misleading claims about compounded GLP-1 products, citing companies for implying they were compounders when products were made by other pharmacies and for claiming their products were “same” or “generic” to FDA-approved treatments like Ozempic and Zepbound.

• Medical device executive pleads guilty to withholding adverse events 💉 — The Department of Justice announced that ExThera Medical’s former chief regulatory officer Sanja Ilic agreed to plead guilty to failing to file adverse event reports with intent to defraud the FDA regarding blood filtration devices used on cancer patients. Ilic faces maximum three years prison and $250,000 fine.

• Court supports FDA withholding of vaccine autopsy records 💊 — Judge Colleen Kollar-Kotelly granted the FDA summary judgment in Freedom of Information Act case, finding the agency “properly withheld autopsy reports in their entirety” from Informed Consent Action Network requests related to Covid-19 vaccine adverse events, citing medical privacy exemptions.

Governing

• Senate Johnson launches FDA rare disease investigation 💊 — Sen. Ron Johnson announced launching Permanent Subcommittee on Investigations inquiry into recent FDA decisions that “scuttled development of certain rare disease drugs,” claiming he learned there’s a “black list within the FDA of companies who make too much noise” and vowing to examine Complete Response Letter reasoning.

• ACIP abandons planned attack on mRNA vaccines 💊 — The Washington Post reports that the CDC’s Advisory Committee on Immunization Practices “abandoned an attack on COVID-19 mRNA vaccines” and no longer plans to vote against recommending mRNA shots, following Commissioner Makary’s opposition to ACIP member Robert Malone’s original plan.

• Former FDA leaders support contraceptive safety in court brief 💊 — Margaret Hamburg, Stephen Ostroff, and Peter Lurie filed an amicus brief with the 3rd Circuit Court of Appeals supporting FDA-approved contraceptives in Pennsylvania v. Trump case, emphasizing the need for accurate information about the FDA’s scientific evaluations not to be “improperly disregarded.”

• Hawley introduces legislation to withdraw mifepristone 💊 — Sen. Josh Hawley introduced S.4066 that would remove mifepristone from the market under withdrawn drug determination and make distribution violations of the Federal Food, Drug and Cosmetic Act. Companion House legislation by Rep. Diana Harshbarger is forthcoming, though Senate passage is unlikely due to a Democratic filibuster threat.

Other

• Disc Medicine lays off 20% of staff following CNPV rejection 💊 — The company announced workforce reduction to preserve the ability to pursue “strategic priorities” after receiving a Complete Response Letter for bitopertin despite selection for the Commissioner’s National Priority Voucher program. The unusual outcome raises questions about the FDA’s initial enthusiasm versus subsequent clinical data assessment.

• UniQure shares plunge following FDA meeting minutes 💊 — Company stock fell more than one-third after releasing Type A meeting minutes from January 30 showing FDA doesn’t agree that Phase 1/2 data with external controls provide primary effectiveness evidence. UniQure plans to request a Type B meeting to discuss study design options.

• Everyone Medicines shuts down, citing inadequate FDA pathway 💊 — A biotech company developing individualized therapies announced closure after determining the FDA’s Plausible Mechanism Pathway “didn’t go far enough to make commercialization of custom drugs feasible, preferring the UK’s Medicines and Healthcare Products Regulatory Agency approach instead.

• GSK receives RSV vaccine supplemental approval 💊 — CBER approved expanded indication for GSK’s respiratory syncytial virus vaccine to include adults aged 18-49 at increased risk of lower respiratory tract disease, expanding from current approval for persons 60+ and at-risk adults 50-59.

• EPA proposes walking back ethylene oxide sterilization rule 💉 — The Environmental Protection Agency announced a new proposal reversing the Biden administration’s severe EtO restrictions, giving facilities a choice between new monitoring systems or adjusted technology review standards for facilities using more than ten tons annually, with a 45-day comment period once published.

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on staff augmentation, auditing, remediation, QMS, and other specialized project work in Quality Assurance, Regulatory Affairs, and Clinical Operations.

With over 3,750 resources worldwide, over 325 of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee.

Here’s why 17 of the top 20 life science firms access their consulting and contractor talent through us:

• Resources in 75 countries and 48 states.

• 26 hours average time to present a consultant or candidate.

• Exclusive life science focus and expertise.

• Dedicated account management team.

• Right resource, first time (95% success).

• 97% client satisfaction rating.

Talk to us when you're ready for a better talent resourcing experience and the peace of mind that comes with a partner whose commitment to quality and integrity reflects your own.

Share The FDA Group's Insider Newsletter

No matter what industry you’re in, a recent warning letter to a cosmetics company in India is a must-read, as it contains photos taken during an inspection.

The March 12 letter to Patcos Cosmetics Pvt. Ltd. of Daman, India references an unannounced inspection of its drug manufacturing facility last July, where investigators found what CDER characterized as "significant violations" of cGMP and "insanitary conditions" so severe that the agency invoked Section 501(a)(2)(A), the adulteration provision for insanitary conditions that may render products injurious to health.

The letter itself is a wrenching catalog of serious findings:

• Broken windows adjacent to open processing lines

• Evidence of harborage areas

• Mold-like residue in product storage

• An unvalidated water system riddled with design flaws

• Unvalidated manufacturing processes

• Missing identity testing on high-risk components

• Deliberate alteration of laboratory data to conceal out-of-specification results

The facility was already on Import Alert 66-40 and had received a prior warning letter in December 2023, and responded to that letter by re-registering with the FDA, affirming its "ongoing compliance with current Good Manufacturing Practices" and "adherence to the highest quality standards." The agency was clearly unimpressed.

But here’s what caught our attention: the letter includes photographs.

Specifically, the FDA included photographic evidence of the insanitary conditions: images of harborage areas outside the production floor, a broken window next to open processing lines, and production-area sinks used for cleaning equipment that appear to be in a state of advanced neglect.

The agency added a footnote explaining that “CDER is including photographs of your facility in this warning letter to document the gross insanitary conditions violations.”

It’s one thing to read that sinks were “insanitary.” It’s quite another to see them.

Companies have periodically refused to allow photographs, citing trade secrets, IP concerns, or internal security policies. As recently as late 2024, the agency issued a warning letter to a Chinese drug manufacturer that cited “limiting photography” as a standalone violation after the company refused to allow inspectors to photograph dirty filling machines. The FDA’s position has been firm: if you’re manufacturing drugs for the U.S. market, allowing investigators to document what they observe is part of the deal, and refusal may be treated as obstruction.

In its June 2024 guidance on the circumstances constituting delaying, denying, or refusing a drug or device inspection, the FDA addresses limiting photos explicitly:

B. Limiting Photography

Photographs are an integral part of an FDA inspection because they present an objective and contemporaneous representation of facility conditions. Examples of conditions or practices effectively documented by photographs include but are not limited to: evidence of rodents or insect infestation; faulty construction or maintenance of equipment or facilities; product storage conditions; product labels and labeling; and visible contamination of components, containers, closures, or products. Impeding or resisting photography by an FDA investigator may be considered a limitation if such photographs are determined by the investigator to be necessary to effectively conduct that particular inspection.

Examples of potentially reasonable explanations that might result in the drugs or devices not being deemed adulterated under section 501(j) of the FD&C Act include, but are not limited to:

• The chemical properties of products manufactured at the facility are such that taking photographs would adversely affect product quality.

• The facility can document that taking photographs of any raw material or assembly would adversely affect product quality

Why this matters for the broader industry

If this becomes a pattern, and given this administration’s stated emphasis on “radical transparency” across FDA operations, it has implications well beyond a cosmetics manufacturer in India.

Warning letters are public documents. They’re read by competitors, customers, investors, law firms, and journalists. The text of a letter is already reputationally damaging. Photographs transform that damage from abstract to visceral. A written description of “water damage with brown discoloration of the ceiling and walls and green mold-like residue” is concerning. A photograph of it is devastating, and shareable in a way that regulatory prose is not.

For all manufacturers, this is worth watching. If the agency begins routinely including photographic evidence in warning letters, the reputational stakes of a facility walkthrough finding just went up significantly.

The calculation around facility maintenance, housekeeping, and environmental controls shifts when you consider that the conditions an inspector observes might not just appear as a paragraph in a letter (they might appear as an image that circulates on LinkedIn and in trade press).

We don’t yet know whether the Patcos letter is an isolated case driven by the severity of the conditions or the beginning of a broader practice. But the footnote suggests intention rather than improvisation. We’ll be watching subsequent letters to see if photographs become a recurring feature.

In the meantime, if you haven’t walked your own facility with fresh eyes recently, this might be a good time to do it!

Read the full warning letter here.

Need audit or mock inspection support? Let’s talk.

Contact us to access our exclusive pool of 3,750+ global consultants, 235+ of whom are former FDA. If we haven’t yet partnered on project support, we provide end-to-end audit support and intensive, comprehensive mock FDA inspections that not only mirror real inspections but go deeper, giving you the insights, corrections, and readiness you need before the FDA walks through your doors.

With a staff of thousands of resources worldwide, we’re the partner firms work with when they want deep domain expertise and the peace of mind that comes with a partner whose commitment to quality and integrity reflects their own.

Whether you need a complete audit program design, full execution, or specific audit support, we’re here to help. Learn more here.

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.

With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.

Share The FDA Group's Insider Newsletter

Sometimes, the most fraught and frustrating audits our team conducts have less to do with the quality system and much more to do with the orchestration of the audit itself.

A quality system might be in great shape, but the auditor requests a batch record and waits 45 minutes. Or the person who can answer questions about the water system is in a meeting no one thought to reschedule. Or the audit room is a corner of the break room with no printer and unreliable Wi-Fi.

We talk a lot here about compliance failures, but we want to focus on hosting stumbles, too. Sometimes these are far more common and insidious than most quality leaders realize.

To state the obvious, when an audit runs smoothly from a logistics standpoint, the auditor can focus on the substance of your quality system, complete their review in the allotted time, and leave with a clear picture of your compliance posture.

When it doesn’t, the auditor spends half their time waiting, repeating requests, and navigating confusion, which eats into their schedule, compresses the review into a shorter window, and creates a general atmosphere of disorganization that colors how they interpret everything else they see.

Having conducted thousands of GMP audits across pharma, biologic, and device companies of all sizes, our auditors tend to identify the same three operational breakdowns over and over during debriefs. None of them requires months of preparation to fix. All of them require someone to actually own the logistics of hosting an audit as a distinct workstream.

Let’s run through them, so if anything sounds familiar, you can address it.

If you need audit, mock inspection, or remediation support, let’s talk.

1. Document retrieval (the 30-minute batch record problem)

This is one of the biggest time-killers in GMP (and other) audits, and it happens at 20-person biotechs and at global pharma sites with sophisticated electronic QMS platforms.

The scenario tends to play out like this:

• The auditor asks to see a specific batch record.

• The person coordinating the audit relays the request to the back room.

• Someone then has to figure out where the record lives. Is it in the eQMS? A shared drive? A physical filing cabinet in the QA office? A binder in the warehouse? Is it still with the reviewer? Has it been archived?

• The person who knows is on the production floor and sometimes can’t be reached immediately.

• Fifteen minutes pass. Then twenty.

• The auditor sits at an empty table.

Now multiply that by additional document requests during a two- or three-day audit as the auditor asks for batch records, training files, calibration logs, deviation investigation reports, supplier qualification packages, equipment maintenance records, stability data, and more. Each one is a small delay that doesn’t usually call attention to itself. But each delay compounds into a larger problem until the auditor is suddenly behind schedule and everyone’s mood starts to sour.

Now we’re exactly where no one wants to be: forced to rush through systems that ought ot be examined carefully, extending the audit timeline (which creates its own disruptions), or making judgments based on incomplete review.

If we were running a CAPA on this, the deeper issue is typically a poor document retrieval capability, and/or one that hasn’t actually been tested under audit conditions. Teams usually know where things are filed and know the system more broadly. But sometimes, auditors are the ones to confront them with the fact that they’ve never simulated the experience of receiving rapid, sequential, sometimes unexpected requests for specific records and measured how long it actually takes to get each one into the auditor’s hands. Until you’ve done that exercise, you don’t know whether your system works under pressure.

What good looks like

The best-prepared sites we audit usually do something simple: they pre-stage documents.

Before the auditor arrives, the audit coordinator reviews the audit scope, anticipates the categories of documents the auditor is likely to request, and pre-pulls files from each category into the audit room (or something similar).

This doesn’t mean guessing which specific batch record the auditor will want.

• It’s having a batch record index ready, so retrieval is a lookup, not a search.

• It means having the training matrix printed or loaded on a screen.

• It means having the CAPA log, the deviation log, the complaint log, and the approved supplier list immediately at hand, because auditors ask for those in virtually every GMP audit.

Beyond pre-staging, the best-prepped sites also designate a dedicated document retrieval person in the back room whose only job during the audit is to find and deliver documents. This isn’t a QA manager, since they need to be available for interviews. It’s a dedicated retrieval person who knows the filing systems, both electronic and physical, and who can get a specific document into the auditor’s hands in no longer than a few minutes. If retrieval time is taking longer than that, there’s work to do.

A small fix that makes a big difference: Before your next audit, run a quick “retrieval drill.” Have someone outside your department generate a list of fifteen documents an auditor would commonly request (say, three batch records, two deviation reports, a CAPA file, a calibration record, a training file, a supplier audit report, an SOP, a validation protocol, the annual product review, a complaint file, and a change control record). Hand the list to your designated retrieval person and time each one. Where you find delays, diagnose the cause:

• Is the filing system unclear?

• Is the document still in someone's queue for review?

• Is the archive disorganized? Is the electronic system difficult to navigate under time pressure?

Each cause has a different fix, but (of course) you can't fix what you haven't measured.

2. The wrong people in the room (or missing entirely)

Another common hosting issue is personnel availability. It usually looks something like this:

• The auditor finishes reviewing one area and wants to move to, for example, the water system.

• The facilities engineer who manages the water system is on PTO, in a production meeting, or at another facility. No one told them the audit was happening this week, or if they were told, no one asked them to actually block their calendar.

• The QA manager tries to answer the auditor’s questions instead, gets two answers deep before hitting the limits of their knowledge, and now the auditor has to note that the responsible person was unavailable, which, at minimum, extends the audit and, at worst, becomes a soft finding about organizational readiness.

Or it’s the inverse of that:

• The auditor asks to speak with a production operator, and the site brings in the Production Director, a well-spoken, senior person who can give polished answers but hasn’t personally operated the equipment in years.

• The auditor doesn’t want the director. They want the person whose hands are on the equipment at 2 p.m. on a Tuesday.

• They want to assess whether frontline personnel understand what they’re doing and why. Sending in a senior proxy doesn’t satisfy that need; it raises questions about whether the organization is trying to manage the auditor’s access.

The underlying problem here is that some audit preparation efforts focus only on the quality system (reviewing documents, closing CAPAs, walking the facility) and ignore the logistics of running an audit. Or this planning amounts to a last-minute coordination task: “Send an email to department heads letting them know the audit is happening.” That’s really not preparation, it’s notification.

What good looks like

Good personnel prep means identifying every SME the auditor might want to speak with based on the audit scope, confirming their availability for the specific audit dates, blocking their calendars, briefing them on what to expect, and establishing a communication protocol so they can be reached quickly if the auditor’s questions go in an unexpected direction.

The teams we’ve seen really nail this build a simple SME availability sheet maybe two weeks or so before the audit.

• For each system or area in scope (production, QC lab, facilities/utilities, warehouse/materials management, document control, training, IT/computer systems, regulatory affairs), identify the primary SME and a backup.

• Confirm both are available for the audit dates.

• Brief both on the audit scope and the kinds of questions they might face.

• Give each person a 30-minute window to review the key documents in their area so they’re not encountering their own records for the first time while sitting across from the auditor.

Equally important is making sure the person coordinating the audit has a fast communication channel to every SME. A group text thread, a Teams channel, a walkie-talkie system, however people talk to each other at your site. The auditor should never have to wait more than a few minutes for the relevant person to appear.

The perception of responsiveness matters here because it matters during real inspections. An auditor who sees a well-coordinated team that can produce documents and people quickly naturally develops confidence in the organization’s operational control. An auditor (or investigator) who keeps hearing “Let me find out who can answer that” develops the opposite impression.

To linger on this just a bit longer, it’s worth noting that many of our auditors notice that floor-level and lab-level staff are the ones least often briefed for audits, especially at smaller companies. When they’re called up by surprise, they sometimes freeze. Then they over-explain. Or they volunteer information about a deviation from last month that wasn’t on the auditor’s radar. Not because they did anything wrong, but because no one told them what to expect, how to interact with an auditor, or that it’s perfectly fine to say “I’m not sure, let me get my supervisor.”

A fifteen-minute all-hands briefing the day before the audit, covering who the auditor is, what they’re looking at, how the team should interact with them, and the principle that honesty and calm are more valuable than perfect answers, can prevent the single most avoidable category of audit complications.

3. No one is actually running the audit

The third operational breakdown we want to cover is the most systemic, and it’s the one that creates the conditions for the other two: no one has been designated to run the audit as a coordinated event that needs to be orchestrated.

At many companies, the Quality Leader or QA Director is the default point of contact for the auditor. That makes sense, as they own the quality system, understand the regulatory framework, and have the authority to decide what information to provide.

Read more

There's a question that sits underneath a lot of career decisions in regulatory affairs: where can you create the greatest impact?

Is it in a large organization with deep resources but layers of silos and stakeholders? Or is it in a small company where you're wearing every hat but moving at a pace that can directly shape a product's trajectory?

The answer, it turns out, depends less on company size than most people might think.

Our own Nick Capman recently sat down with Tammy Sarnelli, Senior Vice President/Global Head Regulatory Affairs and Clinical Quality at Amylyx Pharmaceuticals, to talk through the distinct pressures regulatory leaders face in large and small organizations, and the capabilities that matter regardless of where you sit.

Tammy brings over 35 years of regulatory experience spanning organizations of very different sizes and structures. She spent 27 years at Biogen as Senior Director, then moved to Bioverativ (a rare disease spinout later acquired by Sanofi) as Executive Director, served as Head of Global Regulatory Affairs at EMD Serono (part of Merck KGaA), and has spent the past five-plus years at Amylyx Pharmaceuticals, where she now leads both regulatory affairs and clinical quality.

That range — from one of the industry’s largest organizations to a small, rare disease-focused company — gives her an unusually grounded perspective on what actually changes between environments and what stays the same.

Apple Podcasts | Spotify | YouTube | Web + Others

Tammy’s key insights and practical takeaways

If you’re short on time, here are the most important lessons from the discussion.

• Regulatory expectations are the same regardless of company size. The day-to-day experience is what differs. Whether you’re at a large pharma or a five-person regulatory team at a startup, the job is the same: provide a clear regulatory strategy that guides clinical design, CMC planning, safety strategies, and commercial readiness. You’re still scanning the horizon, researching guidance and precedent, developing trusted dynamics with regulators, and delivering complete, consistent, persuasive documents, first time, on time. What changes is the workload and how it’s distributed. At a large company, you’re likely managing multiple programs across multiple indications with different challenges and approaches. At a small company, there are fewer programs (sometimes just one), but you’re often jumping between fires, filling multiple roles (developing strategy, writing documents, publishing them, pulling references) all in the same day.

• Organizational silos are one of the hardest friction points in large companies. Large organizations have large teams, often separated by therapeutic area or indication, and communication doesn’t always flow freely between them. When information is restricted, collaboration suffers, transparency drops, and knowledge sharing stalls. Regulatory strategy isn’t black and white! The landscape is always evolving. Without sharing openly cross-functionally, opportunities to adjust, adapt, pivot, or expedite development get missed. It also fragments how a company approaches health authority interactions: different therapeutic areas may take entirely different approaches rather than aligning on a consistent company-level strategy. Tammy’s view is that intentional, thoughtful relationship building and knowledge sharing across regulatory teams is critically important for reducing misalignment.

• In small companies, limited resources force sharper prioritization. With fewer people and tighter budgets, leaders have to work more efficiently. Decision-making can actually be faster since there are fewer consultations needed to reach alignment. But that speed comes with a tradeoff: you need to be on top of every potential expedited regulatory mechanism (fast track designations, new pilot programs like the START program) and constantly evaluate whether your program is eligible. Tammy describes this as “all-in thinking” — at a small company with one or two products, everyone in the organization is working on the same thing and can be flexible with workload. You’re constantly asking: what is the most important thing I need to work on today?

• Larger companies have earlier access to regulatory intelligence; smaller ones have to build their own. Large organizations are more likely to have dedicated regulatory intelligence teams monitoring the landscape, government affairs colleagues gathering information directly from health authorities, and the resources to participate in trade associations like PhRMA and BIO that advocate for policy and guidance. At a smaller company, you’re relying on public information from trade publications, scouring health authority websites, and by the time something is published, the landscape has already progressed further. Tammy’s advice: master and grow your professional network. Consulting with other professionals about what they’re seeing can help close the intelligence gap.

• Breaking down silos requires curiosity and authentic relationship building, not just process. Tammy’s approach in large organizations has been rooted in asking questions — being genuinely curious about what colleagues are working on, connecting both professionally and personally, and leaving space for information gathering and sharing. That curiosity builds the relationships that actually break down silos. It’s not a communication framework or governance mechanism. It’s the willingness to be authentic with colleagues and to make time for the connections that allow information to flow.

• Risk tolerance is about culture, not company size, and it directly affects speed. Tammy draws a clear distinction: a risk-tolerant organization doesn’t eliminate risk: it means aligning strategy with action, socializing risk, understanding what actions you can take, and sometimes accepting risk. She used the example of pursuing a Fast Track designation, which requires demonstrating that a therapy “has the potential to improve” — not proof, potential. That potential isn’t always fully understood early in development. An organization has to decide whether it’s worth investing time and resources in that request when the outcome isn’t guaranteed. When people know they won’t be punished for thoughtful, good-faith decisions that involve risk, they make decisions faster. That mindset catalyzes speed. Employees aren’t waiting for certainty, they’re optimizing for informed movement.

• “Failure” in regulatory can mean not taking a chance when you had one. Tammy reframes the idea of regulatory failures and near misses. In large organizations, teams may avoid pursuing riskier health authority interactions (breakthrough therapy designation, PRIME in Europe) because success isn’t guaranteed, so why allocate resources? But for smaller organizations, especially in rare disease, the calculus is different. Patients living with these diseases don’t have time for teams to hold back. Near misses, in Tammy’s framing, are the opportunities you didn’t pursue.

• AI is reshaping regulatory work, but adoption depends on resources. New technologies and AI are reshaping the landscape for companies of all sizes, but the ability to adopt them differs. Larger companies, with more workforce and budget dedicated to researching and evaluating new tools, may adopt faster. Smaller companies face financial constraints that require calculated choices about when and what to introduce. One area Tammy sees evolving rapidly is AI in medical writing. AI can now accelerate accurate, efficient documentation within a structured framework, including drafting clinical study reports. What it can’t do is interpret results. The opportunity is to shift medical writing’s focus from structured formatting and comment reconciliation toward strategy, messaging, and interpretation of content.

• There’s no right answer on company size, just the right fit for the right person. Tammy’s closing point is straightforward: the choice between a structured enterprise and a dynamic startup is ultimately about risk tolerance in your career. Startups bring risk, but also an enormous opportunity to learn about the work and about yourself. Large organizations offer different learning, different growth. She’s found value in every environment she’s worked in because she learned something new each time.

One thing to bring back to your team

Consider where your organization sits on the spectrum of regulatory risk tolerance, and whether that positioning is intentional or inherited.

Ask:

• When your team decides not to pursue an expedited designation or a novel health authority interaction, is that a strategic decision with documented reasoning, or is it avoidance of uncertainty?

• Are your regulatory professionals empowered to make good-faith decisions that involve risk, or does your culture require certainty before action?

• If you’re in a large organization, is information flowing across therapeutic areas and functions, or are silos creating blind spots in your regulatory strategy?

• If you’re in a small organization, have you built the network you need to stay ahead of landscape changes, or are you relying solely on public information?

The organizations that move products forward effectively are the ones that build cultures where informed risk-taking is supported, where people aren’t waiting for certainty, and where regulatory leaders can focus on the path most likely to get a therapy to patients.

Tammy Sarnelli is Senior Vice President/Global Head Regulatory Affairs and Clinical Quality at Amylyx Pharmaceuticals, where she has led regulatory strategy for over five years. Prior to Amylyx, she served as Head of Global Regulatory Affairs at EMD Serono (part of Merck KGaA), Executive Director at Bioverativ (a rare disease-focused company later acquired by Sanofi), and Senior Director at Biogen, where she spent 27 years. Across her career, Tammy has worked across therapeutic areas and organization sizes — from large structured enterprises to resource-constrained startups — with a sustained focus on rare disease.

Connect with Tammy on LinkedIn here.

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on staff augmentation, auditing, remediation, QMS, and other specialized project work in Quality Assurance, Regulatory Affairs, and Clinical Operations.

With over 3,750 resources worldwide, over 325 of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee.

Here’s why 17 of the top 20 life science firms access their consulting and contractor talent through us:

• Resources in 75 countries and 48 states.

• 26 hours average time to present a consultant or candidate.

• Exclusive life science focus and expertise.

• Dedicated account management team.

• Right resource, first time (95% success).

• 97% client satisfaction rating.

Talk to us when you're ready for a better talent resourcing experience and the peace of mind that comes with a partner whose commitment to quality and integrity reflects your own.

Subscribe to The Life Science Rundown:

Apple | Spotify | YouTube | Web + Others

Check out our newly launched AI-powered QMS audit tool, AICA (the Audit Intelligence Compliance Assistant).

As you might have noticed, there’s a lot going on at the FDA these days.

Between major leadership departures, the rollout of a first-of-its-kind regulatory pathway for ultra-rare diseases, the launch of a unified adverse event monitoring system, expanding internal use of artificial intelligence, and user fee reauthorization negotiations now entering the home stretch, there is an enormous amount for the regulated industry to track and prepare for.

Here’s a look at the key developments and what they mean for industry, written for busy professionals who need the news tied together into something digestable.

CBER Director Vinay Prasad is leaving, again

Vinay Prasad, M.D., the director of the FDA’s CBER, is leaving the agency at the end of April, marking his second departure from the role in under a year. Prasad, who also holds the title of Chief Medical and Scientific Officer, will return to his academic position at the University of California, San Francisco.

In a post on X, Commissioner Marty Makary credited Prasad with implementing four major reforms during his tenure: the shift to a single pivotal trial standard, the Commissioner’s National Priority Voucher program, a risk-stratified COVID-19 vaccine framework, and the plausible mechanism pathway for ultra-rare diseases.

But Prasad’s time at CBER was anything but smooth. His tenure was marked by a series of controversies over rare-disease drug decisions that drew bipartisan criticism from Congress.

Maybe most notably, CBER under Prasad clashed publicly with UniQure over the company’s Huntington’s disease gene therapy, AMT-130. Long story short, UniQure had understood it had the agency's prior agreement to use an external control arm for its approval application, but CBER reversed course and demanded a new randomized controlled trial involving sham surgery, a decision that generated significant backlash from the rare disease community and investors alike.

It’s hard to argue the UniQure situation wasn’t part of a broader pattern. CBER issued complete response letters to several other rare disease programs, including therapies from Replimune and Capricor, that were criticized for a lack of clear communication during the review process. The agency also initially refused to file Moderna’s mRNA flu vaccine application, an unusual move that was reversed after the White House reportedly intervened.

At a Senate hearing in February, both Republican and Democratic lawmakers were unusually aligned in their criticism of CBER’s decision-making, highlighting what they described as inconsistency between the agency’s rhetoric about speeding rare disease treatments and the actions coming out of drug reviews.

Leadership turnover in general

Prasad’s departure is part of a pretty staggering pattern of leadership turnover at the top levels of the FDA. Consider the timeline here:

1. Peter Marks, the longtime CBER director, resigned in early 2025 over disagreements with HHS leadership on vaccine policy.

2. Prasad was brought in to replace him but left in July 2025 over the Sarepta Duchenne muscular dystrophy dispute, only to be reinstated two weeks later.

3. George Tidmarsh briefly led both CBER and the Center for Drug Evaluation and Research (CDER) before being placed on administrative leave amid concerns about his personal conduct.

4. Richard Pazdur, the respected longtime oncology regulator, was named CDER director but retired after less than a month, reportedly due to concerns about political interference in the agency’s scientific process.

5. Tracy Beth Hoeg became the fifth person to hold the CDER director role in 2025.

The churn can create real challenges for FDA operations and for the regulated industry. Companies navigating critical regulatory milestones, whether in late-stage development, pre-submission meetings, or post-market compliance, are dealing with an agency where institutional knowledge at the leadership level is being regularly disrupted. Analysts have noted that this volatility has kept companies uncertain about their developmental direction and contributed to investor hesitancy in the biologics space.

There are also open questions about who is actually making key decisions at the FDA right now.

Recent personnel moves at HHS (including the installation of Chris Klomp as a senior counselor acting as a chief of staff, and the elevation of Kyle Diamandis and Grace Graham as FDA senior counselors at HHS) suggest that decision-making authority may be shifting away from Commissioner Makary and toward HHS and the White House. Whether this represents a deliberate effort to provide additional oversight or a signal that Makary’s authority is being constrained remains to be seen.

For the CBER director vacancy specifically, the pool of willing and qualified candidates may be limited. After this many high-profile departures, several under clouds of controversy, recruiting from the industry or the private sector may be a hard sell. One plausible scenario is that Tracy Beth Hoeg, the current acting CDER director, could shift into the CBER role, with the agency then seeking a permanent CDER director separately.

The plausible mechanism framework: a new pathway for ultra-rare disease therapies

On February 23, the FDA released draft guidance on its much-anticipated plausible mechanism framework, a pathway designed to facilitate the approval of individualized therapies for patients with ultra-rare genetic conditions where traditional randomized controlled trials are not feasible due to extremely small patient populations.

Makary and Prasad had previewed the pathway in a New England Journal of Medicine article published in November 2025, but the draft guidance provides substantially more operational detail.

While FDA leaders have indicated the framework could theoretically apply to any drug modality, the guidance focuses specifically on two platforms: genome editing products (such as CRISPR-based therapies) and antisense oligonucleotides (ASOs). These modalities receive the most detailed treatment, signaling that the FDA sees them as the primary vehicles for individualized therapies in the near term.

Several aspects of the guidance are noteworthy for sponsors:

• A statutory basis for approval: The FDA is relying on its existing standard of an adequate and well-controlled clinical investigation with confirmatory evidence, reinterpreting what those terms mean in the context of ultra-rare, individualized therapy. So, this is not a new statutory authority, but a reframing of existing law to accommodate extremely small patient populations.

• Platform approach potential: For gene editing products, the guidance describes how sponsors can leverage proof-of-concept data across multiple clinical programs (for example, by swapping out a guide RNA or tweaking the editor while sharing foundational data). Critically, the FDA describes how in vitro data can be used to add product variants targeting different gene mutations to an existing biologics license application (BLA) after an initial approval. This hints at a platform model where the path to authorization for subsequent similar products is streamlined, maybe significantly so.

• Scope uncertainty: There’s a disconnect between the written guidance which is narrowly focused on therapies for individual patients or very small groups and public statements from FDA leaders, who have suggested the framework could apply to more prevalent conditions. How the agency draws that line in practice will be an important area to watch. Comments on the draft guidance are due April 27, 2026.

The shift to a single pivotal trial standard

Alongside the plausible mechanism guidance, Makary and Prasad’s February 2026 NEJM article announced another big policy shift: the FDA’s default position going forward will be that one adequate and well-controlled study, combined with confirmatory evidence, will serve as the basis for marketing authorization of new drugs.

This is maybe less of a shift than it might initially appear. The FDA has had the statutory authority to approve drugs based on a single trial for nearly 30 years, and data shows the agency already accepts single trials in roughly 66% of cases for new molecular entities, particularly in rare disease and oncology. The change here is in making this the default rather than the exception, and in extending the principle more broadly to common diseases and conditions.

For companies, there are several practical considerations to work through:

• Guidance gap: At this point, the single-trial standard exists only as an NEJM opinion article co-authored by two officials, one of whom is departing the agency. Companies want to see formal guidance with real specificity about when the FDA will accept one trial versus two, and under what conditions.

• Consistency across review divisions: The FDA has a wide array of internal review divisions, each with its own culture and standards. A company with a broad portfolio could find some divisions fully embracing the single-trial approach while others continue to insist on two trials. Without a mechanism for ensuring consistency, the policy risks creating more confusion than clarity.

• Cost implications: If a company shifts its development strategy from two medium-sized Phase 3 studies to one very large pivotal trial, and the FDA subsequently decides it needs additional data, the company could end up with a larger trial plus a supplemental study (a potentially more expensive scenario than the two-trial approach it replaced).

• International harmonization: Most companies are not developing products solely for the U.S. market. Evidence packages need to be acceptable to the EMA, PMDA, Health Canada, the TGA, and other international regulators. A shift away from a known evidentiary standard introduces regulatory uncertainty across all of these jurisdictions, even if the ultimate single-trial standard may be favorable for the sponsor.

Moderna’s experience is instructive here. The company appeared to submit evidence that should have aligned with the new standard, but was effectively told the FDA would not even review the data. The lesson for industry: watch the actions, not just the words.

AI is getting operationalized at the FDA

The FDA’s internal use of AI has been a priority of the Makary administration, and recent months have brought meaningful new details about what that looks like in practice.

Elsa and the shift from Claude to Gemini

The FDA’s primary AI tool is Elsa, a platform containing multiple foundational large language models that launched agency-wide in mid-2025. Internal data indicates that more than 70% of FDA staff now use Elsa voluntarily. The tool assists with reading, writing, summarizing, safety profile assessments, label comparisons, and supporting nonclinical database development.

A significant supply-chain disruption affected FDA’s AI stack in late February. Because Claude had been one of the models available within Elsa, FDA said it was implementing a ‘phase transition’ away from that component, with Gemini positioned to play a larger role.

This raises important questions about model dependency: if an agency’s workflows are built on a particular AI model and that model suddenly becomes unavailable, can it disrupt entire operational pipelines?

Agentic AI deployment

In December 2025, the FDA expanded its AI capabilities by deploying agentic AI, or systems capable of planning, reasoning, and executing multi-step tasks across all agency departments. The rollout leverages Google’s Gemini enterprise platform and is designed for more complex workflows than Elsa’s standard generative AI capabilities. The agency launched a two-month Agentic AI Challenge, encouraging staff to develop new use cases, with demonstrations planned for the FDA Scientific Computing Day.

At the FDA’s Rare Disease Day event on February 23, specific details emerged about how AI is being used in product reviews.

The Office of Oncologic Diseases is conducting a pilot using Elsa to support pediatric study plan reviews. Pediatric oncologists with AI expertise developed specialized prompts, tested them against previously reviewed study plans across multiple models, and are now rolling those prompts out to broader review staff. Reviewers are using the AI-assisted approach in parallel with traditional review processes and providing standardized feedback on the results.

This measured, incremental rollout stands in contrast to some of the more ambitious messaging from agency leadership about AI’s potential to dramatically accelerate reviews. In practice, the approach appears cautious and duplicative by design—running AI alongside human review rather than replacing it.

A key concern from industry: the FDA has not announced any formal procedure for disclosing when AI is used in product reviews. Companies that meticulously scrutinize FDA correspondence and action packages to ensure accuracy may now face uncertainty about whether the language in those documents was generated by a human reviewer, an AI, or some combination of the two. This transparency question could well surface during the upcoming user fee reauthorization discussions in Congress.

FDA-EMA collaboration on AI

Internationally, the FDA and the European Medicines Agency (EMA) are collaborating on the regulatory use of AI. Last year, the two agencies published guiding principles on AI in drug development, and a coordinated AI glossary is expected this year to establish shared terminology. The EMA’s Novel Data Steering Group recently published a comprehensive work plan covering how it intends to integrate AI considerations into its regulatory framework over the coming years, including alignment with the EU AI Act.

AEMS: a unified Adverse Event Monitoring System

On March 11, the FDA launched the Adverse Event Monitoring System (AEMS), a unified platform that consolidates what had been a fragmented patchwork of seven separate adverse event databases into a single streamlined dashboard.

The system already includes reports for drugs, biologics, vaccines, cosmetics, and animal food, with medical devices, human foods, dietary supplements, and tobacco products slated for integration by the end of May 2026.

The legacy systems being retired include FAERS (the FDA Adverse Event Reporting System for drugs and biologics), VAERS (the Vaccine Adverse Event Reporting System, co-owned with CDC), and AERS (the animal drug adverse event system). The agency says the consolidation will save approximately $120 million over five years, down from the roughly $37 million per year it costs to operate the fragmented systems.

The most consequential change for industry is the shift from quarterly data releases to real-time publication of adverse event reports. Under the previous framework, the delay in data availability led to a high volume of Freedom of Information Act requests from companies and researchers seeking the latest safety information ahead of quarterly reports. AEMS should significantly reduce that administrative burden.

Read more

On March 11, the FDA launched the Adverse Event Monitoring System, or AEMS. It’s a single, unified platform that replaces the patchwork of reporting databases the agency has relied on for years. By the end of May 2026, every adverse event report across every FDA-regulated product category will flow through this one system.

This is one of the bigger infrastructure changes the FDA has made to its postmarket surveillance program in a while.

Here’s what happened, what’s changing, and what it means if you work in quality, regulatory, or pharmacovigilance.

What AEMS replaces

If you’ve ever filed an adverse event report with the FDA (or tried to search one) you maybe know the frustration. The agency has been running seven separate databases, each built for a different product center, each with its own interface, its own quirks, and its own limitations.

The legacy systems being retired or absorbed include:

Already live in AEMS (as of March 11):

• FAERS (FDA Adverse Event Reporting System) — drugs, biologics, cosmetics, and color additives

• VAERS (Vaccine Adverse Event Reporting System) — vaccines (co-managed with the CDC; FDA will display VAERS data within AEMS)

• AERS (Adverse Event Reporting System) — animal drugs and animal foods

Migrating to AEMS by the end of May 2026:

• MAUDE (Manufacturer and User Facility Device Experience) — medical devices

• HFCS (Human Foods Complaint System) — human foods and dietary supplements

• CTPAE (Center for Tobacco Products Adverse Event Reporting System) — ENDS and other tobacco products

That’s drugs, biologics, vaccines, devices, food, cosmetics, tobacco, and veterinary products all under one “data roof.”

Why this is happening

The FDA says its fragmented reporting infrastructure was expensive, hard to use, and created blind spots in post-market surveillance. By the agency’s own numbers, those seven databases processed roughly 6 million adverse event reports per year and cost approximately $37 million annually to operate.

The new system is expected to save around $120 million over the next five years.

Beyond cost savings, the agency is making a transparency play. AEMS will publish adverse event reports in real time rather than on the quarterly cycle most of the legacy systems followed. The FDA expects this will significantly reduce the volume of FOIA requests for adverse event data, since the information will already be publicly accessible through a searchable dashboard.

The agency also plans to migrate historical data from the legacy systems into AEMS and roll out new APIs and data analytics tools, including, notably, AI-based tools for signal detection, redaction, and digitization.

What this means for the industry

If you’re in pharma, biologics, or medical devices, here are the practical implications worth tracking:

• Your reporting workflows may need to change. As AEMS absorbs each legacy system, the submission interfaces and data formats will shift. If your adverse event reporting SOPs reference specific legacy system procedures (and they probably do) start planning for updates. The device side (MAUDE migration) is still a few months out, so device companies have a window to prepare.

• The data you submit will be more visible and faster. Real-time publication means your adverse event reports will be publicly searchable much sooner than they were under the old quarterly release model. This has implications for how quickly competitors, plaintiffs’ attorneys, journalists, and patient advocacy groups can access your safety data. Quality and regulatory teams should be aware of this compressed timeline.

• Cross-product signal detection gets easier for the FDA and for you. One of the structural problems with the old system was that safety signals spanning multiple product categories were hard to spot because the data lived in siloed databases. A unified platform makes cross-product surveillance possible in a way it wasn’t before. This is particularly relevant for combination products and companies with portfolios spanning drugs and devices.

• AI-driven analytics are coming. The FDA has signaled that AI tools will play a role in scanning for safety signals within AEMS. Jeremy Walsh, the agency’s Chief AI Officer, described the rollout as the biggest technical transformation in agency history. For regulated companies, this likely means the agency’s ability to detect patterns and clusters in adverse event data will accelerate, which means your internal signal detection and response capabilities need to keep pace.

• The data still has limitations. It’s worth noting — and the FDA itself acknowledges this — that AEMS data carries the same fundamental limitations as the legacy systems it replaces. Reports don’t establish causation! Duplicate and incomplete reports exist! Information hasn’t been independently verified! Occurrence rates can’t be derived from the data alone. The platform is better, but the underlying data quality challenges remain.

A note on real-time publication

Not everyone is enthusiastic about the real-time transparency angle. Peter Pitts, president of the Center for Medicine in the Public Interest and a former FDA associate commissioner, has raised a valid concern to RAPS: releasing raw, unvetted adverse event data to the public in real time risks misinterpretation. Without FDA staff reviewing and contextualizing the reports before publication, there’s a real possibility that patients, media, or advocacy groups draw conclusions the data doesn’t support.

This is the tension at the heart of the AEMS rollout: more transparency is generally good, but raw data without expert interpretation can be misleading, especially in the hands of people who don’t understand the limitations of spontaneous reporting systems.

What to do now

A few action items to think about:

• Audit your current AE reporting SOPs for references to legacy systems (FAERS, VAERS, MAUDE, etc.) and flag them for revision as AEMS timelines firm up.

• Brief your pharmacovigilance and quality teams on the shift to real-time publication and what that means for your internal review and response timelines.

• Monitor the AEMS public dashboard to understand how your product data appears in the new system and whether historical migration introduces any data quality issues you need to address.

• Evaluate your signal detection capabilities. If the FDA is layering AI tools on top of a unified data set, your internal surveillance should at least match the rigor of what the agency will now be able to do.

• Watch for the May migration deadlines, particularly if you’re in medical devices (MAUDE) or food/dietary supplements (HFCS).

Read the FDA’s news release »

Who is The FDA Group?

The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.

With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.

Share The FDA Group's Insider Newsletter

If you’ve been following our AICA series so far, you already know what the platform does, you’ve read through our FAQ, and you’ve seen how quality teams can put it to work across internal audits, supplier audits, and inspection readiness.

Today’s piece is for a different audience (or maybe more accurately, the same audience’s next conversation).

Because here’s what often happens in practice when a quality leader decides to evaluate a tool like AICA: they bring it to IT. And IT often has questions about where data lives, how it moves, who can access it, how it interacts with AI models, and what deployment options look like.

We’ve been fielding these questions since launching earlier this month, and we want to answer them publicly so you have something concrete to share internally. No hand-waving or vague assurances here. Just actual answers.

Let’s walk through each one. As always, if you or others have questions we don’t cover here, head over to aica.thefdagroup.com to ask.

Where your data lives in AICA

AICA is hosted on Microsoft Azure servers located in the United States. All application databases and storage services are hosted in the Azure region selected for the deployment, so your information remains physically within U.S. data centers. Azure does not move data outside the country unless explicitly configured for cross-region replication, and AICA’s default configuration does not enable that.

This is a straightforward point, but it matters a lot for many teams, especially those with stringent data protection concerns. For organizations subject to data residency requirements or internal policies about where regulated data can be stored, the answer is clear: your data stays in the U.S., in Azure, under defined access controls.

How your data is protected in transit and at rest

AICA uses a multi-layered security architecture. Here’s what that means in specific terms.

• In transit: All exposed connections use TLS encryption. Every data transmission between your browser and the AICA platform, and between AICA’s internal components, is encrypted in transit.

• At rest: Sensitive information stored within the platform (your uploaded documents, analysis reports, and associated data) is protected by the built-in encryption mechanisms of Azure’s cloud storage services. Documents are stored in isolated, access-controlled environments.

• Network architecture: The platform minimizes its attack surface through reverse proxy implementation and API management. Cloud resources are network-isolated via firewalls and private connectivity, meaning the infrastructure isn’t broadly exposed to the public internet.

Authentication and access controls

AICA uses mandatory token-based authentication built on JWT (JSON Web Token) standards, integrated with OpenID Connect-compliant identity providers. In practical terms, this means the platform plugs into standard enterprise identity infrastructure.

Access within the platform is managed through centralized role-based access control (RBAC) with granular permission management. Your organization’s admin defines roles and permissions during onboarding (like who can upload documents, who can review observations, and who can export reports), and group-based access controls provide precise resource authorization.

All access is encrypted, logged, and fully auditable within the secure Azure environment.

Who can see your documents

This is probably the single most common question we hear from IT and quality teams. The short answer: essentially no one, unless you have a problem and ask for help.

Your audits and uploaded documents are not viewed by humans. No one at The FDA Group or EPAM, our development partner, personally reviews your documents unless you explicitly opt in to share them for model improvement through an optional setting.

A very small number of authorized FDA Group employees may access data only when needed for two specific scenarios: addressing platform security issues, or resolving technical problems you report. This access is tightly controlled, audited, and restricted under strict privacy and security policies.

How AICA interacts with AI models, and what happens to your data

This is where IT teams tend to have the most nuanced questions, and rightly so.

Here’s how it works:

AICA functions as an orchestration layer. It takes your uploaded QMS documents and the regulatory requirements you’ve selected, structures the analysis, and routes the work through cloud-based large language models (specifically Azure OpenAI) using The FDA Group’s designated cloud AI subscriptions.

The key question everyone asks: does my data get used to train the AI model? No, not directly. AICA retains conversational data and prompts in system logs exclusively for governance and compliance purposes. Your documents are not incorporated into model training datasets. When interfacing with the third-party LLM, Azure OpenAI's processing, retention, and use of data are governed by the service agreements between The FDA Group and Microsoft, which, under Microsoft’s enterprise AI terms, means your data is not used to improve or train foundation models.

All log data is stored within Azure Blob Storage provisioned within The FDA Group’s cloud infrastructure. Access controls and security configurations for that storage remain under the exclusive administration of The FDA Group’s IT department.

A little more context on how we “train” AICA:

AICA is not a general-purpose AI that learns from everything it processes (like ChatGPT or any other "off the shelf” LLM). The platform was built on a foundation of curated biopharma QMS documents provided specifically for that purpose by regulatory subject matter experts.

When you upload documents to AICA, they are analyzed and a report is generated. The system does not automatically absorb, retain, or learn from your documents as part of that process. Your data is stored in isolated, encrypted environments on Microsoft Azure’s U.S.-based infrastructure, and it is never exposed to other customers or made available in any public domain.

Our legal agreements do include provisions that allow The FDA Group to use customer data to improve AICA’s capabilities over time. However, this is not something that happens passively or automatically. AICA’s architecture requires direct human involvement from qualified subject matter experts to review outputs and provide structured feedback before any model improvements can take place. In practice, this means any use of customer data for training would involve a deliberate, resourced engagement, not a behind-the-scenes process.

If your organization prefers that your data not be used for model improvement under any circumstances, you can opt out, and that preference will be honored. We recommend discussing your specific requirements with us during the agreement phase if this is a concern.

Data privacy controls

AICA includes several configurable features designed to support your organization’s data privacy requirements:

• Document retention is entirely in your control. Documents can be deleted immediately after AICA completes its analysis if you prefer not to store them in the platform. You can also configure automated deletion policies based on your organization’s data retention requirements (for example, automatically purging conversation logs and sensitive files after a set interval).

• Analysis reports don’t contain your source documents. The reports AICA generates include references to your documents (document names, specific sections), along with the gap analysis and recommendations. But the actual QMS documents themselves are not embedded in the reports. You can export reports at any time and manage them according to your internal document control procedures.

• An interceptor framework examines communications bidirectionally — both user prompts going to the LLM and responses coming back. This lets us implement custom validation logic for detecting and handling sensitive information or personally identifiable information (PII), and to modify or block requests containing prohibited content. These capabilities help minimize and control the lifetime of PII within the platform.

• The collection of conversation logs is configurable. If your organization’s policies require it, you can disable conversation logging entirely.

What about hallucinations and content safety?

These are fair questions for any platform built on large language models. Let’s walk through it:

• AICA functions as an orchestration layer — it structures and directs the analysis, but does not incorporate its own generative AI logic. What that means in practice: AICA’s value comes from how it structures the audit task, how it maps your documents against specific regulatory requirements, and how it presents findings for human review. The platform is not generating free-form creative output.

• That said, the limitations inherent to LLMs — including the potential for inaccuracies — are why AICA is designed with human-in-the-loop as a non-negotiable requirement. Every observation the platform generates must be reviewed and approved by a qualified quality professional before the report is finalized. The platform is explicit about this: AI-generated findings are preliminary until a human validates them.

• Responsible AI measures, content filtering, and safety controls operate at the LLM layer through Azure OpenAI’s built-in capabilities, which are governed by Microsoft’s responsible AI policies.

Deployment options

AICA’s default deployment is cloud-based SaaS, meaning you access it through your web browser, no local installation required. This works for most organizations and gets you from contract to first audit in one to two weeks.

For organizations with more stringent security requirements around the cloud, AICA can be deployed on your own private cloud infrastructure. In this configuration, the platform runs within your cloud perimeter. Your data never leaves your controlled environment, and your IT team manages access at the infrastructure level.

Private cloud deployment is a more involved implementation that we handle on a case-by-case basis, and several enterprise firms have already expressed interest. If this is a requirement for your organization, it’s worth raising early in the conversation so we can plan the deployment accordingly.

Technical requirements at a glance

For the standard cloud deployment, the technical requirements on your end are minimal:

• Supported browsers: Google Chrome (latest version), Microsoft Edge (latest version), and Safari (latest version) are fully supported. Firefox and Internet Explorer are not currently supported.

• Supported devices: Desktop and laptop computers are fully optimized. Tablets have limited support in the current release phase. Mobile devices are not supported in the current release.

• File formats accepted: PDF files (including scanned documents via OCR) and Microsoft Word documents (.doc and .docx). The maximum file size per document is 512 MB.

• Concurrent users: Multiple users can access AICA simultaneously, with role-based permissions defined by your organization’s admin during onboarding.

No specialized technical expertise, local software installation, or IT configuration is required on the end-user side.

Intellectual property and liability

Two more questions that come up during IT and legal review:

• Who owns the content AICA generates? Intellectual property rights and copyright ownership for any content generated through the platform are governed by the terms and conditions in the service agreement between your organization and The FDA Group. AICA functions as an intermediary tool; it doesn’t independently claim ownership of outputs.

• Who is responsible for AI-generated content accuracy? Liability considerations regarding content accuracy and appropriateness are determined by the contractual arrangements between your organization and The FDA Group as specified in the applicable service agreements. This is also why human review of all findings is built into the platform’s workflow: it ensures that your qualified quality professionals, not the AI alone, are responsible for the conclusions in your final audit reports.

A note on what’s still evolving

We want to be transparent: AICA is a newly launched platform, and some of the technical details covered here will continue to develop. Enhanced concurrent user scaling, additional eQMS integration capabilities, and expanded deployment configurations are all on the roadmap. As these evolve, we’ll update our technical documentation and let customers know what’s changed.

If your IT team has questions that aren’t addressed here, we want to hear them. Every technical question we field helps us build better documentation and a better product. Reach out through our contact form.

What’s next in this series

We've now covered the platform overview, the FAQ, practical use cases, and the security and IT deep dive. Coming up next:

• The benchmarking data behind AICA: A closer look at our internal auditor consistency study — what the overlap numbers mean and what they reveal about the state of traditional auditing.

• The regulatory landscape for AI in compliance: Where AI tools fit in a GxP environment, how to think about validation, and what the industry conversation around AI-assisted auditing looks like right now.

Have questions or want to get a demo?

If you've been following this series and want to see the platform for yourself, request a demo at aica.thefdagroup.com. We’re currently in conversation with a number of firms with onboarding starting soon. Talk to us!

What is AICA?

AICA (the Audit Intelligence Compliance Assistant) is an AI-powered compliance auditing platform purpose-built for pharmaceutical and biologic companies.

Developed by The FDA Group in partnership with EPAM Systems, AICA is trained by 15+ FDA and ISO regulatory experts on real-world pharma QMS documentation. Upload your documents, select which regulations to audit against, and get a comprehensive gap analysis of your entire QMS in hours, not days or weeks. Every finding goes through human review before the final report.

See it in action:

AICA currently supports 21 CFR Parts 11, 211, and 600, with additional regulations in active development.

Learn more, read our FAQs, or request a demo at aica.thefdagroup.com.

Share The FDA Group's Insider Newsletter

This breakdown is available for paid subscribers. Only paid subscribers get regular full access to our breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.

On March 3, 2026, the FDA’s Center for Drug Evaluation and Research (CDER) issued three warning letters to very different operations:

• A domestic OTC manufacturer in Illinois.

• A German sterile drug facility producing for the U.S. market.

• A contract testing laboratory in India.

The inspections behind these letters took place between August and September 2025, and all three letters were posted publicly on March 10.

On their own, of couse each letter tells a site-specific story. Read together though, they tell a much bigger one. The pattern across them is unmistakable: The FDA isn’t just citing CGMP violations. It’s systematically rejecting the corrective action responses firms submitted after their 483s, and it’s doing so in pointed, detailed language that should concern anyone managing a quality system that runs CAPAs.

Let’s walk through what the FDA found, what connects these cases, and what the enforcement posture tells us about where things are headed.

Water and utility systems remain a top structural vulnerability

Two of the three letters center on water or utility system failures. This isn’t new. We’ve been writing about water as a recurring FDA target for years, but the specifics here are worth lingering on.

At the domestic OTC facility in Illinois, the water system consistently failed to meet chemical specifications. The performance qualification report itself contained extensive sampling data showing most samples didn’t meet USP standards, and the firm approved the qualification study anyway. Subsequent data collected over a two-year span (August 2023 through August 2025) showed that nearly all samples continued to fail. The firm used this water to manufacture finished drug products the entire time.

• The system also had known dead-legs, including at points of use in the production area. FDA recovered gram-negative organisms including Pseudomonas aeruginosa and Serratia marcescens from the system.

• The firm committed to stopping use of the system and purchasing water in the interim, but FDA found the response inadequate because it failed to address the quality unit’s prolonged inaction in the face of a long-standing pattern of failing results.

That last point is super important. The FDA didn’t just object to the bad water data. It objected to the quality unit watching the data fail for two years and doing nothing meaningful about it.

At the German sterile facility, cleaning use points associated with ISO 5 aseptic processing and RABS lines were fed through excessively long deadlegs from the utility loop. Between June 2023 and September 2025, routine testing at those cleaning use points produced at least 47 microbial recoveries, with 14 exceeding action limits.

Recovered organisms included Sphingomonas, Methylobacterium, Bradyrhizobium, and Ralstonia (gram-negative, biofilm-forming species that are exactly the kind of organisms you do not want anywhere near aseptic production).

Investigations at that site had already identified the piping design as the most likely root cause. But the CAPAs failed to comprehensively address the design deficiency. FDA’s letter makes clear that the firm’s response (committing to sanitization cycles and procedural changes) didn’t fix the fundamental problem: the pipes feeding their cleanrooms were insanitary by design.

Our auditors continue to see the same dynamic at sites across the industry.

• Water systems are designed or qualified once, and then the data tells a story that nobody wants to act on because the fix is expensive (repiping, system redesign, capital expenditure).

• Firms layer on procedural controls, enhanced monitoring, or interim measures, and the underlying engineering problem persists. The FDA has been explicit for years that this approach doesn’t work, and these letters reinforce that position in the strongest terms.

The key point here: If your water system has known dead-legs, persistent excursions, or a qualification study you approved despite failing data, the time to act is now.

Data integrity: from the lab bench to the garbage bag

The contract testing laboratory in India received the most damning findings of the three, and they go well beyond typical data integrity observations.

FDA investigators discovered two garbage bags containing torn analytical records. Chromatographic results, unidentified number lists, and impurity method validation spreadsheets with handwritten notes.

• For at least one method validation study, the official records contained only handwritten values, while the original data had been discarded in those garbage bags. The firm’s own SOPs prohibited exactly this: destroying records or instrument printouts and required filing such documents with original data for traceability.

• Lab staff were also using unofficial personal diaries to record procedures, analytical observations, results, method modifications, and deviation descriptions with no procedures to control or retain these records.

But it gets worse. At the start of the inspection, FDA investigators observed the firm attempting to remove the two garbage bags that were later determined to contain analytical documents. The firm also initially denied using internal audit forms that were later discovered in the microbiology lab manager’s office, and the manager told the FDA that senior management had instructed him not to share details about audits with the investigator.

The FDA (unsurprisingly) invoked Section 501(j), stating that the firm delayed or limited access to requested records during the inspection, causing the drug products it tested to be deemed adulterated. That’s always a significant escalation. It means every drug tested at that lab is now under a regulatory cloud, regardless of which client sent the samples.

Separately, the lab changed a TNTC (Too Numerous To Count) microbial result to a passing result in a revised test report, with no investigation or supporting documentation to justify the change. When confronted, the firm said the sample wasn’t for the U.S. market and that the customer had directed them not to investigate OOS results because the testing was “for informational purposes only.”

The FDA rejected both arguments outright. A quality agreement with a client does not supersede CGMP responsibilities. And the fact that the lab operates with a single set of procedures, equipment, and practices for all products tested means that integrity failures on non-U.S. work directly compromise the reliability of U.S. testing.

This is as clear a statement as the FDA has made recently on contract lab accountability. If you’re using a contract testing lab, the message is not complicated: their CGMP failures are your CGMP failures.

At the Illinois OTC facility, data integrity issues were less dramatic but still significant. The firm failed to contemporaneously record negative microbiology results. Blank entries were later auto-filled as zeros. During the inspection, the FDA found a plate that had been counted at 20 CFUs, then discarded without recording the result. The firm also couldn’t provide complete microbial sampling results from the water system, with data split across paper and electronic formats and some records simply missing.

FDA characterized this as “a significant risk of systematic underreporting of microbial findings.” That phrase — ”systematic underreporting” — is the kind of language that elevates a documentation deficiency into something much more consequential.

The lesson across both sites: The FDA is looking at your data practices holistically, not just checking whether individual test results are recorded correctly. If your systems allow data to be lost, discarded, unrecorded, or changed without justification, FDA will characterize it as a data integrity failure, and the remediation demands will be extensive.

The quality unit problem runs through everything

Across all three letters, FDA points to breakdowns in quality oversight. In two, that criticism is explicit and direct. In the other, it shows up through failures in review, investigation, maintenance, validation, and decision-making regarding contamination control.

• At the Illinois OTC site, the quality unit monitored water system data failures for 2 years without prompting meaningful action. Microbiology results were either unrecorded or discarded. The FDA demanded a comprehensive assessment and remediation plan to make sure the QU is given the authority and resources to effectively function.

• At the German sterile site, the quality unit relied on transcribed data rather than reviewing raw results. It allowed barrier integrity testing to proceed under acceptance criteria that permitted repeated failures. It didn’t force design-level CAPAs when investigations identified root causes in system design. It accepted decontamination validation results with routine BI positives for years.

• At the Indian contract lab, the quality unit failed to ensure CGMP records were retained. Records were literally in the trash. Deviations were documented on unofficial audit forms outside the QMS, with no CAPA tracking. Senior management instructed staff not to share information with FDA investigators. The QU’s entire framework for oversight had broken down.

In two cases here, the FDA explicitly demanded comprehensive remediation to make sure the quality unit has the authority and resources to function effectively. In the third, the FDA focused its remediation demands more heavily on design, maintenance, decontamination, and contamination-control failures, while still signaling broader quality-system weakness

This isn’t a new theme! But the consistency across three simultaneous letters from the same office makes it worth underscoring. The FDA views quality unit independence and authority as a prerequisite for everything else. If the QU can’t or won’t force action on failing data, flawed investigations, or known design deficiencies, then every other system downstream (validation, testing, release, stability) is compromised.

If your quality unit doesn’t have documented, exercised veto authority over batch release and CAPA closure, that’s the single highest-leverage fix you can make.

The FDA’s response-rejection language is getting sharper

One of the most striking features of these letters is how directly the FDA rejects the firms’ 483 responses. We used to see a lot of boilerplate language about this, but here the language is specific and, in several places, almost adversarial.

• At the Illinois OTC site, the FDA acknowledged the firm’s commitment to stop using the water system and purchase water in the interim. Then it said the response was inadequate because it didn’t address the quality unit’s “protracted insufficient action” in the face of a long-standing failure pattern. On the data integrity observations, the FDA said the response “lacks steps to systemically address your inadequate oversight of data integrity.”

• At the German sterile site, the FDA rejected multiple elements of the response. On the water system: “Your corrective actions fail to address the fundamental, self-identified design flaw.” On decontamination validation: “You failed to address multiple years of consistent recoveries of positive BIs.” On barrier integrity testing: “Your response calls into question the reliability of your testing program.” On fiber shedding: “Your response did not address your failure to evaluate particle generation in the replacement material when you implemented a change control.”

• At the Indian contract lab, the FDA rejected the firm’s claim that destroyed validation documents weren’t related to U.S. products by pointing out that the facility operates with a single set of procedures for all work. It rejected the claim that a client-directed testing arrangement superseded CGMP obligations. It called out the firm’s updated SOP for internal audits as allowing deficiency identification “outside of the Quality Management System without providing guidelines on when personnel must use the QMS framework.”

The message embedded in this language is clear: if your 483 response addresses the specific observation but not the systemic cause, the FDA will reject it, and the warning letter will be more demanding than the 483 was. Firms that treat 483 responses as a compliance checklist rather than an opportunity to demonstrate systemic understanding of their failures are setting themselves up for exactly this outcome.

The bigger signal in these letters

These three letters, issued on the same day from the same CDER office, share a common enforcement posture that goes beyond any individual finding. Let’s be precise:

• The FDA is evaluating whether firms understand the systemic nature of their problems; not just whether they’ve proposed a fix for each observation.

• Procedural CAPAs without design-level or structural remediation are being explicitly rejected.

• Quality unit authority and independence are threshold issues. If the FDA doesn’t see evidence that the QU can force action, everything else is suspect. It’s the seed of doubt.

Read more

Since we rolled out AICA at the beginning of March, we’ve published a full launch explainer walking through the platform, the technology, the partnership, and the security architecture. Then we followed up with an FAQ tackling the questions we’d been hearing from quality leaders, IT teams, and compliance professionals. (If you haven’t read those yet, start there. They’re the foundation.)

Today, we’re shifting gears. Instead of explaining what AICA is, we want to talk about what it does in practice.

Since launch, the conversations we’ve been having with quality and regulatory affairs teams have clustered around three core use cases that map directly to the work these teams are already responsible for, just done better by (responsibly and safely) leveraging AI.

Let’s walk through each one.

1. Internal audits that cover your QMS

This is the use case most teams gravitate toward first and most frequently. Internal audits are a regulatory requirement, they consume significant time and resources, and the coverage you get from a traditional sampling approach is, frankly, limited much of the time.

To quickly reiterate the tension most quality leaders live with that we’re trying to address:

• Your internal audit schedule says you’ll audit a given area once or twice a year.

• When that audit happens, your auditor pulls a sample of QMS documentation, reviews it against the applicable regulations, writes up findings, and both parties move on until the next audit.

• The rest of the documentation doesn’t get touched until next cycle or an actual investigator comes in.

Teams know they’re not touching areas where gaps could be. You just can’t get to all of them with the time and people you have.

AICA can change the math here. Instead of sampling, you upload all of your documentation for a given area and run the analysis against the regulations that apply. Every document gets reviewed. Every applicable requirement gets checked, and you get results in hours.

This doesn’t replace your internal audit. It precedes it to make it more efficient.

Think of AICA as the documentary review phase of your internal audit, run at machine speed. Once you have AICA’s output, your auditors can focus their time on the things AI can’t do: interviewing personnel, observing processes, verifying that what’s documented is actually what’s happening on the floor, and applying the kind of situational judgment that only comes from experience.

The practical workflow here looks like this:

1. Before your scheduled internal audit of a given area, run that area’s QMS documentation through AICA.

2. Review the observations with your quality team. Include, edit, or reject findings based on your institutional knowledge.

3. Then hand the validated output to your auditor as a starting point. They walk into the audit with a complete documentary baseline already in hand, so they can spend their time on implementation verification rather than reading SOPs.

One more thing worth noting: because AICA can run the same analysis any time you want, you’re no longer limited to your audit schedule to get documents reviewed against regulations. If you update a batch of procedures after a CAPA, you can run a quick check to confirm the new documentation is compliant before your next scheduled audit. “Proactive compliance monitoring” finally means something in a workflow like this.

2. Supplier audits with less overhead and better coverage

Having supported thousands of firms, we know supplier management is one of the most resource-intensive parts of a quality program (especially for companies with complex supply chains).

You need to qualify suppliers, audit them on a regular schedule, follow up on corrective actions, and maintain documentation for all of it.

The challenge with supplier audits is similar to internal audits: limited time, limited coverage, but with an added layer of complexity much of the time: you’re dealing with someone else’s documentation, someone else’s quality system, and often someone else’s timeline.

AICA applies here straightforwardly: When a supplier provides their QMS documentation for review (which they do as part of qualification or ongoing monitoring), you upload it into AICA and run it against the regulations that apply to what they’re supplying.

You get a comprehensive gap analysis of their documentation (not a sample, all of it) with specific regulatory references for every finding.

This is useful in a few scenarios:

• During initial supplier qualification, it gives you a thorough documentary assessment before you commit to an on-site audit or a long-term relationship.

• During routine supplier monitoring, it lets you verify that suppliers’ documentation remains compliant without dispatching an auditor every time. And when you’re following up on supplier corrective actions (SCARs), you can re-run the relevant documentation to confirm the gaps have actually been addressed.

• For desktop audits in particular, where you’re reviewing documentation without going on-site, AICA effectively does the heavy lifting. Your auditor reviews AICA’s observations, applies their judgment, and generates the report. What used to take days of manual document review can be compressed into a fraction of that time.

The result is that you can audit more suppliers, more thoroughly, with the same resources you have today. Or you can maintain your current supplier audit coverage and redirect the time savings toward the audits that genuinely require on-site presence and interviews.

3. Inspection readiness that isn't a fire drill

This is the use case that tends to resonate most with leadership: the VPs and directors who are ultimately accountable when an FDA investigator shows up.

Inspection readiness (in practice) usually looks like this at many drug firms: you get a notification (or you hear through the grapevine) that an inspection might be coming. A scramble begins. Your team pulls documentation, reviews it against the regulations you think the investigator will focus on, identifies gaps, tries to fix the most critical ones, and hopes the rest holds up.

It’s stressful, it’s reactive, and the coverage is almost always incomplete because there simply isn’t time to review everything.

AICA gives you a different way to approach this. Instead of waiting for the pressure of a potential inspection to trigger a review, you can run your QMS documentation against the relevant regulations proactively as often as you want.

• Preparing for an inspection focused on electronic records? Run your documentation against 21 CFR Part 11.

• Expecting scrutiny on your manufacturing controls? Run against Part 211.

• Want a full baseline across everything? Upload your entire QMS and audit against all applicable regulations at once.

The output gives you a clear picture of where your documentation stands relative to what regulators require. You see the gaps, the specific regulatory clauses involved, and recommendations for remediation, all prioritized so you know where to direct your team’s attention first.

What makes this genuinely different from a traditional pre-inspection review is completeness. When an investigator arrives, they’re not sampling your QMS the way an internal auditor might. They follow the threads that interest them, wherever those threads lead. The more of your documentation you’ve already reviewed and remediated, the fewer surprises you’ll encounter.

There’s also a subtler benefit here: When you can show an investigator that you’re conducting systematic, comprehensive QMS assessments as part of your ongoing compliance program (not just scrambling before inspections) it demonstrates a maturity of approach that regulators genuinely appreciate.

AICA’s reports are designed with this in mind. Every finding includes the specific regulatory clause, the non-conforming document, a clear explanation of the gap, and corrective action recommendations.

Whether you share those reports directly with investigators or use them to generate your own internal audit reports in your standard format, the underlying rigor is there.

A note on what AICA doesn’t do

We want to be clear about the boundaries with AICA, because we think honesty about limitations is just as important as enthusiasm about capabilities, especially in a regulated environment.

AICA reviews QMS documentation (your policies, procedures, and work instructions. It identifies gaps between what those documents say and what regulations require. That’s a critical piece of the compliance puzzle, but it’s not the whole picture.

AICA doesn’t verify that your team is actually following the procedures you’ve documented. It doesn’t review quality records like batch records or test results. It doesn’t conduct personnel interviews or training verifications. And it doesn’t perform physical facility observations.

These are things that require qualified auditors, on the ground, applying their professional judgment. AICA is built to augment that work, not replace it. It handles the document-intensive, time-consuming review layer so your auditors and quality professionals can focus their expertise on the areas where human judgment is irreplaceable.

We think that’s the right design for a regulated industry at the moment given where AI is now. You need the AI to extend your coverage. You need the human to validate and act on what it finds. AICA is built around both.

What’s next in this series

Over the coming weeks, we’ll continue going deeper on specific aspects of AICA:

• The benchmarking data behind AICA: A closer look at our internal study — how we tested auditor consistency, what the overlap numbers actually mean, and what they tell us about the state of traditional auditing.

• Security and IT deep dive: A detailed walkthrough of AICA’s security architecture for the IT and procurement teams who need to evaluate it.

• The regulatory landscape for AI in compliance: Where AI tools fit in a GxP environment, how to think about validation, and what regulators are actually saying about AI-assisted auditing.

Have questions or want to get a demo?

If you've been following this series and want to see the platform for yourself, request a demo at aica.thefdagroup.com. We’re currently in conversation with a number of firms with onboarding starting soon. Talk to us!

What is AICA?

AICA (the Audit Intelligence Compliance Assistant) is an AI-powered compliance auditing platform purpose-built for pharmaceutical and biologic companies.

Developed by The FDA Group in partnership with EPAM Systems, AICA is trained by 15+ FDA and ISO regulatory experts on real-world pharma QMS documentation. Upload your documents, select which regulations to audit against, and get a comprehensive gap analysis of your entire QMS in hours, not days or weeks. Every finding goes through human review before the final report.

See it in action:

AICA currently supports 21 CFR Parts 11, 211, and 600, with additional regulations in active development.

Learn more, read our FAQs, or request a demo at aica.thefdagroup.com.

Share The FDA Group's Insider Newsletter

This breakdown is available for paid subscribers. Only paid subscribers get regular full access to our breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.

Want to stay out of our warning letter breakdowns? Contact us to access our global network of 3,750+ consultants and 325+ former FDA employees. We run audits, mock inspections, and remediation for 17 of the top 25 life science firms.

A warning letter recently sent to a clinical researcher alleges that he collected samples from a patient as part of a clinical trial for an investigational product, despite the patient's repeated refusal and in violation of basic informed consent procedures.

Read the full warning letter

The investigator attributed this event to an inadvertent mistake and outlined a series of corrective and preventive actions to prevent it from happening again. The collected samples were also destroyed.

But the FDA wasn’t satisfied, and the reasons why are worth understanding, because they apply far beyond this one case.

Let’s quickly break it down and pull out the lessons it offers.

What happened at a glance

The FDA conducted an inspection of a clinical site in Denver between October and November 2024 under its Bioresearch Monitoring Program. The inspection reviewed the investigator’s conduct across two clinical investigations involving investigational drugs.

The core finding: a subject enrolled in one of the protocols had declined consent twice, in September and October 2023, for the collection of optional aqueous humor samples used for pharmacokinetic and pharmacodynamic assessments.

Despite that documented refusal, the site collected an aqueous humor sample from the subject’s study eye at a visit in March 2024.

The protocol was clear here. Subjects were required to sign the appropriate informed consent form before optional aqueous humor samples could be collected. This subject had explicitly declined. Twice. And yet the procedure was performed anyway.

The investigator's response

In a written response to the 483 dated December 3, 2024, the investigator acknowledged the event and characterized it as inadvertent.

The response described several corrective actions:

• The site reported the incident to the IRB after the sponsor's medical monitor flagged it.

• The subject was notified at their next visit.

• The collected sample was submitted for destruction (which the sponsor confirmed).

Going forward, the investigator stated the site would implement quick-reference labels on subjects' source binders and use an informed consent form tracking feature in the site's clinical trial management system (CTMS) to flag optional procedure consent status. The investigator also noted these measures would carry over to a new practice location.

Why the FDA found the response inadequate

The FDA acknowledged the corrective actions but found the response insufficient on a specific and telling basis: the investigator did not explain how the proposed corrective actions would actually be implemented.

The FDA wanted details on how they planned to operationalize the actions they outlined:

• How the labeling system or CTMS notation would work in practice.

• What training would be provided to the investigator and site staff.

• How those procedures would be used to accurately determine a subject’s consent status for optional procedures during a clinical investigation.

Put another way, the FDA’s issue wasn’t with the corrective actions themselves. It was with the lack of specificity about execution. Saying you’ll use labels or a CTMS feature is a plan in name only if you can’t describe the workflow, the training, and the accountability behind it, which is exactly what the FDA wants to see in just about every response, no matter what it’s for.

The FDA also flagged a deeper concern: the subject’s refusal was clearly documented in the record. This wasn’t a case where consent status was ambiguous or difficult to locate. The subject declined twice, and those refusals were in the file. The procedure happened anyway. That sequence of events (clear documentation, ignored documentation) raises questions about whether the site’s processes ensure that consent status is actually reviewed before procedures are performed, not just recorded somewhere.

A few practical lessons here

This letter is a useful case study for any clinical site or sponsor, not because the underlying issue is complex (it isn’t), but because it illustrates how a relatively straightforward compliance failure escalates when the response doesn’t meet the FDA’s expectations.

• Informed consent is not a one-time checkbox. Consent status, especially for optional procedures, needs to be verified at the point of care, every time. If your site relies on staff memory or a single consent form filing to ensure optional procedures are only performed on consenting subjects, that’s a process gap. Consent status for optional components should be visible and confirmable at the moment the procedure decision is made, not buried in a binder that someone has to go find and flip through.

Read more