21 U.S.C. § 374 — Inspection

(a) Right of agents to enter and inspect; notice; promptness; exclusions FDA officers who show proper credentials and give the owner a written notice can enter, at reasonable times, any factory, warehouse, or establishment where food, drugs, devices, tobacco products, or cosmetics are made, processed, packed, or held for interstate commerce. They can also enter any vehicle carrying those goods across state lines. Once inside, they can inspect — at reasonable times, within reasonable limits, and in a reasonable manner — the building, vehicle, equipment, finished and unfinished materials, containers, and labeling. For anyone (except farms and restaurants) who makes, processes, packs, transports, holds, or imports food, the inspection also covers certain records described in section 350c, but only under the standards and limits that section sets. For a facility that makes or processes cosmetics, the inspection also covers records described in sections 364a, 364b, and 364f, under those sections' own standards. For any factory, warehouse, establishment, or lab that makes, processes, packs, or holds prescription drugs, nonprescription drugs for human use, devices, or tobacco products, the inspection can reach everything in the place — records, files, papers, processes, controls, and facilities — that bears on whether the products are "adulterated" or "misbranded" (terms this section does not define) or otherwise violate the law. Even so, inspectors cannot look at: financial data; sales data other than shipment data; pricing data; personnel data (except records showing whether technical and professional staff are qualified); and research data. The research-data exclusion has its own exception: data about new drugs, antibiotic drugs, devices, and tobacco products that other laws require to be reported and inspected is not protected, and neither is comparable data about other drugs, devices, or tobacco products that a new drug would have to report under section 355(j). Each inspection needs its own separate notice, but inspectors don't need a fresh notice every time they walk back in during that same inspection. Every inspection must start and finish promptly. The records rule above (the "third sentence" of paragraph (1)) does not apply to four groups: pharmacies that follow local pharmacy and medicine laws, fill prescriptions from licensed practitioners for patients under those practitioners' care, and don't make drugs or devices for sale beyond their normal retail business; licensed practitioners who make drugs or devices only for their own patients; people who make drugs or devices only for research, teaching, or chemical analysis, not for sale; and any other group the Secretary exempts by regulation, after finding that inspecting them isn't needed to protect public health. When an inspection enforces the infant-formula rules in section 350a, the inspector can also access, copy, and verify records showing whether the formula meets those rules, or records section 350a requires the company to keep. If the FDA wants records from a drug or device manufacturer, or from a site or facility inspectable under paragraph (5)(C) below, the agency can ask for them ahead of or instead of a physical inspection. The company must hand them over within a reasonable time, within reasonable limits, in a reasonable way, in electronic or paper form, at its own expense. The FDA's request must explain what records it wants and why it's asking before or instead of inspecting. The FDA must confirm it received the records. The FDA can use those records to satisfy a preapproval or risk-based inspection, or to clear up problems an inspection found. None of this takes away the FDA's normal power to inspect. The FDA can also enter sites and facilities connected to clinical trials, to check the accuracy of studies and records supporting drug or device marketing applications. This covers records about how a study was run, its results and analysis, and how it protected human and animal subjects. It reaches sites owned by the study's sponsor, by anyone the sponsor hired to help, by an institutional review board or others hired by someone other than the sponsor, or by anyone else who ran such a study. Whoever holds those records must give the FDA access — letting the FDA copy the records, use the electronic systems that store them, and inspect the facilities, equipment, written procedures, and processes involved. This doesn't cancel any other law protecting confidential business or trade-secret information. These inspections, too, must happen at reasonable times, within reasonable limits, in a reasonable manner. The studies covered are: clinical and other studies backing a marketing application; postmarket safety work; any other clinical study of a regulated drug or device; and any other submission the FDA decides is worth inspecting for public health reasons. This part of the law just clarifies FDA's authority — it doesn't mean the FDA lacked this power before December 29, 2022. (b) Written report to the owner; copy to the Secretary After finishing an inspection of a factory, warehouse, lab, or other establishment, and before leaving, the inspector must hand the owner, operator, or person in charge a written report. The report lists anything the inspector saw that suggests the food, drug, device, tobacco product, or cosmetic is filthy, putrid, or decomposed, or was made, packed, or held in dirty conditions that could contaminate it or make it unsafe. A copy goes to the Secretary right away. If the establishment makes an approved drug that has a manufacturing-change notice on file, is or was on the drug-shortage list within the last five years, or falls under section 355(j)(11)(A), a copy of the report also goes promptly to the FDA's drug-shortage experts. (c) Receipt for samples taken If the inspector took any samples, before leaving the inspector must give the owner, operator, or person in charge a receipt describing what was taken. (d) Analysis of samples furnished to the owner If the inspector took a food sample and had it analyzed to check whether it's filthy, putrid, decomposed, or otherwise unfit to eat, the FDA must promptly give the owner, operator, or person in charge a copy of the results. (e) Accessibility of records Anyone required by section 360i or 360j(g) to keep device records — and anyone else who holds or is in charge of those records — must let a designated FDA officer see, copy, and verify them at reasonable times, on request. (f) Recordkeeping by accredited persons A person accredited to do device inspections (under this section's own program or under section 360m) must keep records showing its staff's training, how it handles confidential information, its pay arrangements, and how it spots and avoids conflicts of interest. On request, the accredited person must let a designated FDA officer see, copy, and verify these records at reasonable times, and must produce copies within 15 days of a written FDA request. (g) Inspections by accredited persons The FDA accredits outside organizations to inspect factories that make class II or class III medical devices, for inspections required under sections 360(h) or 360(i). A device maker eligible under paragraph (6) can pick an accredited inspector from the FDA's published list. The FDA publishes accreditation criteria in the Federal Register, tells applicants within 60 days whether their request is ready for review, and acts on it promptly. An accreditation states exactly which inspection activities the person is approved for. To qualify, an accredited person must: not be a federal employee; be an independent organization with no ownership, financial, or consulting ties to a device manufacturer, supplier, or vendor; be a legal entity allowed to do this work; not design, make, promote, or sell regulated products itself; and follow accepted professional and ethical practices. In writing, it must agree to: certify that its reports accurately reflect what it reviewed and observed; take on only work it's competent and able to handle; keep information it receives confidential (except from the FDA); promptly try to resolve complaints about its work; and keep any employee with a financial conflict of interest off device inspections, while publishing yearly disclosures about how well it and its staff avoid such conflicts. It must tell the FDA within 30 days if a device establishment it inspects loses, has suspended, or has restricted its quality-system certificate. It may also audit facilities for conformance with the quality-system standard mentioned in paragraph (7). The FDA posts online a list of accredited persons and what each is accredited to do, updated within a month of any accreditation, suspension, withdrawal, or change. To make sure accredited persons keep meeting the standards, the FDA periodically audits their performance by reviewing inspection reports and having its own people evaluate device establishments and the accredited inspectors. The FDA can withdraw an accreditation — after notice and a chance for an informal hearing — if the person substantially fails to meet the standards, threatens public health, doesn't act consistently with this program's purpose, or has a financial conflict of interest with an establishment it inspected. The FDA can suspend the accreditation while that process is pending. A device establishment can use an accredited inspector only if: its most recent FDA inspection was rated "no action indicated" or "voluntary action indicated"; and its owner or operator sends the FDA a notice giving the date and rating of that last inspection, stating an intent to use an accredited person, naming the specific person chosen, and certifying that at least one device made there is sold in the U.S. and at least one is sold (or meant to be sold) in a foreign country that recognizes that accredited person as an authorized inspector. Unless the FDA responds within 30 days of that notice — either denying clearance or asking for more information — the establishment is automatically cleared to use the accredited person it named. The FDA can ask the establishment for two-year compliance data showing its quality controls, including any outside inspection findings and how it fixed past problems, or ask the accredited person for information about its relationship with the establishment (limited to what the accredited person must already keep in its own records under subsection (f)(1)). The establishment or accredited person has 60 days to answer. After that, the establishment is cleared unless the FDA denies clearance within 60 days of getting the requested information. The FDA can deny clearance if it has evidence the establishment's certification was untrue, or if the establishment failed to show consistent compliance — in both cases the FDA must give the establishment a written statement of its reasons or evidence. The FDA can also reject the specific accredited person chosen, with a written statement of reasons, such as a failure to respond fully or FDA concerns about the relationship between the two. If rejected, the establishment can name a different accredited person and go through the same process again. If the FDA denies clearance or rejects the chosen inspector, the establishment can ask, within 30 days, for another FDA reviewer to look at the FDA's stated reasons; that review must start within 30 days of the request unless both sides agree to a different timeline. An accredited person must write down its inspection observations, present and explain them to the establishment's representative, and prepare a report designed to fit international quality-system standards; only the FDA can officially classify the inspection's results. The report must name who at the establishment is responsible for manufacturing-practice compliance, give the inspection's dates and scope, describe every observation in detail, note anything else relevant to compliance, and record any recommendations made during or at the end of the inspection. The report must go to the FDA and to the establishment's representative at the same time, no later than three weeks after the last day of inspection, and the FDA's copy must include all the written observations already given to the establishment. Anyone at the establishment who lies to an accredited inspector is subject to the federal false-statements law (18 U.S.C. § 1001). If an accredited person finds a condition that could create an unreasonable public-health risk, it must immediately tell the FDA which establishment and what condition. To help set inspection priorities, the FDA will also accept voluntary reports of ISO quality-system audits; if an owner chooses to submit one, it must submit all such reports from the past two years. The accredited person and whoever hires it agree on and pay its compensation. This program doesn't limit the FDA's own power to inspect any device establishment. For fiscal year 2005 and later years, no establishment may be inspected by an accredited person in a given year if, in each of the two prior fiscal years, the FDA spent less on its own device inspections than an "adjusted base amount" set by formula: the "base amount" is what the Government Accountability Office found the FDA spent inspecting devices in fiscal year 2002 (not counting inspections tied to reviewing applications under section 360e); the adjusted base amount for fiscal year 2003 is that base amount plus 5%; for every year after that, it's the prior year's adjusted base amount plus another 5%. This whole accredited-inspector program ends on October 1, 2027. Within four years of October 26, 2002, the Comptroller General had to report to Congress on: how many inspections accredited persons versus federal employees performed; how many people sought and received accreditation; why any were denied; how many audits the FDA ran of accredited persons and how good their inspections were; whether the program is getting the FDA better information than it gets from its own inspections; whether it's helping device makers rely on outside inspections to satisfy foreign governments; and whether Congress should keep, change, or end the program. The FDA must also list, in its annual report under section 393(g), every accredited person, what each is accredited for, and anyone whose accreditation was withdrawn that year. Nothing in this program affects any separate agreement between the FDA and a foreign government under section 383(b). Separately, the FDA can recognize outside auditing organizations — ones already recognized by international harmonization bodies — to inspect device establishments required to register or to be inspected under sections 360(h) and 360(i) (excluding devices licensed under 42 U.S.C. § 262). This doesn't affect the FDA's own inspection authority or its power to officially classify an inspection. (h) Improvements to the inspection process for device establishments For inspections that are not "for cause," the FDA had to review its device-inspection rules as they stood on August 18, 2017, and update them with uniform standards. Those standards must: allow reasonable exceptions; announce an inspection ahead of time, telling the owner or operator what kind of inspection it will be; give a reasonable estimate of how long it will take, let the establishment and inspectors talk in advance about working hours, and, where feasible, give advance notice of some records the inspector will ask for; and keep regular communication going during the inspection about its status, which either side may record if both agree in advance. If an establishment asks — in a timely way — for feedback on how it plans to respond to an inspection report under subsection (b), and that response involves a public-health priority, a major or system-wide action, or an emerging safety issue, the FDA must give nonbinding feedback within 45 days. None of this limits the FDA's normal power to inspect establishments to enforce the law.