21 U.S.C. § 360 — Registration of producers of drugs or devices

(a) Definitions "Manufacture, preparation, propagation, compounding, or processing" also covers repackaging a drug or device, or changing its container, wrapper, or label, as it moves from the original maker to the person who finally sells or delivers it to the user. "Name" includes, for a partnership, the name of every partner; for a corporation, the name of every officer and director and the state where it was incorporated. (b) Annual registration (1) Every year, between October 1 and December 31, anyone who owns or runs a drug-making establishment must register with the Secretary: their name, their business addresses, every such establishment, a unique facility identifier for each one, and a contact email address. (2) In that same window, anyone who owns or runs a device-making establishment must register their name, business addresses, and every such establishment. (3) The Secretary picks the unique facility identifier system that drug registrants must use under (1). That identifier requirement does not start until the Secretary has picked the system. (c) New producers Anyone who starts making drugs or devices at an establishment they own or run must register with the Secretary right away, giving the drug information from (b)(1) or the device information from (b)(2), as applicable. (d) Additional establishments A person already registered must immediately register any new establishment where they start making drugs or devices. (e) Registration number; uniform system for identification of devices The Secretary may give a registration number to any registered person or establishment, and a listing number to each listed drug or class of drugs; that number must match the National Drug Code. The Secretary may also create, by regulation, a uniform system for identifying devices meant for human use, and require people who list devices under (j) to use it. (f) Availability of registrations for inspection The Secretary must let anyone who asks inspect a filed registration. The exception: device lists filed under (j)(3), and the information filed along with lists under (j)(1) or (2), stay off-limits unless the Secretary decides that keeping them secret would hurt public health. (g) Exclusions from application of section The registration rules above do not apply to: (1) Pharmacies that follow local pharmacy and medicine laws, that regularly fill prescriptions written by licensed practitioners for their own patients, and that do not make drugs or devices for sale beyond their normal retail business. (2) Licensed practitioners who make drugs or devices only for use in their own practice. (3) People who make drugs or devices only for research, teaching, or chemical analysis, and not for sale. (4) Wholesale device distributors who do not manufacture, repackage, process, or relabel devices. (5) Any other class of people the Secretary exempts by regulation, after finding that registering them is not needed to protect public health. A "wholesale distributor" is anyone, other than the manufacturer or the first importer, who moves a device from the factory to the person who finally delivers or sells it to the user. (h) Inspections (1) Every establishment required to register must be open to inspection under section 374. (2) Risk-based schedule for devices: The Secretary must inspect device-making establishments on a risk-based schedule that (A) applies the risk factors from paragraph (4) as far as they fit devices, and (B) considers whether the establishment takes part in recognized international device audit programs. (3) Risk-based schedule for drugs: The Secretary must inspect drug-making establishments on a similar risk-based schedule. (4) Risk factors: The schedule under (2) or (3) must weigh: (A) the establishment's compliance history; (B) its record of recalls; (C) how risky the drug or device made there is; (D) how often and recently it has been inspected, including whether it was inspected under section 374 in the last 4 years; (E) whether a recognized foreign government agency has inspected it; (F) the compliance history of establishments in that country or region, including violations tied to products exported from there; and (G) any other criteria the Secretary decides are needed to spend inspection resources wisely. (5) Effect of status: When scheduling drug inspections under (3), the Secretary must not consider whether the drugs made there are the kind described in section 353(b). (6) Annual report: By May 1 each year, the Secretary must post a report on the FDA website covering: (A) how many domestic and foreign establishments registered in the past year, broken out by region of interest, how many of those were inspected, how many inspections supported drug or biologic applications (including supplements changing manufacturing), how many were routine surveillance inspections, how many were for-cause inspections, and how many inspections the Secretary recognized under an agreement or otherwise — each broken out by region; (B) how many establishments make an active drug ingredient versus a finished drug product; (C) what percent of FDA's budget paid for these inspections; and (D) how FDA is doing at relying more on inspections done by foreign regulators, including any obstacles. (7) "Region of interest" means a foreign region or country the Secretary picks, including China, India, the European Union, the United Kingdom, or others. (i) Registration of foreign establishments (1) Anyone who owns or runs a foreign establishment that makes a drug or device imported, or offered for import, into the United States must register electronically. (A) The first time they start this activity, they must immediately register, giving: for drugs, the name and business address of the person, all such establishments, each establishment's unique facility identifier, a contact email, the name of the U.S. agent for each establishment, the name of every U.S. importer of the drug known to the establishment, and the name of everyone who imports or offers to import it; for devices, the name and business address of the establishment, the name of its U.S. agent, the name of every known U.S. importer, and the name of everyone who imports or offers to import it. (B) After that, each establishment must re-register every year between October 1 and December 31. (2) The establishment must also provide the information required by subsection (j). (3) The Secretary may make cooperative arrangements with foreign officials to help decide whether these establishments' drugs or devices should be refused entry into the U.S. under section 381(a). (4) The Secretary picks the unique facility identifier system for these foreign drug registrants, too, and the identifier requirement does not start until that system is picked. (5) These rules apply even if the drug or device gets further manufacturing at a separate foreign establishment before being imported. (j) Filing of lists of drugs and devices (1) When someone registers under (b), (c), (d), or (i), they must also file a list of every drug and every device they make for commercial sale that they have not already listed, plus a brief explanation of why each listed device counts as a device and not a drug. Each item is listed by its official established name and any brand name. The list must come with: (A) for a drug covered by section 355 or 360b, or a device with a performance standard under 360d or covered by 360e, proof of the authority to market it and a copy of all its labeling; (B) for other listed drugs or devices — (i) if the drug is prescription-only under 353(b)(1), or the device is "restricted," a copy of all labeling, a sample of ads, and, if the Secretary asks for good cause, every ad for that product; or (ii) otherwise, the label, package insert, and a sample of other labeling; (C) for a drug covered by (B), a list of how much of each active ingredient it contains (the Secretary can require amounts of all ingredients if that is genuinely needed); (D) if the registrant decided a drug or device is not covered by 355, 360b, 360d, or 360e, or is not restricted, a brief explanation of that decision if the Secretary asks for one; and (E) for a listed drug, the name and address of every maker of an ingredient (excipient) used in it, including all of that maker's production sites, each site's unique facility identifier, and a contact email. (2) Each registrant must also report — for drugs, every June and every December; for devices, once a year between October 1 and December 31 — the following: (A) any new drug or device they have started selling that was not on an earlier list, listed by established and brand name with the (1) information attached; (B) if they have stopped making a listed drug or device since their last report (or, for a first report, since February 1, 1973), notice of that, the date it stopped, and the drug or device's identity; (C) if they have restarted making a drug or device they had reported as discontinued, notice of that, the date it restarted, its identity, and the (1) information, unless already reported; and (D) any real change to information they reported earlier. (3) (A) Each drug registrant must report every year how much of each listed drug they actually made for sale, in whatever electronic format the Secretary sets, and the Secretary may require this report right when a public health emergency is declared. (B) The Secretary may excuse certain biological products from some or all of this reporting if it decides that reporting is not needed to protect public health. (4) The Secretary may also require a registrant to list every drug product it makes for sale that contains a particular ingredient, but only after finding that this list is truly necessary. (5) Once the Secretary has set up the unique facility identifier systems from (b)(3) and (i)(4), people covered by this subsection must use them for drugs. (k) Report preceding introduction of devices into interstate commerce A registrant who wants to start selling a device across state lines must, at least 90 days ahead of time, report to the Secretary, or to a person accredited under section 360m(a), in whatever form the Secretary requires: (1) what class the device falls into under section 360c, or, if the person believes it is not classified, a statement saying so and explaining why; and (2) what the person has done to meet any requirements under sections 360d or 360e that apply to the device. If this report includes clinical trial data for an "applicable device clinical trial," it must come with the certification required under section 282(j)(5)(B) of title 42; that certification does not itself count as part of the report. (l) Exemption from reporting requirements (1) No report under (k) is needed for a device that is exempted under (m), that is a Class I device, or for a change that matches an already-cleared "predetermined change control plan" under section 360e–4. This exception does not cover a Class I device that is important for preventing harm to human health, or one that could pose an unreasonable risk of illness or injury. (2) Within 120 days of December 13, 2016, and at least once every 5 years after that, the Secretary must publish in the Federal Register any Class I device types that no longer need a (k) report to reasonably assure safety and effectiveness. Once published: (A) those device types are exempt from the (k) report; and (B) their classification rule is treated as amended to include that exemption. (m) List of exempt class II devices (1) The Secretary must: (A) within 90 days of December 13, 2016, and at least once every 5 years after that, publish a proposed Federal Register list of Class II device types that no longer need a (k) report, and give at least 60 days for public comment; and (B) within 210 days of December 13, 2016, publish the Secretary's final list. (2) Starting the day after that final list is published, the Secretary may exempt a Class II device from the (k) report — on its own or by someone's petition — if it decides the report is not needed to assure the device's safety and effectiveness. The Secretary must publish notice of the plan or petition, give 60 days for public comment, and then issue a final order within 120 days. If the Secretary does not answer a petition within 180 days, the petition is automatically granted. (3) Once the final list is published: (A) those Class II device types are exempt from the (k) report; and (B) their classification rule is treated as amended to include that exemption. (n) Review of report; time for determination by Secretary (1) The Secretary must review a (k) report and make a decision under section 360c(f)(1) within 90 days of receiving it. (2) (A) By 18 months after July 9, 2012, the Secretary had to send Congress a report explaining when a new (k) submission is required for a change to a device already on the market, including what the Secretary means by "could significantly affect the safety or effectiveness of the device," "a significant change or modification," and "major change or modification in the intended use." The report also had to discuss how industry could figure out whether a new (k) submission is needed, and how to use existing quality-system rules to reduce the burden on companies. (B) The Secretary had to withdraw a 2011 draft guidance on device modifications, stop using it for reviews or enforcement, and could not issue new guidance or rules on that topic until Congress received the report from (A) and a full year had passed after that. (C) A 1997 FDA guidance on the same topic stays in effect until any later guidance or rule replaces it, and the Secretary must keep interpreting it the same way FDA has interpreted it since 1997. (o) Reprocessed single-use devices (1) For reprocessed single-use devices that need a (k) report: (A) the Secretary must identify device types whose reports must include validation data — showing the cleaning, sterilization, and functional performance still work as well as the original device after the maximum number of times it is meant to be reprocessed — publish that list within 6 months of October 26, 2002, and update it as needed; once published, (k) reports for those listed types must include that data. (B) Anyone with a (k) report already on file for a listed type before the list existed must submit the validation data within 9 months of the list's publication. During those 9 months, the Secretary cannot act against the device just because that data has not been submitted. After the data is submitted, the Secretary cannot call the device misbranded or adulterated, or act against it for missing (k) information, until the review is withdrawn, the Secretary accepts the data, or the Secretary finds the device is not substantially equivalent to its predicate — which, like a withdrawal, ends the device's legal marketing. (C) For a (k) report on a device type not yet on the list, the Secretary may require this validation data even before formally adding that type to the list. (D) Section 352(o) applies if a (k) report is missing required validation data. (2) For critical or semi-critical reprocessed single-use devices currently exempt from the (k) report under (l) or (m): (A) the Secretary must identify and list device types whose exemption should end to protect safety, publish and update that list, and require the (o)(1)(A) validation data in the resulting reports. (B) A (k) report for a listed device is due within 15 months of the list's, or its revision's, publication. During that time, the Secretary cannot act against the device just because the report is missing. Afterward, the same kind of protection applies until the review is withdrawn, the Secretary finds the device substantially equivalent, or finds it not substantially equivalent, which ends its legal marketing. (C) The first list for semi-critical devices was due within 18 months of this subsection's effective date; for critical devices, within 6 months. (D) Section 352(o) applies to a missing or incomplete report required here, too. (E) Ending the exemption for a reprocessed version of a device under this paragraph does not end the exemption for the original, non-reprocessed device. (p) Electronic registration and listing (1) Registrations and listings under this section, including updates, must be submitted to the Secretary electronically, unless the Secretary waives that because electronic filing is not reasonable for that particular person. (2) Within 2 years of the Secretary setting up the unique facility identifier system under (b) and (i), the Secretary must keep an electronic database, not open to inspection under (f), built from the information submitted under (1), that: (A) lets FDA staff search by any field in a registration, or any combination of fields; and (B) uses the facility identifier system to link with other relevant FDA databases, including the one for filings under section 381(r). (3) The Secretary must keep FDA's relevant databases accurate and coordinated so risk-based inspections under (h) can be properly identified. (q) Reusable medical devices (1) Within 180 days of December 13, 2016, the Secretary must identify and publish a list of reusable device types whose (k) reports must include: (A) instructions for use that have been validated the way the Secretary specifies; and (B) validation data on cleaning, disinfection, and sterilization, of the kind the Secretary specifies — data that a decision on substantial equivalence can be based on. (2) The Secretary must revise that list as needed, with notice in the Federal Register. (3) (k) reports filed after that list is published, for the device types on it, must include the required instructions for use and validation data.