TLDR
FDA quality agreement requirements apply to every contract manufacturing arrangement in pharma, biotech, and medical device. A quality agreement defines which party bears responsibility for each GMP activity. FDA inspectors look for three specific failure patterns: absence of an agreement, vagueness in responsibility language, and currency gaps where agreements have not kept pace with operational changes. All three patterns generate FDA Form 483 observations and can escalate to Warning Letters.
FDA Quality Agreement Requirements: What Contract Manufacturers and CMOs Need in Writing
The moment a pharmaceutical, biotech, or medical device company contracts out any GMP-regulated activity, a critical compliance obligation attaches: a written quality agreement must define, clearly and in detail, which party owns each regulatory responsibility. That obligation is not discretionary.
FDA's November 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements (docket FDA-2013-D-0558), states the agency's expectation explicitly. Quality agreements should be executed before manufacturing begins, should cover every GMP activity within the contracted scope, and must assign unambiguous responsibilities to a named party. For medical device manufacturers, 21 CFR 820.50 under the Quality Management System Regulation (QMSR) imposes parallel purchasing-control requirements that effectively demand the same level of documented oversight. For Active Pharmaceutical Ingredient manufacturers working with contract facilities, ICH Q7 Section 16 sets the applicable GMP standard.
What ties these frameworks together is a straightforward premise: a contract does not transfer regulatory responsibility. Both the contract giver (the brand owner or NDA/ANDA holder) and the contract acceptor (the CMO or contract lab) remain independently accountable to FDA. The quality agreement is the mechanism through which each party's obligations are made visible, specific, and enforceable.
The most practical starting point for any quality or regulatory affairs team responsible for managing CMO relationships is a clear understanding of what FDA inspectors actually cite during inspections, and why.
The Three FDA 483 Observation Patterns Every Quality Team Should Know
FDA inspectors who review outsourced manufacturing arrangements generate FDA Form 483 observations in one of three recurring patterns. Recognizing these patterns allows quality leads to conduct gap assessments before an inspector arrives.
Pattern 1: Absence
The most straightforward observation is also the simplest to write and the hardest to defend: no written quality agreement exists. FDA has cited both contract givers and contract acceptors for this deficiency under 21 CFR 211.22 (quality unit responsibilities) and the agency's own 2016 guidance on contract manufacturing arrangements.
Absence observations typically read: "There is no written quality agreement in place with the contract manufacturer" or "Failure to establish a written contract with the contract facility."
The risk level is high. An absence finding is among the most likely to escalate from a 483 observation to a Warning Letter action, because it signals to FDA that the organization has not established even the foundational structure for GMP oversight of outsourced operations. The 2016 guidance is explicit: agreements should be in place before any contracted activity begins, not retroactively drafted in response to inspection findings.
Both parties in a contract manufacturing arrangement are vulnerable to this citation. A CMO that operates without quality agreements across multiple client relationships is as exposed to this observation as the brand owner who failed to require one.
Pattern 2: Vagueness
The vagueness pattern arises when a quality agreement exists but fails to allocate responsibilities with sufficient specificity. This is the most common of the three patterns and appears across a wide range of compliance contexts: batch release authority, deviation ownership, stability testing obligations, and annual product review assignments.
Common observation language for this pattern includes: "The quality agreement does not adequately define the responsibilities of each party," "The written agreement fails to specify which party is responsible for investigations of failures," and "The agreement does not define notification timelines or escalation procedures."
FDA inspectors routinely compare the written agreement against the practices actually observed during an inspection. Language such as "as mutually agreed" or "as appropriate," used without further definition, consistently draws scrutiny. Agreements that leave batch release criteria ambiguous or fail to specify which party maintains original batch records versus certified copies are particularly vulnerable to this citation.
A vague agreement is in many ways more dangerous than an absent one. It creates the false impression of compliance while providing no actual protection. When a quality event occurs, an unclear quality agreement ensures that neither party can demonstrate it met its obligations. Vagueness observations under a GMP quality agreement also complicate CAPA response, because investigators then question whether the agreement was ever intended to govern actual practice.
Pattern 3: Currency
The currency pattern affects organizations that initially drafted a solid, compliant quality agreement but have not kept it current as operations, processes, or regulatory requirements changed. FDA expects quality agreements to reflect the actual state of the manufacturing relationship at the time of inspection.
Currency observations include language such as: "The quality agreement has not been updated to reflect current manufacturing processes," "The written agreement does not reflect changes to the contracted scope," and "The agreement fails to address [regulatory requirement] implemented after the agreement was executed."
This is the most frequently overlooked pattern in internal compliance reviews. Quality teams that performed thorough work at contract initiation often miss the ongoing obligation to review and update agreements at defined intervals, after process changes, after regulatory changes, or following significant deviations. A quality agreement CMO arrangement requires a living document, not a one-time deliverable.
What a Compliant Quality Agreement Must Contain
FDA's 2016 guidance provides the most structured framework of required elements for a quality agreement contract manufacturer arrangement. These elements cover the full lifecycle of a manufacturing relationship, from initial qualification through product disposition.
Scope of Contracted Activities
The agreement must open with a precise description of the contracted activities. This includes the specific drug products or device components covered, the manufacturing steps performed at the contract facility, and any analytical or testing services within the contract scope. Imprecise scope definitions are a primary driver of vagueness observations. The scope section should identify the facility by name and address, the specific manufacturing steps executed there, and any activities explicitly excluded from the agreement.
Responsibility Allocation
Every GMP activity within scope must be assigned to a named party. This includes who performs in-process testing, who conducts final release testing, who holds authority to release or reject batches, who maintains original batch records, who owns regulatory filings, and who is responsible for CGMP training at the contract site.
FDA emphasizes that both parties must retain a quality unit capable of independently fulfilling its obligations. The quality agreement should not allow one party's quality unit to substitute for or absorb the responsibilities of the other. Both quality units must be named in the agreement, with their respective approval authorities stated explicitly.
Change Control
Change control provisions are among the most scrutinized sections of any 21 CFR quality agreement. The agreement must specify what types of changes require notification, which changes require prior written approval from the contract giver, and what timelines govern each notification category.
A Process Change Notification provision should address manufacturing process changes, site changes, equipment changes, raw material substitutions, and new regulatory submissions. The agreement should define tiered change categories with different notification timelines: for example, major changes requiring 30-day prior written approval versus minor changes requiring 10-day notification before implementation. Failure to specify timelines is a direct path to a currency observation in future inspections.
Deviations and CAPA
The agreement must define how deviations at the contract site are identified, documented, communicated, and resolved. This includes who initiates the Deviation Report, within what timeframe critical deviations are communicated to the contract giver, and which party owns the Root Cause Investigation.
Deviation CAPA ownership must also be explicit. The agreement should state whether the contract acceptor or the contract giver owns corrective and preventive action implementation and follow-up verification, what escalation procedures apply when a CAPA is not closed on schedule, and how CAPA effectiveness checks are documented and shared across the parties.
Audit Rights
The quality agreement must grant the contract giver the right to conduct Audits of the contract facility, including access to GMP records, procedures, and manufacturing areas. ICH Q7 Section 16.4 requires this provision specifically for API manufacturers. FDA's 2016 guidance reinforces that audit access must be available both to the contract giver and to regulatory authorities.
The agreement should specify audit frequency, advance notice requirements, the scope of Process Audit access, and what types of Audit Findings trigger escalation or potential suspension of manufacturing activities.
Review Cycle
A defined review cycle is the structural mechanism that prevents currency observations. The agreement must specify a maximum interval between formal reviews, typically one to two years, as well as triggers for off-cycle reviews: significant deviations, regulatory changes, facility changes, scope expansions, or product line additions. The review cycle provision should also specify who must approve agreement revisions and what approval timelines apply.
Cloudtheapp's Supplier Quality Management module builds review cycle tracking directly into each supplier record, generating automated reminders when a quality agreement approaches its review date. This removes the manual calendar tracking that most organizations rely on, and that most commonly fails.
ICH Q7 Requirements for API Contract Manufacturers
For Active Pharmaceutical Ingredient manufacturers, ICH Q7 Section 16 establishes the GMP standard for contract manufacturing quality agreements. The requirements parallel FDA's 2016 guidance but carry additional specificity for the API supply chain.
ICH Q7 Section 16.3 requires a written and approved contract or formal agreement that defines the GMP responsibilities of each party, including quality measures. Section 16.4 mandates that contracts allow the API manufacturer to audit the contractor for GMP compliance. Section 16.5 specifies that where contract laboratories are involved, the contract must define testing responsibilities, sample release authority, and reference sample retention obligations. Section 16.6 prohibits the contractor from subcontracting any work to a third party without prior written evaluation and approval from the API manufacturer.
ICH Q7 also introduces obligations that cross-reference other sections of the guideline. A quality agreement covering API contract manufacturing must address materials management (Section 7), laboratory controls and out-of-specification handling (Section 11), change control (Section 13), rejection and rework authority (Section 14), and complaint and recall notification procedures (Section 15). An ICH Q7-compliant agreement is therefore substantially more detailed than a general commercial services agreement and requires input from both the quality unit and regulatory affairs at the time of drafting.
21 CFR 820.50 and QMSR Purchasing Controls for Medical Device Manufacturers
Medical device manufacturers operating under the QMSR face FDA quality agreement requirements through a parallel regulatory pathway: 21 CFR 820.50, which governs purchasing controls.
Under 21 CFR 820.50, device manufacturers must establish and maintain procedures to ensure that all purchased or received products and services conform to specified requirements. This includes evaluating and selecting suppliers based on their ability to meet specified requirements, and defining the extent of control based on that evaluation and the potential effect on device quality.
The purchasing controls framework requires written quality agreements with CMOs and critical component suppliers because, without them, a manufacturer cannot demonstrate what requirements it communicated, how it verified compliance, or what obligations it placed on the contract facility. FDA investigators who review purchasing controls will request supplier agreements as a matter of routine. The absence or inadequacy of those agreements becomes an observation under 21 CFR 820.50.
The QMSR's harmonization with ISO 13485 reinforces this further. ISO 13485 Clause 7.4 requires documented procedures for supplier evaluation, selection, monitoring, and re-evaluation, with records maintained as evidence of conformity. A quality agreement functions as both the specification document and part of the supplier conformity record.
Quality Agreement Management at Scale
For organizations managing multiple CMO relationships, the operational challenge is not drafting a single compliant agreement. The challenge is maintaining a controlled, current, and auditable portfolio of agreements across a supplier network that changes over time.
This is where a purpose-built supplier quality platform creates a measurable compliance advantage. Cloudtheapp's supplier qualification and contract management capabilities allow quality teams to store quality agreements against supplier records, set automated review cycle reminders, link agreement provisions directly to audit findings, and maintain a complete Audit Trail of every revision, approval, and review event.
Rather than relying on spreadsheet trackers and calendar reminders, quality teams get an always-current view of which agreements are due for review, which suppliers have open audit findings that may trigger agreement updates, and which change notifications require agreement amendments. That visibility is the operational foundation for preventing currency observations before they occur.
The Compliance Case for Getting Quality Agreements Right
FDA quality agreement requirements are not a paperwork exercise. They are the regulatory scaffolding that makes outsourced manufacturing controllable and defensible under inspection. A well-structured quality agreement contract manufacturer arrangement assigns clear ownership to every GMP activity, establishes the communication protocols that prevent quality events from falling between parties, and creates the documented basis for demonstrating control of the supply chain.
The three observation patterns that FDA inspectors repeatedly cite are preventable. Each has a direct fix: execute the agreement before manufacturing begins, write it with unambiguous responsibility language, and build a defined review cycle into the agreement itself. For API manufacturers, ICH Q7 Section 16 provides an additional layer of specificity that should be treated as the floor, not the ceiling. For device manufacturers, 21 CFR 820.50 purchasing controls demand the same rigor through a different regulatory path.
Organizations that treat quality agreements as living governance documents rather than static contracts are better positioned in every inspection, every audit, and every quality event that crosses a CMO boundary.
Ready to bring your supplier quality management and CMO oversight under a single, FDA-validated platform? Request a demo of Cloudtheapp's Supplier Quality Management and compliance modules, or start your 30-day free trial today.
