Does GMP Apply to a Small Batch or Startup Pharmaceutical Company?
Yes, and the regulation does not care how small you are. Section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act deems a drug adulterated if the methods, facilities, or controls used to make it do not conform to current good manufacturing practice, and nothing in that language scales with batch size. 21 CFR Parts 210 and 211 contain no exemption for a 5-liter batch or a 2,000-unit lot. A startup making clinical supply in a rented suite and a multinational running a 20-line packaging hall are measured against the same text.
What differs is how you meet it. Part 211 is written in outcome language: procedures must be "written," equipment must be "of appropriate design," and testing must be "appropriate." That wording leaves a small company a great deal of room to build something proportionate, as long as the quality system can show, with records, that each requirement is met. I have come to think the startups that struggle are rarely the ones with too little money. They are the ones that treat GMP as a binder to be written before an inspection instead of a way of working from the first batch.
This article is the pillar guide I would hand a founder on day one: what applies when, what to build first, what to buy instead of build, and where small companies most often get hurt.
When Does GMP Actually Start? Phase-Appropriate Expectations
The most common early confusion is timing. Founders hear "GMP" and assume full commercial-scale controls are needed for their first toxicology lot. They are not, but the line is more specific than people think.
| Stage | Governing requirement | What it means in practice |
|---|---|---|
| Nonclinical / toxicology material | No GMP mandate for the material itself, though the data supports your IND | Good documentation and characterization still matter, because tox lots must be representative of what you will dose |
| Phase 1 investigational drug | FD&C Act 501(a)(2)(B) applies; 21 CFR 210.2(c) exempts Phase 1 drugs from Part 211 | FDA's July 2008 guidance CGMP for Phase 1 Investigational Drugs describes a scaled approach built on quality oversight, controlled facilities and equipment, and records |
| Phase 2 and Phase 3 | 21 CFR Part 211 applies in full to clinical supply | Validated methods, defined specifications, batch records, stability, and a quality unit with release authority |
| Commercial | Parts 210 and 211, plus establishment registration and drug listing under section 510 and 21 CFR Part 207 | Process validation, a complete quality system, and readiness for a pre-approval inspection |
The Phase 1 exemption in 21 CFR 210.2(c) is real but narrow. It removes the Part 211 text, not the statutory obligation, and the 2008 guidance still expects you to control things like identity, strength, sterility where relevant, and cross-contamination. A Phase 1 sponsor who reads "exempt" and builds nothing is setting up an expensive rebuild at Phase 2, when the clinical supply history gets questioned.
My advice is to design your quality system to the Phase 2 standard from the beginning, even while operating at Phase 1 rigor. Retrofitting document control, change control, and deviation handling onto a year of informal practice is much harder than starting with a lean version of each.
What Does an FDA Investigator Expect From a Small Company?
Inspectors read the same regulation whether you have 8 employees or 800. A few provisions do most of the work in small-company inspections.
An independent quality unit. 21 CFR 211.22(a) gives the quality control unit the responsibility and authority to approve or reject all components, containers, closures, in-process materials, packaging materials, labeling, and drug products, and to review production records for errors. It also covers products manufactured under contract by another company. Section 211.22(d) requires these responsibilities and procedures to be in writing. In a ten-person company, the most frequent finding I see is not a missing quality person but a quality person who reports to the production lead, or a founder who overrides a rejection to protect a timeline.
Qualified people. 21 CFR 211.25(a) requires that each person engaged in manufacturing, processing, packing, or holding have the education, training, and experience, or a combination, to perform assigned functions. Training has to be documented and current. This is where the personnel-training discipline matters most, and I covered it in more detail in our personnel training article.
Written procedures that are followed. 21 CFR 211.100(a) requires written procedures for production and process control, reviewed and approved by the appropriate organizational units and by the quality control unit. Section 211.100(b) then requires that they be followed and that deviations be recorded and justified. Small companies tend to write procedures that describe an ideal operation, then run something looser. FDA investigators will watch what your operators actually do, and the gap between the document and the floor becomes the observation.
Batch records and laboratory records. 21 CFR 211.188 requires a batch production and control record for each batch, and 211.194 requires complete laboratory records including all data and calculations. Under 211.180(a), records must be kept at least one year after the batch expiration date.
Qualified consultants. If you use outside help, 21 CFR 211.34 says consultants advising on manufacture, processing, packing, or holding must have sufficient education, training, and experience, and you are expected to keep records of who advised and what they did.
What Should a Startup Build First?
Founders often ask for a sequence. In my view the order matters less than making sure nothing critical is missing when the first clinical batch ships. Here is the order I tend to recommend, because each item depends on the one before it.
1. Quality unit and quality manual
Name the person with release authority, give that person a reporting line that does not run through production or finance, and write down the scope of their authority. A short quality policy and an organization chart are enough to start. The structure matters more than the page count.
2. Document control
Before you write a single SOP, decide how documents are numbered, approved, versioned, issued, and retired. Every later system sits on top of this one. A controlled system with 20 good procedures beats an uncontrolled folder of 80.
3. Specifications and materials control
21 CFR 211.84 sets the rules for testing and approval of components. Under 211.84(d)(2) you may rely on a supplier's certificate of analysis for a component only if you perform at least one specific identity test and establish the supplier's reliability through appropriate validation at intervals. For a small company buying an API from a single source, this is where supplier qualification and a quality agreement earn their keep.
4. Master and batch records
Write the master production record carefully, because the batch record is a copy of it. Every step an operator needs, every in-process check, every yield calculation and reconciliation belongs in there. Review a mock batch record against a dry run before the first real batch, since the dry run always exposes missing fields.
5. Deviation, CAPA, and change control
These three systems are what inspectors use to judge whether a company learns. A startup will produce deviations in its first month, and that is not a problem. A company with no deviations is generally a company that is not recording them.
6. Laboratory controls and stability
21 CFR 211.160 through 211.176 govern laboratory controls, and 211.165(a) requires testing of each batch against final specifications before release. A written stability program under 211.166(a) must support the expiration date assigned under 211.137. Stability programs take time, so they should start early. Our guide to stability testing goes through the design questions.
7. Facilities, equipment, and cleaning
21 CFR 211.42 through 211.58 cover building design, ventilation, and sanitation, and 211.63 through 211.72 cover equipment. Equipment must be cleaned and maintained on a schedule under 211.67, with records. If you share a suite with other products, cross-contamination controls become one of the central questions in your risk assessment.
Should We Build Our Own Facility or Use a CDMO?
This decision shapes your whole compliance workload, and it is often made on cost alone. It deserves a compliance lens as well.
| Factor | In-house manufacturing | Contract manufacturer (CDMO) |
|---|---|---|
| Control of schedule and know-how | High | Depends on contract and capacity |
| Capital and fixed cost | High: facility, utilities, equipment qualification | Low upfront, higher per-batch cost |
| Quality system you must build | Complete, from facility to release | Smaller, but you must run a real oversight program |
| Regulatory accountability | Yours | Still yours for the product |
| Typical weak point | Resources stretched across everything | Weak oversight of the contractor |
The last row of the middle section is the one people miss. Moving manufacturing to a CDMO moves the work, not the responsibility. 21 CFR 211.22(a) puts the duty to approve or reject product made under contract on your quality control unit, and FDA's November 2016 guidance Contract Manufacturing Arrangements for Drugs: Quality Agreements describes what a written agreement should assign. A startup that signs a supply agreement and never audits, never reviews batch records, and never reads deviation reports does not have a quality system. It has a vendor and a hope.
If you are going the CDMO route, plan to do at least these things: qualify the CDMO with an audit before the first batch, sign a quality agreement that spells out who approves changes, who investigates deviations, and who releases the product, review each executed batch record before disposition, and keep a standing schedule of oversight audits. I think of the quality agreement as the single most valuable document a virtual company owns.
How Do Small Batches Change the Compliance Picture?
Small batches create a few specific problems that large manufacturers rarely face.
Sampling consumes a meaningful share of the batch. When you make 500 units, retention samples under 21 CFR 211.170, stability pulls, and release testing can use up a big portion of the lot. Plan batch size and testing volume together, and write the sampling plan into the master record so nobody improvises it.
Process validation is still required for commercial product. FDA's January 2011 guidance Process Validation: General Principles and Practices describes a three-stage lifecycle: process design, process qualification, and continued process verification. Small batch size makes it harder to collect statistically useful data, but it does not remove the expectation that you demonstrate the process produces consistent results.
Manual operations carry more variability. Small companies often use more hands-on steps, which places more weight on training under 211.25 and on clear, specific batch instructions. A manual step that is not controlled by instruction is a deviation waiting to happen.
Campaign manufacturing raises cross-contamination risk. When one room makes several products in sequence, your cleaning validation, changeover procedure, and line clearance records carry the argument that one product did not end up in another. Our article on sanitary design offers more on how layout decisions reduce that risk.
None of these problems is a reason to loosen controls. They are reasons to make controls more specific.
How Do You Handle Data Integrity When You Have Few People?
Data integrity is where small companies get hurt in ways they do not expect. FDA's December 2018 guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers applies ALCOA-style expectations that data be attributable, legible, contemporaneous, original, and accurate, and it addresses shared logins, audit trails, and the review of electronic raw data.
A practical startup problem is one analyst who runs the instrument, reviews the data, and approves the result. Where electronic records are used, 21 CFR Part 11 adds requirements for controls on access, audit trails, and electronic signatures. A spreadsheet that calculates assay results and can be edited by anyone is a classic early finding. When I help a young company with this, I look first at four things: who can log in to each system, whether audit trails are on and reviewed, whether spreadsheets used for GMP calculations are validated and locked, and whether a second person reviews raw data before release.
If your computerized systems include newer tools, such as software that uses machine learning for batch review or deviation triage, the same validation logic applies. See our article on validating AI systems in FDA-regulated GMP environments for how to approach it.
How Does Risk Management Help a Small Company Prioritize?
You cannot build everything at once, and you should not try. ICH Q9(R1), Quality Risk Management, revised in 2023 and adopted in FDA's guidance program, gives a way to decide where rigor goes. The idea is straightforward: put the heaviest controls where the risk to patient safety, product quality, and data reliability is highest.
For a startup, that usually means putting early effort into identity and potency of the API, sterility assurance if the product is sterile, cross-contamination, and release testing. It usually means a lighter touch on things like elaborate trending programs that need years of data to be meaningful. ICH Q10, Pharmaceutical Quality System, describes a lifecycle quality framework that scales well to a growing company, and I often use it as the outline for a young company's quality manual.
Risk-based does not mean risk-free paperwork. Write down your reasoning when you decide a control can be lighter, because an inspector will ask why, and a documented rationale is a defensible answer while "we were busy" is not.
What Are the Registration and Filing Steps Around GMP?
GMP compliance sits alongside a few regulatory steps that startups sometimes treat as separate projects.
- Establishment registration and drug listing. Under section 510 of the FD&C Act and 21 CFR Part 207, owners and operators of drug establishments register with FDA, list their drugs, and update the registration annually between October 1 and December 31.
- IND and NDA/ANDA content. The chemistry, manufacturing, and controls section of your application describes your process and controls. What it says must match what you do. A gap between your CMC narrative and your batch records is a classic source of pre-approval inspection trouble.
- Pre-approval inspection readiness. FDA's Compliance Program 7346.832 covers pre-approval inspections, which verify that the facility can manufacture the product described in the application and that the submitted data are accurate. Treat the last six months before filing as a rehearsal period for the inspection.
For a broader look at how inspection readiness fits together, the FDA inspection prep page lays out the work, and our pharmaceutical manufacturers page describes how this support is structured for drug companies.
What Are the Most Common Mistakes Startups Make?
These are the patterns I see most often, and most of them are avoidable.
- Quality reports to operations. The quality unit cannot exercise independent authority under 211.22 if its head is evaluated by the person whose batch it must reject.
- Procedures written once, never tested. The SOP reads well and nobody has run it.
- No supplier qualification. The API arrives with a certificate and nobody has ever audited the source or run a confirming identity test as 211.84(d)(2) expects.
- Informal change control. A formulation tweak or equipment swap happens by email and never reaches the quality unit.
- Overreliance on the CDMO. The company assumes the contractor's compliance covers its own.
- Hiring a consultant and handing off ownership. Under 211.34, consultants must be qualified, but the responsibility for the system stays with you. A consultant should help you build a program your team can run without them.
- Waiting until Phase 3 to take GMP seriously. By then the clinical supply history is long, and any weakness in it affects the whole application.
Most of these come back to the same root. GMP is a habit, and habits are far cheaper to form in month two than in year three.
A Realistic First-Year Roadmap
If I were sitting with a founder today, I would sketch the first year this way. It is a template, not a rule, and it shifts with the product and dosage form. For a deeper walk through the opening stretch, see our first 90 days guide.
| Period | Focus | Outputs |
|---|---|---|
| Months 1–3 | Foundation | Quality unit defined, document control live, gap assessment against Part 211, supplier and CDMO shortlist |
| Months 4–6 | Core systems | Specifications, master batch records, deviation/CAPA/change control, training matrix, quality agreement signed |
| Months 7–9 | Execution | Dry runs, first GMP batch, laboratory method qualification, stability program started |
| Months 10–12 | Verification | Internal audit, management review, CDMO oversight audit, mock inspection |
The internal audit and mock inspection at the end are the part founders most want to skip, and in my experience they are the part that pays back the most. Finding your own problems costs a corrective action. Having FDA find them costs a Form 483 and possibly a delayed application.
Frequently Asked Questions
The questions below come up in almost every startup conversation I have.
Is there a batch size below which GMP does not apply?
No. 21 CFR Parts 210 and 211 contain no minimum batch size. The only exemption of this kind is for Phase 1 investigational drugs under 21 CFR 210.2(c), which are exempt from Part 211 but remain subject to section 501(a)(2)(B) of the FD&C Act and the expectations in FDA's 2008 Phase 1 guidance.
Can a virtual company with no facility be GMP compliant?
Yes. A virtual company relies on contract manufacturers and testing labs, but 21 CFR 211.22(a) still places responsibility for approving or rejecting contract-manufactured product on its quality control unit. It needs a quality system, a quality agreement with each contractor, and a program to audit and review them.
When do we need to be fully compliant with 21 CFR Part 211?
For clinical supply beyond Phase 1, Part 211 applies. For commercial distribution, you need full compliance plus registration and listing under 21 CFR Part 207. Building the system early is cheaper than retrofitting it.
How much does GMP compliance cost for a startup?
It depends on the product, dosage form, and whether you use a CDMO. The larger drivers are usually facility and equipment qualification if you build in-house, and quality staffing and oversight if you outsource. A gap assessment early on gives you a defensible budget, which beats a guess.
Where to Go From Here
If you take one idea from this guide, I hope it is that proportion is the whole game. Part 211 gives a small company room to build something lean, and it gives an inspector the right to ask how you know it works. The companies that do well spend their early money on the unglamorous basics: an independent quality unit, controlled documents, honest records, and real oversight of their suppliers and contractors.
What would your quality system look like if you had to defend every control to an investigator next month? That question tends to show a founder where to start. If you want help answering it, a conversation with a GMP compliance consultant before your first GMP batch is almost always cheaper than one after.
Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, Certify Consulting
Last updated: 2026-11-06
Frequently Asked Questions
Is there a batch size below which GMP does not apply?
No. 21 CFR Parts 210 and 211 contain no minimum batch size. The only comparable exemption is for Phase 1 investigational drugs under 21 CFR 210.2(c), which are exempt from Part 211 but still subject to section 501(a)(2)(B) of the FD&C Act and the expectations in FDA's 2008 Phase 1 guidance.
Can a virtual pharmaceutical company with no facility be GMP compliant?
Yes. A virtual company relies on contract manufacturers and labs, but 21 CFR 211.22(a) still places responsibility for approving or rejecting contract-manufactured product on its quality control unit. It needs a quality system, a quality agreement with each contractor, and a program to audit and review them.
When does a startup need to comply fully with 21 CFR Part 211?
Part 211 applies to clinical supply beyond Phase 1 and to commercial product. Commercial distribution also requires establishment registration and drug listing under section 510 of the FD&C Act and 21 CFR Part 207. Building the system early is cheaper than retrofitting it.
What is the most common GMP mistake startups make?
A quality unit that is not independent of production or business pressure. 21 CFR 211.22 gives the quality control unit authority to approve or reject product, and that authority is hollow if the person holding it can be overridden to protect a timeline.
Jared Clark
GMP Compliance Consultant, Certify Consulting
Jared Clark is a GMP compliance consultant and founder of Certify Consulting, specializing in FDA GMP requirements for pharmaceuticals, dietary supplements, cosmetics, and food manufacturing.