21 CFR Parts 600–680

This glossary term is part of the SG Systems Global regulatory & operations guide library.

Updated December 2025 • biologics licensing (BLA), biologics manufacturing & control standards, lot release testing expectations, blood & blood components (CGMP + donor controls), postmarketing adverse experience reporting for biological products, biological product deviation reporting, diagnostic substances, allergenic products • Primarily Biologics / CBER-regulated operations (vaccines, blood centers, plasma-derived products, allergenics, diagnostics) with meaningful overlap to drug CGMP and data integrity

21 CFR Parts 600–680 is the cluster of FDA regulations that governs biological products—how they’re licensed, manufactured, controlled, tested, documented, and reported. If your world includes vaccines, blood and blood components, plasma-derived therapies, allergenic products, or certain diagnostics, this is not “nice-to-have compliance.” This is the rulebook FDA uses to decide whether your product and your operation are controlled enough to be trusted.

Here’s the reality: Parts 600–680 don’t just describe what to do; they describe what you must be able to prove. That proof shows up as controlled records, stable product identity, validated processes, defensible investigations, and a reporting posture that doesn’t collapse under pressure. If your organization depends on tribal knowledge, heroics, or “we’ll reconstruct it later,” biologics regulations are where that strategy gets exposed.

It’s also important to understand what Parts 600–680 are not. They’re not a replacement for the broader GMP baseline. Many biologics are also “drugs” for CGMP purposes, which is why biologics manufacturers commonly have to align with drug CGMP expectations such as 21 CFR Part 210 and 21 CFR Part 211, plus biologics-specific controls in this 600–680 set. In practice, your compliance posture is judged by the tightness of your data integrity, your ability to show trustworthy change history with an Audit Trail (GxP), and your ability to run investigations and CAPAs that don’t read like fiction (see Deviation Management and CAPA (Corrective & Preventive Action)).

“In biologics, the product is only half the story. The other half is whether your evidence is strong enough that regulators can trust what you claim happened.”

1) What people mean when they cite “21 CFR 600–680”

When a QA leader, RA team, auditor, or consultant says “we have to comply with 21 CFR 600–680,” they’re usually not talking about a single clause. They’re talking about a specific operating posture: licensed biologics require controlled manufacturing, defensible testing, credible investigations, and regulated reporting.

In the real world, the phrase is shorthand for three non-negotiables:

1) Licensing and lifecycle discipline. Biologics live and die by what’s licensed and how you control change. If your change process is informal, your licensing story becomes inconsistent. That’s where Change Control stops being a “quality form” and becomes an existential requirement.

2) Evidence quality under pressure. Biologics organizations don’t fail because they “don’t have SOPs.” They fail because, under real events, their records don’t reconcile. That’s why the conversation quickly turns into data integrity, reliable audit trails, and controlled corrections (see Batch Record Corrections and Good Documentation Practices).

3) Reporting posture. If you manufacture or distribute biological products, you’re living in a world where adverse experiences, deviations, and complaint signals are expected to be triaged and handled with discipline. This is why teams that treat complaints as customer service tickets end up scrambling—because they’re actually building regulated evidence (see Customer Complaint Handling Process, Complaint Trending, and Postmarket Surveillance).

2) Scope map: what’s inside the 600–680 set

Think of “600–680” as a regulatory bundle for biologics. It spans licensing, general biologics requirements, general product standards, and category-specific requirements (especially blood). A clean way to understand it is to map “part” to “operational meaning.” For the authoritative organization of these biologics parts, the eCFR index for Subchapter F is a practical anchor: 21 CFR Subchapter F — Biologics (eCFR).

The practical takeaway is simple: this is not one regulation. It is a set of biologics controls that hit licensing, manufacturing, and reporting all at once. If you treat these like separate compliance projects, you end up with separate spreadsheets, separate “owners,” and a compliance posture that fractures exactly when you need it most.

3) Who this applies to (and why “we’re not a biologics company” can still be wrong)

Coverage surprises happen for one reason: organizations define themselves by org chart labels (“we’re just manufacturing,” “we’re just QA,” “we’re just distribution”), but FDA evaluates you by covered activities and product category realities. If you’re involved in licensed biological products—or in blood and blood component operations—Parts 600–680 stop being academic.

Common “we didn’t realize” scenarios include:

• CDMO / contract operations: you may not own the brand, but you still own your evidence. Your batch record posture, deviation system, and change control are still regulated reality.
• Hybrid portfolios: organizations that make both biologics and “standard drugs” often assume one GMP model fits both. That is how you end up with controls that are “technically present” but not biologics-grade.
• Blood operations embedded in larger systems: blood identity and donor controls don’t behave like typical ERP inventory. If you force them into generic workflows, you manufacture compliance gaps.

In practice, the safest mindset is: if you touch biologics product identity, batch disposition, complaint signals, or postmarket reporting, you’re in the evidence business. That means your supporting systems have to be built to preserve truth—especially around changes, corrections, and investigations (see Deviation Management and CAPA).

4) Part 600: establishment controls, deviations, and postmarketing responsibilities

21 CFR Part 600 (eCFR) is where many biologics teams discover the difference between “we have processes” and “we have regulated controls.” It is not only about manufacturing steps. It is about establishment-level responsibilities: the kind of control posture you must demonstrate so FDA can trust your operation.

Operationally, Part 600 pushes you to answer uncomfortable questions with records, not opinions:

Do you detect and control deviations? Not the “headline” deviations—every regulated operation can catch those—but the quieter ones that show up as mismatched counts, missing signatures, unexplained holds, repeated minor nonconformances, or recurring data corrections. If your deviation system is mostly narrative, you won’t be able to defend patterns under inspection (see Deviation Management and Deviation Investigation).

Do you manage postmarket responsibilities like a workflow? In biologics, complaints and adverse experiences are not “somebody’s inbox.” They are regulated signals. That’s why robust organizations build intake + triage logic that clearly separates: (1) product quality complaints, (2) potential adverse events requiring reporting review, and (3) non-reportable feedback—then they trend and govern it (see Customer Complaint Handling Process and Complaint Trending).

If you want a practical way to pressure-test your current approach, read your own complaint files and ask: “Could an inspector reconstruct our decision logic without talking to our people?” If the answer is no, you don’t have a process. You have a dependency on institutional memory.

5) Part 601: licensing (BLA), supplements, and change discipline

21 CFR Part 601 (eCFR) is the licensing backbone. This is where biologics operations differ from teams that live only in “generic GMP space.” In licensing space, the core question becomes: Are you doing what you said you do? And when you change something, can you prove the change was controlled, assessed, and aligned with what’s authorized?

Operationally, Part 601 forces you into disciplined change behavior. That is not the same as “we have change control forms.” It’s: do changes reliably carry impact assessments, comparability logic when relevant, linked validation evidence when relevant, and consistent effective dates across SOPs, batch records, training, and systems?

If your operation can implement a process change without simultaneously updating your controlled documents and training posture, you’ve created a licensing risk—because now your actual execution and your documented execution are drifting. This is why mature biologics organizations treat change control as a cross-system orchestration problem, not a QA paperwork problem (see Change Control, Document Control System, and System Validation).

6) Part 610: general standards—what “potency” and “purity” mean operationally

21 CFR Part 610 (eCFR) is where biologics compliance becomes brutally concrete. “Safety,” “purity,” and “potency” are not marketing terms; they’re operational expectations that show up in release testing, method control, and lot disposition logic.

Two common misunderstandings drive avoidable pain:

First: teams assume Part 610 is “the lab’s job.” In reality, the lab is only one component of a release decision chain. Release is an evidence decision that ties together batch execution, deviations, environmental and utility context where applicable, lab results, and QA disposition. If those elements don’t reconcile, your release story becomes fragile (see Electronic Batch Record System and Batch Release).

Second: teams treat methods and specifications as “static.” In biologics, drift happens—new lots, new instruments, method improvements, reagent changes, lab staffing changes—and drift becomes risk when it’s not governed. This is where disciplined Revision Control and a practical record approach to lab and release evidence stops being administrative and becomes protective.

7) Blood and blood components: what changes when Parts 606/607/630/640 apply

If your operation includes blood and blood components, the 600–680 conversation shifts. Blood is not a typical “manufactured inventory” model; it is identity-driven, donor-driven, testing-driven, and time-driven. That means the failure mode is usually not “we forgot a document.” It’s that identity, testing, storage, labeling, and movement controls were not integrated into an end-to-end evidence chain.

That’s why the blood-focused parts matter together:

Part 606 is the CGMP backbone for blood operations (eCFR), Part 607 anchors registration and listing (eCFR), Part 630 drives donor requirements (eCFR), and Part 640 covers additional standards for human blood and blood products (eCFR). Treating any one of these as “someone else’s compliance domain” is how gaps multiply.

8) Part 606: CGMP for blood—controls that fail at scale

21 CFR Part 606 (eCFR) drives the blood CGMP posture. What tends to fail is not the existence of procedures; it’s the consistency of execution and the integrity of identity controls when volume and complexity rise.

Three scale-breakers show up repeatedly:

• Identity drift: labels, donor identifiers, component identifiers, and test results that aren’t tightly linked become reconciliation nightmares.
• Status integrity gaps: a “hold” that does not reliably prevent movement is not a control; it’s wishful thinking.
• Corrections without governance: if you can “fix” a record without a defensible correction story, you’ve created evidence you can’t trust. This is where audit trail design and correction discipline matter.

Blood CGMP compliance, at scale, is fundamentally a systems problem: you either have an integrated identity + status + record chain, or you have operational chaos with a compliance veneer.

9) Part 607: establishment registration & product listing—why master data matters

21 CFR Part 607 (eCFR) is often treated as “regulatory admin.” That’s a mistake. Registration and listing problems are almost always master data problems: inconsistent facility identity, inconsistent product naming and categorization, or changes that occur operationally but never make it into controlled systems.

If you want this to be boring (which is what you want), you need a single internal source of truth for facility and product identity data, governed updates, and periodic reconciliation. That’s the same discipline that protects you in other regulated areas: Master Data Control, Revision Control, and a real Document Control System that keeps operational reality and documented reality aligned.

10) Parts 630 & 640: donors, testing, components, labeling, and traceability reality

Part 630 (eCFR) and Part 640 (eCFR) are where blood operations become unforgiving: donor eligibility requirements, test expectations, component-specific requirements, labeling, storage, and handling are all tightly connected. This is not an environment where “close enough” holds up.

Operationally, the underlying control pattern is consistent with other regulated operations: you need a traceable chain of custody and a stable identity model. But the time sensitivity and safety implications compress your margin for error. If your records are scattered, your labels are inconsistent, or your systems allow bypass behavior, you don’t have a safety posture—you have luck.

11) Part 660: diagnostic substances—evidence quality still applies

21 CFR Part 660 (eCFR) covers additional standards for diagnostic substances. Even when your product type feels “less like manufacturing,” the same truth applies: diagnostics live and die by evidence quality. If method control is weak, if lot genealogy is fuzzy, or if records are not retrievable, your compliance posture is fragile.

Organizations that do this well treat diagnostic production evidence the same way they treat other regulated evidence: controlled revisions, governed deviations, disciplined CAPA, and a retention posture you can actually execute (see Record Retention – Data Integrity & Archival and Record Retention Policy).

12) Part 680: allergenic products—standardization, labeling, and control posture

21 CFR Part 680 (eCFR) covers additional standards for miscellaneous products, including allergenic products. The operational trap in allergenics is thinking the compliance story is “we have labels and we have SOPs.” In reality, the compliance story is identity and standardization: what is the product, how is it controlled, and how do you prove consistency and traceability across lots?

If your allergenic product operation depends on manual relabeling, uncontrolled spreadsheets, or informal recipe changes, you’re building a compliance narrative that can’t survive scrutiny. This is where controlled records and disciplined versioning matter more than most teams want to admit (see Revision Control and Recipe Versioning & Change Control).

13) Adverse experience & deviation reporting: building a workflow that doesn’t break

Biologics operations are judged by how they behave when something goes wrong. That includes both product quality deviations and postmarket safety signals. The failure mode is usually not “we didn’t do anything.” It’s that the organization can’t show a clean, consistent, defensible record of what happened, who decided what, and why.

A mature posture uses a structured workflow:

One practical operational tip: teams often want to jump straight to “is this reportable?” before they’ve captured clean facts. Flip it. Capture consistent facts first. Then apply the reportability logic. If your record is sloppy, your reportability decision is sloppy too—and that’s the kind of sloppiness regulators notice.

14) Records: what inspectors actually ask for (and what “available” really means)

In biologics, inspections are rarely won by your SOP library. They’re won by your ability to produce trustworthy evidence quickly. Inspectors tend to pressure-test the same categories because those are where organizations hide fragility:

• Batch execution evidence: what was done, by whom, when, and with what materials/equipment.
• Deviations and investigations: not just “opened and closed,” but whether the logic is defensible and complete.
• Change history: whether changes are controlled, assessed, and aligned across systems and documents.
• Complaint and safety signal handling: whether triage and trending are structured and consistent.
• Training evidence: whether qualified execution can be proven, not assumed.

This is why “records must be available” cannot mean “somewhere on a shared drive.” Availability means: searchable, complete, consistent, and retrievable without reconstructing the story. If you need a practical, operations-focused foundation for record discipline, the combination of Good Documentation Practices, Record Retention Policy, and controlled correction behavior (Batch Record Corrections) is a good baseline.

15) Where Part 11 intersects biologics operations

Most biologics operations maintain at least some regulated records electronically. That is where 21 CFR Part 11 becomes part of the conversation—especially when you use electronic signatures, audit trails, controlled access, or electronic batch records.

But here’s the straight talk: even when teams debate Part 11 applicability nuance, data integrity expectations do not disappear. If your system allows silent overwrites, unclear authorship, uncontrolled permissions, or undetectable post-hoc edits, your records won’t be trusted—even if you can argue legal technicalities. If you want a practical, inspection-survivable posture, start with Part 11 Readiness and treat “audit trail + permissions + controlled corrections” as non-negotiables.

16) System architecture: building biologics-grade evidence

Biologics compliance is easiest when your systems generate evidence as a byproduct of execution. It’s hardest when you try to manufacture evidence after the fact. The architecture difference is simple: event-linked records versus reconstructive records.

A biologics-grade evidence architecture typically includes:

If your current state is “we store PDFs,” understand what that means: your compliance posture is fundamentally manual. That can work at small scale with stable teams, but it becomes fragile under growth, turnover, inspections, or incidents.

17) Inspection readiness: how to avoid chaotic narratives

Biologics inspections reward organizations that can tell a consistent story with records. The simplest way to build that capability is to treat inspection readiness like a repeating operational exercise, not a once-a-year panic.

Three practices reliably separate strong teams from scramble teams:

1) Retrieval drills. Pick a lot, then pull batch execution evidence, deviations, CAPA, changes, training, and release evidence. If it takes days and five spreadsheets, your posture is not resilient.

2) “Single truth” governance. If your QMS says one thing, your batch record says another, and your warehouse or lab systems say a third, you lose time arguing with yourself.

3) Pre-defined escalation logic. When a complaint, deviation, or safety signal arrives, you shouldn’t invent the workflow in real time. It should already exist, and it should already be trained and tested (see Audit Readiness and Complaints & Recalls / Post-Market Surveillance Hub).

18) Copy/paste readiness scorecard (self-assessment)

Use this as a practical self-assessment. If you can’t answer these cleanly, your 600–680 posture is fragile.

The goal isn’t to “score well.” The goal is to locate where your operation depends on reconstruction and replace it with event-driven evidence.

19) Common pitfalls: how biologics compliance gets “papered over”

• Compliance-by-PDF. Scanned or static documents without structured identity fields make retrieval slow and error-prone.
• Uncontrolled corrections. “Fixing” records without governed correction logic destroys trust in your own evidence.
• Change drift. Changes implemented in practice but not reflected in controlled documents, training, and systems.
• Complaint chaos. Complaints treated like customer service tickets rather than regulated signals and evidence.
• Fragmented truth. Disconnected systems (and shadow spreadsheets) create conflicting records under inspection pressure.
• Inspection theater. Prepping slides instead of building retrieval capability and evidence integrity.

20) How this maps to V5 by SG Systems Global

V5 supports biologics outcomes by focusing on what Parts 600–680 actually demand in practice: controlled execution, governed quality workflows, and fast retrieval of trustworthy evidence. Regulations don’t want pretty dashboards; they want defensible records.

Practical alignment points:

If your biggest risk is “we can’t pull a coherent batch-and-quality story fast,” start with controlled quality workflows and record governance via V5 Quality Management System (QMS) and build event-linked execution records where appropriate using V5 Manufacturing Execution System (MES). For organizations that need to reduce integration fragility (where systems disagree under inspection pressure), V5 Connect API is the practical bridge between “systems exist” and “systems reconcile.” A high-level overview of how these pieces fit together is here: V5 Solution Overview.

The point is not “software replaces compliance.” The point is that biologics compliance assumes your operating model can produce defensible evidence without improvisation. V5 is designed to make that operating model enforceable.

21) Extended FAQ

Q1. Is “21 CFR 600–680” basically “blood regulations”?
Blood is a major portion (Parts 606/607/630/640), but the set is broader. It covers biologics licensing and general standards that apply across biological products categories. The authoritative part list is easiest to confirm via Subchapter F — Biologics (eCFR).

Q2. Do biologics manufacturers still need to care about Parts 210/211?
Often, yes. Many biologics also align with drug CGMP expectations, which is why organizations commonly map their posture to Part 210 and Part 211 alongside biologics-specific controls in the 600–680 set.

Q3. What fails most often in practice?
Evidence integrity: inconsistent identity, scattered records, weak audit trails, uncontrolled corrections, and investigations that read like narrative cleanup.

Q4. Does “electronic” automatically mean Part 11?
Not automatically, but electronic records increase scrutiny around audit trails, permissions, and signatures. Regardless, data integrity expectations still apply if you want your records to be defensible (see Part 11 and Part 11 Readiness).

Q5. What’s the fastest way to tell if our posture is real?
Run retrieval drills. Pick a lot or event, then prove you can pull a coherent batch + quality + change + complaint story from system records without ad hoc spreadsheets.

Related Reading
• Regulatory Sources: 21 CFR Subchapter F — Biologics (eCFR) and key parts like Part 600, Part 601, and Part 610
• Evidence & Governance: Good Documentation Practices + Batch Record Corrections + Record Retention Policy
• Signals & Response: Complaint vs Adverse Event + Audit Readiness