cGMP, in one sentence.
Current Good Manufacturing Practice (cGMP) is the body of regulation that governs how human drugs and biological products are manufactured. In the U.S. it is codified in 21 CFR Parts 210 and 211 (drugs) and Part 1271 (human cells and tissues). In other jurisdictions, parallel frameworks apply: EudraLex Volume 4 in the EU, PIC/S internationally, COFEPRIS-aligned standards in Mexico. The standards are remarkably similar across geographies because they trace back to the same WHO guidance.
What cGMP regulates: the entire chain from raw materials to release of finished product. Facility design. Air handling. Equipment qualification. Personnel training. Documentation. Quality control testing. Quality assurance review. Deviation handling. Stability. Traceability. Storage. Distribution.
What cGMP is not: a sticker you put on a centrifuge.
A manufacturing standard
Regulates facility, process, testing, and quality systems end to end.
A clinic credential
Clinics aren't cGMP. Labs that make their product are.
Inspections and audits
Real cGMP facilities undergo regulator and third-party inspection.
The facility, cleanrooms, classified air.
A cGMP cell-therapy facility is built around classified cleanrooms. The classification system rates particle counts per cubic meter of air. The room where cells are actually handled in open processes is typically ISO Class 5 (equivalent to FDA Grade A), under 3,520 particles ≥0.5 μm per cubic meter, achieved with HEPA-filtered laminar flow.
Adjacent rooms step up in classification: Grade B (the room around the Grade A workstation), then Grade C (gowning, less critical operations), then Grade D (warehouse-adjacent). Pressure cascades flow from cleaner to dirtier so contamination cannot drift inward. Each transition has interlocked airlocks. HVAC systems are validated and continuously monitored.
Air gets cleaner as you move inward.
Four concentric grades. Pressure flows outward. D pushes into the corridor, A is positive-pressure relative to B. Particles cannot drift toward the cells.
None of this happens accidentally. A real cleanroom is a piece of engineering: structural shell, sealed surfaces, HEPA banks, differential-pressure sensors, particle counters, environmental monitoring program. It is built to spec, qualified through a documented IQ/OQ/PQ process, requalified periodically, and inspected.
If a clinic processes cells in the same room where it treats patients, it is not a cGMP facility. If "the lab" is a corner of the office with a biosafety cabinet, it is not a cGMP facility. A cGMP cell manufacturing suite is physically separate, dedicated infrastructure with its own air system, gowning protocol, and material flow.
The process: controlled, documented, repeatable.
Every step that happens to a batch of cells is governed by a Standard Operating Procedure. The SOP specifies what is done, by whom, with what materials, at what temperature, for how long, with what equipment, and how each step is documented. Operators sign in real time. A second operator reviews. Deviations are flagged, investigated, and adjudicated.
This is not paperwork for paperwork's sake. The product is invisible, you cannot look at a vial of cells and know whether anything went wrong. The documentation is how a batch is reconstructed: who touched what, when, with what, to produce what outcome. Every batch is traceable end to end.
What gets captured for every batch.
Seven streams of data, generated as the batch is produced, reviewed independently, and bound into a single record.
Quality control, independent batch testing.
Quality Control is the laboratory function that tests each batch before it can be released to a patient. QC sits organizationally apart from manufacturing: different reporting line, different leadership, to remove pressure to pass borderline results. QC's job is to run the assays the regulatory file specifies and report the result to Quality Assurance.
Eight tests, run on every batch.
No vial leaves the facility without a passing result on every required line. A Certificate of Analysis records each one and binds the batch to its data.
The data goes into a Certificate of Analysis (CoA) for each batch. Without a passing CoA, the batch cannot be released. A clinic that uses a cGMP product should be able to show you the CoA for the batch your dose came from. More on the full testing panel.
Quality assurance. the release gate.
Quality Assurance is the function that decides whether a batch is released. QA reviews the batch record, the QC results, the environmental monitoring, any deviations, the equipment qualification status, the analyst qualification status. If anything is missing, out of spec, or unresolved, QA does not sign the release.
This is the firewall between "the process produced cells" and "the cells reach a patient." In serious operations QA is a separate department, often with veto authority. The QA signature on a batch release is the document a regulator looks for first.
From analysis to signed release.
Three independent functions. No vial moves to the next step until the prior one is closed.
Runs the panel
- Sterility, mycoplasma, endotoxin
- Identity, viability, count
- Potency, karyotype
- Generates raw data → CoA
Reviews everything
- Batch record completeness
- QC data vs. spec
- Environmental monitoring
- Deviations + dispositions
Signs or rejects
- Pass: batch released to clinic
- Fail: batch quarantined
- OOS investigation triggered
- Patient receives identified vial
What QA also owns
Beyond batch release: deviation investigation, CAPA (corrective and preventive action), change control, internal audit, vendor qualification, training records, document control. The quality system is the connective tissue holding everything else together. Without it, "cGMP-compliant" is a poster on the wall.
Staffing, specialists, not generalists.
A cGMP cell manufacturing operation requires specific roles. Many are full-time. None can be done by the same person.
Process operators
Quality team
A "clinic with a lab" can have one or two of these roles. A real cGMP operation has all of them, separately staffed, with documented training and competency records.
Inspection. how compliance is verified.
Self-described cGMP compliance is worthless on its own. The standard is verified by external inspection. Three layers commonly apply:
Federal authority
Periodic on-site inspection. Licensure depends on outcome. Findings can shut a facility down.
Third-party body
Voluntary. Signals seriousness beyond the minimum regulatory bar. Periodic audits maintain status.
Filing partner
When a CMO makes cells for a sponsor pursuing approval, the sponsor audits its supplier. Often the most rigorous review.
cGMP is infrastructure, not a sticker.
A real cGMP operation has a classified cleanroom, a dedicated quality system, a documented batch record, an external-inspected release panel, and a separately-staffed QA function. A clinic does not have these. The lab that makes its product does, or it doesn't.
If a clinic claims "cGMP" but cannot show you a CoA for the specific batch your dose came from, the claim is decorative. Real cGMP produces documentation as a side effect of operating; it cannot be retrofitted onto a process that doesn't have it.
Ask for the CoA
Every batch generates a Certificate of Analysis. Your dose came from a specific batch. The CoA should be retrievable.
Ask who signed release
A named QA function: not the clinic, not the doctor, not the marketing page. A real cGMP operation has a QA head with a signature.
Ask about the last inspection
Date, regulator, outcome. The answers should arrive quickly. Hesitation or vagueness is the answer.