⚖️ Module 03 of 17 — Foundations
Key Laws &
Regulations
Every FDA requirement traces to a specific law passed by Congress — almost always in response to a public health disaster. This module covers every major statute in FDA's legal framework: what it says, why it was written, exactly what it requires, and how it affects products entering the U.S. market today.
Why the Law Matters More Than the Regulations
Most regulatory consultants work primarily with the CFR — the Code of Federal Regulations — which is where the detailed rules live. But the CFR is secondary law: regulations written by FDA to implement statutes passed by Congress. When a CFR regulation and a congressional statute conflict, the statute wins. When a regulation is challenged in court, the court looks at the statute to determine whether FDA exceeded its authority.
Understanding the underlying statutes makes you a better consultant in three specific ways. First, you understand why a regulation exists — which makes it easier to explain to clients and identify when it genuinely applies. Second, you can recognize when FDA's interpretation of a statute is aggressive or contestable — useful in enforcement situations. Third, you can anticipate regulatory changes by tracking Congressional activity, not just FDA rulemaking.
// The Legislative Hierarchy
How U.S. Law Works in Layers
Congress passes a statute (e.g., the FD&C Act). FDA writes regulations to implement it (published in the CFR). FDA also issues guidances explaining how it interprets the regulations. Courts enforce all three — but statutes trump regulations, and regulations trump guidances. Knowing which layer you're working in changes how you advise clients.
The Legislative Timeline — A History in Disasters
The history of FDA law is inseparable from public health failures. Nearly every major statute was enacted in response to a specific tragedy. This pattern explains why FDA takes compliance so seriously — and why the agency's enforcement posture can seem disproportionate to companies that view their products as safe.
1906
Pure Food and Drug Act — The First FDA Law
The original federal food and drug law. Prohibited interstate commerce in adulterated or misbranded food and drugs. Did not require pre-market approval — just prohibited harmful products already on the market.
Trigger: Upton Sinclair's The Jungle exposing meatpacking conditions; widespread patent medicine fraud.
1938
Federal Food, Drug, and Cosmetic Act (FD&C Act)
The foundational statute governing FDA today. Required drugs to be proven safe before marketing for the first time. Created mandatory factory inspections. Established cosmetic regulation. Introduced adulteration and misbranding as the two core violation categories.
Trigger: Elixir Sulfanilamide — 107 deaths from a toxic drug solvent, mostly children.
1962
Kefauver-Harris Drug Amendments
Added the efficacy requirement — drugs must be proven both safe AND effective. Created the modern NDA system with mandatory clinical trial evidence. Required informed consent for research subjects. Mandated adverse event reporting to FDA.
Trigger: Thalidomide birth defects epidemic in Europe (U.S. largely spared by FDA's Dr. Frances Kelsey).
1976
Medical Device Amendments (MDA)
Created the three-class device classification system. Established the 510(k) premarket notification pathway. Required Premarket Approval (PMA) for life-sustaining devices. Gave FDA authority to recall dangerous devices.
Trigger: Dalkon Shield IUD — linked to septic abortions and deaths in thousands of women.
1984
Hatch-Waxman Act
Created the ANDA pathway for generic drugs. Established the Paragraph IV patent certification system allowing generic manufacturers to challenge brand patents. Granted 180-day generic exclusivity to first ANDA filers.
Trigger: High drug prices; need to balance brand protection with generic access.
1992
Prescription Drug User Fee Act (PDUFA)
Allowed FDA to collect user fees from pharmaceutical companies to fund drug review. Created binding 10-month (standard) and 6-month (priority) review timeline commitments. Reauthorized every 5 years — a major legislative event watched by the entire pharmaceutical industry.
Trigger: Congressional concern about slow drug approvals delaying patient access.
1994
Dietary Supplement Health and Education Act (DSHEA)
Carved dietary supplements out of the drug category. Eliminated pre-market approval for supplements. Allowed structure/function claims with a required disclaimer. FDA must prove a supplement is unsafe to remove it — reversing the drug burden of proof.
Trigger: Supplement industry lobbying; consumer demand for vitamin/herbal access without Rx requirements.
2002
Bioterrorism Act
Required food facility registration with FDA for the first time in U.S. history. Created the Prior Notice requirement for imported food. Gave FDA authority to administratively detain food believed to be adulterated or misbranded.
Trigger: September 11, 2001 attacks and concerns about deliberate food supply contamination.
2004
FALCPA — Food Allergen Labeling and Consumer Protection Act
Required plain-English allergen labeling for the 8 major allergens (milk, eggs, fish, shellfish, tree nuts, wheat, peanuts, soybeans). Later expanded by the FASTER Act (2021) to add sesame as the 9th major allergen, effective January 1, 2023.
Trigger: Undeclared allergen deaths; consumer safety advocacy.
2007
FDA Amendments Act (FDAAA)
Dramatically expanded FDA's post-market drug safety authority. Required Risk Evaluation and Mitigation Strategies (REMS) for drugs with serious risks. Mandated clinical trial registration at ClinicalTrials.gov. Enhanced device post-market surveillance.
Trigger: Vioxx cardiovascular scandal — 27,000+ heart attacks attributed to the drug before 2004 withdrawal.
2011
Food Safety Modernization Act (FSMA)
The most sweeping food safety reform in 70 years. Shifted FDA from reactive to preventive. Created the Foreign Supplier Verification Program (FSVP). Required Food Safety Plans with hazard analysis. Gave FDA mandatory recall authority for food for the first time.
Trigger: Peanut butter Salmonella (2008–09, 714 cases, 9 deaths), spinach E. coli (2006), cantaloupe Listeria (2011).
2016
21st Century Cures Act
Accelerated medical product development. Created new pathways for regenerative medicine. Expanded real-world evidence use in approvals. Required mental health system reform. Established the Cancer Moonshot and BRAIN Initiative.
Trigger: Bipartisan push to speed medical innovation.
2022
Modernization of Cosmetics Regulation Act (MoCRA)
First major cosmetics overhaul since 1938. Created mandatory facility registration, product listing, safety substantiation records, and adverse event reporting. Gave FDA authority to mandate cosmetic recalls. Required GMP regulations for cosmetics.
Trigger: Talc/asbestos contamination lawsuits; EU cosmetics regulation far stricter than U.S.
The FD&C Act — The Foundation of Everything
Every FDA consultant must have intimate knowledge of the Federal Food, Drug, and Cosmetic Act. It is not just a historical document — it is the living legal authority that FDA exercises every day. The act has been amended dozens of times since 1938, each amendment expanding or refining FDA's authority in response to new challenges.
📜
Enacted 1938 — Continuously Amended
Federal Food, Drug, and Cosmetic Act
FD&C Act
The foundational statute. Everything in FDA regulation traces back here.
⚡ Triggered by: Elixir Sulfanilamide — 107 deaths, 1937
Core Legal Concepts
- Adulteration (21 U.S.C. §§ 342, 351, 361) — Product is adulterated if unsafe, filthy, manufactured under insanitary conditions, or below required quality. Can apply even before anyone is harmed.
- Misbranding (21 U.S.C. §§ 343, 352, 362) — Product is misbranded if labeling is false, misleading, or lacks required information. Most common violation category at the U.S. border.
- Prohibited Acts (21 U.S.C. § 331) — The master list of illegal actions: selling adulterated/misbranded products, refusing FDA inspections, failing to register, submitting false information.
- Criminal Penalties (21 U.S.C. § 333) — Misdemeanor (no intent required) or felony (with intent). Corporate officers personally liable.
Key Provisions by Product
- Food (§§ 341–350l): Standards of identity, food additives, color additives, dietary supplements, infant formula, nutrition labeling, allergen labeling
- Drugs (§§ 351–360eee): Drug approval requirements, establishment registration, drug listing, cGMP, advertising regulation
- Devices (§§ 360–360bbb): Device classification, 510(k), PMA, device listing, QSR, MDR adverse event reporting, device recalls
- Cosmetics (§§ 361–364): Expanded by MoCRA (2022) — facility registration, product listing, safety substantiation, adverse event reporting
The Responsible Corporate Officer Doctrine — The Most Powerful Personal Liability Concept in FDA Law
Section 333 of the FD&C Act creates one of the most powerful personal liability provisions in U.S. regulatory law. Under the Supreme Court's interpretation in United States v. Park (1975), a corporate officer can be convicted of a misdemeanor for selling adulterated or misbranded products even if they had no knowledge of the violation and took no deliberate act. The standard is whether the officer had the authority and responsibility to prevent the violation — not whether they were personally at fault.
This is not theoretical. FDA has pursued criminal charges against corporate officers in cases involving contaminated peanut butter (Stewart Parnell, sentenced to 28 years), falsified drug testing records, and medical device quality system failures. The doctrine creates strong incentives for executives to invest in compliance — because their personal freedom can depend on it.
21 U.S.C. §§ 301–399d
21 CFR Title 21 (all parts)
Consultant application: When a client pushes back on compliance costs, cite the responsible corporate officer doctrine. A $2,000 label review or $1,500 facility registration is trivially small compared to personal criminal liability under § 333. This reframes compliance from a cost center to personal liability insurance — an argument that resonates immediately with business owners.
FSMA — The Food Safety Revolution
🥗
Signed January 4, 2011
Food Safety Modernization Act
FSMA
Shifted U.S. food safety from reactive to preventive. The most significant food law in 70 years.
⚡ Triggered by: Peanut butter Salmonella — 714 cases, 9 deaths, 3,913 products recalled
The Seven Major FSMA Rules
- Preventive Controls for Human Food (21 CFR Part 117) — Written Food Safety Plans with hazard analysis, preventive controls, monitoring, corrective actions, verification. A PCQI (Preventive Controls Qualified Individual) must develop and sign off.
- Preventive Controls for Animal Food (21 CFR Part 507) — Same framework applied to pet food, livestock feed, and aquaculture.
- Produce Safety Rule (21 CFR Part 112) — Standards for farms growing produce: agricultural water, biological soil amendments, worker hygiene, equipment, post-harvest handling.
- Foreign Supplier Verification Program (FSVP) (21 CFR Part 1, Subpart L) — U.S. importers must verify that foreign suppliers produce food meeting U.S. safety standards. The legal obligation sits with the importer — but foreign suppliers must cooperate.
- Sanitary Transportation Rule (21 CFR Part 1, Subpart O) — Temperature control, cleaning, and documentation for food transport by motor vehicle and rail.
- Intentional Adulteration Rule (21 CFR Part 121) — Vulnerability assessments and mitigation strategies for deliberate food supply contamination.
- Third-Party Certification — Voluntary program for accredited auditors to certify foreign food facilities.
What Changed for International Exporters
- Foreign facilities must now comply with U.S. preventive controls standards — not just be registered
- U.S. importers are legally responsible for verifying foreign supplier compliance — they will request documentation, audit reports, and food safety plan summaries
- FDA can deny import of food from foreign facilities that refuse inspection (21 U.S.C. § 384a)
- Mandatory recall authority — FDA can now order food recalls, not just request voluntary ones
- Registration suspension — FDA can suspend a facility's registration if it poses a reasonable probability of serious adverse health consequences, immediately blocking all imports
HARPC — The Hazard Analysis Framework at FSMA's Core
HARPC (Hazard Analysis and Risk-Based Preventive Controls) is FSMA's version of HACCP — but broader. Where HACCP focuses on biological, chemical, and physical hazards, HARPC also encompasses radiological hazards and economically motivated adulteration (food fraud). Every covered food facility must conduct a formal hazard analysis and implement preventive controls for all identified significant hazards. The complete plan must be documented, signed by a PCQI, and available for FDA inspection.
21 U.S.C. §§ 2201–2252
21 CFR Parts 1, 112, 117, 121, 507
Consultant application: FSVP is your entry point with U.S. food importers. When a U.S. importer asks you to help verify a foreign supplier, that is FSVP consulting. It requires: supplier hazard analysis, a supplier evaluation (audit, third-party certification, or review of FDA inspection reports), and annual review. This is repeatable, retainer-friendly work — one U.S. importer with 20 foreign suppliers is a substantial ongoing engagement.
DSHEA — The Supplement Industry's Charter
🌿
Enacted October 25, 1994
Dietary Supplement Health and Education Act
DSHEA
Carved supplements out of the drug category. No pre-market approval. FDA must prove harm before acting.
⚡ Triggered by: Industry lobbying + consumer demand for supplement access
What DSHEA Created
- Supplement definition: A product intended to supplement the diet containing a dietary ingredient — vitamin, mineral, herb, botanical, amino acid, enzyme, or concentrate thereof. Must be labeled as a supplement and taken as a supplement (not as a conventional food or meal replacement).
- No pre-market approval: Unlike drugs, supplements do not require FDA approval before sale. The manufacturer bears full responsibility for ensuring safety and truthful labeling.
- NDI notification: Ingredients not marketed before October 15, 1994, require a 75-day pre-market notification to FDA with safety evidence. Filing an NDI without adequate safety data invites an objection letter from FDA.
- Reversed burden of proof: FDA must prove a supplement is unsafe to remove it from the market — the complete opposite of the drug approval system, where manufacturers must prove safety first.
The Claims Hierarchy — The Most Important Thing
- Disease claims → ILLEGAL on supplements: "Treats depression," "cures cancer," "prevents Alzheimer's" — these transform the product into an unapproved drug under 21 U.S.C. § 321(g) regardless of product form
- Health claims → Permitted if FDA-authorized: Approximately 12 authorized claims exist (e.g., "Adequate calcium throughout life may reduce the risk of osteoporosis")
- Structure/function claims → Permitted with mandatory disclaimer: "Supports immune health," "promotes cardiovascular function," "helps maintain healthy cholesterol already within normal range"
- 30-day notification: Manufacturers must notify FDA within 30 days of first marketing any structure/function claim
- FTC dual jurisdiction: The FTC regulates supplement advertising (not labeling) — a supplement company can be compliant with FDA but still face FTC action for misleading advertising claims
The Mandatory Disclaimer — Exact Wording Required
Required on every label making a structure/function claim:
"These statements have not been evaluated by the Food and Drug Administration.
This product is not intended to diagnose, treat, cure, or prevent any disease."
// Format requirements (21 CFR § 101.93):
— Must appear with each structure/function claim on the label
— Must be placed prominently and conspicuously on the label
— Exact wording required — no paraphrasing
— Must also appear in any advertising for the claim
21 U.S.C. §§ 321(ff), 342(f), 343(r)(6), 350b
21 CFR Part 111 · 21 CFR § 101.93
Consultant application: The single most common compliance failure in the supplement industry is disease claims — on the label, on the company website, on Amazon listings, and in social media posts. FDA explicitly treats website content and social media as "labeling" under 21 U.S.C. § 321(m). Before advising any supplement client on registration, audit every piece of content: label, website, Amazon listing, Instagram, Facebook, YouTube. A single post claiming "helps fight cancer" triggers enforcement against the entire product line.
// Real-World Scenario — When Digital Claims Kill Compliance
The Indonesian Turmeric Extract
An Indonesian company produces a turmeric extract supplement and wants to export to the U.S. Their label says "Supports joint health and reduces inflammation" — potentially permissible with the required disclaimer. But a full digital audit reveals:
- Company website: "Clinical studies show turmeric treats arthritis as effectively as ibuprofen" → disease claim → unapproved drug
- Instagram: "Our customers report complete recovery from rheumatoid arthritis" → disease claim → unapproved drug
- Amazon listing: "The natural cure for joint pain" → disease claim → unapproved drug
- YouTube video title: "How this supplement eliminated my arthritis pain" — client testimonial on official channel → disease claim → unapproved drug
The physical label alone might be salvageable. But under 21 U.S.C. § 321(m), labeling includes "all labels and other written, printed, or graphic matter upon any article or any of its containers or wrappers, or accompanying such article." Courts have consistently held this extends to websites, social media, and online retail listings associated with the product.
🚫 The product cannot be registered or imported as a dietary supplement in its current commercial presentation. All digital content must be revised before any registration work begins.
Medical Device Amendments — The Device Classification Framework
🔬
Enacted May 28, 1976
Medical Device Amendments
MDA
Created Class I/II/III classification and the 510(k) pathway. The foundation of all device regulation.
⚡ Triggered by: Dalkon Shield IUD — septic abortions and deaths in thousands of women
The Three-Class System — Risk-Based Regulation
- Class I — General Controls (~47%): Lowest risk. Bandages, tongue depressors, elastic bandages. Most exempt from premarket review. Must still register establishment, list device, comply with labeling and GMP.
- Class II — Special Controls (~43%): Moderate risk. Blood pressure monitors, X-ray equipment, pregnancy tests, contact lenses. Subject to general plus special controls. Most require 510(k) clearance before marketing in the U.S.
- Class III — PMA (~10%): Highest risk — life-sustaining or implantable. Pacemakers, cochlear implants, heart valves, breast implants. Require full Premarket Approval (PMA) with clinical evidence of safety and effectiveness.
The 510(k) — A Unique Legal Construction
- A premarket notification — not an application for approval
- Demonstrates "substantial equivalence" to a legally marketed predicate device
- FDA's clearance means the device can be marketed — NOT that FDA found it independently safe and effective
- The predicate chain can trace back to a pre-1976 device with no modern safety review — a limitation critics call the "predicate treadmill"
- De Novo pathway (2012): For novel low-to-moderate risk devices with no valid predicate — creates a new device type that others can then use as a predicate
Safe Medical Devices Act (1990) — The Post-Market Obligation
The SMDA expanded on the MDA by creating mandatory Medical Device Reporting (MDR): device manufacturers must report device-associated deaths to FDA within 30 days, and serious injuries within 30 days (or 5 days for imminent hazard). This MDR obligation is a permanent post-market compliance requirement for all device companies — one that must be built into quality systems from day one.
21 U.S.C. §§ 360c–360k
21 CFR Parts 800–898
Consultant application: The 510(k) vs. PMA determination is the single most consequential decision you'll make for a device client. Class II via 510(k): potentially $50–100K and 6–12 months. Class III via PMA: potentially $10M+ and 3–7 years. Always recommend a free Q-Submission (Pre-Sub) meeting with CDRH before filing — it costs nothing and can confirm your predicate strategy, testing requirements, and submission format before you spend a dollar on the formal submission.
MoCRA — The New Cosmetics Era
💄
Signed December 29, 2022
Modernization of Cosmetics Regulation Act
MoCRA
First major cosmetics overhaul since 1938. Mandatory registration, listing, safety records, adverse event reporting — all new.
⚡ Triggered by: Talc/asbestos lawsuits; EU regulation far stricter; consumer safety concerns
What MoCRA Requires (All New)
- Facility Registration — Every facility manufacturing or processing cosmetics for U.S. distribution must register with FDA via Cosmetics Direct. Foreign facilities must designate a U.S. Agent. Deadline: December 29, 2023. Renewal: every 2 years.
- Product Listing — Every cosmetic product individually listed with FDA. Must include product name, category, and complete ingredient list in INCI format. Deadline: July 1, 2024. New products: 120 days after market introduction.
- Safety Substantiation — Manufacturers must maintain records demonstrating adequate evidence that the product is safe for its intended use. No specific test required — but records must be available for FDA inspection.
- Adverse Event Reporting — Serious adverse events (hospitalization, disfigurement, death) must be reported to FDA within 15 business days. Annual reporting for non-serious events. Records maintained for 6 years.
New FDA Authorities Under MoCRA
- Mandatory recall authority: FDA can now order cosmetic recalls — first time ever for cosmetics
- Enhanced inspection: FDA can inspect cosmetic manufacturing facilities and records under MoCRA authority
- GMP requirement: FDA required to establish GMP regulations for cosmetics — currently using ISO 22716 as best practice while formal rule is developed
- Fragrance allergen disclosure: FDA must develop regulations for fragrance allergen labeling (rulemaking in progress)
- Small business exemption: Businesses averaging less than $1M in annual gross sales of cosmetics are exempt from registration/listing (but not from safety substantiation requirements)
Before and After MoCRA — The Critical Comparison
| Requirement | Before MoCRA | After MoCRA |
|---|---|---|
| Facility Registration | Voluntary | Mandatory |
| Product Listing | Voluntary | Mandatory |
| Safety Substantiation | Industry practice | Legally required records |
| Adverse Event Reporting | Voluntary | Mandatory — 15 business days |
| Recall Authority | Voluntary recalls only | FDA can mandate recalls |
| GMP | No federal rule | Rule being developed |
21 U.S.C. §§ 361–364 (as amended)
21 CFR Parts 700–740
Consultant application: MoCRA created a massive new compliance requirement that thousands of international beauty brands still have not addressed. This is an immediate consulting opportunity — registration + product listing + safety substantiation review can be packaged as a fixed-fee engagement ($1,500–$3,500 per facility, $100–200 per additional product). Many beauty brands in Asia, the Middle East, and South America exporting to U.S. distributors are completely unaware of MoCRA's existence.
Other Key Statutes — Quick Reference
| Statute | Year | What It Does | When It Matters for Consultants |
|---|---|---|---|
| Orphan Drug Act | 1983 | Incentivizes drug development for rare diseases (<200,000 U.S. patients). Provides 7-year market exclusivity, 50% clinical trial tax credits, fee waivers, and expedited review. | Pharma clients with rare disease drugs — orphan designation fundamentally changes the economics of drug development and may make otherwise-unviable products commercially feasible. |
| Hatch-Waxman Act | 1984 | Created the ANDA pathway for generic drugs. Paragraph IV certification allows patent challenges. 180-day exclusivity for first generic filer. Balances brand protection with generic access. | Generic drug clients — the entire generics industry operates under this framework. Patent certifications and exclusivity periods directly affect market entry timing decisions. |
| FALCPA + FASTER Act | 2004, 2021 | Required plain-English allergen labeling for 9 major allergens (milk, eggs, fish, shellfish, tree nuts, wheat, peanuts, soybeans, sesame added 2023). "Contains: [allergen]" statement required. | Every food client — undeclared allergens are the most common cause of Class I food recalls in the U.S. Sesame (added 2023) is still frequently missed by international exporters. |
| Bioterrorism Act | 2002 | Required food facility registration for the first time. Created Prior Notice for food imports. Administrative detention authority for suspected adulterated food. | Every food import client — registration and Prior Notice are the two most immediate compliance requirements for any food entering the U.S. |
| BPCIA (Biologics Price Competition) | 2009 | Created the biosimilar approval pathway (351(k)) — the biologic equivalent of ANDA. Established the "patent dance" process for biosimilar-reference product patent disputes. | Biologic and biosimilar clients — highly specialized area; know enough to identify and refer to biosimilar specialists. |
| Drug Quality and Security Act (DQSA/DSCSA) | 2013 | Overhauled pharmacy compounding after NECC fungal meningitis outbreak (64 deaths). Created electronic drug track-and-trace system (DSCSA) — serialization requirements now fully in effect for manufacturers, wholesale distributors, and dispensers. | Pharmaceutical supply chain clients — DSCSA serialization and track-and-trace compliance is an active, ongoing requirement that pharmaceutical distributors frequently need help implementing. |
Regulations, Guidances, and Policies — The Practical Hierarchy
For day-to-day consulting work, you'll deal with three types of documents that carry very different legal weight. Confusing these layers is a common mistake — especially when advising clients on how much flexibility they have in a compliance situation.
⚖️
Regulations (CFR)
Legally binding. Published in the Federal Register through notice-and-comment rulemaking. Companies must comply — no discretion unless a specific exception exists. Can only be changed through formal rulemaking taking months to years.
Example: 21 CFR § 101.9 — Nutrition labeling. Every covered food must have a Nutrition Facts panel in the specified format. Not optional.
Example: 21 CFR § 101.9 — Nutrition labeling. Every covered food must have a Nutrition Facts panel in the specified format. Not optional.
📋
FDA Guidances
Not legally binding. Represent FDA's current thinking. Companies can deviate with documented justification — but doing so invites scrutiny and requires strong reasoning.
Example: FDA guidance on voluntary sodium reduction targets for processed foods. Not a law. Companies that don't follow it won't be cited — but those who do may receive more favorable treatment in inspections.
Example: FDA guidance on voluntary sodium reduction targets for processed foods. Not a law. Companies that don't follow it won't be cited — but those who do may receive more favorable treatment in inspections.
📝
Enforcement Policies
Reflects FDA's resource allocation. FDA can exercise enforcement discretion — choosing not to enforce a regulation in specific circumstances — without changing the underlying law.
Example: During COVID, FDA issued enforcement policies allowing regulatory flexibilities for PPE and diagnostic tests without changing the underlying device regulations.
Example: During COVID, FDA issued enforcement policies allowing regulatory flexibilities for PPE and diagnostic tests without changing the underlying device regulations.
⚠️
The Guidance Trap: Clients sometimes read an FDA guidance and conclude they must follow it as law — then panic when compliance seems impossible. Others read "not legally binding" and dismiss it entirely. The correct position is in the middle: guidances represent FDA's stated intent and inspection priorities. Deviating without documented justification is a deliberate risk management decision — not a neutral choice.
The CFR Navigation Map — Your Primary Reference
The CFR is organized by Title, Part, Section, and Paragraph. Title 21 is FDA's entire domain. Here is the complete reference map every FDA consultant should know:
// Title 21 CFR — Complete Navigation Map
FOOD & SUPPLEMENTS (CFSAN)
Part 1 General administrative; food facility registration; Prior Notice
Part 101 Food labeling — the complete rulebook for every food label element
Part 112 Produce Safety Rule — farms growing produce for human consumption
Part 117 FSMA CGMP + hazard analysis + preventive controls for human food
Part 121 Intentional adulteration — food defense vulnerability assessments
Part 101.93 Structure/function claims for dietary supplements — disclaimer requirement
Part 111 Current GMP for dietary supplements — identity, purity, strength, composition
COSMETICS (CFSAN)
Parts 700–740 Cosmetics — general regulations, labeling, prohibited ingredients, color additives
HUMAN DRUGS (CDER)
Part 201 Drug labeling — prescription and OTC labeling requirements
Part 202 Prescription drug advertising
Parts 210–211 Drug cGMP — the core manufacturing quality requirements
Part 314 NDA submissions for new brand-name drugs
Part 320 Bioavailability and bioequivalence for generic drugs (ANDA)
VETERINARY (CVM)
Parts 500–599 Animal food, feed, and veterinary drug regulations
Part 507 FSMA preventive controls for animal food
Parts 514–516 NADA and ANADA applications for animal drugs
MEDICAL DEVICES (CDRH)
Part 801 Device labeling requirements
Part 803 Medical Device Reporting (MDR) — adverse event reporting
Part 806 Reports of corrections and removals (device recalls)
Part 807 510(k) premarket notification; establishment registration; device listing
Part 814 Premarket Approval (PMA) applications — Class III devices
Part 820 Quality System Regulation (QSR) — the device GMP framework
BIOLOGICS (CBER)
Parts 600–680 Biologics — licensing, labeling, blood, vaccines, tissue, gene therapy
// Authoritative sources
Current CFR text: ecfr.gov
FDA guidances: fda.gov/regulatory-information/search-fda-guidance-documents
Warning letters: fda.gov/inspections-compliance-enforcement/warning-letters
Import alerts: accessdata.fda.gov/cms_ia/
✅
Subscribe to FDA's rulemaking notifications: Every proposed rule goes through public notice-and-comment before becoming final. Subscribe to the Federal Register at federalregister.gov for specific Title 21 sections, and to FDA's email update service at fda.gov/about-fda/contact-fda/subscribe-podcasts-and-news-feeds. Staying ahead of rulemaking changes is a key differentiator between generalist consultants and recognized experts.
✦ Module 03 — Key Takeaways
- Every major FDA statute was enacted in response to a public health disaster. The severity of FDA enforcement is proportional to the severity of the tragedies that created its authority.
- The FD&C Act (1938) is the foundation. Adulteration and misbranding are strict liability offenses under § 333 — corporate officers can be personally convicted without intent. This is the responsible corporate officer doctrine from United States v. Park (1975).
- FSMA (2011) created the FSVP obligation — U.S. importers must verify foreign suppliers. This creates documentation requirements that foreign food manufacturers must support, and is a substantial consulting opportunity for both sides of the supply chain.
- DSHEA (1994) gave supplement manufacturers freedom from pre-market approval but created strict claims controls. Disease claims on any platform — website, social media, Amazon listing — convert a supplement into an unapproved drug under 21 U.S.C. § 321(m).
- The Medical Device Amendments (1976) created the 510(k) and PMA pathways. 510(k) clearance is not the same as approval — it is a finding of substantial equivalence to a predicate. Always recommend a free Q-Sub meeting with CDRH before any device submission.
- MoCRA (2022) created mandatory cosmetics registration for the first time in U.S. history. Thousands of international beauty brands are still non-compliant — representing an immediate, actionable consulting opportunity.
- Regulations (CFR) are binding law. Guidances are not — but deviating from them without documented justification is a deliberate risk management decision. The practical standard is: follow guidances unless you have strong documented reasons not to, and have that reasoning reviewed by counsel in high-stakes situations.
Need to know which laws apply to your product?
Regovant provides regulatory strategy memos that identify every applicable statute, regulation, and guidance for your specific product — with a clear action plan and timeline.