In the drug and device product liability world, we love our acronyms and our short-hand phrases.  The MDAs to the FDCA.  Class III.  PMA.  510(k).

Today’s acronym is CGMP, which sometimes you will see written as “cGMP”.  The GMP stands for Good Manufacturing Practices, and the “C” (or “c”) has, since a 1996 Final Rule—and until recently—stood for Current. 

These CGMPs have been housed in the Code of Federal Regulations, 21 C.F.R. 820, et seq. (which, to add to the acronyms, are sometimes called “QSRs” for Quality System Regulations or “QMSR” for Quality Management System Regulations).

Although the CGMPs were meant to “govern the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use” and “intended to ensure that finished devices will be safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (the act)” [21 C.F.R. § 820.1(a) (1996)], they were never prescriptive.

They were meant to be tailored by manufacturers to the particular device at issue, and they were meant to evolve and adapt to fit the circumstances.  

For example, 21 C.F.R. § 820.22 (available at https://www.govinfo.gov/content/pkg/FR-1996-10-07/pdf/96-25720.pdf) required device quality checks, but it provided:

Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system.

Similarly, 21 C.F.R. § 820.70 required manufacturing processes that would prevent non-conforming products, but stated:

Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications.

Design, manufacture, labeling, adverse event reporting—all the regulations followed the same pattern.  Manufacturers need to have processes covering these areas, but those processes are not “one size fits all.”

Over the years, many plaintiffs have tried to plead around express preemption for Class III, PMA devices [21 U.S.C. § 360k(a) as interpreted in Riegel v. Medtronic, Inc., 552 U.S. 312 (2008)] by citing a laundry list of allegedly-violated CGMPs.  

The courts that have properly understood the non-prescriptive aspect of alleged CGMP violations have found such allegations insufficient to support a claim that escapes preemption because these CGMPs always have been “intentionally vague and open-ended.” Ilarraza v. Medtronic, Inc., 677 F. Supp. 2d 582, 588 (E.D.N.Y. 2009); see also In re Medtronic, Inc. Sprint Fidelis Leads Prod. Liab. Litig., 592 F. Supp. 2d 1147, 1157 (D. Minn. 2009) (CGMPs “are inherently flexible” and “require manufacturers to develop their own quality-system controls”).

A more compelling reason exists for preemption of CGMP-based claims, however.  For devices approved through the PMA process, the FDA actually reviews and approves the manufacturer’s quality management system processes as part of the PMA process and the FDA then is charged with enforcing what has been transformed into device-specific federal requirements.

As the FDA explained in “Quality System Information for Certain Premarket Application Reviews; Guidance for Industry and FDA Staff” (available at https://www.fda.gov/media/71083/download),

A Premarket Approval Application (PMA) is required to include a complete description of the methods, facilities, and controls, in sufficient detail so that FDA can make a knowledgeable assessment of the quality control used in producing the medical device (21 U.S.C. 515(c)(1)(C)).

Not enough?  See also FDA’s Compliance Program Guidance Manual related to Medical Device PMA Preapproval and PMA Postmarket Inspections, at Part I, p. 1-2:

PMA applications “are required to include” descriptions of their compliance with Current Good Manufacturing Practices (“CGMP”) requirements, which are promulgated in the Quality System Regulation (“QSR”), and “approval of a PMA application for a device can be denied if a manufacturer does not conform to the QS regulation requirements.”  

In other words, although all devices have to have tailor-made quality processes as outlined in the otherwise vague regulations at  21 C.F.R. § 820 et seq., for PMA devices, the FDA always has had the last word on whether those processes were appropriate and adequate—and once the FDA mandated those processes by granting premarket approval, changes to those devices that might affect safety or effectiveness had to be approved by the FDA as well.  

Accordingly, although we certainly agree that superficial citations to various CGMP regulations have always failed to assert a non-preempted claim because the regulations themselves are too vague and open-ended, that is not even half of the preemption story.  

The rest of the preemption story is that, as part of the PMA process, the FDA actually examines the manufacturer’s proposed processes and then mandates (through premarket approval) what those processes must entail.  A tort plaintiff who tries to use state law to fault the FDA-required process and suggest that a different one should have been used is, by definition is seeking to enforce a state law requirement that is different from, or in addition to, what the FDA itself required as a matter of federal law.   

The reality of the FDA’s regulatory processes matter to preemption, and it is important to inform courts about those processes because they are not well-developed in the preemption case law.  

Please also note that the CGMPs of 21 C.F.R. 820 et seq. themselves recently underwent a significant change, effective February 2, 2026.  In 89 Fed. Reg. 7496, the FDA issued

a final rule to amend the device current good manufacturing practice (CGMP) requirements of the Quality System (QS) regulation to harmonize and modernize the regulation. We are harmonizing to align more closely with the international consensus standard for devices by converging with the quality management system (QMS) requirements used by other regulatory authorities from other jurisdictions (i.e., other countries). We are doing so by incorporating by reference an international standard specific for device quality management systems.

The main international standard:  ISO 13485 (2016), Medical Devices—Quality Management System Requirements for Regulatory Purposes.  (Users who register can download a read-only version of ISO 13485 at https://ibr.ansi.org/Standards/iso2.aspx ).

This change-over—from federal regulations covering the various quality system topics to incorporation of ISO 13485 which does much the same thing—should not alter the preemption arguments.  

Like the CGMPs before it, ISO 13485 requires the development of device-appropriate design, manufacture, labeling, and other processes, and relevant for preemption purposes, those will still require FDA review and approval through the PMA process, and that should mean preemption is the result.