Glossary
The regulatory vocabulary, explained.
Written by people who read the source documents, and updated when the guidance moves.
What Is a Complete Response Letter? FDA CRLs ExplainedFDA's decision not to approve an application in its present form. What a CRL contains, your three options, and the one-year clock that follows.FDA Form 483 Response: What to Write and WhenA Form 483 lists an investigator's inspectional observations. What the 15 business day window buys you, how to structure a response, and what happens if you miss it.Continued Process Verification: Stage 3 Never EndsCPV is the third stage of process validation and the only one with no end date. What to monitor, how control charts differ from specifications, and when to act.CAPA: Correction, Corrective Action, Preventive ActionThree different things sharing one acronym. Why the distinction decides whether a CAPA works, what root cause analysis has to establish, and effectiveness checks.IEC 60601-1: The Standard and Its Collateral Family60601-1 is basic safety and essential performance for electrical medical equipment. How collaterals and particulars stack, and what essential performance means.HCT/Ps: The 361 or 351 QuestionWhether a cell or tissue product is regulated as an HCT/P or a biologic turns on four criteria. Minimal manipulation, homologous use, and why it decides everything.Statistical Analysis Plan: Finalise It Before You UnblindThe SAP specifies the analysis before anyone sees the data. What it must fix, why the timing is the whole point, and how estimands changed what it has to state.Technology Transfer: Moving a Process Without Moving the ProductTech transfer moves a process between sites while proving the product is unchanged. What transfers besides the batch record, and where comparability decides it.UDI: What the Code on the Label Actually ContainsA UDI is a device identifier plus production identifiers. How DI and PI differ, what goes in GUDID, and why the EU and US systems are not interchangeable.EU MDR: What Changed From the DirectiveMDR replaced the MDD with more evidence, more classes and fewer self-certified devices. Notified bodies, technical documentation, and the transition dates.Notified Bodies: Who Certifies You, and the Capacity ProblemA notified body assesses conformity for most EU devices. What it does, what it cannot do, and why capacity is a scheduling constraint rather than a formality.Clinical Evaluation Report: The Document MDR Made HarderA CER argues a device is safe and performs as intended. The MEDDEV structure, why equivalence claims got much harder, and how PMCF feeds back into it.EUDAMED: Six Modules, Rolled Out SeparatelyEUDAMED is the EU database underpinning MDR transparency. What each module holds, which are mandatory yet, and the Basic UDI-DI that ties them together.IVDR: Why 80% of Diagnostics Suddenly Needed a Notified BodyIVDR replaced a list-based classification with a four-class risk system, inverting how many IVDs self-certify. Classes, performance evidence, and the transition.Nitrosamine Impurities: Why This Became Everyone's ProblemThe 2018 valsartan recalls turned nitrosamines into a standing obligation. The three-step process FDA expects, AI limits, and where NDSRIs come from.Quality Agreements: Who Is Actually ResponsibleA quality agreement divides GMP responsibility between an owner and a contract facility. What it must cover, and why the owner stays accountable regardless.APR and PQR: The Yearly Review Nobody Reads21 CFR 211.180(e) requires an annual review of every product. What it must cover, how the EU PQR differs, and why a compliant one can still be worthless.Batch Release: The Decision and Who Owns ItRelease is a documented decision that a batch conforms. What the record must show, how the EU QP differs from the US quality unit, and what blocks release.Supplier Qualification: Beyond the QuestionnaireQualification is evidence a supplier can consistently meet requirements. Risk-based tiers, what an audit adds over a questionnaire, and keeping status current.Regulatory Intelligence: Knowing What Changed Before It Costs YouRegulatory intelligence is monitoring what regulators publish and deciding what it means for your products. The sources, the hard part, and why it decays.ICH Q3D: Elemental Impurities and the Risk AssessmentQ3D replaced heavy metals testing with a risk assessment across every potential source. The PDE classes, the three assessment options, and where elements come from.Untitled Letters: The Warning Letter's Quieter CousinAn untitled letter cites violations that do not meet the threshold for a warning letter. Why it still matters, where it is published, and how to respond.Protocol Deviations: Important, or Just RecordedEvery trial has deviations. What makes one important, why classification decides your CSR, and the reporting obligations that follow an important deviation.Field Alert Reports: Three Working Days, and Most Firms Miss ItAn FAR is due within three working days of information about a distributed drug's failure. What triggers one, what does not, and why over-reporting is the safer error.Establishment Inspection Report: What FDA Writes After It LeavesThe EIR is the investigator's full account, and it carries the classification that decides what happens next. NAI, VAI, OAI, and how to get a copy.FDA Debarment: The Certification in Every ApplicationDebarment bars a person from working on drug applications. What triggers it, why every ANDA carries a certification, and the diligence obligation it creates.Company Core Data Sheet: The Label Every Other Label Comes FromThe CCDS is the internal master a company maintains for a product. How local labels derive from it, why divergence accumulates, and what happens when safety changes.SmPC: The EU Label and How It Differs From US LabellingThe Summary of Product Characteristics is the approved EU label. Its fixed section structure, how it relates to the PIL and USPI, and what a variation costs.PSUR and PBRER: Periodic Safety Reporting Without the ConfusionPBRER is the ICH E2C(R2) format; PSUR is what the EU calls the report submitted in it. Data lock points, the birth date, and why the schedule catches people out.Signal Detection: From Disproportionality to a Label ChangeA signal is information suggesting a new causal association. How disproportionality works, why it is a screen rather than a finding, and the path to validation.ISO 15223-1: The Symbols on a Device LabelSymbols replace translated text on device labels. Which are mandatory, what the MD and EC REP symbols mean, and why symbol review catches so many errors.Claims Matrix: One Row Per Claim, One Source Per RowA claims matrix maps each promotional claim to the evidence supporting it. How to build one, what belongs in a row, and why it collapses MLR review time.ICH E6(R3): What Changed From R2, and What It Means for YouR3 restructures GCP around quality by design and risk proportionality. The principles, the annexes, and how much actually changes if you were already doing it right.Inspection Readiness: Being Ready Without a Fire DrillReadiness is a state, not a project. What inspectors ask for in the first hour, the documents that must be retrievable, and why the back room decides the outcome.ICH M7: Mutagenic Impurities and the Five Control OptionsM7 governs DNA-reactive impurities. The TTC, the five control options, and the trap of assessing two impurities separately when they share a mechanism.GAMP 5: Software Categories and the Second EditionGAMP 5 is the industry framework for validating computerised systems. The software categories, what the second edition changed, and how it relates to CSA.Trial Master File: Completeness Is the Whole ProblemThe TMF demonstrates a trial was conducted to GCP. Why contemporaneous filing matters more than the index, and what inspectors do when a document is missing.OOS Investigations: Why You Cannot Just RetestAn out-of-specification result triggers a two-phase investigation. What Phase I permits, when retesting is allowed, and why invalidating a result is the risk.MLR Review: Getting Promotional Material ClearedMedical, legal and regulatory review is the gate every promotional piece passes. What each reviewer is actually checking, Form 2253, and where OPDP comes in.Patient Narratives: Where CSR Timelines Actually GoA narrative is a short prose account of a serious event for one subject. What ICH E3 requires, which subjects need one, and why they take so long.PMRs and PMCs: Which Obligations Are EnforceableA postmarketing requirement is enforceable; a commitment is not. Which statute creates which, what happens if you miss one, and why the distinction matters.Information Requests and Deficiency Letters: Answering WellAn IR is a question during review, and how you answer it changes the timeline. The types, the clock implications, and the mistake of answering only what was asked.Does Using AI Trigger Part 11? The Question Is MisframedPart 11 attaches to records, not tools. Which system becomes your system of record, what CSA says about validating for intended use, and where accountability sits.PAS, CBE-30 or Annual Report: Choosing a Reporting CategoryA post-approval change is reportable three ways, and the choice sets your timeline. What 21 CFR 314.70 requires, and why over-reporting costs as much as under-reporting.ICH Q12: Established Conditions and Why They MatterQ12 lets a sponsor and regulator agree in advance which elements are binding. Established conditions, PACMPs, and what FDA has and has not adopted.Clinical Study Report: What ICH E3 Actually RequiresA CSR is the definitive account of one trial, structured by ICH E3. The 16 sections, what goes in the appendices, and why consistency is the hard part.Quality Overall Summary: 40 Pages That Frame Module 3The QOS in Module 2.3 is how a reviewer first meets your CMC data. The page limit, what belongs in it, and the mistake of writing it as a summary.FDA Cleared vs FDA Approved: Not the Same ClaimCleared, approved, granted, registered and listed mean different things. Which one applies to your product, and why saying the wrong one is a labelling violation.Substantial Equivalence: Choosing and Defending a PredicateA 510(k) rises or falls on the predicate. The two-part test, what a different technological characteristic costs you, and why predicate choice is strategic.ANDA: Proving Sameness Instead of Proving SafetyA generic application substitutes bioequivalence for clinical trials. What ANDA requires, how Paragraph IV certification works, and the 30 month stay.REMS: When Approval Comes With ConditionsA REMS is a required safety programme FDA can impose as a condition of approval. The elements, what ETASU means, and why REMS is a commercial constraint.Pre-Approval Inspection: The Three Objectives FDA Arrives WithA PAI decides whether your application gets approved. FDA arrives with three stated objectives, and the third one, data integrity, is where applications fail.ALCOA and Data Integrity: What Each Letter Actually RequiresALCOA+ is the standard FDA and MHRA judge records against. What the nine attributes mean in practice, and the audit trail questions that decide inspections.eCTD: The Format Every US Submission Has to Arrive IneCTD is mandatory for NDAs, ANDAs, BLAs and commercial INDs. The five modules, the XML backbone, lifecycle operations, and what v4.0 changes.IND: The 30 Day Clock That Lets You Dose HumansAn IND is an exemption from the rule that unapproved drugs cannot cross state lines. What it contains, the 30 day rule, and what makes it commercial.Combination Products: Which Centre Reviews You, and Why It MattersA drug-device combination is assigned by primary mode of action. How the PMOA decision works, what a Request for Designation does, and the cGMP rule.Computer System Validation: What CSA ChangedCSV is proving a system does what you rely on it to do. FDA's Computer Software Assurance guidance shifts the effort from documentation to critical thinking.PMA: Premarket Approval for Class III DevicesPMA is the only device pathway that requires independent evidence of safety and effectiveness rather than a comparison to a predicate. What it takes and how it differs.Human Factors Engineering: Use Errors, Critical Tasks, ValidationFDA expects a use-related risk analysis and validation with real users. What counts as a critical task, why 15 participants, and why combination products get caught.OTC Monograph: Marketing a Nonprescription Drug Without an NDAMost OTC drugs reach the market without FDA approving them individually. How the monograph system works, what the CARES Act changed, and when you need an NDA instead.Real World Evidence: Relevance, Reliability, and What FDA AcceptsRWE can support a label expansion or a post-approval requirement, but it does not lower the substantial evidence standard. The two tests FDA applies to the data.FDA Warning Letter Response: Deadlines, Content, Close-OutA Warning Letter states FDA considers you in violation and names the regulations. The 15 working day deadline, what a response must contain, and close-out.510(k) Transfer of Ownership: What Changes Hands in a Device DealBuying a cleared device means inheriting its 510(k). No FDA form and no approval, but a 30 day registration deadline most acquirers find late.Clinical Hold: Grounds, Response, and the 30 Day ClockFDA can halt an IND study under 21 CFR 312.42. The grounds, what a complete response has to cover, and the 30 day window FDA works to once you file it.IND Safety Report: The 7 and 15 Day Clocks21 CFR 312.32 requires expedited reporting of serious, unexpected suspected adverse reactions. What triggers 7 days versus 15, and the three-part test sponsors get wrong.Biologics License Application (BLA): What It Is and How to File OneThe application to market a biological product in the US, under section 351 of the PHS Act. What goes in it, how it differs from an NDA, and the timelines.Batch Manufacturing Record (BMR): What It Is and What Goes In ItA BMR is the executed record of one batch. What 21 CFR 211.188 requires in it, how it differs from the master record, and where BMRs fail inspection.Structured Product Labeling (SPL): The FDA XML Standard, ExplainedSPL is the HL7 XML format FDA requires for drug labeling, listing and establishment registration. What it is, what goes in it, and how it reaches DailyMed.Common Technical Document (CTD): The Five Modules, ExplainedThe CTD is the ICH-agreed structure for a marketing application. What each of the five modules holds, why Module 1 is not really part of it, and how eCTD differs.Reference Listed Drug (RLD): What It Is and How to Pick OneThe RLD is the approved drug your ANDA relies on. How it differs from the Reference Standard, how to find it in the Orange Book, and what TE codes mean.Drug Master File (DMF): Types, Letters of Authorization, and FeesA DMF lets a supplier give FDA confidential manufacturing detail without showing it to their customer. The types, how referencing works, and the GDUFA fee.FDA Meeting Types: A, B, C and D, ExplainedFour formal FDA meeting types with four different clocks. What each is for, when Type D applies, and why the meeting package matters more than the meeting.Software as a Medical Device (SaMD): Definition and RegulationSaMD is software that is itself a medical device. How IMDRF categorises it, when clinical decision support is exempt, and what FDA now expects on AI and cybersecurity.AI-Enabled Medical Devices: How FDA Regulates ThemFDA has authorised over a thousand AI-enabled devices, nearly all through 510(k). How they get cleared, and what a change control plan does for a model.De Novo Pathway: Classifying a Device With No PredicateThe De Novo request classifies a novel low-to-moderate risk device that has no predicate. How it works, what it requires, and why it creates a predicate.ISO 14971: Risk Management for Medical Devices, ExplainedISO 14971 is the risk management standard for medical devices. The process, the risk control hierarchy, and why a warning in the manual is the weakest control.IEC 62304: Medical Device Software Life Cycle, ExplainedIEC 62304 defines the software life cycle processes for medical devices. How safety classes A, B and C work, what SOUP means, and how it links to ISO 14971.ISO 10993: Biological Evaluation of Medical Devices, ExplainedISO 10993 governs biocompatibility. How contact type and duration set the endpoints, why chemical characterisation comes first, and what FDA expects.Post-Market Surveillance for Medical Devices, ExplainedPMS is the proactive half of what happens after launch. What the US and EU each require, how PMCF differs, and why complaint handling is not surveillance.PADER: The Periodic Adverse Drug Experience Report, ExplainedA PADER is the US postmarket safety report required under 21 CFR 314.80. What goes in it, when it is due, and how it differs from a PBRER.505(b)(2): The Pathway Between an ANDA and a Full NDAA 505(b)(2) is an NDA that relies partly on FDA's findings for an already-approved drug. When it applies, what it needs, and how it differs from an ANDA.Design History File (DHF): What It Is After the QMSRThe DHF proves your device was designed the way your plan said. What goes in it, how it differs from the DMR and DHR, and what QMSR changed in February 2026.FDA Expedited Programs: Fast Track, Breakthrough, Accelerated ApprovalFour programs, four different things. What Fast Track, Breakthrough Therapy, Accelerated Approval and Priority Review each change, and how orphan designation differs.IQ OQ PQ: Equipment and Process Qualification, ExplainedIQ, OQ and PQ are the three qualification stages: installed right, works right, works right on your product. How they fit FDA's process validation lifecycle.What Is GxP? The Good Practice Regulations, ExplainedThe umbrella term for the good practice regulations in life sciences: GMP, GLP, GCP and the rest. What each covers, who enforces it, and what compliance means.21 CFR Part 11: Electronic Records and Signatures, ExplainedFDA's conditions for treating electronic records and signatures as trustworthy. What it covers, what a predicate rule is, and where enforcement discretion applies.21 CFR 820: What the QMSR Changed in February 2026Part 820 no longer states device quality requirements in its own words. Since 2 February 2026 it incorporates ISO 13485:2016 by reference, as the QMSR.