On September 23, 2025, Scholar Rock said FDA had issued a complete response letter (CRL) for apitegromab, its spinal muscular atrophy drug. The company said the letter related solely to observations at the Catalent Indiana fill-finish facility. [2] Its release stated that “The CRL did not cite any other approvability concerns.” [2] The molecule was acceptable. The building that filled the vials was not.
FDA approved the drug, now called Isembyld, in September 2026. [3] Before that, Scholar Rock had moved its U.S. application to a second fill-finish site. [15] The sources I found do not say which site supported the final approval. The company’s approval release is dated September 11, 2026. [18] If that is the approval date, the delay from the CRL was 353 days. That figure is my calculation. No source reports it.
Most CDMO selection guides start with price, capacity, and technical fit. I think that order is wrong. The public record shows that site-level compliance decides whether a sound drug reaches patients on time. This article gives a 52-point checklist in seven domains. It also gives the public data behind each domain.
I use FDA documents, federal rules, company filings, and published datasets. I use DrugPatentWatch for patent and exclusivity context. [26] Where I calculate a number, I label it as analysis.
The Short Answer: What Should You Check First When You Select a CDMO?
Check the inspection history of the exact site that will make your product. Do this before you compare price. Then check the quality system, then technical fit, then contract terms.
The reason is plain. Facility problems stop approvals. FDA’s Center for Drug Evaluation and Research (CDER) reported that about 28% of nearly 10,000 facility-assessed submissions in FY2024 and FY2025 received a CRL. Of those CRLs, 43% were facility withholds. [1]
Ten Findings From the Public Record
Each finding below is a standalone statement. A calculated figure carries the label “analysis.”
About 12% of facility-assessed submissions in FY2024 and FY2025 received a CRL tied to a facility withhold. CDER reports that 28% of nearly 10,000 submissions got a CRL and that 43% of those were facility withholds. [1] Analysis: 0.28 x 0.43 = 12.0%.
FDA classified 18% of the 1,309 drug inspections in FY2025 as Official Action Indicated (OAI). [1] Analysis: that is about 236 inspections, calculated from a rounded percentage.
U.S. inspections had a 21.6% OAI rate in FY2025. China’s rate was 8.0%. [1] Analysis: the U.S. rate is 2.7 times the China rate.
FDA drug quality assurance inspections rose from 972 in FY2024 to 1,248 in FY2025. U.S. inspections rose from 432 to 702. Foreign inspections rose from 540 to 546. [1] Analysis: about 98% of the increase was domestic.
GMP-related CDER warning letters rose from 39 in 2023 to 78 in 2024 and 111 in 2025, according to PharmaSource. [5] Analysis: the 2025 count is 2.8 times the 2023 count.
Regulatory violations and Form 483 observations were the top reason a CDMO lost a bid. In a Q3 2025 survey of 100 respondents, 26% named them as the main reason. [5]
Scholar Rock waited 353 days from CRL to approval, if approval came on September 11, 2026. [2][18] Analysis: calendar-day count.
Published 2025 estimates of the CDMO market range from $166.0 billion to $258.88 billion. [9] Analysis: the high estimate is 56% above the low estimate.
The Office of Management and Budget (OMB) must publish its first BIOSECURE list of biotechnology companies of concern by December 18, 2026. [24] Analysis: that date is 55 days after October 24, 2026.
Proclamation 11020 sets a 100% Section 232 tariff on patented pharmaceuticals and their active pharmaceutical ingredients (APIs). The rate is 15% for products of Japan, EU member states, South Korea, Switzerland, and Liechtenstein. [22]
What Is a CDMO, and Why Does the Drug Owner Keep the Regulatory Risk?
A contract development and manufacturing organization (CDMO) develops processes and makes drug substance or drug product for a sponsor. The sponsor can hand off the work. The sponsor cannot hand off the legal responsibility.
What Do CDMO, OAI, Form 483, and CRL Mean?
CDMO: a company that develops processes and makes drug substance or drug product under contract.
CMO: a contract manufacturer that does not offer development work.
Quality unit: the group with authority to approve or reject components, drug product containers, and drug products. [6]
Form 483: the list of observations an FDA investigator gives site management at the end of an inspection.
OAI: Official Action Indicated. FDA describes a facility with this classification as “in an unacceptable state of compliance.” [14]
CRL: a letter in which FDA says it cannot approve an application in its present form.
FEI number: the FDA Establishment Identifier for a site. The Curia warning letter cites FEI 1310298 for its New York facility. [4]
Who Is Legally Responsible Under 21 CFR 211.22 and FDA’s Quality Agreement Guidance?
The drug owner is responsible. Section 211.22(a) of Title 21 says the quality control unit “shall be responsible for approving or rejecting drug products manufactured, processed, packed, or held under contract by another company.” [6]
FDA’s 2016 guidance on quality agreements repeats the point. The owner’s quality unit is “legally responsible for approving or rejecting drug products” made by the contract facility. [7] The owner also “remains responsible for ensuring its products are made in compliance with CGMP.” [7]
The guidance also states that a party cannot delegate its CGMP responsibilities through the agreement. Assigning an activity to one party does not relieve either party of its obligations. [7]
What Should a Quality Agreement Cover, and What Should It Leave Out?
A quality agreement should state which party performs each CGMP activity. It should cover quality unit activities, facilities and equipment, materials management, laboratory controls, documentation, and change control. [7]
It should not carry general business terms. FDA lists confidentiality, pricing, delivery terms, and limits on liability as items to keep out. [7] FDA recommends that the quality agreement be a separate document from the master services or supply agreement, or at least severable from it. [7]
What Does ICH Q7 Require for API Contract Manufacturers?
ICH Q7 applies to APIs. Its section on contract manufacturers sets six rules. [8]
All contract manufacturers, including laboratories, “should comply with the GMP defined in this guidance.” [8]
The company should evaluate each contractor for GMP compliance at the contractor’s sites. [8]
A written and approved contract should set out each party’s GMP responsibilities. [8]
The contract should allow the company to audit the contractor’s facilities. [8]
The contractor should not pass work to a third party without the company’s prior evaluation and approval. [8]
The contractor must inform the company of changes to process, equipment, test methods, or specifications, and the company must approve them. [8]
How Big Is the CDMO Market, and Why Do Estimates Differ by 56%?
No one agrees on market size. Published estimates for 2025 range from $166.0 billion to $258.88 billion. [9] The reason is scope. Some firms count only pharmaceutical CDMO services. Others count a wider set of services. [9]
2025 CDMO Market Estimates Compared
Publisher
2025 estimate (USD)
Scope note
Source
Grand View Research
$166.0 billion
Pharmaceutical CDMO segment
[9]
Precedence Research
$197.40 billion
As reported by PharmaSource
[9]
PharmaSource composite
About $220 billion
Average of major publications
[9]
Fortune Business Insights
$255.01 billion
As reported by PharmaSource
[9]
Mordor Intelligence
$258.88 billion
Core pharmaceutical CDMO services; API manufacturing is 55.44% of the market
[9]
Analysis: the high estimate is 1.56 times the low estimate. PharmaSource puts the consensus growth rate at 7.5% a year. [9] PharmaSource also flags that two sources report later-year figures that are lower than earlier-year figures. [9] I used only the 2025 values for that reason.
What does this mean for selection? Market reports do not tell you whether one CDMO has open capacity for your process in your launch year. Ask each CDMO for a written capacity commitment. Do not use a market report as a proxy.
Methodology: What I Analyzed and How I Calculated It
Which Data Sources and Inclusion Rules Did I Use?
Primary sources: the CDER FY2025 Report on the State of Pharmaceutical Quality [1], 21 CFR 211.22 [6], FDA guidance documents [7][8][19][20], an FDA warning letter [4], company releases and an SEC exhibit [2][17], and a Federal Register notice [23].
Secondary sources: PharmaSource [5][9], a published tally of FDA CRLs by Phase 3 Search [11], trade press for event dates [14][15][16], and law firm summaries [22][24][25].
Time period: FDA statistics cover FY2025, which ran from October 1, 2024 to September 30, 2025. [1] Events cover July 2025 to October 24, 2026.
Case inclusion rule: I included a CRL as a facility case only when a company or FDA document ties it to a named facility.
Duplicates: I counted each event once, even when several outlets reported it.
Calculations: I counted calendar days. I computed percentages from published values. Counts derived from rounded percentages are approximate.
What Are the Limits of This Analysis?
I did not recompute CRL counts from the raw openFDA file. My working environment could not reach that dataset. The CRL shares in this article come from a published tally. [11]
That tally comes from Phase 3 Search, an executive search firm with a commercial interest in staffing conclusions. [11] FDA’s CRL release is also not a random sample. The first tranche in July 2025 drew only from applications that FDA later approved. [11] FDA said the first release covered CRLs for applications submitted between 2020 and 2024. [10]
Press reports differ on some dates. Where they differ, I say so and I favor company statements. A manufacturing section in a CRL does not prove that the section caused the rejection. [11]
What the Data Shows: How Often Do Facility Problems Block FDA Approval?
Often enough to lead your diligence. FDA’s own report puts facility withholds at about 12% of facility-assessed submissions. Published CRL tallies show a manufacturing section in 62.6% of letters. [1][11]
CDER reported that about 28% of nearly 10,000 facility-assessed submissions in FY2024 and FY2025 received a CRL. Of those CRLs, 43% were facility withholds. (CDER Report on the State of Pharmaceutical Quality, FY2025) [1]
What Share of Published CRLs Cite Manufacturing Problems?
Phase 3 Search coded 457 published CRLs from the openFDA bulk download of July 22, 2026. It counted a letter when a manufacturing or quality section header stood alone on its line. [11]
Group
Letters
Share
Source
Manufacturing or quality section present
286 of 457
62.6%
[11]
Manufacturing only
202
44.2%
[11]
Manufacturing and clinical
84
18.4%
[11]
Clinical only
58
12.7%
[11]
Neither
113
24.7%
[11]
Biologics applications
68.9% of 119
68.9%
[11]
Small-molecule applications
60.5% of 337
60.5%
[11]
Analysis: the biologics share is 8.4 percentage points higher than the small-molecule share. A biologics sponsor has more reason to audit fill-finish and drug substance sites early.
Other studies point the same way, with different cohorts. A Jefferies analysis reported by BioSpace found that over 50% of public CRLs cited manufacturing. A 2026 study by Dilek and colleagues found that 65% of CRLs for 43 novel therapeutics from 2020 to 2024 cited facilities. [11] I did not review those studies directly. I rely on the tally in [11] for both figures.
How Did FDA Inspection Outcomes Split in FY2025?
FDA classified 22% of its 1,309 inspections as no action indicated (NAI), 60% as voluntary action indicated (VAI), and 18% as OAI. [1]
Outcome
Reported share
Approximate count (analysis)
Source
NAI
22%
288
[1]
VAI
60%
785
[1]
OAI
18%
236
[1]
OAI, U.S. sites
21.6%
Not reported
[1]
OAI, China sites
8.0%
Not reported
[1]
Does a Lower OAI Rate in China Mean Lower Risk?
No. CDER reports that the U.S. OAI rate is significantly above the global average and the China rate is significantly below it. [1] That does not show that Chinese sites make better product.
Inspection mix and notice rules differ. In FY2023, nearly 90% of FDA foreign inspections were preannounced. Unannounced inspections were typically done at U.S. sites. [12] FDA said in May 2025 that it would expand unannounced foreign inspections. [12] Future foreign OAI rates may change when that policy takes effect.
For selection, use the site’s own record. Do not use a country average.
Where Did the Increase in FDA Inspections Come From?
Measure
FY2024
FY2025
Change (analysis)
Source
Drug quality assurance inspections
972
1,248
+28.4%
[1]
U.S. inspections
432
702
+62.5%
[1]
Foreign inspections
540
546
+1.1%
[1]
Share of inspections done in the U.S.
44%
56%
+12 points
[1]
Analysis: U.S. sites account for 270 of the 276 added inspections. That is 97.8% of the increase. If you pick a U.S. CDMO, expect FDA to visit it more often than in the past.
White & Case reports a backlog. As of May 2024, about 2,000 pharmaceutical manufacturing firms had not been inspected since before the pandemic. More than 340 of the plants were in India and China. [12] An old inspection date at a foreign site is not the same as a clean record. It can mean no recent inspection.
How Fast Are GMP Warning Letters Growing?
PharmaSource reports that CDER’s manufacturing and GMP-related warning letters rose from 39 in 2023 to 78 in 2024, then to 111 in 2025. [5]
Year
GMP-related CDER warning letters
Change from prior year (analysis)
Source
2023
39
Not applicable
[5]
2024
78
+100%
[5]
2025
111
+42.3%
[5]
In the same PharmaSource report, 26% of 100 respondents named regulatory violations or Form 483 observations as the main reason a CDMO loses a bid. Cost was next at 20%. Timeline was third at 16%. [5] The survey asked about bid losses. It does not show that sponsors switched CDMOs after a warning letter.
Case Study: What Did One Fill-Finish Site Cost Its Customers?
At least three sponsors received CRLs that company or press reports tie to the former Catalent site in Bloomington, Indiana: Regeneron, Scholar Rock, and Incyte. [14][16] Novo Holdings bought Catalent in an all-cash deal at an enterprise value of about $16.5 billion. Novo Nordisk then took over three Catalent fill-finish sites, in Anagni, Bloomington, and Brussels. [13]
Analysis: FDA’s July 2025 inspection of the Bloomington site came about seven months after the deal closed on December 18, 2024. The timing does not show cause. It does show that a change of owner does not reset a site’s compliance risk.
Catalent Indiana Timeline: December 2024 to September 2026
Date
Event
Source
December 18, 2024
Novo Holdings completes the Catalent acquisition. Novo Nordisk is to take the three fill-finish sites.
[13]
July 2025
FDA conducts a general site inspection at Bloomington and issues a Form 483.
[14][15]
July 30, 2025
FDA issues Regeneron a CRL for odronextamab, tied to the Bloomington inspection.
[14]
September 23, 2025
Scholar Rock announces a CRL for apitegromab, related solely to the Catalent Indiana site.
[2]
October 9 to 10, 2025
Regeneron and Scholar Rock report that FDA classified the site OAI.
[14]
November 2025
FDA issues a warning letter to the site.
[15][16]
February 27, 2026
FDA issues Incyte a CRL for Zynyz in first-line non-small cell lung cancer, citing inspection findings at the Bloomington site.
[16]
March 2026
Scholar Rock refiles with both the Catalent site and a second fill-finish facility. FDA and the company agree on the data package for the second site.
[15][17]
April 2026
FDA inspects Bloomington again and issues a new Form 483.
[15][17]
August 6 to 7, 2026
Scholar Rock says the classification is pending. Novo then tells Scholar Rock that FDA issued an OAI designation.
[17][15]
September 11, 2026
Scholar Rock announces FDA approval of Isembyld (apitegromab-mstn).
[18]
Sources differ on the date of the latest OAI classification. Fierce Pharma reports that Novo told Scholar Rock on August 7, 2026. [15] Scholar Rock’s own August 6 release says the classification of the April 2026 inspection was still pending. [17] BioSpace places it in spring 2026. [3] I use the company statements. The October 2025 classification is separate and comes from Regeneron and Scholar Rock. [14]
What Did FDA Find at the Site?
Fierce Pharma reports that the summer 2025 inspection found the site failed to investigate more than 20 deviations. The deviations related to possible mammalian hair contamination in or around the stopper region of vials. [16] STAT obtained the inspection report. As relayed by Pharma Manufacturing, it cited concerns including “hair, pests, bacteria, and equipment failures.” [14]
Was Every Manufacturing CRL Caused by the Same Site?
No. Ferring received a manufacturing-related CRL on February 27, 2026 for follitropin delta. Fierce Pharma says the CRL does not appear to come from the Indiana site. It followed deficiencies found in a pre-license inspection of a different facility. [16] The lesson is general. Any site can fail.
What Does a 353-Day Facility Delay Cost? A Scenario Analysis
This is a scenario, not a reported cost. It uses one published burn range and one observed delay.
Input
Value
Source or basis
Delay
353 days, or about 11.6 months
Analysis from [2] and [18]; 353 divided by 30.4 days
Monthly burn, Phase 2 or 3 program
$5 million to $10 million
[11]
Delay cost, low case
About $58 million
Analysis
Delay cost, high case
About $116 million
Analysis
What Does the Scenario Leave Out?
It leaves out lost revenue, launch costs, and the cost of the second-site work. Phase 3 Search, which reports the burn range, is a staffing firm. [11] Scholar Rock’s actual spend can differ from the range. Treat the output as an order of magnitude. A sponsor can use the same formula with its own monthly spend.
Three Lessons From the Catalent Indiana Case
Check the site, not the brand. The same parent company can run sites with very different records.
Qualify a second site before you need it. Regeneron said in October 2025 that it planned to add a second filler to its EYLEA HD application within three months. [14] Scholar Rock later described “two independent paths to an FDA approval decision.” [17]
Write notification duties into the contract. Scholar Rock learned the classification from Novo, the site owner, which is a secondhand route. [15]
Case Study: Curia New York and a Data Integrity Warning Letter
FDA issued a warning letter to Curia New York, Inc. dated September 18, 2026. It followed an inspection of the Rensselaer, New York site from January 28 to February 5, 2026. The site makes APIs and intermediates, and FDA states that the APIs are adulterated under section 501(a)(2)(B) of the FD&C Act. [4]
What Did FDA Cite at Curia New York?
Laboratory records: analysts ran unexplained HPLC and UPLC trial injections. FDA found nine injections without sufficient justification. [4]
Quality unit oversight: original laboratory records, including pH and balance printouts, were found in shred bins. Staff had reviewed photocopies instead of originals. [4]
Computerized systems: analysts shared usernames and passwords for calibrations and sample testing. [4]
Remediation scope: the firm’s retrospective review covered only 12 stand-alone instruments and a limited time period. [4]
The letter states: “Your Quality Unit failed to ensure adequate control over paper and electronic records.” [4] It requires a written response within 15 business days. The response must include an independent data integrity assessment, a shred-bin investigation, a risk assessment, and a global corrective and preventive action plan. [4]
How Long Did FDA Take to Issue the Letter?
Analysis: the letter is dated 225 days after the inspection ended on February 5, 2026. FDA posted it on September 29, 2026, which is 236 days after the inspection ended. [4] This is one case. It is not an average. It does show that a clean-looking public record can lag the facts by more than seven months.
What Does This Mean for a Sponsor?
FDA’s data integrity guidance defines data integrity as “the completeness, consistency, and accuracy of data.” [19] It says that when login credentials are shared, “a unique individual cannot be identified through the login.” [19] It also says production and control records, including audit trails, must be reviewed and approved by the quality unit. [19]
Each of those points can be tested in a sponsor audit. Ask to see the audit trail review procedure. Ask who can hold an administrator role on laboratory software. Ask what happens to paper originals after review. A sponsor audit does not replace FDA inspection data. It can find the same weakness months earlier.
The CDMO Selection Checklist: 52 Checks in Seven Domains
The checklist below is my own framework. It is not an industry standard. I built it from the FDA rules and the cases above. It has seven domains and 52 checks. Nine checks are gates. A gate is a pass or fail test. If a CDMO fails a gate, stop the evaluation or require a documented fix. The other 43 checks are scored from 0 to 3.
Domain 1: Regulatory and Inspection History (8 Checks)
1.1 (Gate) Pull the FDA inspection history for the exact site by FEI number. Record five years of NAI, VAI, and OAI outcomes.
1.2 (Gate) Read every Form 483 from the last three inspections. Read the firm’s written response to each.
1.3 (Gate) Search for warning letters, untitled letters, and import alerts at the site and at sister sites that share its quality system.
1.4 Confirm that the inspection scope matches your process. A sterile fill-finish inspection says little about an oral solid line.
1.5 List the approved applications that name the site. Note any pre-approval inspections of similar products.
1.6 If you plan filings outside the U.S., check the site’s record with each regulator you will use.
1.7 Ask how the site prepares for unannounced inspections. FDA announced expanded unannounced foreign inspections in May 2025. [12]
1.8 Require written notice of any Form 483, warning letter, or classification change within a fixed number of days.
Check 1.1: How Do You Read an Inspection Record Correctly?
Read the classification, the date, and the scope. Then ask whether a classification is pending. Scholar Rock’s August 6, 2026 release said the classification of the April 2026 inspection was still pending. [17] A site with a pending classification can look clean in a database.
Check 1.2: Why Read the 483 Response and Not Only the Observations?
The response shows how the firm thinks about scope. In the Curia letter, FDA criticized a retrospective review that covered only 12 stand-alone instruments and a limited period. [4] A narrow response to a broad observation is a warning sign. This is my analysis. FDA does not publish it as a rule.
Domain 2: Quality System and Data Integrity (8 Checks)
2.1 (Gate) Confirm that the CDMO’s quality unit has written authority and procedures that it follows. This matches 21 CFR 211.22(d). [6]
2.2 (Gate) Test data integrity controls: unique logins, audit trail review, and control of paper originals. [4][19]
2.3 Review deviation and CAPA metrics: closure times and repeat deviations by category.
2.4 For sterile products, ask for the contamination control strategy and the process for investigating excursions. At Bloomington, FDA reported failure to investigate more than 20 deviations. [16]
2.5 Ask whether the site joined FDA’s Quality Management Maturity (QMM) prototype program. [20]
2.6 Review the supplier qualification program for starting materials, excipients, and container closure components.
2.7 Review change control. Confirm that you approve changes to process, equipment, test methods, and specifications. [8]
2.8 Confirm that your quality unit can review batch records and audit trails before release. [19]
Check 2.2: What Does a Data Integrity Test Look Like in an Audit?
Pick three recent batches. Trace each from raw data to the released record. Ask for the audit trail of one chromatography run. Ask to see the login list for the laboratory software. Look for shared accounts, unexplained injections, and records kept only as copies. Each of those items appears in the Curia letter. [4]
Check 2.5: Should You Require QMM Participation?
No. FDA describes QMM as a voluntary prototype program. Evaluation cohorts were announced for 2024, 2025, and 2026. A February 11, 2026 Federal Register notice invited up to nine establishments into the third cohort. [20] FDA says it “has proposed the development of a rating system,” and it gives no rating scale. [20] Treat participation as a plus. Do not treat absence as a minus.
Domain 3: Technical Capability and Technology Transfer (8 Checks)
3.1 (Gate) Obtain a written technology transfer plan with owners, acceptance criteria, and a comparability approach.
3.2 Match modality and scale. Confirm that the site has run your type of molecule at your batch size.
3.3 Review analytical method transfer and validation capability.
3.4 Ask for the process validation plan and the number of validation lots.
3.5 Ask for scale-up data on two or more similar products.
3.6 Confirm that development and commercial supply can use the same site. A second transfer adds a second risk.
3.7 Review stability program capacity, storage, and testing turnaround.
3.8 Ask about CMC authoring support and the CDMO’s experience with pre-approval inspections.
Check 3.1: What Should a Technology Transfer Plan Contain?
It should name the party that owns each task. It should list acceptance criteria for each transferred method and process step. It should state how you will show that product from the new site matches the reference product. It should set dates for each stage. A plan without acceptance criteria is a schedule, not a plan. This is a practice recommendation from my analysis.
Domain 4: Capacity, Scheduling, and Supply Chain Resilience (7 Checks)
4.1 Obtain a written slot reservation with remedies if the CDMO misses it.
4.2 (Gate) Identify a qualified or qualifiable second site for each critical step. [14][17]
4.3 Map sources of raw materials and starting materials. Flag single points of failure.
4.4 Agree on safety stock for critical components such as stoppers, filters, and resins.
4.5 Ask for unplanned shutdowns and recalls in the last five years.
4.6 Confirm capacity at commercial volume, not clinical volume.
4.7 Ask which steps the CDMO subcontracts. ICH Q7 requires your prior approval of subcontracting for APIs. [8]
Check 4.2: How Fast Can a Second Site Be Added?
Scholar Rock’s case gives one data point. The company received its CRL on September 23, 2025. [2] FDA and the company agreed on a second-site data package at a Type C meeting in March 2026. [17] Analysis: that is five to six months, depending on the March date. The second path then needed FDA review. [17] Start the second-site work before you need it.
Domain 5: Geopolitical, Tariff, and Ownership Risk (7 Checks)
5.1 Identify the CDMO’s owner and any change-of-control plans. Require notice of a change in ownership.
5.2 (Gate) Map the country of manufacture for drug product, API, and key starting materials, and compute tariff exposure. [22]
5.3 Confirm whether your product is patented and Orange Book or Purple Book listed, since that decides tariff scope. [22][26]
5.4 Screen the CDMO, its subcontractors, and its equipment suppliers against the DoD 1260H list. [25]
5.5 Evaluate U.S. onshoring options, including FDA PreCheck and Commerce onshoring agreements. [21][22]
5.6 Review export control, sanctions, and data jurisdiction terms.
5.7 Check whether the CDMO’s sites are concentrated in one region.
Check 5.2: Why Map Country of Origin for APIs and Starting Materials?
The 100% Section 232 rate covers APIs and key starting materials for covered products. U.S.-origin APIs and key starting materials are exempt. [22] A U.S. fill-finish site that uses imported API may still carry tariff cost. Trace each layer of the supply chain.
Domain 6: IP, Contract, and Quality Agreement (8 Checks)
6.1 (Gate) Keep the quality agreement separate from the supply agreement. [7]
6.2 Include a matrix that assigns each CGMP activity to a named party. [7]
6.3 Define ownership of background IP, foreground IP, and process improvements.
6.4 Check the CDMO’s platform technology for third-party patents, and run a freedom-to-operate search on the process. [26]
6.5 Secure routine and for-cause audit rights and the right to attend FDA inspections. [8]
6.6 Require notice of Form 483s, out-of-specification results, and regulatory actions.
6.7 Prohibit subcontracting without your prior approval. [8]
6.8 Agree on exit terms: data package, materials, equipment, and transfer-out support.
Check 6.1: Why Separate the Quality Agreement?
FDA recommends that the quality agreement be a separate document or at least severable. It should leave out pricing, delivery terms, and liability limits. [7] A commercial dispute then cannot hold quality duties hostage. A quality dispute cannot reopen the price.
Check 6.4: Why Is Process-Patent Clearance Not an Orange Book Task?
DrugPatentWatch notes that process, metabolite, and intermediate patents are not listable in the Orange Book. It also notes that such patents can still support infringement suits. [26] A CDMO’s process can fall inside such claims. Search the USPTO database for non-listed patents. [26] Orange Book data does not clear a manufacturing process.
Domain 7: Commercial and Financial (6 Checks)
7.1 Build a total cost model that includes failure cost, not only unit price.
7.2 Test the CDMO’s financial stability and debt load.
7.3 Review price escalators and minimum purchase commitments.
7.4 Place liability, indemnity, and insurance terms in the supply agreement, not the quality agreement. [7]
7.5 Call reference customers. Ask about inspections, delays, and responsiveness.
7.6 Set up governance: a joint steering committee and an escalation path. In the PharmaSource survey, 6% of respondents named lack of responsiveness as the main reason a CDMO loses a bid. [5]
Check 7.2: How Do You Test a CDMO’s Financial Stability?
Ask for audited financials or a credit summary. Ask who owns the CDMO and what debt sits on it. Ask how the CDMO would fund a remediation plan after an OAI classification. The Bloomington case shows that remediation takes months. [15][17]
How Do You Score the 43 Weighted Checks? A Weighted Scorecard
Score each weighted check from 0 to 3. Zero means no evidence. Three means documented evidence and a clean audit. Convert each domain to a percentage and apply a weight. The weights below are an illustration. They are not an industry standard. Adjust them to your product.
Domain
Checks
Gates
Illustrative weight
1. Regulatory and inspection history
8
3
25%
2. Quality system and data integrity
8
2
20%
3. Technical capability and tech transfer
8
1
15%
4. Capacity and resilience
7
1
12%
5. Geopolitical, tariff, and ownership
7
1
10%
6. IP, contract, and quality agreement
8
1
10%
7. Commercial and financial
6
0
8%
Total
52
9
100%
What Happens If Your CDMO Fails an Inspection?
Move fast on three fronts: facts, FDA, and supply. Get the Form 483 and the firm’s response. Ask for the expected classification date. Start second-site work at once. The Catalent Indiana case shows that a single-site plan has no fallback. [14][17]
A Seven-Step Response Plan After a Failed CDMO Inspection
This plan is my analysis. It draws on the cases above.
Get the Form 483 and the CDMO’s written response within days. Contract check 1.8 and 6.6 make this a right, not a favor.
Ask which of your filings name the site. A site named in a pending application can hold that application.
Ask when FDA will classify the inspection. Classification can take months. Scholar Rock’s April 2026 inspection was still unclassified on August 6, 2026, more than three months later. [17]
Decide whether to request an FDA meeting. Scholar Rock asked for a Type A meeting about resubmission after its CRL. [14]
Start the second-site package. In the Scholar Rock case, FDA agreed on the data package at a Type C meeting in March 2026. [17]
Keep both paths open until FDA acts. Scholar Rock called this “two independent paths to an FDA approval decision.” [17]
Review ex-US filings. In August 2026, Scholar Rock’s EMA application still listed only the Catalent site. [15]
When Should You Move Product Away From a Troubled Site?
Move when the site holds an OAI classification or an open warning letter and the CDMO cannot show a credible, dated remediation plan. The Bloomington site had a Form 483 in July 2025 and a warning letter in November 2025. It received a new Form 483 in April 2026. [15] Each step took months. A sponsor that waited for a clean result would have waited more than a year.
How Do Section 232 Tariffs Change CDMO Selection in 2026?
They make the country of manufacture a cost variable for patented products. Proclamation 11020, issued April 2, 2026 under Section 232 of the Trade Expansion Act of 1962, sets a 100% tariff on patented pharmaceuticals in the Orange Book or Purple Book. It also covers their APIs and key starting materials. [22]
Section 232 Pharmaceutical Tariff Terms at a Glance
Item
Term
Source
General rate
100% on covered patented pharmaceuticals, APIs, and key starting materials
[22]
Rate for Japan, EU member states, South Korea, Switzerland, Liechtenstein
15%, in place of the 100% rate
[22]
Phase-in dates
July 31, 2026 and September 29, 2026, depending on the company
[22][23]
Onshoring plan approved by Commerce
Different treatment until April 2, 2030
[22]
Onshoring plus pricing agreement with HHS
No additional tariff until January 20, 2029
[22]
Generic pharmaceuticals and biosimilars
Exempt; Commerce must advise within one year on extending tariffs to them
[22]
U.S.-origin products, APIs, and key starting materials
Exempt
[22]
Specialty categories
Orphan-only drugs, nuclear medicines, plasma-derived therapies, fertility drugs, cell and gene therapies, antibody drug conjugates, CBRN countermeasures, animal health; zero rate depends on listed-jurisdiction origin or Commerce approval
[22][23]
Why Do the Phase-In Dates Differ Between Sources?
Crowell reports that the 100% rate took effect July 31, 2026 and that a group of 17 companies in Annex IV had until September 29, 2026. [22] The Federal Register notice of September 23, 2026 says the rate took effect July 31 for companies listed in Annex III and September 29 for all other companies. [23] The two sources assign the dates to different company groups. Check the annexes to the proclamation for your company. Do not rely on either summary.
What Should a CDMO Contract Say About Tariffs?
Crowell advises companies that rely on contract manufacturers for drug product, API, or key raw materials to assess the supply chain impact and to consider onshoring. [22] In practice, the contract should say who pays a tariff. It should say what happens if the rate changes. It should name the country of origin of each material. These are my recommendations. They are not legal advice.
Whether a product is “patented” and listed is a patent-data question. DrugPatentWatch organizes Orange Book data, ANDA filing histories, litigation records, and inter partes review proceedings. [26] A team can use that data to see where its product sits. Counsel must confirm the legal scope.
Does FDA PreCheck Help When You Choose a U.S. CDMO Site?
It may. FDA announced PreCheck on August 7, 2025 as a two-phase framework for U.S.-based drug manufacturing facilities. [21] Phase 1 encourages early engagement during site design and construction. Sponsors can submit facility information through a Type V drug master file. Phase 2 focuses on the CMC section of applications. [21]
The Sidley summary describes the benefits as possible, not guaranteed. It also notes that program details were still developing when it wrote. [21] Check FDA’s current materials before you rely on the program.
What Is the BIOSECURE Act, and Does It Affect Your CDMO Choice?
The BIOSECURE Act restricts federal contracting and funding that involves biotechnology equipment or services from a “biotechnology company of concern.” It became law on December 18, 2025 as section 851 of the FY2026 National Defense Authorization Act (P.L. 119-60). [24]
The Act names no companies. [24] A company is a biotechnology company of concern if it is on the DoD 1260H list and is involved in making, distributing, providing, or procuring biotechnology equipment or services. The government can also designate other companies. [25]
BIOSECURE Timeline: Enactment, WuXi AppTec, and Next Deadlines
Date
Event
Status
Source
December 18, 2025
BIOSECURE Act signed as section 851 of the FY2026 NDAA
Confirmed
[24]
June 8, 2026
DoD adds WuXi AppTec to the 1260H list; WuXi AppTec has filed a legal challenge
Confirmed
[25]
December 18, 2026
OMB deadline for the first list of biotechnology companies of concern
Statutory deadline
[24][25]
Up to June 2028
Maximum estimated date for the FAR revision
Estimate
[24]
60 or 90 days after the FAR revision
Prohibitions take effect: 60 days for 1260H-listed entities, 90 days for other designated companies
Projected
[24]
Five years from the FAR revision
End of grandfathering for contracts signed before the effective date
Projected
[24]
Does BIOSECURE Cover Purely Private CDMO Contracts?
The Baker McKenzie summary does not address purely private contracts. Its focus is federal contractors, grant recipients, and, through the VA Federal Supply Schedule, manufacturers’ Medicaid and Medicare Part B eligibility. [24] The same summary does not say whether CDMO manufacturing services fall inside “biotechnology equipment or services.” The statutory language covers items used in “research, development, production, or analysis” related to biological materials. [24] Ask counsel before you assume either answer.
Is 1260H Listing the Same as a BIOSECURE Designation?
No. Listing on the 1260H list is a prerequisite. It does not by itself make a company a biotechnology company of concern. [25] The second step is an administrative process involving OMB, DoD, and other agencies. [25]
What Should You Do Before the OMB List Appears?
This list is my analysis. It assumes the OMB deadline of December 18, 2026 holds. [24]
Map every CDMO, subcontractor, and equipment supplier in your supply chain against the 1260H list.
Add a clause that lets you exit or suspend work if a supplier is designated.
Keep a qualified alternative for any supplier on the list.
Note that grandfathering does not apply to existing contracts with companies on the 1260H list as of December 18, 2025. [24]
How Do Patents and IP Affect CDMO Selection?
A CDMO takes your process into its plant. That move creates three IP questions: who owns improvements, whether the process infringes a third-party patent, and who can use your data after the contract ends.
Why Do Orange Book Patents Not Cover Manufacturing Processes?
DrugPatentWatch states that process patents, metabolite patents, and intermediate patents are not listable in the Orange Book, however relevant they are commercially. [26] The same source says such patents can still support infringement suits. It advises a search of the USPTO database for non-listed patents on manufacture, intermediates, and metabolites. [26]
I use DrugPatentWatch for Orange Book patent expiry, ANDA filing history, litigation, and inter partes review context. [26] It does not replace a USPTO search for process claims. The Orange Book does not list those claims.
Which IP Clauses Should a CDMO Contract Contain?
Background IP stays with its owner. Each side lists what it brings.
Foreground IP and process improvements are assigned to a named party, with a license to the other if needed.
The CDMO warrants that its platform does not infringe known third-party patents, or it discloses known risks.
The CDMO may not use your data, cell lines, or process know-how for other customers.
At exit, the CDMO returns the data package, retained samples, and agreed materials.
How Does CDMO Delay Interact With Patent and Exclusivity Dates?
A patent expiry or exclusivity end date is fixed on the calendar. A CDMO delay does not move it. Analysis: if a generic or biosimilar sponsor needs product on a set launch date, each month lost to a facility problem is a month of market access lost. The 353-day Scholar Rock delay is the observed scale for a facility-driven CRL, though it came from a first-cycle brand application. [2][18]
Red Flags That Should End a CDMO Evaluation
The site has an OAI classification or an open warning letter and no dated remediation plan. [14][15]
The CDMO refuses to share Form 483s and its responses.
Analysts share logins, or original records are kept only as copies. [4][19]
The firm’s remediation review is narrow compared with the observation. [4]
The CDMO subcontracts steps without your approval. [8]
The CDMO will not support a second site.
Quality duties sit inside a pricing contract, with no separate quality agreement. [7]
The CDMO cannot state its exposure to the 1260H list. [25]
What This Means for Different Sponsors
What This Means for Biotech Sponsors With One Lead Product
You carry the most concentration risk. A single facility CRL can hold your only application. Scholar Rock held $492.1 million in cash and marketable securities on June 30, 2026. [17] Your cash may be lower. Build a second-site plan and run the burn-rate scenario above with your own numbers.
What This Means for Brand Manufacturers
Your products are the ones in tariff scope when they are patented and Orange Book or Purple Book listed. [22] Country of manufacture, API origin, and onshoring terms now belong in the supplier scorecard. Domain 5 covers them.
What This Means for Generic and Biosimilar Developers
Generics and biosimilars are exempt from the Section 232 tariff for now. Commerce must advise within one year on extending it to them. [22] Build that risk into long-term contracts. Your launch date is tied to patent and exclusivity expiry, so a facility delay costs you the window directly.
Key Takeaways
The drug owner’s quality unit is legally responsible for products made under contract. A quality agreement cannot delegate that duty. [6][7]
CDER reported that 43% of CRLs among facility-assessed submissions in FY2024 and FY2025 were facility withholds. [1]
In FY2025, FDA classified 18% of 1,309 drug inspections OAI. The U.S. rate was 21.6% and the China rate was 8.0%. [1]
About 98% of the increase in FDA quality inspections from FY2024 to FY2025 was domestic (analysis from [1]).
GMP-related CDER warning letters rose from 39 in 2023 to 111 in 2025. [5]
One facility, Catalent Indiana, is tied to CRLs for at least three sponsors. [14][16]
Scholar Rock’s CRL-to-approval interval was 353 days, if approval came on September 11, 2026 (analysis from [2] and [18]).
FDA cited shared logins and shredded original records in a September 2026 CDMO warning letter. [4]
Section 232 sets a 100% rate on patented pharmaceuticals and APIs, with a 15% rate for several jurisdictions. Generics and biosimilars are exempt for now. [22]
OMB’s first BIOSECURE list is due by December 18, 2026. [24]
FAQ: CDMO Selection Questions
How can I check whether a CDMO site has received an FDA warning letter?
FDA posts warning letters on its website. The Curia New York letter is dated September 18, 2026 and was posted September 29, 2026, 11 days later. [4] Search by company name and FEI number. Also ask the CDMO directly, because a letter may be unposted for days.
Does FDA publish complete response letters?
Yes. FDA published more than 200 CRLs on July 10, 2025, for applications submitted between 2020 and 2024. [10] A July 22, 2026 download of the openFDA data held 457 records. [11] The first release drew only from applications FDA later approved, so the set is not a random sample. [11]
How long does FDA take to classify an inspection?
It varies. Scholar Rock reported on August 6, 2026 that the classification of its CDMO site’s April 2026 inspection was still pending. [17] That is more than three months for one case. Ask the CDMO for the date it expects a classification.
What does FDA PreCheck offer a sponsor that plans a new U.S. plant?
It offers early engagement during design and construction, through a Type V drug master file, and a focus on the CMC section of the application. [21] A sponsor that uses a CDMO should ask whether the CDMO’s new U.S. site plans to take part.
Will FDA inspect foreign CDMO sites without notice?
FDA said on May 6, 2025 that it would expand unannounced inspections at foreign manufacturing facilities. [12] In FY2023, nearly 90% of foreign inspections were preannounced. [12] Ask each foreign site how it prepares for no-notice visits.
Which products are exempt from the Section 232 pharmaceutical tariff?
Generics, biosimilars, and U.S.-origin products are exempt. [22] Orphan-only drugs, nuclear medicines, plasma-derived therapies, fertility drugs, cell and gene therapies, antibody drug conjugates, CBRN countermeasures, and animal health products fall in specialty categories. [22] The zero rate for those categories depends on origin from a listed jurisdiction or Commerce approval. [23]
Should price or compliance come first when I rank CDMOs?
Compliance. In the PharmaSource survey of 100 respondents, 26% named regulatory violations as the main reason a CDMO loses a bid. Cost was named by 20%. [5] The Scholar Rock case adds a number: a facility CRL cost 353 days. [2][18] A lower unit price does not cover a delay of that size.
What should a CDMO notification clause cover?
It should cover Form 483s, warning letters, classification changes, out-of-specification results, and any change to process, equipment, test methods, or specifications. ICH Q7 requires that the contract giver be informed of and approve such changes for APIs. [8] Scholar Rock learned of the OAI designation through the site owner. [15] Set a fixed number of days for each notice.
Does the BIOSECURE Act apply to private CDMO contracts?
The Act restricts federal agencies, federal contractors, and grant and loan recipients. Summaries do not address purely private contracts. [24] Federal Supply Schedule links can reach manufacturers’ Medicaid and Medicare Part B eligibility. [24] Ask counsel to review your exposure.
Is WuXi AppTec a biotechnology company of concern?
Not yet, as of the sources I reviewed. DoD added WuXi AppTec to the 1260H list on June 8, 2026. That listing is a prerequisite and not a designation. WuXi AppTec has filed a legal challenge. [25] OMB must publish the first designation list by December 18, 2026. [24]
References
U.S. Food and Drug Administration, Center for Drug Evaluation and Research. (n.d.). CDER report on the state of pharmaceutical quality: Fiscal year 2025. https://www.fda.gov/media/188153/download
Scholar Rock. (2025, September 23). FDA issues complete response letter (CRL) for apitegromab as a treatment for patients with spinal muscular atrophy (SMA) solely related to observations identified at Catalent Indiana LLC fill-finish facility [Press release]. https://investors.scholarrock.com/news-releases/news-release-details/fda-issues-complete-response-letter-crl-apitegromab-treatment
BioSpace. (2026, September 14). Scholar Rock secures first FDA approval for muscle-targeting rare disease drug. https://www.biospace.com/fda/scholar-rock-secures-first-fda-approval-for-muscle-targeting-rare-disease-drug
U.S. Food and Drug Administration. (2026, September 18). Curia New York, Inc. – 728790 – 09/18/2026 [Warning letter]. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/curia-new-york-inc-728790-09182026
PharmaSource. (n.d.). FDA warning surge: Regulatory violations #1 reason for CDMO disqualification [Reports ISR Bioprocessing Market Outlook 2025-2030 survey, Q3 2025, n = 100]. https://pharmasource.global/?p=32802
Cornell Law School Legal Information Institute. (n.d.). 21 CFR 211.22: Responsibilities of quality control unit. https://www.law.cornell.edu/cfr/text/21/211.22
U.S. Food and Drug Administration. (2016, November). Contract manufacturing arrangements for drugs: Quality agreements. Guidance for industry. https://www.hhs.gov/guidance/sites/default/files/hhs-guidance-documents/FDA/Contract-Manufacturing-Arrangements-for-Drugs–Quality-Agreements.pdf
U.S. Food and Drug Administration. (2001, August). Q7A good manufacturing practice guidance for active pharmaceutical ingredients. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/q7a-good-manufacturing-practice-guidance-active-pharmaceutical-ingredients
Bilton, L. (2025, September 11). CDMO market size: Global pharmaceutical forecasts. PharmaSource. https://pharmasource.global/content/expert-insight/cdmo-market-size-global-pharmaceutical-forecasts/
Regulatory Affairs Professionals Society. (2025, July 10). FDA publishes 200 complete response letters. https://www.raps.org/resource/fda-publishes-200-complete-response-letters-in-tra.html
Phase 3 Search. (2026). The complete response letter report. https://ph3.bio/fda-crl-report/
White & Case LLP. (n.d.). FDA foreign inspections: Key developments and strategic shifts. https://www.whitecase.com/insight-alert/fda-foreign-inspections-key-developments-and-strategic-shifts
Novo Holdings. (2024, December 18). Novo Holdings completes acquisition of Catalent [Press release]. Business Wire. https://www.businesswire.com/news/home/20241218507326/en/Novo-Holdings-Completes-Acquisition-of-Catalent
Pharma Manufacturing. (2025, October 13). FDA hits Novo Nordisk Indiana site with “official action indicated” letter. https://www.pharmamanufacturing.com/sector/contract-manufacturing/article/55322900/fda-hits-novo-nordisk-indiana-site-with-official-action-indicated-letter
Fierce Pharma. (2026, August 7). Scholar Rock ditches Novo’s legacy Catalent plant in FDA refiling of SMA drug. https://www.fiercepharma.com/pharma/scholar-rock-ditches-novo-legacy-catalent-plant-fda-refiling-sma-drug
Fierce Pharma. (2026, March 9). Novo’s troubled Indiana plant claims another victim as FDA rejects Incyte’s lung cancer application. https://www.fiercepharma.com/manufacturing/novo-nordisk-catalent-plant-problem-claims-another-victim-fda-rejects-incytes-lung
Scholar Rock. (2026, August 6). Scholar Rock reports second quarter 2026 financial results and recent business highlights [Form 8-K, Exhibit 99.1]. U.S. Securities and Exchange Commission. https://www.sec.gov/Archives/edgar/data/0001727196/000119312526336715/srrk-ex99_1.htm
NeurologyLive. (2026, September 11). FDA approves apitegromab for spinal muscular atrophy. https://www.neurologylive.com/view/fda-approves-apitegromab-spinal-muscular-atrophy
U.S. Food and Drug Administration. (2018, December). Data integrity and compliance with drug CGMP: Questions and answers. Guidance for industry. https://fda.gov/media/119570/download
U.S. Food and Drug Administration. (n.d.). CDER quality management maturity. https://www.fda.gov/drugs/pharmaceutical-quality-resources/cder-quality-management-maturity
Sidley Austin LLP. (2025, August 13). FDA launches PreCheck program to support U.S. pharmaceutical manufacturing: What industry stakeholders should know. https://goodlifesci.sidley.com/2025/08/13/fda-launches-precheck-program-to-support-u-s-pharmaceutical-manufacturing-what-industry-stakeholders-should-know/
Bureau of Industry and Security, U.S. Department of Commerce. (2026, September 23). Guidance and procedures for implementing tariff adjustments for specialty pharmaceuticals and associated pharmaceutical ingredients and technical corrections to the Harmonized Tariff Schedule of the United States for duties imposed under Proclamation 11020. Federal Register, 91, 60360. https://www.federalregister.gov/documents/2026/09/23/2026-19498/guidance-and-procedures-for-implementing-tariff-adjustments-for-specialty-pharmaceuticals-and
Baker McKenzie. (2026, January). United States: The BIOSECURE Act becomes law. https://www.bakermckenzie.com/en/insight/publications/2026/01/united-states-the-biosecure-act-becomes-law
Arnold & Porter. (2026, June). National security controls and the life sciences sector: BIOSECURE Act, Section 1260H, and COINS Act developments. https://www.arnoldporter.com/en/perspectives/advisories/2026/06/national-security-controls-and-the-life-sciences-sector
DrugPatentWatch. (n.d.). The FDA Orange Book decoded: How generic drug makers find, time, and win market entry. https://www.drugpatentwatch.com/blog/the-fda-orange-book-decoded-how-generic-drug-makers-find-time-and-win-market-entry/
