What FDA inspectors cite about computerised systems

2026-09-23 · Updated 2026-09-26 · Author: M.A., Validation Lead

Two datasets, read for computers

FDA publishes what its inspectors write down in two places, and they do not agree to the unit. Inspection Observations is an annual spreadsheet: every citation reference, how often it was written, and how many Form 483s were issued. The Data Dashboard carries one row per citation per inspection, with the site's country and the inspection's classification. This post uses the first for rates and the second for who was cited, and never adds one to the other.

Across Drug, Device and Part 11 inspections ending between October 2022 and August 2026, the Data Dashboard carries 14,525 citations. 1,427 of them, 9.8%, concern computerised systems or the records those systems hold. FDA, Data Dashboard, inspection citations, October 2022 to 31 August 2026

Finding 1: the rate did not rise

FDA wrote 81 observations under 21 CFR 211.68(b), the drug GMP clause on computer controls, in FY2023 and 110 in FY2025. Over the same years it issued 510 and then 713 drug Form 483s. Per 100 drug 483s, the clause was written 15.9 times in FY2023, 14.3 in FY2024 and 15.4 in FY2025. FDA, Inspection Observations, fiscal years 2023 to 2025

Most of the growth is more inspections ending in a 483. Once a 483 was written, the chance it carried this clause barely moved. The figure is observations per 483 rather than the share of 483s carrying one, since a single 483 can carry the clause more than once.

The Data Dashboard, counted differently, moves a little more. Core computerised-systems citations were 3.6% of all drug citations in FY2023, 3.4% in FY2024 and 4.1% in FY2025. FY2026 stands at 4.7% so far, on a year that covers inspections only to 31 August 2026 and whose citations are still being posted. FDA, Data Dashboard, inspection citations, October 2022 to 31 August 2026

Finding 2: one observation carries the clause

FDA writes 211.68(b) as 5 separate observations, and between FY2023 and FY2025 it wrote them 271 times. 208 of those, 76.8%, were one observation: computer control of master formula records. FDA, Inspection Observations, fiscal years 2023 to 2025

Read as written, the dominant observation is about control over who may change a record, not about the software. The other four cover checking input against output, backup, and the written record kept where computerisation removed the paper. The published data carries FDA's wording for each observation, not what individual inspectors wrote under it.

Finding 3: who is cited, and how the inspection was classified

346 inspections in the Data Dashboard carried at least one core computerised-systems citation. FDA classified 103 of them Official Action Indicated, 241 Voluntary Action Indicated and 2 No Action Indicated. Official Action Indicated means FDA judged the conditions to warrant regulatory action; it is the most serious of the three classifications, and 29.8% of these inspections carry it. FDA, Data Dashboard, inspection citations, October 2022 to 31 August 2026

United States accounts for 238 of the sites and India for 32. That is a map of where FDA inspects, not of where computerised systems are worst. No single inspection here carried more than 4 core citations.

Part 11 does appear, rarely. The Data Dashboard records 6 citations of 21 CFR Part 11 in this window: 1 in FY2023, 1 in FY2024 and 4 in FY2025, all under the Part 11 Compliance programme area. Inspectors overwhelmingly cite the predicate rule instead. FDA, Data Dashboard, inspection citations, October 2022 to 31 August 2026

Device inspections are counted differently. Software validation is cited under 21 CFR 820.70(i), at 2.5 per 100 device Form 483s in FY2025. Since the Quality Management System Regulation took effect in February 2026, FDA cites ISO 13485:2016 clauses instead, and 12 such core citations appear in the FY2026 rows, so device counts stop being comparable with earlier years at that point. FDA, Data Dashboard, inspection citations, October 2022 to 31 August 2026

Finding 4: the EU publishes less

EudraGMDP lists 65 statements of GMP non-compliance for inspections ending between March 2022 and July 2026, from 18 national authorities. Each statement's own page carries Part 3, the issuing authority's account of what was found. Read across all 65: 20 name a computerised system — Annex 11, an audit trail, a LIMS, access rights or electronic data — 16 more describe records or data-integrity failures without naming a system, and 29 mention neither. EMA, EudraGMDP, statements of GMP non-compliance, inspections ending March 2022 to July 2026

What is counted there is a mention, not a finding. Part 3 summarises an inspection rather than listing its deficiencies, and each authority writes it in its own house style, some in translation, so a statement with no match is one that does not mention a computerised system — never evidence that the inspection found none. The spreadsheet export carries no finding text at all, which is why the count had to be read from the 65 statement pages one at a time.

What this data does not cover

FDA's citation data covers only Form 483s produced by its electronic inspection system; manually prepared 483s are absent. Citations are posted only once an inspection's classification is final, so the most recent months are under-reported. FDA, Data Dashboard, inspection citations, October 2022 to 31 August 2026

Which citations count as computerised systems is a judgement. Core citations here are those written under the clauses on computer control, software validation and electronic records, plus citations whose text names computers, software, electronic records or audit trails. A different rule gives different counts. This is reporting on public inspection records, not a validation deliverable and not regulatory advice.