Your Contract Lab's Warning Letter Is Your Problem: Lessons From FDA's Eurofins Microbial Data Letter

When the United States Food and Drug Administration posts a warning letter to a contract testing laboratory, the lab is not the only company that should pay attention. Every sponsor, manufacturer, and exporter that relied on that lab to release product is now exposed. On 13 October 2026, FDA posted a warning letter to Eurofins SF Analytical Laboratories, a microbiology contract lab inspected at its Horsham, Pennsylvania site. The findings are a textbook example of why a certificate of analysis is only as trustworthy as the laboratory behind it, and why reliance on a third party never transfers your accountability for a compliant batch.

If your organization uses an outside laboratory for release testing, stability testing, or environmental monitoring, this letter is a direct warning about your own supply chain. Below, we break down exactly what FDA cited, what it means under both US and Canadian rules, and the practical steps Canadian sponsors and exporters should take before the next shipment leaves the dock.

Executive Summary

FDA inspected Eurofins SF Analytical Laboratories from 1 to 3 June 2026 and issued a warning letter dated 6 October 2026, reference 320-27-05, posted publicly on 13 October 2026. The letter cites three core current good manufacturing practice (CGMP) failures: incomplete laboratory records under 21 CFR 211.194(a), failure to investigate aberrant results under 211.192, and a quality unit that lacked proper authority under 211.22. FDA concluded that the drug products tested were adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act.

What FDA Cited in the Eurofins Warning Letter

What is it? The Eurofins SF warning letter is a formal FDA notice that a microbiology contract laboratory operated outside CGMP, to the point that the drug products it tested are considered adulterated. Why does it matter? Because the lab performs release testing for other companies, those companies inherit the data-integrity risk. What should you do? Read the specific findings, then ask whether the same gaps could exist in any lab that tests your products.

FDA grouped its findings into three CGMP regulations. The table below summarizes what each citation covered.

FDA also invoked section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, stating plainly that the drug products tested are adulterated. That is the language that matters to a sponsor: adulteration is a product status, not just a lab problem, and it attaches to the finished goods that moved on that data.

Why a Contract Lab's Warning Letter Becomes Your Problem

What is it? Regulatory accountability for a released batch stays with the product owner, even when testing is outsourced. Why does it matter? A certificate of analysis is a representation, not a guarantee, and relying on it does not discharge your own release obligations. What should you do? Treat every contract lab as an extension of your own quality system and verify, do not assume.

This principle is identical on both sides of the border. In the United States, 21 CFR 211.22 makes the quality unit responsible for approving or rejecting all components, drug product containers, and finished products, including those tested under contract. FDA has made clear for years, including in its 2026 supplier-oversight actions, that outsourcing an activity never outsources the responsibility for it.

In Canada, the same logic flows from the Food and Drug Regulations and Health Canada's Good Manufacturing Practices Guide (GUI-0001). The fabricator, packager, labeller, importer, and distributor each hold defined responsibilities, and a drug establishment licence (DEL) holder cannot sign away accountability through a service contract. A supplier qualification programme that survives an inspection is the mechanism that keeps that accountability under control.

The Eurofins case sharpens the point. The lab admitted to selective recording of microbial data since February 2025. Any company that received a certificate of analysis from that lab during that window now has to ask a hard question: was my release decision based on complete, accurate data? FDA asked the lab the same thing, questioning whether the TNTC omissions made customer certificates of analysis incomplete.

Who Is Responsible for What: Sponsor Versus Contract Lab

A clear split of duties, written into a quality agreement, is the difference between managed risk and a finger-pointing exercise after an inspection. The table below shows a practical division of responsibilities for outsourced testing.

Notice the last row. The contract lab never makes the release decision. That decision, and the accountability that comes with it, always sits with the product owner. This is why audit trail review is the data-integrity battleground and why a signed certificate is a starting point for your review, not the end of it.

The Three Failures and What They Teach Your Lab Programme

1. Incomplete Records: The TNTC and Zero-Count Problem

Under 21 CFR 211.194(a), laboratory records must include complete data from all tests. Eurofins recorded pour-plate counts but omitted TNTC results, logged desiccated and cracked plates as within limits, and required no second-person check of plates read as zero. The risk is obvious once stated: a result you do not record cannot be investigated, trended, or defended.

The practical lesson applies to every microbiology lab, in-house or contract. Build controls that make selective recording impossible: time-stamped photographs of plates at the moment of reading, mandatory second-person verification of low and zero counts, and a documented procedure for plates that are damaged, cracked, or desiccated. This is the same discipline we stress in our coverage of why FDA warning letters keep citing data integrity.

2. Failing to Investigate Aberrant Results

21 CFR 211.192 requires a thorough investigation of any unexplained discrepancy or failure to meet specifications. Eurofins did not investigate cracked or desiccated plates and justified its results through analyst interviews rather than records. FDA rejected that approach because an investigation grounded in memory is not evidence.

A defensible investigation identifies the root cause, assesses the impact on every affected batch, and verifies the effectiveness of the corrective action. If you want a model for how this should read, see our breakdown of batch failure investigations under 21 CFR 211.192. The same standard applies to a contract lab's investigations, and you are entitled to review them.

3. A Quality Unit Without Authority

FDA found the quality unit was not enabled to exercise proper authority. Under 21 CFR 211.22, and under Health Canada's expectations for a Quality Assurance Person, the quality function must have the independence and the power to stop a release. When the quality unit reports to production, or lacks the resources to review records before disposition, the findings above become inevitable.

This is where many organizations are quietly exposed. A quality unit that cannot say no, or that is not given time to review batch records before shipment, is a finding waiting to happen. Our article on how FDA warning letters start with the training record shows how these authority gaps surface in practice.

Can You Rely on a Contract Lab's Certificate of Analysis for Batch Release?

Short answer: not on its own. A certificate of analysis supports a release decision, but it does not replace your own oversight. Under both FDA and Health Canada rules, the product owner must qualify the laboratory, define the methods and specifications, review the data behind the certificate on a risk basis, and keep final release authority. Periodic verification testing and audit trail review are how you confirm the certificate reflects reality.

For Canadian natural health product and drug exporters shipping to the United States, this is doubled. You must satisfy Health Canada and FDA at once. Our guide to 21 CFR Part 111 for Canadian NHP exporters explains how US expectations layer on top of Canadian site licensing, and contract-lab oversight is a shared requirement across both.

What Canadian Sponsors and Exporters Should Do Now

If you rely on any third-party laboratory, work through these steps in order. They move from immediate exposure to long-term control.

1. Identify every contract lab in your supply chain. List each laboratory that performs release, stability, or environmental testing on your products, and note which batches depend on it.
2. Check for posted regulatory action. Search the FDA warning letter database and Health Canada inspection records for each lab. If a lab has an open finding, treat its recent certificates as suspect until verified.
3. Review the quality agreement. Confirm it defines data expectations, investigation notification, deviation handling, and your right to audit and to review raw data and audit trails.
4. Audit the data, not just the system. Request raw data and audit trails for a sample of batches. Look for dropped results, re-tests without justification, and missing second-person reviews.
5. Re-examine release decisions. For any lab with a known gap, reconstruct whether your release rationale still holds on complete data. Open a deviation and a risk assessment where it does not.
6. Strengthen your own controls. Require time-stamped plate photography, second-person verification of low and zero counts, and a damaged-plate procedure, whether the testing is in-house or outsourced.

Contract Laboratory Oversight: Compliance Checklist

Use this checklist to gauge how exposed you are to a contract-lab data failure. Each unchecked item is a gap to close.

• A current list of every contract laboratory and the tests each performs is maintained.
• Each laboratory is formally qualified before use and re-qualified on a defined risk-based schedule.
• A signed quality agreement defines methods, specifications, data expectations, and investigation notification.
• The agreement grants the right to audit, to review raw data, and to review audit trails.
• Certificates of analysis are reviewed against specifications before each batch is released.
• Raw data and audit trails are reviewed on a risk basis, not taken on trust.
• Out-of-specification and aberrant-result investigations from the lab are reviewed and approved by your quality unit.
• The quality unit holds final, independent release authority and the time to exercise it.
• Microbiology controls require second-person review of low and zero counts and time-stamped plate records.
• A procedure exists for damaged, cracked, or desiccated plates and for reporting them to the sponsor.

Common Mistakes That Leave You Exposed

• Treating the certificate as the end of the review. The certificate reflects what was reported, not what was observed. Accepting it without any data review is the most common and most costly error.
• No right to audit raw data. Quality agreements that allow a site audit but not a review of raw data and audit trails leave the real risk untouched.
• Confusing accreditation with compliance. A lab's ISO/IEC 17025 accreditation is valuable, but it does not guarantee CGMP data integrity or discharge your oversight duty.
• Letting the quality unit run short on time. When batch records are reviewed in a rush to ship, the quality unit cannot catch the gaps that FDA will.
• Ignoring a lab's warning letter because it is not yours. A warning letter to your lab is a warning about your product. Waiting to act until FDA or Health Canada contacts you is the wrong order.

Frequently Asked Questions

Does using a contract lab transfer my compliance responsibility?

No. Under 21 CFR 211.22 and Health Canada's GMP expectations, the product owner keeps responsibility for the batch. A contract lab performs testing, but the release decision and its accountability stay with you. FDA has repeatedly stated that using a consultant or a contract service does not relieve a firm of its CGMP obligations.

What does 21 CFR 211.194(a) require for laboratory records?

It requires complete records of all data obtained during testing, including the results and the information needed to judge whether a batch meets its specifications. Selectively recording results, such as omitting too-numerous-to-count counts or logging damaged plates as passing, violates this requirement because it hides data that should be investigated.

What did FDA actually cite in the Eurofins warning letter?

FDA cited 21 CFR 211.194(a) for incomplete laboratory records, 211.192 for failing to investigate aberrant results, and 211.22 for a quality unit without proper authority. It concluded the tested products were adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act and requested an independent assessment and a qualified consultant under 211.34.

How should I verify a certificate of analysis?

Compare the certificate against the approved specifications, then review the raw data and audit trails for a risk-based sample of batches. Confirm that all results, including out-of-specification and aberrant ones, are present and investigated, and that second-person reviews were performed where required.

Is this relevant to Canadian companies and natural health products?

Yes. Canadian drug and NHP firms that use third-party labs carry the same oversight duty under the Food and Drug Regulations and Health Canada's GMP Guide. Exporters to the United States must also meet FDA expectations, so a contract-lab gap can create risk in both jurisdictions at once.

How quickly do I need to respond if my lab receives a warning letter?

The lab has 15 business days to respond to FDA. Your own exposure clock starts the moment you learn of the finding. Treat recent certificates from that lab as suspect, verify the data behind your releases, and document a risk assessment without waiting to be contacted.

How MFLRC Can Help

MF License and Regulatory Consultants (MFLRC) helps regulated companies in Canada and cross-border markets turn contract-lab risk into controlled, defensible oversight. We bring more than 20 years of quality assurance, quality control, and regulatory affairs experience across pharmaceuticals, natural health products, cannabis, food, and medical devices.

• Contract-lab and supplier audits to assess data integrity, quality systems, and investigation practices before they become your finding.
• Audit and gap assessments including certificate-of-analysis reliance reviews and inspection-readiness checks.
• Quality assurance and SOP development for quality agreements, data-integrity controls, and microbiology record requirements.
• QAP services and quality-unit support to give your quality function real authority over release decisions.
• Validation services for analytical methods, computerized systems, and the controls that keep laboratory data reliable.

Rely on a third-party lab for release testing? Book an MFLRC contract-lab oversight review before your next shipment. Our pharmaceutical market team and natural health product specialists can scope the work to your risk and your timelines.

Conclusion

The Eurofins SF warning letter is not really a story about one laboratory. It is a reminder that a certificate of analysis carries your name into the field, and that FDA and Health Canada will hold the product owner, not only the lab, accountable for a compliant batch. Incomplete records, uninvestigated results, and a powerless quality unit are the failures that turn a routine certificate into an adulteration finding.

The fix is not complicated, but it is deliberate. Qualify your labs, write real data rights into your quality agreements, review the data behind the certificate, and keep release authority where it belongs. Do that, and a contract lab's warning letter becomes a problem you have already managed rather than one you inherit.

Sources and References

• FDA Warning Letter, Eurofins SF Analytical Laboratories, Inc., reference 320-27-05 (6 October 2026)
• US FDA, 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals (eCFR)
• US Federal Food, Drug, and Cosmetic Act, section 501 (Adulterated drugs and devices)
• Health Canada, Good Manufacturing Practices Guide for Drug Products (GUI-0001)
• US FDA, Quality Systems Approach to Pharmaceutical CGMP Regulations (guidance)