Who's Accountable When Your Contract Manufacturer Fails? FDA's 2026 Supplier-Oversight Crackdown

When a contract manufacturer, packager, or testing lab lets a product down, one question decides how much trouble your company is in: who does the FDA hold accountable? In 2025 and 2026 the answer has become very clear. The agency holds the sponsor, the brand owner, and the licence holder responsible, not just the third party who did the work. If your name is on the product, the FDA expects your quality unit to have been in control the whole time.

This shift is not a matter of tone. It is showing up in enforcement numbers and in the specific violations the FDA is citing. Warning letters increasingly point to weak quality agreements, thin supplier audit programs, and a failure to oversee changes made by a contractor. For pharmaceutical, biologic, natural health product, and medical device companies that outsource any part of manufacturing or testing, supplier oversight is now one of the fastest ways to fall out of compliance, and one of the most important places to invest.

Executive summary

What is happening? The FDA treats a contract facility as an extension of the product owner. Under 21 CFR 211.22(a), the owner's quality unit is responsible for approving or rejecting every batch made, packaged, held, or tested under contract. A quality agreement can divide the work, but it cannot transfer the legal duty to comply with good manufacturing practice. When a contractor fails, the FDA can inspect the owner and hold the owner responsible for oversight failures.

Why does it matter? Outsourcing is now the norm across pharma, biologics, NHP, and devices, and regulators have caught up. Warning letters cite sponsors for missing or vague quality agreements, supplier audits that never happened, and changes a contractor made that the owner never reviewed. As of February 2, 2026, the FDA can also inspect supplier audit records that used to be off limits, so weak oversight is now visible in ways it was not before.

What should companies do? Put a binding quality agreement in place with every contractor, qualify and audit suppliers on a risk basis, test and trace incoming materials, and control every change a contractor makes. Treat supplier oversight as a core part of your quality system, not paperwork you sign once and file away.

What does sponsor accountability actually mean?

Sponsor accountability means the company that owns the product carries the regulatory responsibility for its quality, even when someone else does the manufacturing or testing. The FDA calls this party the owner. Health Canada calls it the fabricator, importer, or licence holder. The European system calls it the contract giver. Whatever the label, the message is the same. You cannot outsource responsibility.

The FDA set this out in its 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements. The guidance rests on a single principle from 21 CFR 211.22(a): the quality control unit is responsible for approving or rejecting drug products manufactured, processed, packed, or held under contract by another company. The agency has said plainly that it views a contracted facility as an extension of the owner. If problems are found at a contractor, the FDA can inspect the owner and hold the owner responsible for good manufacturing practice failures or for oversight failures in monitoring that contractor. Depending on the severity, that can lead to a recall, seizure, injunction, or other action.

A quality agreement is a valuable tool, but it has limits. It defines who does what. It does not move the duty to follow good manufacturing practice from one company to another. The contractor is responsible for the operations it performs, and the owner remains responsible for the product it places on the market. Neither party can point at the other to escape a finding.

Why is the FDA cracking down now?

The FDA is cracking down because outsourcing has grown faster than oversight, and because a record year of enforcement gave the agency both the data and the motivation to act. Fiscal year 2025 produced 303 drug and biologic warning letters, up 59 percent in a single year. Many of the underlying problems trace back to quality unit failures, and increasingly to how owners supervise the contractors in their supply chain.

Two recent warning letters to Sanofi's Genzyme sites show the pattern, even though both involved the company's own plants rather than outside contractors. In January 2025 the FDA warned the Genzyme site in Framingham, Massachusetts, that its quality unit was not able to fully exercise its authority and responsibilities, and that it had failed to investigate critical manufacturing deviations. In June 2026 the FDA warned the Genzyme site in Waterford, Ireland, that its quality unit failed to exercise proper oversight, including oversight of data integrity. The common thread in both letters is oversight. The FDA is looking for a quality unit that is genuinely in control, and it says so when it does not find one.

That same expectation applies with full force when the work is done by a separate company. If your quality unit cannot show that it approved the contractor, set clear expectations in writing, checked the contractor's performance, and reviewed the contractor's changes, then from the FDA's point of view your quality unit is not in control of your product.

The quality agreement is your first line of defence

A quality agreement is a written document that defines the good manufacturing practice roles and responsibilities of the owner and the contractor. It is your first line of defence because it turns a business relationship into a controlled, auditable one. The FDA describes the most critical parts as quality control and change control. If an inspector asks who was responsible for a given decision, the quality agreement should answer the question without ambiguity.

The FDA is clear that a quality agreement is separate from the commercial supply contract. It should focus on quality and compliance, not price, volume, or legal indemnities. A strong quality agreement is put in place before the commercial contract is signed, so that both parties understand and can meet every requirement from the start.

Supplier qualification and audit programs

Supplier qualification is the process of evaluating a contractor or material supplier before you rely on them, and auditing them on a schedule after that. It matters because a signed agreement means little if you never check that the other party can actually meet it. The FDA expects owners to evaluate facilities through audits, material testing, and other means, and to monitor the contractor's performance over time.

A practical program is risk based. A supplier of a critical active ingredient or a sterile fill and finish service earns a full on-site audit and close monitoring. A supplier of a low-risk item may be qualified with a questionnaire and a review of certificates. The point is to match the depth of oversight to the risk the supplier carries, and to document the decision so an inspector can follow your logic.

For device companies this work is more exposed than ever. Under the old Quality System Regulation, supplier audit reports were shielded from routine FDA review. The new Quality Management System Regulation, effective February 2, 2026, removed that exemption. FDA investigators can now request your supplier audit records during an inspection, so those records need to be complete, current, and honest.

Incoming-material testing and traceability

Incoming-material testing is the checking of components, ingredients, and packaging when they arrive, to confirm they are what the supplier says they are. Traceability is the ability to follow a material from the supplier through your process and back again. Together they are how you catch a supplier problem before it reaches a patient or consumer, and how you contain it if it does.

In Canada, Health Canada is direct about where this duty sits. Its good manufacturing practices guide, GUI-0001, states that testing of raw materials is the responsibility of the fabricator, even when the material is supplied by the client, unless a written agreement clearly assigns that testing to another qualified party. If no such agreement is in place, the observation is written against whoever the regulations make responsible. The lesson is that silence does not protect you. Only a clear, written allocation does.

Traceability also has to survive the hand-offs between companies. Your quality agreement should define how materials are identified, how shipping conditions are monitored, and how records move from the contractor back to you. When a recall happens, the speed and accuracy of your traceability is what limits the damage.

This is not just a pharma problem

Supplier oversight is a shared expectation across every regulated sector and every major market. The wording changes, but the principle does not. The party that owns the product is ultimately responsible for the quality of everything in its supply chain, including work done by others.

Natural health products. Health Canada's pharmaceutical quality system expectations require licence holders to select and monitor suppliers, verify that each delivery comes from the approved supply chain, and manage outsourced activities. Natural health product site licence holders who use contract manufacturers carry the same oversight duty as any other regulated maker.

Medical devices. The FDA's Quality Management System Regulation, effective February 2, 2026, is built on ISO 13485:2016, which devotes a full section to purchasing and supplier controls. Manufacturers must evaluate suppliers, define purchasing information, and verify purchased product. Health Canada has required ISO 13485 through the Medical Device Single Audit Program for years, so Canadian device makers already live with these controls.

Europe. The European Union's good manufacturing practice rules, in Chapter 7 of EudraLex Volume 4, cover outsourced activities and state that the contract giver is ultimately responsible. A Canadian or American company that exports to the EU is measured against the same idea of owner accountability.

Supplier oversight compliance checklist

Use this checklist to test whether your supplier oversight program would hold up under an FDA or Health Canada inspection.

• A binding, product-specific quality agreement is in place with every contract manufacturer, packager, and testing lab.
• Each quality agreement clearly defines quality unit roles, testing, documentation, change control, and communication.
• Every contractor and material supplier is qualified before use, on a risk basis, with the rationale documented.
• Critical suppliers are audited on a defined schedule, and audit reports and follow-up actions are complete and current.
• Incoming materials are tested or verified against defined acceptance criteria, with responsibility assigned in writing.
• Traceability is defined from supplier through process, including shipping conditions and record hand-offs.
• Change control requires owner quality unit review and approval before any contractor change takes effect.
• The owner quality unit reviews and releases every batch, including those made or tested by a contractor.
• Deviations, complaints, and recalls have clear reporting and escalation paths between the parties.
• Supplier oversight records are ready to show an inspector, including the supplier audit records the QMSR now exposes.

Common mistakes to avoid

Treating the quality agreement as a formality. An agreement that is signed once and never revisited will not reflect how the relationship actually works. Review it when processes, products, or suppliers change.

Confusing the supply contract with the quality agreement. A commercial contract sets price and volume. A quality agreement sets responsibilities for compliance. You need both, kept separate.

Qualifying a supplier once and never auditing again. Qualification is a starting point, not a finish line. Suppliers drift, change ownership, and cut corners. Periodic audits catch what a one-time review cannot.

Letting contractors change things quietly. An unreviewed change at a contractor is one of the most common roots of a serious finding. Your change control must reach into the contractor's operations.

Assuming client-supplied materials do not need testing. In Canada, the fabricator is responsible for testing raw materials even when the client supplies them, unless a written agreement says otherwise. Do not assume.

Keeping oversight records that cannot survive an inspection. With the QMSR now exposing supplier audit records for devices, incomplete or embarrassing files are a liability. Keep them accurate and defensible.

Frequently asked questions

If my contract manufacturer gets a warning letter, is my company affected?

Very possibly. The FDA can inspect the owner after finding problems at a contractor, and it can hold the owner responsible for failing to oversee that contractor. A finding at one facility can also trigger an inspection at the other. Your best protection is documented oversight that shows your quality unit was in control.

Is a quality agreement legally required?

The FDA's regulations do not explicitly require a quality agreement, but they do require your quality unit to define its responsibilities in writing and to approve or reject contractor batches. In practice, a written quality agreement is the clearest way to meet that requirement, and its absence is frequently cited in warning letters.

Who is responsible for testing incoming raw materials?

In Canada, Health Canada states that testing raw materials is the responsibility of the fabricator, even when the client supplies the material, unless a written agreement assigns the testing to another qualified party. Under FDA rules, the owner's quality unit is responsible for approving materials and released product. Either way, responsibility must be clear and documented.

Does a quality agreement move responsibility to my contractor?

No. A quality agreement divides the work, but it cannot transfer the duty to comply with good manufacturing practice. The contractor is responsible for the operations it performs, and the owner remains responsible for the product it places on the market.

How often should we audit our suppliers?

Audit frequency should be based on risk. Critical suppliers, such as active ingredient makers or sterile manufacturers, generally warrant on-site audits at defined intervals. Lower-risk suppliers may be reviewed less often. The key is a documented, risk-based schedule that an inspector can follow.

What changed for medical device makers in 2026?

As of February 2, 2026, the FDA's Quality Management System Regulation removed the exemption that once shielded supplier audit reports from FDA review. Investigators can now request those records during an inspection, so device makers need their supplier controls and audit files to be inspection ready.

We are a small or virtual company that outsources everything. Does this still apply?

Yes, and arguably more so. A virtual company that outsources manufacturing and testing still owns the product and still needs a quality unit that approves suppliers, sets expectations in writing, and releases product. Outsourcing the work does not outsource the responsibility.

How MFLRC can help

MFLRC helps pharmaceutical, biologic, natural health product, and medical device companies build supplier oversight programs that stand up to FDA and Health Canada scrutiny. Our work in quality assurance and audit services covers the full lifecycle, from the first quality agreement to the follow-up after an audit finding.

• Quality agreement drafting and review so every contract manufacturer, packager, and testing lab relationship is defined, binding, and inspection ready.
• Supplier qualification programs that set risk-based criteria and documentation so you can defend every supplier decision.
• Supplier and contractor audits conducted on your behalf, with clear reports and practical corrective actions.
• Gap assessments and CAPA support that find weak oversight before an inspector does, and help you fix the root cause.
• Compliance-as-a-Service for companies that need ongoing quality unit and oversight support without hiring a full in-house team.

For related reading, see our guides on how to respond to an FDA Form 483 or Health Canada inspection observation, why data integrity still drives most FDA warning letters, and the FDA QMSR and ISO 13485 changes that reshaped device supplier controls in 2026.

You can also review our practical guides on building an internal audit program, avoiding the most common root cause analysis mistakes, and the NHP GMP Guide GUI-0158 Version 4.0 for natural health product licence holders.

Conclusion

The question of who is accountable when a contract manufacturer fails no longer has a comfortable answer for sponsors. The FDA, Health Canada, and the European authorities all point to the same party, the owner of the product, and they are backing that view with enforcement. A record year of warning letters, a fresh focus on quality unit oversight, and a new rule that exposes supplier audit records have raised the stakes for every company that outsources. The good news is that the fix is well understood. Put binding quality agreements in place, qualify and audit your suppliers, test and trace your materials, and control every change. Do that, and a contractor's failure becomes a problem you manage, not a finding that lands on your licence.

Sources and references

FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements (Guidance for Industry).

FDA, Warning Letter to Genzyme Ireland Limited, June 22, 2026.

FDA, Warning Letters (database).

FDA, Quality Management System Regulation (QMSR).

Health Canada, Good manufacturing practices guide for drug products (GUI-0001).

ISO, ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes.

European Commission, EudraLex Volume 4: Good Manufacturing Practice Guidelines (Chapter 7, Outsourced Activities).