The compliance landscape for FDA-regulated laboratories is not a monolith. It’s a patchwork of overlapping citations- and knowing which regulation applies to your lab, and precisely which section governs your sample management obligations, is the difference between a clean inspection and a 483 that takes six months to close.
This guide maps the relevant 21 CFR regulations directly to sample management requirements- collection, labeling, storage, retention, disposal, and documentation- organized by industry sector. It’s intended for quality and regulatory affairs managers who already know the fundamentals and need something more actionable: a precise regulatory reference they can take into an audit readiness review.
Which Regulation Governs Your Lab?
The FDA does not operate under a single unified laboratory standard. Instead, sample management obligations are distributed across multiple parts of Title 21 of the Code of Federal Regulations, with each part targeting a distinct industry sector:
- 21 CFR Part 58 governs nonclinical (preclinical) laboratories conducting studies intended to support FDA research or marketing permit applications — what the agency formally calls Good Laboratory Practice (GLP).
- 21 CFR Part 211 (Subpart I, Laboratory Controls, and Subpart J, Records and Reports) governs pharmaceutical manufacturers producing finished drug products under current Good Manufacturing Practice (cGMP).
- 21 CFR Part 820, the Quality System Regulation (QSR) — updated as the Quality Management System Regulation (QMSR) effective February 2, 2026, incorporating ISO 13485:2016 — governs medical device manufacturers.
- 21 CFR Part 11, though not a sample management regulation per se, imposes binding electronic records and electronic signature requirements on any of the above when computerized systems are used for regulated data. It is the connective tissue that makes everything else auditable.
Food laboratories operating under 21 CFR Parts 110/117 (cGMP for food and FSMA’s preventive controls rule) have their own sample and record requirements, but the pharma, device, and nonclinical sectors above carry the highest regulatory exposure — and the most inspection activity.
21 CFR Part 58: Sample Management in Nonclinical (GLP) Labs
GLP labs supporting drug, biologic, or device submissions sit under Part 58, which is, in structural terms, the most rigorous of the three frameworks when it comes to specimen traceability.
Collection and identification. Under §58.130 (Conduct of a nonclinical laboratory study), all data generated during a study — including specimens — must be attributable to the study they support. The regulation requires that specimen collection follow the approved study protocol, and any deviation must be documented. Specimens must be identified by study number, test system (animal or in vitro preparation), nature of the specimen, and date of collection. There is no regulatory ambiguity here: unidentified or improperly labeled specimens are per se documentation deficiencies.
Storage facilities. Section 58.51 requires dedicated specimen and data storage facilities with conditions that minimize deterioration in accordance with required retention periods and the nature of the specimens. The regulation further mandates that archives allow for orderly storage and expedient retrieval of all raw data, documentation, protocols, specimens, and interim and final reports — with an identified individual responsible for the archives and access restricted to authorized personnel only.
Labeling of reagents. All reagents and solutions in the laboratory areas must be labeled to indicate identity, titer or concentration, storage requirements, and expiration date — and deteriorated or outdated reagents and solutions must not be used.
Retention. Records, raw data, and specimens pertaining to a nonclinical study must be retained in the archives for at least 2 years following FDA approval of the application for which the study was submitted, or at least 5 years after submission if not approved. A critical nuance: wet specimens — except those from mutagenicity tests and wet specimens of blood, urine, feces, and biological fluids — need only be retained as long as the quality of the preparation permits evaluation, and in no case longer than the standard retention periods. This is a significant practical exception that many labs fail to document properly, treating all specimens as if they carry identical retention obligations.
The archive must be secured, indexed, and retrievable for required periods, including raw data, protocols, SOPs, specimens, and the final report — with controlled access, documented retrieval procedures, and disciplined data migration when systems change.
The Study Director obligation. Part 58 places unique accountability on the Study Director (§58.33), who is responsible for the overall conduct of the study including specimen integrity. This is not merely an organizational designation — it is an auditable accountability chain. If specimens are improperly stored or chain-of-custody breaks down, the Study Director is the regulatory target.
21 CFR Part 211: Sample Management in Pharmaceutical cGMP Labs
For finished drug product manufacturers, Subpart I of Part 211 is where sample management lives, with supporting documentation obligations in Subpart J.
Sampling plans and specifications. The establishment of specifications, standards, sampling plans, and test procedures must be drafted by the appropriate organizational unit and reviewed and approved by the quality control unit. This is not a discretionary activity — sampling plans are a regulated document class. Inspectors routinely look for evidence that sampling plans are scientifically defensible, not merely procedural boilerplate.
Component testing and quarantine. The regulation requires quarantining each container of components until tested and approved, and for each lot, at least one specific identity test must be performed (§211.84(d)(1)). Materials that fail specifications must be labeled as “Rejected” and physically isolated to prevent accidental use.
Reserve samples: the most specific sample management obligation in Part 211. §211.170 is among the most detailed and operationally specific provisions in the entire pharmaceutical cGMP framework. A reserve sample that is representative of each lot or batch of drug product must be retained and stored under conditions consistent with product labeling, in the same immediate container-closure system in which the drug product is marketed, and must consist of at least twice the quantity necessary to perform all required tests — except for sterility and pyrogens.
The retention timelines are product-specific:
- For standard drug products, the reserve sample shall be retained for 1 year after the expiration date.
- For radioactive drug products with expiration dating of 30 days or less, the retention period is 3 months after expiration; for those with expiration dating exceeding 30 days, 6 months post-expiration.
- For OTC drug products exempt from expiration dating, the reserve sample must be retained for 3 years after the lot or batch is distributed.
The same retention framework applies to active ingredients, anchored to the expiration date of the last lot of finished product containing that ingredient.
Annual visual examination. Reserve samples must be visually examined at least once a year for evidence of deterioration unless doing so would affect the integrity of the sample — and any evidence of deterioration must be investigated in accordance with §211.192, with results recorded and maintained with other stability data. This annual examination requirement is consistently underestimated by labs that manage reserve samples competently at intake but treat ongoing stewardship as administrative overhead.
Laboratory records. Laboratory controls must cover method validation and verification, sampling plans, scientifically sound specifications, and proper calculations with independent review, with OOS results investigated per SOP. Under Subpart J, all production, control, or distribution records associated with a batch must be retained for at least 1 year after the expiration date, and records must remain readily available for authorized inspection during the entire retention period. Complete calibration records for all laboratory instruments, apparatus, gauges, and recording devices are separately required under §211.194.
21 CFR Part 820 / QMSR: Sample Management in Medical Device Labs
The medical device quality framework has undergone its most significant revision in decades. The QMSR became effective on February 2, 2026, amending 21 CFR Part 820 by incorporating by reference ISO 13485:2016 — harmonizing FDA’s CGMP regulatory framework with international standards used by other regulatory authorities.
For laboratory sample management in a device context, the key regulatory anchors are:
Acceptance activities (§820.80 under the legacy QSR, now aligned to ISO 13485 §8.4). Incoming components, materials, and finished devices must pass defined acceptance criteria before use or release. Samples collected for incoming inspection, in-process testing, and finished device verification must be traceable to the lot or batch they represent, with results documented in the Device History Record (DHR).
Traceability and identification. The QMSR extends ISO 13485:2016 traceability requirements for implantable devices to devices that support or sustain life. In laboratory terms, this means specimens or components tested in connection with implantable or life-sustaining devices carry a heightened identification obligation — one that must be maintained throughout the test lifecycle.
Nonconforming product (§820.90). Samples or components that fail testing must be controlled to prevent inadvertent use, documented with the nature of the nonconformance, and subjected to a defined disposition process. This covers all components, parts, and finished products — the automated or manual process must identify, evaluate, review, and handle all nonconforming materials.
Records. The QMSR’s Control of Records section (§820.35) defines content requirements for complaint records and service records more explicitly than the prior QSR — these records must be maintained in a form that allows audit and inspection. Device History Records for each batch must document all production and testing activities, including laboratory test results.
Design verification and validation testing. Laboratories that conduct verification or validation testing for medical device design (under §820.30’s design controls framework) must retain all data — test plans, protocols, results, and conclusions — as part of the Design History File. These records support the legally required demonstration that the device conforms to its design input requirements.
Where Labs Actually Fail: 21 CFR 483 Trends in Sample Management
The FDA’s publicly available inspection observation data makes the compliance failures visible. Year over year, the citations that surface in pharmaceutical and device inspections point to the same structural weaknesses — and most of them trace back to how samples and their associated records are managed.
Among the most frequently cited observations in pharmaceutical inspections is 21 CFR 211.160(b) — laboratory controls not scientifically sound — where controls failed to include the establishment of scientifically sound and appropriate specifications, standards, sampling plans, and test procedures. The implication is clear: sampling plans are treated as procedural documentation rather than scientific decisions, and inspectors find them when they look.
A second persistent citation involves 21 CFR 211.192 — failure to investigate discrepancies — where laboratory records did not include complete data derived from all tests necessary to assure compliance with established specifications and standards. Incomplete test records are, functionally, the same problem as incomplete sample traceability: you cannot reconstruct what happened to a sample without complete contemporaneous records.
Across fiscal year 2024 inspection data, failures to establish or follow written procedures for various quality control and laboratory operations, and the lack of complete documentation for laboratory testing and investigations, were among the dominant findings. These are not exotic compliance failures requiring sophisticated detection — they are the routine documentation disciplines that a functioning sample management system is supposed to produce automatically.
The trend data from 2023–2024 pharmaceutical facility inspections shows a notable increase in Official Action Indicated (OAI) outcomes globally, with a persistent regulator focus on ensuring science-based manufacturing process controls and robust data-driven investigation programs. Samples that are not traceable to a specific lot, stored under undocumented conditions, or released without complete test records are the audit targets driving those OAI classifications.
A particularly underappreciated failure mode involves reserve sample stewardship. Firms maintain reserve samples at intake per §211.170, then neglect the annual visual examination requirement. When an inspector asks for the examination records, they often find they don’t exist — which converts a retention compliance success into a documentation deficiency.
How a LIMS Operationalizes FDA Compliance Requirements
The regulatory obligations described above share a common implementation problem: they require persistent, date-stamped, tamper-evident records that span years, often outlasting the original analysts, systems, and even storage facilities. Manual systems simply cannot maintain this kind of longitudinal integrity at scale.
A purpose-built Laboratory Information Management System (LIMS) with FDA compliance architecture addresses this at multiple levels:
Sample chain-of-custody. Every sample receives a unique, system-generated identifier at accessioning. The system records who collected it, when, under what conditions, and what test protocol it was assigned to — fulfilling the identification and attribution requirements of Part 58, Part 211, and Part 820 simultaneously.
21 CFR Part 11 compliance. Electronic records generated in the LIMS must meet Part 11 requirements: audit trails, electronic signatures with linked identity, and data integrity controls that prevent unauthorized alteration. A LIMS that is not Part 11-compliant generates electronic records that are, in FDA’s view, not equivalent to paper records — a critical distinction for labs that have digitized their workflows but not their compliance infrastructure.
Retention scheduling. The system can enforce product-type-specific retention timelines — standard pharmaceuticals, radioactive products, OTC exemptions — automatically flagging samples approaching mandatory disposition dates and generating the annual examination reminders required under §211.170.
OOS workflow. When a test result falls outside established specifications, the LIMS routes it into a mandatory investigation workflow, generating the documentation required under §211.192 and ensuring that no out-of-specification result can be administratively closed without review.
Reserve sample inventory. Automated tracking of reserve sample quantities, storage conditions, and examination history creates the exact record chain that inspectors look for when evaluating §211.170 compliance.
To Wrap it Up
FDA inspection risk in laboratory sample management concentrates in three places: the adequacy of sampling plans as scientific documents (not just procedural ones), the completeness and contemporaneity of records at every stage of the sample lifecycle, and the long-term stewardship of reserve samples and archived specimens. The regulations are specific, the inspection trends are consistent, and the citations are predictable.
Labs that treat compliance as a documentation retrofit — generating records to satisfy requirements after the fact — will always be exposed. The regulatory architecture requires that sample management systems produce compliant records as a byproduct of normal operations, not as a separate compliance activity.
QISS LAB provides purpose-built LIMS and sample management solutions designed around FDA regulatory requirements. If your current system leaves gaps in your 483 readiness, book a demo to see how the platform maps to your specific regulatory framework.
