If the record cannot be trusted, the product cannot be trusted.
Data integrity is not an IT detail. It is the foundation every batch decision, release decision, and inspection outcome stands on — and it is where regulators are actively finding failures right now.
FDA expects all data to be reliable and accurate.
In its guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), FDA states that data should be complete, consistent, and accurate — attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA). The guidance was written in response to an increase in data integrity violations found in inspections, violations that resulted in warning letters, import alerts, and consent decrees. The underlying rules — 21 CFR Part 11 for electronic records and signatures, and 21 CFR 211.68 and 211.194 for controls and laboratory records — apply every day, not just on inspection day.
In 2026, failures still end in import bans.
When FDA finds data it cannot trust, it does not just cite the record — it can place every product from the site on Import Alert 66-40, detaining shipments at the border until compliance is proven. In March 2026, FDA issued a warning letter to Xiamen Kang Zhongyuan Biotechnology and placed all of its drug products on Import Alert 66-40 after data integrity lapses, and recommended a recall of product already in U.S. distribution. For a small or mid-size manufacturer, that outcome is existential: no shipments, no revenue, and a remediation bill many times larger than prevention would have cost.
Validation is becoming risk-based — and lighter where risk is low.
On September 24, 2025, FDA issued its Computer Software Assurance guidance for production and quality system software, updated in February 2026. It replaces heavy, one-size-fits-all scripted documentation with assurance effort matched to risk. That guidance formally covers medical-device production and quality-system software; for drug, food, supplement, and other regulated manufacturers it is a direction of travel, not a mandate — and the risk-based thinking behind it, shared with ISPE's GAMP 5, is exactly how right-sized validation should be built. At the same time, AI is entering regulated manufacturing faster than the rules for validating it: the EU's draft Annex 22 and ISPE's GAMP AI guide are still emerging, and no framework yet lets an algorithm's output stand without a qualified human reviewing it.
Find your gaps before an inspector does.
Our free Data Integrity Gap Assessment scores your operation against the same expectations — audit trails, access control, ALCOA+, review practice — and ranks every gap Critical, Major, or Minor with the regulation it maps to and the fix it needs. It takes about ten minutes, and every report is a draft until a validation expert reviews it.
Government and regulatory sources
FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers (final guidance, December 2018), summary via RAPS.
FDA, Warning Letter to Xiamen Kang Zhongyuan Biotechnology Co., Ltd. (March 23, 2026; Import Alert 66-40).
FDA, General Principles of Software Validation (noting the September 24, 2025 Computer Software Assurance guidance that supersedes its Section 6).