What does FDA's GMP rule (21 CFR 211.25) require for personnel training?

US drug manufacturing rules are federal regulations issued by the FDA under the Federal Food, Drug, and Cosmetic Act and published in Title 21 of the Code of Federal Regulations (CFR). For readers outside the US: Congress passes the statute, the agency writes binding regulations under it, and the agency then issues guidance documents that explain its current thinking but do not create new legal requirements.

The FDA lists its drug CGMP regulations as 21 CFR Parts 210, 211, 212 and 600: Part 210 covers general status, Part 211 covers finished pharmaceuticals, Part 212 covers positron emission tomography drugs, and Part 600 covers biological products. This page focuses on Part 211, the rule most regulated organizations mean when they say "FDA GMP". It states the position as at September 2026; the personnel sections of Part 211 (211.25, 211.28, 211.34) have not been amended since the eCFR's 2016 baseline.

Under 21 CFR 210.1, Parts 210 and 211 contain the minimum CGMP, and failing to comply renders a drug adulterated under section 501(a)(2)(B) of the Act, with the drug and "the person who is responsible for the failure to comply" subject to regulatory action.

Section 211.25 requires that every person in drug manufacturing operations, and every supervisor, is qualified by education, training, and experience, and that there are enough qualified people. Paragraph (a) is the core training requirement:

The full text is in 21 CFR Part 211, Subpart B. Note that the rule says "education, training, and experience, or any combination thereof": a firm can qualify someone through a mix, but it must be able to show the mix is sufficient for the role.

Part 211 sets no fixed interval or minimum hours. It requires CGMP training "on a continuing basis and with sufficient frequency" to keep employees familiar with the requirements that apply to them, so the frequency is a quality decision the firm must justify and document.

Many firms run annual CGMP refreshers plus event driven training when a procedure changes, after a deviation, or when someone moves into a new role. None of these triggers is written into 211.25, but each is a defensible way to show "sufficient frequency". Guidance on choosing intervals is in how to set mandatory training refresh cycles.

Because the rule ties training to "written procedures required by these regulations", every change to a standard operating procedure that affects a person's job creates a training need. Organizations with large procedure libraries usually control this with a training matrix that links each standard operating procedure to the roles that must read and be trained on it.

FDA guidance expects a training program with a full cycle: needs, delivery, effectiveness, and records. The FDA's final guidance Quality Systems Approach to Pharmaceutical CGMP Regulations (2006) says managers are expected to establish training programs that include:

1. Evaluation of training needs.
2. Provision of training to satisfy these needs.
3. Evaluation of effectiveness of training.
4. Documentation of training and/or re-training.

The same guidance says managers should define qualifications for each position, that training should focus on both the employee's specific job functions and the related CGMP requirements, and that managers should verify that skills gained from training are applied in day to day performance. It maps these expectations to 211.25(a) and (b).

For active pharmaceutical ingredients (APIs), the FDA has adopted the international guideline ICH Q7 (September 2016). Section 3.12 states: "Training should be regularly conducted by qualified individuals and should cover, at a minimum, the particular operations that the employee performs and GMP as it relates to the employee's functions. Records of training should be maintained. Training should be periodically assessed."

Medical device manufacturers are not covered by Part 211. Since February 2, 2026 they follow the Quality Management System Regulation (QMSR), 21 CFR Part 820, which incorporates ISO 13485:2016 by reference.

Under 21 CFR 820.10, a device manufacturer must document a quality management system that complies with the applicable requirements of ISO 13485. In the final rule published February 2, 2024, the FDA said Clause 6.2 of ISO 13485 requires that individuals doing work that affects quality are competent on the basis of appropriate education, training, skills, and expertise, and that examples of such individuals may include internal and external personnel, full time and part time staff, contractors, and consultants. Combination product makers may need to meet both rule sets.

Map each element of the rule to an observable outcome and to the evidence an investigator would ask for. The table below is illustrative; each site must tailor it to its products, processes, and procedures.

This structure reflects the difference between completing a module and demonstrating competence. For assessment design, see competency assessment and how to convert SOPs into training.

Part 211 does not contain a dedicated training records section, but a site must be able to prove each person is qualified, and FDA guidance and ICH Q7 both expect documented training. In practice investigators ask for the records below.

• Job descriptions or role profiles defining required qualifications for each position.
• A curriculum per role linking SOPs, CGMP topics, and on the job qualifications.
• Dated training records showing the SOP version trained on, the trainer, and the assessment result.
• Trainer qualification records.
• Evidence of training needs analysis and training effectiveness checks.
• Consultant records required by 211.34.

Records required under Part 211 must be readily available for authorized inspection during the retention period under 211.180(c). For preparing them, see how to prepare training records for an audit. The Australian and Japanese equivalents are covered in TGA GMP personnel training and Japan's GMP ordinance.

Knowledge Foundry models each regulation clause, SOP, and role as linked nodes in a knowledge framework, then attaches the learning outcomes and assessment points that evidence competence. When a procedure is revised, the affected roles and training are identified from those links rather than by manual search. See how this works for healthcare and life sciences.