Where do CAPA requirements come from for medicines and for medical devices?

Why

The US drug CGMP regulations never use the word CAPA. The requirement comes from 211.192, which says unexplained discrepancies and specification failures must be thoroughly investigated, extended to other batches that may be affected, and recorded with conclusions and follow-up. The FDA's 2006 quality systems guidance links that section to corrective action and describes CAPA as three ideas: remedial correction, root cause analysis with corrective action, and preventive action.

ICH Q10 makes CAPA one of the four elements of the pharmaceutical quality system and says investigations should aim at root cause with effort proportional to risk. EU GMP Chapter 1 is more explicit. It asks for an appropriate level of root cause analysis, addressing the most likely causes when the true cause cannot be found, justifying any conclusion of human error, taking CAPAs and monitoring their effectiveness.

Medical devices changed in 2026. The FDA's Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, so device CAPA expectations now follow that standard's structure rather than the old Quality System Regulation text. Combination products and companies working across both sectors need to know which framework applies to which part of the product.

Whatever the source, inspectors look for the same thing: evidence that problems are understood and stay fixed.