FDA guidance vs. regulation — what actually binds you

Search any FDA topic and most of what you find is guidance — documents that announce, on the first page, that they “contain nonbinding recommendations.” That banner is not boilerplate. Under 21 CFR 10.115, FDA's good guidance practices regulation, guidance documents state the agency's current thinking and do not establish legally enforceable responsibilities — for you or for FDA. The statute binds. The regulations bind. Guidance explains. Practitioners who blur those three layers make two opposite mistakes, and both are expensive.

The hierarchy, precisely

Statute

The law Congress wrote — for this field, chiefly the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act. Statutes create the categories everything else lives in: adulteration, misbranding, approval, licensure. Only Congress changes them.

Regulation

Rules FDA itself issues in Title 21 of the Code of Federal Regulations, through notice-and-comment rulemaking under the Administrative Procedure Act. Regulations carry the force of law: 21 CFR 312 is why an IND works the way it does, 21 CFR 807 is why a 510(k) does. Violating one is violating the law.

Guidance

Documents described by 21 CFR 10.115: the agency's current thinking on a topic — how it interprets a regulation, what evidence it recommends, how it intends to exercise discretion. Not legally binding on the public or on FDA, and required to say so. The operative verb in guidance is “should”; requirements — “must” — may only restate what a statute or regulation already imposes.

Draft guidance

A guidance issued for public comment before finalisation. It signals direction and is read by the same reviewers who will read your file — but it is explicitly not for implementation, and its specifics can change with the docket.

Why the framing matters

The first failure mode treats guidance as law. Teams gold-plate: every “should” becomes a requirement, every recommended study gets run even where the technology makes it meaningless, and nobody asks the review division whether an alternative approach would serve — despite every guidance inviting exactly that conversation. The cost is real money and real time spent complying with recommendations that were never requirements, on a programme that could have argued a better way.

The second failure mode treats “nonbinding” as “ignorable,” and it is worse. Guidance is the reviewer's working yardstick: it tells you, in advance and in writing, what the person reading your file expects to see. Deviate silently and the deviation reads as an oversight — and comes back as a deficiency. The discipline that carries an IND past its 30-day review or a 510(k) through substantial equivalence is the same discipline here: know what the applicable guidances recommend, follow them where they fit, and where they do not fit, say so first, with reasons.

What this means in practice

Used well, the distinction is leverage. Because guidance is not law, a justified alternative is a legitimate regulatory strategy, not a compliance failure — the burden is simply on you to show the alternative satisfies the statute and regulations the guidance interprets. Because guidance is the reviewer's yardstick, following it where it fits buys you a predictable review. And because guidance changes faster than regulation, tracking the guidance database and the comment dockets is not administrative hygiene — it is how you see the agency's expectations move before your competitors do.

Where the hierarchy trips people

Citing a draft as if it were final

A draft is a preview of thinking, issued for comment and subject to change. Building a protocol or a quality system on a draft's specifics — without tracking whether finalisation kept them — leaves you compliant with a document that no longer exists.

Deviating from guidance silently

The recommendations are not law, but they are the questions the reviewer will ask. An undocumented deviation looks like ignorance rather than strategy. The justification you could not be bothered to write becomes the deficiency response you must write later, on the review clock.

Letting guidance create phantom requirements

If an obligation appears only in a guidance, it is a recommendation — 21 CFR 10.115 says guidance may not impose requirements the statute and regulations do not. Teams that cannot trace a “requirement” to its regulation cannot argue about it either; the trace is what turns compliance from folklore into a position.

Frequently asked questions

Can FDA refuse my submission for not following a guidance?

Not for that reason alone — a deficiency has to trace to a statutory or regulatory standard, and guidance documents state on their face that alternative approaches may be used. In practice, an unexplained deviation reads as an oversight and returns as a deficiency letter. Deviate deliberately: with data, a written rationale, and ideally the review division's early agreement.

Do draft guidances matter?

Yes, twice over. A draft signals where the agency's thinking is heading, and reviewers read the same drafts you do. But a draft is issued for comment, not implementation — it can change or be withdrawn, and building a programme on a draft's specifics without tracking the docket is building on sand.

Can I comment on FDA guidance?

Yes. Draft guidances open a comment period through the public docket on regulations.gov, and under the good guidance practices regulation you may comment on any guidance at any time — the agency is required to consider comments on final guidance for future revisions.