Methodology, sources & disclaimers

What this is

CDMO Ledger lists 175 contract manufacturing (CDMO/CMO) and contract testing sites. For each site we show (1) basic capabilities quoted from the company's own website and (2) a dated timeline of regulatory records that public regulators have published, each linked to its source. We do not score, grade, rank or rate sites, and we do not interpret what records mean for quality.

Sources

• FDA Data Dashboard – public downloadable datasets (datadashboard.fda.gov): the "Entire Dataset" exports for Inspections (classification NAI/VAI/OAI by FEI number and inspection end date), Citations (FDA's posted Form 483 citation summaries by FEI and inspection) and Compliance Actions (warning letters, injunctions, seizures by FEI). These are public downloads from the dashboard pages; we do not use the key-based Data Dashboard API. The dashboard covers inspections from FDA fiscal year 2009 onward and only includes final classifications FDA has published; 483 citations are only present where FDA posted them.
• FDA warning letters (fda.gov warning letter listing and letter pages): used to link a warning letter to its full text. A letter is linked only when the case number in the letter's fda.gov address equals the case ID of a compliance action that the Data Dashboard attaches to the site's FEI.
• openFDA drug enforcement reports (recalls; bulk download of the same data served at api.fda.gov/drug/enforcement.json).
• FDA Import Alert 66-40 (detention without physical examination of drugs from firms that have not met drug GMPs), parsed from the public alert page.
• EudraGMDP (EMA) public list of GMP non-compliance reports.
• Company websites for capability tags only.

Not included: UK MHRA. MHRA does not publish an easily machine-readable public list of GMP non-compliance or inspection outcomes, so it is not checked yet. UK statements entered into EudraGMDP before 2021 would appear via EudraGMDP. Device and biologics recall databases, FDA's FOIA reading-room 483 documents and EIRs are not checked either.

Source status at last refresh (16 Oct 2026)

If a source fails to download, the previous copy is kept and used until the next successful refresh.

How sites were chosen and identified

We started from a seed list of well-known CDMOs, CMOs and contract testing labs. A site is published only when we could (a) find it in the FDA Data Dashboard inspection data under the company's name, in the same city, with an FEI number, and (b) find a page on the company's own website describing its services, from which at least one capability tag could be quoted. The FEI shown is the one FDA's own data uses for that name and city; we did not get it from any other source. Location details (city, state, postal code, country) are as recorded in FDA's data.

How capability tags are assigned

Tags come only from wording on the company's website. We fetch the page, strip site-wide menus, headers and footers, and look for specific phrases (for example "fill-finish", "lyophilization", "mammalian", "oral solid", "sterility testing"). The sentence each tag is based on is quoted on the site page, with the page link and the date we checked it. Where one company page describes several sites, only the text describing this site is used, and a tag is dropped if the wording sits next to another site's name. Tags from company-level pages are labelled as such. Tags were reviewed by hand and a few that came from menus or staff biographies were removed. Tags may be incomplete or out of date; the company's website is authoritative.

How regulatory records are matched to sites

1. By FEI number first. FDA inspection classifications, posted 483 citations and FDA compliance actions are attached only when their FEI number is one of the site's FEI numbers.
2. Warning letter pages are linked only through the exact case-number match described above. When no fda.gov page matches, the compliance-action record is shown with a link to the Data Dashboard instead.
3. By name + city for sources without FEI numbers (recalls, import alerts, EU non-compliance): the record's firm name must contain the company's distinctive name (for example "Catalent", "Patheon", "Siegfried"), and its city (or, for US records, ZIP code) and country must match the site.
4. When unsure, we don't attach. If a name + city record could fit more than one site in the directory, it is left off. Recalls are often reported under the brand owner rather than the contract manufacturer, so many recalls of products made at a site are not attached to it.

Records currently attached

1,178 FDA inspections · 185 inspections with posted 483 citations · 9 warning letters · 2 recalls.

Disclaimers

• CDMO Ledger is independent. It is not affiliated with, endorsed by, or acting for the U.S. FDA, the European Medicines Agency, the UK MHRA, any other regulator, or any company listed.
• Information only. Nothing here is advice, an audit, a supplier qualification, or a judgment about any company's compliance or quality.
• Regulatory data is shown as published and may contain errors, lags or later changes (for example, classifications updated or import-alert listings removed). Always verify with the official sources linked on each record before relying on it.
• An inspection with posted citations, a warning letter or a recall is a point-in-time record and may since have been resolved. A missing record does not mean that no record exists.
• Company names and trademarks belong to their owners and are used only to identify sites.

Corrections welcome

If a record is attached to the wrong site, a capability quote is out of date, or a site is missing, we want to fix it. A contact channel for corrections is being set up and will be posted on this page. Corrections fix matching or capability errors; published regulatory records themselves are not removed on request.

— The CDMO Ledger team