How many PPQ batches are actually required, and how do I defend the number I picked?

This is United States federal law, read for five product classes: dietary supplements, food, cosmetics, over-the-counter drugs, and infant formula. Which one you are in decides whether the question has a federal answer at all, so that comes first.

Almost everything written about performance qualification batches was written about pharmaceuticals. If you make a supplement, a food, or a cosmetic, the article you read was about somebody else’s rule. That does not make the work pointless. It changes what you are defending, and who you are defending it to.

On this page: Which rule reaches you · Where three came from · What the inspection record shows · What you actually defend · The pattern underneath it · Four things to check

Which rule reaches you

Drugs, including over-the-counter drugs. Part 211 carries the minimum current good manufacturing practice for preparation of drug products, excluding positron emission tomography drugs and medical gases as defined in section 213.3(b)(12), for administration to humans or animals (21 CFR 211.1(a)). Several clauses bear on process validation, and the set below is 21 CFR 211.100(a), 211.110(a), 211.113(b) and 211.94(c) rather than an exhaustive reading of the part.

• There shall be written procedures for production and process control designed to assure that the drug products have the identity, strength, quality, and purity they purport or are represented to possess (21 CFR 211.100(a)).
• To assure batch uniformity and integrity, written procedures shall be established and followed that describe the in-process controls and tests or examinations to be conducted on appropriate samples of in-process materials of each batch, and such control procedures shall be established to monitor the output and to validate the performance of those manufacturing processes that may be responsible for causing variability in the characteristics of in-process material and the drug product. That clause does not stop there. It goes on to say that such control procedures shall include, but are not limited to, the following, where appropriate, and then lists six subjects: tablet or capsule weight variation, disintegration time, adequacy of mixing to assure uniformity and homogeneity, dissolution time and rate, clarity, completeness or pH of solutions, and bioburden testing (211.110(a), 211.110(a)(1) through (a)(6)).
• Procedures designed to prevent microbiological contamination of drug products purporting to be sterile shall include validation of all aseptic and sterilization processes (211.113(b)).
• Drug product containers and closures shall be clean and, where indicated by the nature of the drug, sterilized and processed to remove pyrogenic properties, and such depyrogenation processes shall be validated (211.94(c)).

Read those four together and one thing is missing from all of them: a number. The rule says validate. It never says how many times.

Read the scope of part 211 to its end before assuming it reaches you, because it carries an exception. Pending consideration of a proposed exemption published in 1978, the requirements of the part are not enforced for over-the-counter drug products if the products and all their ingredients are ordinarily marketed and consumed as human foods, and until further notice parts 110 and 117, and where applicable parts 113 through 129, are applied in determining whether those products are made under current good manufacturing practice (211.1(c)). Note the condition carefully. It is not enough that the product is also an ordinary food. The product and every one of its ingredients have to be ordinarily marketed and consumed as human foods.

Dietary supplements. Part 111 applies to you if you manufacture, package, label, or hold a dietary supplement, with a narrow carve-out for holding at a retail establishment for the sole purpose of direct retail sale to individual consumers (21 CFR 111.1(a), 111.1(b)). Search all 590 clauses of it for the word validation and you will not find it. Not once. What it asks for instead is a production and process control system covering all stages of manufacturing, packaging, labeling, and holding, designed to ensure the quality of the supplement (111.55, 111.60(a)); a specification for any point, step, or stage in the process where control is necessary (111.70(a)), with in-process specifications and adequate documentation of your basis for why meeting them, in combination with meeting component specifications, will help ensure the finished specifications are met (111.70(c)(1), 111.70(c)(2)); a responsibility to determine whether those specifications are met (111.73); and verification, for a subset of finished batches you identify through a sound statistical sampling plan or for every finished batch, that the batch meets product specifications (111.75(c)). That last clause is the closest part 111 comes to asking how many. What it asks for is a sampling plan with a basis, not a batch count.

Food. The preventive controls rule does use the word, and defines it. Validation means obtaining and evaluating scientific and technical evidence that a control measure, combination of control measures, or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards (21 CFR 117.3). The obligation itself: you must validate that the preventive controls identified and implemented in accordance with 117.135 are adequate to control the hazard, as appropriate to the nature of the preventive control and its role in the facility’s food safety system (117.160(a)).

Read the rest of that section with it, because it carries its own exceptions. You do not need to validate the food allergen controls, the sanitation controls, the recall plan, the supply-chain program, or other preventive controls where a preventive controls qualified individual prepares or oversees a written justification that validation is not applicable, based on factors such as the nature of the hazard and the nature of the preventive control and its role in the food safety system (117.160(c)).

And the subpart carrying that obligation does not reach every facility. The exemption section runs from paragraph (a) through paragraph (k), and these are some of them rather than all of them. Except as provided by subpart E of the part, subparts C and G do not apply to a qualified facility, which is subject to modified requirements instead (117.5(a)). They do not apply to activities subject to part 123, fish and fishery products, or to part 120, hazard analysis and critical control point systems, where you are required to comply with those parts and are in compliance with them (117.5(b), 117.5(c)). They do not apply to activities subject to part 113, thermally processed low-acid foods in hermetically sealed containers, on the same condition, and that one is limited to the microbiological hazards regulated under that part (117.5(d)(1), 117.5(d)(2)). They do not apply to a facility with regard to manufacturing a dietary supplement in compliance with part 111 and the serious adverse event reporting section of the Act (117.5(e)). Further paragraphs reach produce safety activities (117.5(f)), named on-farm packing, holding, and low-risk manufacturing activities at small and very small businesses (117.5(g)(3), 117.5(h)(3)), alcoholic beverages at certain permitted facilities (117.5(i)(1)), and facilities solely engaged in storing raw agricultural commodities other than fruits and vegetables (117.5(j)). Read the section itself against your own operation. Where the obligation does apply, it names no number of runs. It names evidence.

Infant formula. Part 106 carries an FDA definition of validation, and it is worth reading for what it is scoped to. For the purposes of one section only, validation means establishing documented evidence that provides a high degree of assurance that a system will consistently produce a product meeting its predetermined specifications and quality characteristics, and can be accomplished through any suitable means, such as verification studies or modeling (21 CFR 106.35(a)(4)). In that section, system means a collection of components including software and hardware organized to accomplish a specific function or set of functions in a specified environment (106.35(a)(3)), and the requirement is that each system be validated before the release for distribution of any formula made using it (106.35(b)(3)). The section is about automatic mechanical and electronic equipment. It is a good definition and a common one to borrow, and borrowing it as a general definition of process validation reads it past its own opening words.

Cosmetics. The statute directs the Secretary, by regulation, to establish good manufacturing practices for cosmetic facilities, consistent to the extent practicable and appropriate with national and international standards, taking account of the size and scope of the businesses and providing flexibility, including simplified requirements for smaller businesses (21 U.S.C. 364b(a), 364b(b)). The same section times that obligation: the Secretary shall publish a notice of proposed rulemaking not later than 2 years after December 29, 2022, and shall publish a final such rule not later than 3 years after December 29, 2022 (364b(c)). A cosmetic is adulterated if it has been manufactured or processed under conditions that do not meet the good manufacturing practice requirements of that section (361(f)). No such regulation is cited here, and the final-rule date in the statute has passed. The international cosmetics good manufacturing practice standard, ISO 22716, contains no clause using the word validation in any of its 262 clauses. Check the current state of that rulemaking at its source before you rely on any of this, because a regulation issued after the read date at the foot of this page would not appear here.

Certification schemes, which are the other half of the answer. A scheme binds you because you claimed it, not because Congress wrote it. The NSF over-the-counter drug good manufacturing practice standard states that manufacturing processes are validated to produce a product that consistently meets specifications, that successful and sufficient process validation has been performed for each drug product, and that validated processes are subject to documented continued verification confirming the process remains in a state of control (NSF/ANSI 455-4, 4.5.1, 4.5.1.2, 4.5.1.4). Its dietary supplement counterpart asks something different, and the difference is the point: manufacturing processes shall be designed to produce a product that consistently meets specifications (NSF/ANSI 455-2, 4.3.4). Designed, not validated. Neither standard’s own text names a number of batches. The over-the-counter drug clause does point outward, carrying FDA’s process validation guidance in the bracket that gives its basis; that guidance is not read here, and nothing on this page describes what it says.

Where three came from

Somebody told you three. Here is the sentence they got it from, and it is not in a regulation.

ICH Q7 is a harmonized guideline on good manufacturing practice for active pharmaceutical ingredients. Its scope clause says it applies to the manufacture of APIs for use in human drug products, and the same clause then narrows that considerably: it reaches sterile APIs only up to the point immediately prior to their being rendered sterile; it excludes all vaccines, whole cells, whole blood and plasma, blood and plasma derivatives, and gene therapy APIs; it does not apply to medical gases, bulk-packaged drug products, or control aspects specific to radiopharmaceuticals; and it does not apply to steps prior to the introduction of the defined API starting material (ICH Q7, 1.3). Its introduction says that in the guide the word should indicates recommendations that are expected to apply unless shown to be inapplicable or replaced by an alternative demonstrated to provide at least an equivalent level of quality assurance (ICH Q7, 1.1).

Mark the standing before the number. ICH Q7 is not a United States regulation, and it is not a certification scheme you are audited against. It reaches you only where something else brings it: a marketing application you filed, a customer who wrote it into a contract, or a scheme you claimed that adopts it.

The clause everyone is quoting without knowing it reads: the number of process runs for validation should depend on the complexity of the process or the magnitude of the process change being considered; for prospective and concurrent validation, three consecutive successful production batches should be used as a guide, but there may be situations where additional process runs are warranted to prove consistency of the process, for example complex API processes or processes with prolonged completion times; and for retrospective validation, generally data from ten to thirty consecutive batches should be examined to assess process consistency, though fewer can be examined if justified (ICH Q7, 12.50).

Four things travel with that sentence and get dropped in the retelling. It is offered as a guide rather than a requirement. It is conditioned on complexity and on the size of the change before the number is even reached. It carries a second number, ten to thirty, that nobody quotes. And it was written for active pharmaceutical ingredient manufacture, inside the scope limits set out above.

The same guideline puts the obligation where it belongs. The validation protocol should specify the critical process steps and acceptance criteria, the type of validation to be conducted, and the number of process runs (ICH Q7, 12.21). It asks you to state a number. It does not hand you one.

The three-stage lifecycle framing you have read elsewhere, in which a process is designed, then qualified at performance, then verified continuously, is in none of the regulations read here: not in 21 CFR parts 106, 111, 117 or 211. Where a reader meets that framing, it is in guidance rather than in a rule, and that guidance is not read here, so nothing on this page describes what it says. What we can say is what FDA’s own regulation says about the standing of every guidance document it issues: guidance documents do not establish legally enforceable rights or responsibilities, and they do not legally bind the public or FDA (21 CFR 10.115(d)(1)). The same section adds that you may choose to use an approach other than the one set out in a guidance document, and that your alternative approach must comply with the relevant statutes and regulations (10.115(d)(2)). Reading a guidance is worth your time. Treating it as the rule is a different act, and it is the one that leaves you unable to say where your number came from.

Related reading on the third of those stages, and what actually sits behind it in the rules: what continued process verification is, and how to set one up and react to what it shows.

What the inspection record shows

FDA publishes its inspection observation records. Here is every clause in them that carries a process validation requirement, and what each one has been cited for.

For scale on that last row: part 111 carries 23,440 observations in the same record, across 454 distinct clauses. The clause that asks whether finished batches were verified against product specifications carries 519 observations across 519 inspections. The supplement rule is inspected hard. It is not inspected for process validation, because it does not ask for it.

Then the number this article is about. Across the whole record, 489 distinct observation texts use the word validation. Exactly one of them contains a count word, and it is a complaint record missing its lot number. Not one recorded observation text in the set asks a firm to justify how many validation runs it performed.

What these figures do not evidence. A count of citations against a clause is evidence that the clause gets cited. It is not a rate, because these are counts of observation rows and of the inspections they sit in, not of firms, and not of the inspections in which nothing was written. It says nothing about the quality of the validations that do exist, and a clause cited a thousand times for a validation being absent is not evidence that the validations that exist are unsound. The silence on batch count is evidence about the wording of FDA’s own recorded observation text, which is largely standardized, and not about what an investigator asks across a table during an inspection. Nobody should read it as an assurance that the question will not be put to them. Counted from FDA’s published inspection observation records, read August 18, 2026; fiscal year 2026 was still open at that date. The clause selection is ours.

Related reading on the same record read for a different subject: whether your cleaning validation survives an inspection, and where the hole is.

What you actually defend

Take the number out and read what each source asks for. They do not all ask for the same thing, and the difference is worth knowing.

• Drugs, a basis. Valid in-process specifications shall be consistent with drug product final specifications and shall be derived from previous acceptable process average and process variability estimates where possible, and determined by the application of suitable statistical procedures where appropriate (21 CFR 211.110(b)). And acceptance criteria for quality control sampling and testing shall be adequate to assure that batches meet each appropriate specification and appropriate statistical quality control criteria as a condition of their approval and release, with those criteria including appropriate acceptance levels, rejection levels, or both (211.165(d)).
• Food, evidence. Validation must include obtaining and evaluating scientific and technical evidence or, where such evidence is not available or is inadequate, conducting studies, to determine whether the preventive controls when properly implemented will effectively control the hazards (21 CFR 117.160(b)(2)).
• Dietary supplements, a documented basis. The subset of finished batches you verify is identified through a sound statistical sampling plan (111.75(c), 111.80(c)), and your basis for the in-process specifications behind it is documented and reviewed and approved by quality control personnel (111.70(c)(2), 111.105(c)).
• The API guideline, a stated number and an approval. This one is different, and we mark the difference rather than fold it in. A written validation protocol should be established specifying how validation will be conducted, and should be reviewed and approved by the quality unit or units and other designated units (ICH Q7, 12.20); the protocol should specify the type of validation and the number of process runs (ICH Q7, 12.21). It asks the protocol to state the number and to be approved. It does not, in those clauses, ask for a written derivation of the number itself.

So three of the four ask for a basis and the fourth asks for a stated number under approval. None of them is satisfied by three, because everyone runs three.

What follows is our own position rather than a requirement any of those clauses states. In our reading of validation packages, the ones that survive a hard question have four things written down: what the process has to deliver, what varies in it and by how much, what the run count is meant to detect, and what would have told you it did not. No clause above demands that page. It is simply the shortest document we know of that answers the question when it is asked.

Read the timing conditions too, because a number defended once is not defended forever. Under the food rule, validation must be performed or overseen by a preventive controls qualified individual, and the default timing is before implementation of the food safety plan. Only where it is necessary to demonstrate that the control measures can be implemented as designed does the later window open: within 90 calendar days after production of the applicable food first begins, or within a reasonable timeframe where that qualified individual prepares or oversees a written justification for exceeding 90 days. Validation is required again whenever a change to a control measure could affect whether it will effectively control the hazards, and whenever a reanalysis of the plan reveals the need (21 CFR 117.160(b)(1)). The API guideline takes the other side of the same point: systems and processes should be periodically evaluated to verify they are still operating in a valid manner, and where no significant changes have been made and a quality review confirms the process is consistently producing conforming material, there is normally no need for revalidation (ICH Q7, 12.60).

Related reading on the same argument moved to the equipment: how often you have to requalify, and how equipment is kept in a qualified state.

The pattern underneath it

This is not really a regulatory problem, and you will recognize it from outside compliance. Numbers in routine use often turn out to have no derivation behind them. They trace to a passing remark, to somebody’s recollection, to a figure its own setters called arbitrary, or to no requirement at all. Where a number has actually been traced, it usually proves real but arbitrary, an inherited convention rather than an invention. Limits get taken from what a process already achieves rather than from what the requirement demands, and acceptance criteria get settled by negotiation rather than calculated.

Three is that kind of number. It is real, it has a source, and the source is a guide inside a guideline written for a different product class. None of which makes three wrong for your process. It makes three undefended until somebody writes down why it is right for your process.

The same argument turns up wherever a number sits inside a validation package. Where a cleaning acceptance limit comes from is this argument about residue, and how to justify a sampling plan and frequency is this argument about sites and intervals.

Four things to check before your next validation

Take dated copies before you change anything. A validation protocol and its acceptance criteria are controlled records, and revising one is your own quality unit’s decision.

1. Find the sentence in your protocol that sets the run count, and read what sits after it. If the reason is that three is standard, that is the sentence to rewrite. If there is no reason at all, that is the finding you would rather make than have made for you.
2. Check which rule you actually cited. A supplement validation protocol citing the drug rule or a pharmaceutical guideline is citing something that does not reach it, and the clauses that do reach it, the specification and sampling clauses, are usually the thin part of the file.
3. Look for the variability estimate. The run count only means something against how much the process moves. If there is no statement of what varies, by how much, and from what data, the number has nothing to be derived from.
4. Ask what the number would have caught. Take a failure mode you actually worry about and ask whether the runs you planned would have detected it. If the honest answer is that they would not, the count is the wrong lever and the protocol is the thing to change.