Section 506C Has Two Halves — Most Teams Have Only Built One

Section 506C of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. §356c) gets described, almost always, as a notification rule: tell FDA before you stop making a drug. That is half the statute. The other half — a standing, continuously maintained redundancy risk management plan under §506C(j), in force since September 23, 2020 — is not a notification at all. It is an operating requirement, and five years in, it remains the half most covered manufacturers have not actually built.

What the notification duty actually covers

Not every drug is in scope. Section 506C applies to a sole or primary manufacturer of a drug that is life-supporting, life-sustaining, or intended for use in the prevention or treatment of a debilitating disease or condition, approved under §505(b) or §505(j) of the FD&C Act. A parallel provision at 21 CFR 600.82 extends the same logic to biological products. Whether the underlying event is itself a reportable post-approval manufacturing change is a separate question from whether it also triggers 506C — a single manufacturing decision can hit both duties on different clocks, and treating them as one filing is how teams miss a deadline on the other.

Two trigger events, one clock

The statute recognizes two events: a permanent discontinuance, and an interruption in manufacturing likely to lead to a meaningful disruption in the drug's supply in the United States. Both run on the same six-month default. FDA can reduce that window for good cause, and where six months genuinely was not possible — a supplier failure, a contamination event, a sudden regulatory action — the agency still expects notice as soon as practicable, no later than five business days after the discontinuance or interruption occurs. That five-day fallback is not a grace period; it is the floor. Building the judgment call about which event you are facing into your CMC regulatory affairs process, before an interruption happens, is what keeps the fallback from becoming the default.

The notification duty tells FDA what already happened, or is about to. The redundancy plan is supposed to make the notification less likely to be needed at all. Why the two halves aren't interchangeable

The half that's easy to skip: §506C(j)

Section 506C(j) requires each manufacturer of a life-supporting or life-sustaining drug — and each manufacturer of an active pharmaceutical ingredient or associated medical device used to prepare or administer one — to develop, maintain, and implement a redundancy risk management plan for every establishment where that drug or ingredient is made. The plan has three required elements: a risk assessment, risk control measures, and a risk review. Risk control is where the substance lives — redundant manufacturing capacity, supply-chain controls, strengthened relationships with contract manufacturers and ingredient suppliers, and identified alternative suppliers. None of that is a filing you submit; it is an operating discipline FDA can ask to see, which is exactly why it gets built later than the notification process that has a form and a deadline attached to it. The overlap with supplier and vendor audits is direct: a redundancy plan without current supplier-risk data behind it is a document, not a control.

FDA's only guidance on what a compliant plan should contain is still in draft — issued in May 2022 and, as of this writing, not finalized. Treat the statute's three elements as the floor, and build toward the draft framework rather than a finished target; when it finalizes, the plan needs a review against whatever changed, not a rebuild from nothing.

None of this is exotic, but it is easy to under-scope: teams that already track post-approval reporting duties like the field alert report and annual report cadence tend to assume 506C sits on the same calendar and gets the same attention. It doesn't, by default — the redundancy plan has no submission deadline to force the issue, which is precisely why it is the piece still missing five years after it became law. Our FDA regulatory consulting team builds both halves together: the notification workflow and the standing plan behind it.