FDA Post-Approval Changes: What Actually Sorts a CBE-30 From a PAS

21 CFR 314.70 requires every holder of an approved NDA or ANDA to report a post-approval manufacturing, facility, or process change — and it sorts every one of those changes into one of four tracks. CMC teams often treat those four tracks as a menu: pick the one that gets the change out fastest. They aren't a menu. They're the output of a single legal test — the change's potential to adversely affect the drug's identity, strength, quality, purity, or potency — and the test picks the track, not the team.

One test, four tracks

Section 506A of the Federal Food, Drug, and Cosmetic Act, implemented through 314.70, asks a single question of every post-approval change: what is its potential to have an adverse effect on the drug's identity, strength, quality, purity, or potency? The answer — minimal, moderate, or substantial — is what FDA's guidance calls a major, moderate, or minor change, and that risk tier determines the filing track. Teams that start from "which track do we want" rather than "what is this change's actual risk" are answering the question backward, and it shows up later when a reviewer disagrees with the category on file.

The four tracks, in risk order

Read top to bottom, the tracks run from least to most oversight — and the risk test, not the paperwork burden a team would prefer, is what places a given change on this list.

• Prior Approval Supplement (PAS). Substantial potential to adversely affect identity, strength, quality, purity, or potency. The applicant must submit the supplement and receive FDA approval before distributing any product made using the change.
• CBE-30. Moderate potential for an adverse effect. Distribution can begin 30 days after FDA receives the supplement, unless FDA objects — a default track for moderate changes that don't fall into the CBE-0 carve-out.
• CBE-0. A narrower exception inside the moderate tier: a specifically enumerated set of changes — most notably certain safety-related labeling strengthenings under 314.70(c)(6)(iii) — that can take effect immediately, on FDA's receipt of the supplement.
• Annual Report. Minimal potential for an adverse effect. The applicant documents the change in the drug's next annual report rather than filing a supplement in real time.

A CBE-30 is not FDA agreeing with you. It is FDA choosing not to object in the window you gave it — and the agency's authority to revisit that choice doesn't expire with the 30 days. Why a CBE-30 filing isn't the finish line

What a CBE-30 actually commits you to

The most common practitioner mistake isn't misjudging the initial risk tier — it's treating a CBE-30 filing as functionally equivalent to an approval once the 30 days pass without a response. It isn't. A CBE supplement is a notification: the applicant is telling FDA a change has been made (CBE-0) or will be made in 30 days (CBE-30), not asking permission. Within that window, FDA can tell the applicant the change actually needed prior approval, that required information is missing, or — if the agency later disapproves the supplement — can order the applicant to stop distributing product made with the change. Silence is permission to proceed, not a determination that the category was correct.

1. Apply the adverse-effect test first. Judge the specific change's potential effect on identity, strength, quality, purity, or potency before reaching for a track label.
2. Check for a CBE-0 carve-out. Don't assume a moderate-risk change qualifies for immediate effect — CBE-0 is a specifically enumerated list, not a lower rung of CBE-30.
3. File and track the clock. For a CBE-30, monitor the 30-day window for an FDA objection rather than treating the filing itself as the obligation discharged.
4. Reassess if scope shifts. A change that expands during implementation — a second site added, a wider specification range — can move into a higher-risk category than the one it was filed under.

Where teams get the category wrong

The failure pattern is rarely a team ignoring 314.70. It's a team anchoring the category to how the change was described internally — "just a supplier change," "a minor equipment swap" — rather than to what the change does to the product's identity, strength, quality, purity, or potency. A raw-material supplier change that also shifts an impurity profile, an equipment change that alters a critical process parameter, or a specification widening that looks administrative but actually loosens a quality attribute can each carry more risk than the label the team gave it internally suggests. This is exactly the gap a comparability protocol negotiated in advance is built to close for a defined, recurring change — but a comparability protocol only helps the changes it was written for. Every other change still needs the 314.70 test run fresh, on its own facts, every time.

None of this is exotic. It's a bounded, repeatable judgment: state the change precisely, apply the adverse-effect test to that precise change, check the narrow carve-outs before defaulting to the moderate track, and document why. Companies that treat 314.70 as a form-selection exercise get the category wrong exactly where it costs the most — on the changes that looked routine internally and weren't. If your internal change control process classifies changes before regulatory affairs reviews the actual risk, that ordering is worth revisiting; our CMC regulatory strategy work exists for exactly this gap.