No. Nothing in 21 CFR Part 211 requires three batches for performance qualification. The three-run convention is an industry practice that hardened into an assumption, and the FDA’s own process validation guidance moved away from it deliberately.
This matters commercially in both directions. Three runs on a highly variable process produces a validation report that will not survive its first out-of-specification result. Insisting on three runs for a well-characterized process on qualified equipment is an expensive ritual. Either position is defensible if the protocol argues it; neither is defensible if the protocol merely assumes it.
What the regulation actually says
| Citation | What it requires | What it does NOT say |
|---|---|---|
| 21 CFR 211.100(a) | Written procedures for production and process control, designed to assure identity, strength, quality and purity | Any number of qualification runs |
| 21 CFR 211.110(a) | In-process control procedures to monitor and validate performance | Any number of batches |
| 21 CFR 211.110(b) | In-process specifications consistent with drug product final specifications, derived from prior acceptable process average and variability | That “prior” means exactly three |
| 21 CFR 211.180(e) | Annual review of records for each product | That validation ends when the report is signed |
The phrase doing the work is in 211.110(b): specifications derived from process average and variability. That is a statistical statement, and how many runs it takes to characterize variability depends on how variable the process is. A number fixed in advance cannot answer a question about variability that has not been measured yet.
Where the number should come from instead
- Stage 1 knowledge. If process design established the sources of variability and their magnitude, fewer confirmatory runs are needed – the understanding already exists.
- Measured variability. A process with wide batch-to-batch variation needs more runs to make any statistical claim, not fewer.
- Risk to the patient. Higher-consequence products justify more evidence.
- Detectability. Where a failure would be caught reliably downstream, less front-loaded evidence is required than where it would not.
Write the justification into the protocol. An investigator asking “why three?” is entitled to an answer better than “that is what everyone does” – and a protocol that argues its number from variability is stronger evidence of process understanding than one that runs five without explaining why.
Where the convention came from
Three has no regulatory origin. It reflects an older validation model in which qualification was a discrete event to be passed rather than a lifecycle to be maintained, and three is the smallest number from which any trend can be inferred. The 2011 lifecycle guidance replaced that model with continued process verification – 211.180(e) makes the ongoing part binding, which is the half most programs still under-resource. A validation effort that stops when the report is signed has satisfied a convention and left a regulation unaddressed.
Fuller treatment in what is process validation and IQ/OQ/PQ requirements.
Get a single-source quote
Related questions
Is the three-batch rule for PQ required by the FDA?
No. It appears nowhere in 21 CFR Part 211, and FDA process validation guidance explicitly moved away from a fixed number toward a justification based on understanding of process variability. Three batches remains extremely common practice, and it is defensible – but only when the protocol argues why three is sufficient for that particular process rather than treating it as a given.
How many PQ runs do I actually need?
Enough to support a statistical claim about the process, which depends on its measured variability, the knowledge carried forward from process design, the risk to the patient and how detectable a failure would be downstream. A well-characterized process on qualified equipment may justify fewer runs; a variable process may need more. The number belongs in the protocol with its reasoning attached.
Does validation end when the PQ report is signed?
No, and this is the more consequential misunderstanding. 21 CFR 211.180(e) requires an annual review of records for each product to determine whether specifications or procedures need changing, and the FDA lifecycle model treats continued process verification as an ongoing stage. A program that stops at the report has satisfied an industry convention while leaving a binding requirement unaddressed.
Where does the three-batch convention come from?
From an older validation model that treated qualification as a discrete event to be passed rather than a lifecycle to be maintained, in which three is simply the smallest number of points from which any trend can be inferred. It has no regulatory origin and never did. It persists because it is familiar and because nobody is penalized for over-testing.
Qualification support
We write and execute qualification protocols against acceptance criteria your quality unit approves, and produce the raw data and objective evidence behind them. On the three-batch question specifically, the useful support is helping justify the number of runs from process understanding and variability rather than defaulting to three, since current FDA process validation guidance expects a science and risk-based rationale rather than a fixed count. Protocol approval and product release remain yours.