FDA Warning Letter with a China Site: Run US CAPA and PRC Legal Tracks Together

Life Sciences & Healthcare Blog · Legal cluster hub

When an FDA Warning Letter names a China manufacturing or clinical site, the company must run two legal tracks at the same time: the US regulatory response and the PRC legal response. The two tracks have different deadlines, different legal frameworks and different risks, and they cannot be managed as one process. This article explains how to build a dual-track remediation plan that satisfies the FDA while protecting the company's position under PRC labor, evidence, drug administration and data protection law.

Why the dual-track structure is necessary#

The FDA Warning Letter typically follows an inspection that identified significant deviations from current good manufacturing practice, data integrity failures or quality system deficiencies at a China site. The company must respond to the FDA, usually within fifteen business days, with a comprehensive corrective and preventive action plan. At the same time, the facts that triggered the FDA findings may also implicate PRC regulators, employees and vendors. The same batch record that the FDA says was falsified may be the subject of an NMPA inspection, a labor dispute with the quality manager who signed it, or a criminal investigation into the falsification itself. A company that treats the Warning Letter as a purely US regulatory matter will discover, often too late, that its PRC actions have created new legal exposure.

The core risk is sequencing. US counsel will naturally want to gather facts quickly, interview employees and draft the CAPA. PRC counsel will caution that the same fact-gathering can trigger labor law obligations, evidence preservation duties and data protection restrictions. The two tracks must be coordinated so that the US timeline is met without violating PRC law, and so that PRC legal processes are completed without undermining the US response.

Statutory framework in the PRC#

Four areas of PRC law are directly relevant when a Warning Letter names a China site.

Labor Contract Law#

The PRC Labor Contract Law Article 39(2) permits summary dismissal without severance where an employee seriously violates the employer's rules and regulations, and Article 39(3) permits summary dismissal where an employee commits serious dereliction of duty or practices fraud causing major damage to the employer. In a Warning Letter context, the company may wish to dismiss the quality manager or other employees whose record falsification contributed to the FDA findings. The company must follow the statutory procedure: the dismissal must be based on rules that the employee has acknowledged, the union must be notified under Article 43, and the dismissal must be documented. A dismissal that skips these steps is unlawful, and the employee can claim reinstatement or compensation even if the underlying misconduct is proven.

Drug Administration Law#

The PRC Drug Administration Law Article 43 requires drug manufacturers and quality control personnel to comply with GMP requirements and maintain accurate and complete records. Article 124 establishes administrative penalties, including fines and license suspension, for record falsification and other violations. The FDA findings of data integrity failure are therefore likely to be relevant to NMPA as well. The company should proactively assess whether the same facts trigger obligations to report to NMPA, and should prepare for a potential joint or sequential inspection.

Personal Information Protection Law and Data Security Law#

The PRC Personal Information Protection Law Article 38 restricts cross-border transfer of personal information, requiring one of the statutory mechanisms: security assessment, certification or standard contractual clauses. The PRC Data Security Law Article 36 prohibits the provision of important data stored in China to foreign judicial or law enforcement agencies without prior approval. When US counsel requests employee records, laboratory data or quality documents for the FDA response, the company must determine whether the data is personal information or important data under PRC law and whether transfer to the US requires a mechanism or approval. In practice, much of the quality and batch data can be reviewed in-country by US counsel with a written analysis, avoiding transfer of raw personal data.

Enforcement context: the Shanghai Pudong labor case#

The interaction between foreign regulatory findings and PRC labor law is illustrated by a labor dispute decided by the Shanghai Pudong District Court in 2021. In that case, a quality assurance manager was summarily dismissed after a foreign agency audit exposed manufacturing record falsification. The court upheld the dismissal, ruling that GMP compliance forms a core duty of the employee's position and that falsification of quality records constitutes a serious violation of employer rules under Article 39(2) of the Labor Contract Law. The case is important for two reasons. First, it confirms that the company can lawfully dismiss employees whose misconduct is exposed by a foreign audit, provided the procedure is followed. Second, it confirms that courts will scrutinize whether the employer had a documented rule against falsification and whether the employee acknowledged it. A company that cannot produce the rule, the acknowledgment or the union notification will lose the case regardless of the underlying facts.

The dual-track timeline chart#

The practical deliverable is a timeline that aligns the US and PRC obligations. The chart has three phases.

Phase 1: Days 1-15 — FDA submission and evidence locking#

The FDA response is due within fifteen business days, and the company should use this window to do four things in parallel. First, convene the US and PRC counsel to agree on a single factual chronology. Second, issue a document hold that complies with both US litigation preservation expectations and PRC evidence rules; the hold must reach every employee who handled the affected batches, and must be documented. Third, begin the internal investigation with a privilege-aware plan, interviewing employees with counsel present and preserving drafts. Fourth, notify insurers and any contractual counterparties whose notices are triggered by the Warning Letter. The evidence locking is critical: once the FDA timeline starts, the company must not re-image computers, delete email or sanitize systems, because those actions would both undermine the FDA response and potentially violate PRC evidence rules.

Phase 2: Days 15-45 — PRC labor and regulatory process#

After the FDA submission, the company turns to the PRC track. If dismissals are contemplated, the company documents the rule basis, obtains the union notification required by Labor Contract Law Article 43, and executes the dismissals with proper payment calculations. If NMPA obligations are triggered, the company prepares a voluntary report or responds to any inquiry. The company also reviews vendor agreements: CROs, CDMOs and logistics providers whose conduct contributed to the findings may need to be investigated, and the company must preserve its contractual rights to recover damages or terminate for cause.

Phase 3: Days 45-90 — Remediation and monitoring#

The final phase is the implementation of the CAPA itself and the monitoring of the site's return to compliance. The company should document every corrective action with evidence, train affected staff, and prepare for a possible FDA re-inspection and an NMPA follow-up. Throughout this phase, the company maintains the separation between the US and PRC tracks, sharing only what each regulator is entitled to receive.

Data transfer and cross-border considerations#

The cross-border data question deserves particular attention. When the FDA requests documents that include employee names, salary information or personal health data, the company must evaluate the transfer under PIPL. The practical solution in most cases is a data room in China, with US counsel reviewing documents through a secure connection without transferring raw personal data. For important data under the Data Security Law, the company should consult counsel before any transfer to a foreign authority, and should never respond directly to a foreign subpoena or document request without a PRC legal assessment. The same discipline applies to data held by vendors: a CRO or laboratory in China cannot simply upload its records to the sponsor's US server because the sponsor asked for them.

What not to do#

Four mistakes are common and costly. First, re-imaging computers or sanitizing systems before a forensic hold is in place; this destroys evidence and invites obstruction findings. Second, firing scapegoats without the labor law process; an unlawful dismissal converts a manageable regulatory matter into a labor claim. Third, inventing a root cause for customers or distributors that contradicts the FDA narrative; inconsistent stories become the company's biggest liability in follow-on litigation. Fourth, treating the PRC track as secondary; the NMPA, the local market regulation authority and the labor arbitration commission are independent actors with their own agendas, and the company that ignores them pays twice.

The dual-track approach is not optional for companies that take the Warning Letter seriously. It is the difference between a contained regulatory event and a cascading set of liabilities across jurisdictions. Companies should also consider the impact of the Warning Letter on their commercial relationships. Hospitals and distributors in China routinely review a manufacturer's regulatory status, and a public Warning Letter can trigger contractual audit rights, supply suspension clauses or tender disqualification. In-house counsel should review the affected supply and distribution agreements early, identify the clauses that a Warning Letter activates, and prepare the customer communication plan with the same discipline applied to the regulator response. The communication plan must be consistent with the CAPA narrative, must not overpromise timelines, and must preserve the company's position if customers assert rights against it. This commercial track is often neglected because the regulatory deadline dominates attention, but it is the track that determines whether the company retains its market position after the regulatory matter is resolved.

Read next: FDA Warning Letter response · MDR/IVDR · Trial data red line

Part of the life sciences legal cluster · Life sciences blog