# How a molecule becomes a legal drug: the approval-to-market compliance chain
In 2013, Johnson & Johnson agreed to pay over $2.2 billion to resolve allegations that it had marketed the antipsychotic Risperdal for uses the FDA (U.S. Food and Drug Administration) never approved. The drug itself was legal. The way it was sold was not. That gap, between having an approved product and running a compliant business around it, is where pharmaceutical companies most often get into trouble. This lesson walks the full chain: from clinical data to application to approval to the years of obligations that follow.
Before any application for marketing approval, a drug must pass through controlled clinical trials, typically Phase I (safety, small groups), Phase II (efficacy signal, larger groups), and Phase III (large-scale confirmatory trials). These are governed in the US by the FDA under the Federal Food, Drug, and Cosmetic Act (FDCA), and in the EU by the European Medicines Agency (EMA) under the Clinical Trials Regulation.
Companies must also follow Good Clinical Practice (GCP), an international ethical and scientific quality standard for designing and conducting trials, and Good Manufacturing Practice (GMP), which governs how the drug is physically produced. Failing GCP can invalidate years of trial data; failing GMP can halt a factory regardless of how good the science is.
Once trial data exists, the sponsor (the company owning the drug) files for approval. Two main pathways matter in the US:
Both require exhaustive data: manufacturing processes, labeling, safety and efficacy evidence, and facility inspection reports. The FDA's CDER (Center for Drug Evaluation and Research) reviews NDAs; CBER (Center for Biologics Evaluation and Research) reviews most BLAs.
In the EU, the equivalent is a Marketing Authorisation Application (MAA) submitted to the EMA, which issues a centralized authorization valid across all EU member states, a major structural difference from the US's single national regulator.
Timelines (estimates, as of 2025): standard FDA review targets around 10 months from filing acceptance; priority review (for drugs addressing unmet medical need) targets around 6 months. EMA's standard review clock is around 210 active days, often stretching to over a year in real calendar time with clock-stops for company responses.
Here is where many non-specialists misunderstand the system: approval means the FDA or EMA has agreed the drug can be marketed for a specific indication, in a specific population, at a specific dose, based on the data submitted. It does not mean unlimited commercial freedom.
Three constraints kick in immediately:
Labeling. The approved label defines exactly what claims a company can make. Marketing a drug for anything outside that label ("off-label promotion") to physicians is illegal, even though physicians themselves may legally prescribe off-label based on their own judgment. This asymmetry, doctors can prescribe off-label, companies cannot promote it, is the root of many enforcement actions, including the J&J case above.
REMS (Risk Evaluation and Mitigation Strategy). For higher-risk drugs, the FDA can require a REMS: special distribution controls, prescriber certification, or patient monitoring programs. Opioids like fentanyl products often carry REMS requirements restricting how pharmacies and prescribers handle them.
Post-marketing commitments (PMCs) and post-marketing requirements (PMRs). Approval is frequently conditional on the company running further studies, sometimes called Phase IV trials, to confirm long-term safety or efficacy in real-world use. Accelerated approvals (a faster pathway for drugs targeting serious conditions with unmet need, based on surrogate endpoints) almost always carry this obligation. If the confirmatory trial fails or is delayed, the FDA can withdraw approval, as happened with several accelerated-approval oncology indications in recent years.
Approval locks in a specific manufacturing process and facility. Any material change, a new factory, a new supplier of an active ingredient, requires FDA or EMA notification or re-approval depending on the change's significance.
Facilities remain subject to ongoing GMP inspections. An FDA Form 483 (a notice of observed violations following an inspection) or a Warning Letter can halt shipments even for an already-approved drug. This is why generic drug shortages sometimes trace back to a single overseas APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → (Active Pharmaceutical Ingredient) plant failing an inspection, not to any change in the drug's legal status.
Once a drug is on the market, companies must run pharmacovigilance systems: continuous monitoring, collection, and reporting of adverse events. In the US this feeds FAERS (FDA Adverse Event Reporting System); in the EU, EudraVigilance, managed by the EMA.
Serious unexpected adverse events typically must be reported within 15 calendar days of the company becoming aware of them. Failure to report promptly is itself a compliance violation independent of whether the drug caused the harm.
This is also where black box warnings (the FDA's strongest label warning, encased in a bordered box) get added after approval, based on accumulating real-world evidence, as happened with antidepressants and suicidality warnings in the mid-2000s.
For a readable primer on how this system fits together, the FDA's own overview is a solid starting point: FDA Drug Development and Approval Process.
Knowledge check
1. The Johnson & Johnson Risperdal case illustrates what core compliance principle?
2. A company is developing a monoclonal antibody therapy. Which US application pathway would it most likely use, and why?
3. Why does the lesson emphasize that failing GCP versus failing GMP creates different types of problems?
4. Select ALL correct answers about the phased structure of clinical trials.
Select all the correct answers.
5. Select ALL correct answers about the distinction between NDA and BLA pathways.
Select all the correct answers.
Three recurring failure patterns show up across enforcement history:
1. Off-label promotion. Sales reps pushing indications not on the label, often the single largest source of pharma settlements historically (Pfizer's Bextra case, GlaxoSmithKline's $3 billion 2012 settlement covering multiple drugs).
2. Failure to honor post-marketing commitments. Companies obtain accelerated approval, capture market sharemarket shareThe percentage of total industry sales your company captures in a given period. It measures competitive position relative to rivals in a defined market.View full definition →, then delay or under-resource the confirmatory trial.
3. Manufacturing drift. Plants that passed inspection at approval time degrade in practice, quality control shortcuts, unvalidated process changes, leading to recalls years later.
The compliance lesson generalizes: regulatory status is not a one-time badge, it is a continuously maintained condition, verified through inspections, filings, and monitoring that never really stop.
How Drugs Are Made: FDA Approval Process Explained
The EU's centralized procedure through the EMA means one approval can cover 27 member states, but pricing and reimbursement decisions remain national (Germany's G-BA, France's HAS, and others each negotiate separately). This means a drug can be legally approved across the EU while being commercially unavailable in specific countries for years due to separate pricing negotiations, a distinction worth remembering: regulatory approval and market access are not the same event.