Chain of Identity and Chain of Custody — The CMC System That Cannot Fail

In autologous cell therapy, chain-of-identity failure is not a quality event — it is a patient safety catastrophe. The CMC section that describes your CoI system is evaluated by CBER with that understanding.

Every autologous cell therapy product is, by definition, manufactured for a single, named patient. There is no second lot to pull if a mix-up is discovered post-infusion. When CBER’s Office of Therapeutic Products (OTP) reviews the CMC package for an autologous product — whether a CAR-T construct, a tumor-infiltrating lymphocyte (TIL) product, or a patient-specific dendritic cell vaccine — reviewers are not reading the chain-of-identity section as a procedural formality. They are evaluating whether the sponsor has built a system capable of preventing the irreversible harm that comes from infusing the wrong patient’s cells into the wrong patient. The regulatory consequence of an inadequate CoI/CoC description is a CMC deficiency letter; the clinical consequence of an inadequate CoI/CoC system is a patient death.

The Chain of Identity Framework: The Regulatory Requirement for Autologous Product Traceability

The regulatory foundation for autologous product traceability in the United States sits at the intersection of several distinct authorities. FDA 21 CFR Part 1271 establishes the tracking requirements applicable to human cells, tissues, and cellular and tissue-based products (HCT/Ps), requiring that sponsors be able to trace any HCT/P from the donor to its receipt by the consignee and, where applicable, to the point of administration. For cell therapy products regulated as biologics under CBER jurisdiction, this HCT/P traceability framework is layered on top of the cGMP expectations articulated in FDA’s Chemistry, Manufacturing, and Controls (CMC) Information for Human Gene Therapy INDs guidance (2020), which, while titled for gene therapy, governs the CMC expectations for all CBER-regulated advanced therapy products including autologous cell therapies. This dual-authority structure means that a CMC section describing chain-of-identity for an autologous TIL product must satisfy both the donor traceability records required under Part 1271 and the manufacturing control documentation expected by the 2020 CMC guidance — two distinct documentation requirements that address the same risk from different regulatory angles.

The practical implication for the CMC package is that a procedural description of how cells are labeled is insufficient. CBER expects to see evidence that the unique patient identifier system — whatever barcode, alphanumeric code, or RFID structure the sponsor has assigned — has been validated to prevent assignment errors and that the validation evidence, not just the procedure, is described or referenced in the submission. The FACT-JACIE International Standards for Hematopoietic Cellular Therapy, which have been cited by CBER reviewers in the context of autologous cell therapy inspections, require donor identification systems to include at minimum two unique identifiers at every point of custody transfer. A CMC package that references a single identifier — patient name, for example — without a secondary identifier and without validation evidence that the system performs correctly under failure conditions will generate a deficiency.

For products with EU clinical sites, the traceability requirement reaches a different scale entirely. EU Regulation 1394/2007 Article 15, which governs advanced therapy medicinal products (ATMPs) under EMA/CAT authority, mandates 30-year traceability of autologous and allogeneic ATMPs — from starting material collection through manufacturing to patient administration and long-term follow-up. A sponsor conducting a Phase II autologous TIL study at a site in Germany or the Netherlands must address in the CMC package how this 30-year traceability obligation will be discharged, including the document management system and retention schedule, not merely acknowledge that EU regulations apply.

Chain of Custody Controls: Logistics, Labeling, and the GMP Requirements for Patient-Specific Products

The chain-of-custody dimension of autologous cell therapy manufacturing begins not at the cleanroom but at the apheresis suite or operating room. For a TIL therapy product such as lifileucel — the first FDA-approved TIL therapy (BLA 125773, 2024) — the starting material is a surgically resected tumor specimen. The custody record for that specimen must capture the surgical site, the time of excision, the transport conditions from the operating room to the GMP facility, and the identity verification step at receipt. FDA’s Current Good Tissue Practice (cGTP) and Additional Requirements for Manufacturers of Human Cells, Tissues, and Cellular and Tissue-Based Products guidance (2011) specifies that the donor eligibility determination and relevant records must be maintained in a manner that permits traceability — and for autologous tumor-derived starting materials, the “donor” and the intended recipient are the same patient, which does not eliminate the documentation requirement; it concentrates the risk of any documentation failure onto a single irreplaceable individual.

Temperature monitoring during the apheresis-to-manufacturing or tumor-to-manufacturing shipment is a specific area of CBER scrutiny that many sponsors underestimate in their CMC packages. A batch record that documents receipt of the apheresis product at the manufacturing facility but does not describe the temperature monitoring device used during transit, the data record generated, and the out-of-specification response procedure will generate a deficiency. For cryopreserved apheresis products, the chain-of-custody record must capture the shipment temperature profile, not merely the condition of the product on arrival. This is not a theoretical concern: a leukapheresis product collected in excellent condition at an apheresis center that experiences a temperature excursion during overnight shipping to a centralized manufacturing facility may arrive with acceptable viability metrics but compromised expansion potential — a quality failure that is undetectable at receipt without a continuous temperature monitoring record showing when the excursion occurred and for how long.

Product labeling at the point of final container filling and release represents the highest-risk custody transfer point in autologous manufacturing. The label applied to the final cryopreserved product must match the patient identifier assigned at the start of the manufacturing run, and this match must be verified by a dual-person independent verification step — not a single review. A batch record in which label application and label verification are performed sequentially by the same operator fails this control, regardless of how well the procedure is written. CBER has documented this failure mode in inspection observations, and a CMC package that describes a label verification process without specifying dual-person verification will invite a deficiency inquiry.

The Chain of Identity Failure Modes That CBER Documents and the Patient Safety Consequences

The failure modes that produce CoI breakdowns in autologous cell therapy manufacturing share a structural characteristic: they are procedurally invisible until a specific error occurs that exposes the gap. Consider the following operational scenario. A CAR-T manufacturing facility is running six patient lots concurrently, each assigned a unique batch number. During the REP phase for a TIL product, a technician transfers the cell suspension from a G-Rex vessel into a final formulation bag and applies the pre-printed patient label from a label set stored beside the incubator. The label set for Patient A’s lot is stored in a bin directly adjacent to the label set for Patient B’s lot. The technician applies Patient B’s label to Patient A’s product. A single-person verification step — the technician checking their own work against the batch record — does not catch the error because the batch record also lists the technician as the preparer. The product is released, cryopreserved, and shipped to the clinical site under the wrong patient’s identity. This is not a hypothetical: it is the failure mode that CBER’s inspection program and the field of cellular therapy quality management have repeatedly identified as the proximate mechanism of most autologous product mix-ups.

The CMC package’s role in this failure scenario is not to describe what happened — it is to demonstrate, with validation evidence, that the system is structured to make this scenario impossible rather than merely unlikely. A procedure that says “label application shall be verified by a second qualified person” is not validation evidence. Validation evidence is a documented study demonstrating that the identifier system correctly prevents assignment under simulated failure conditions — wrong label presented, barcode scanner misread, two lots open in the suite simultaneously — and that the dual-person verification step is a structural control embedded in the batch record execution workflow, not an advisory step.

The EU traceability requirement under Regulation 1394/2007 Article 15 adds a documentation dimension that compounds the risk for globally operating sponsors. Failure to maintain 30-year traceability records for autologous ATMPs administered at EU clinical sites is not merely a post-marketing compliance gap — it is a CMC deficiency that can arise during MA application review if the CTD does not describe the traceability system with sufficient specificity to demonstrate that the 30-year obligation can actually be discharged. A sponsor that describes a document management system built only to the 10-year minimum retention period required domestically under 21 CFR 1271.55 — without addressing the additional 20 years required to satisfy the EU’s 30-year obligation under Regulation 1394/2007 Article 15 — has a structural gap in the CMC package that will surface in EMA/CAT review.

Building a CoI/CoC System That Structurally Prevents the Failures CBER Has Identified

The XGene Autologous Cell Therapy CoI/CoC Validation Architecture is a structured methodology for designing, documenting, and validating chain-of-identity and chain-of-custody systems for autologous cell therapy products — built specifically to meet CBER CMC submission standards and EMA/CAT ATMP traceability requirements.

1. Unique Identifier Architecture Design and Validation. Assign a primary and secondary patient-specific identifier at the point of apheresis or tumor collection, ensure both identifiers are encoded in the barcode or RFID label affixed to every container at every custody transfer point, and execute a validation study demonstrating that the system correctly rejects mismatches under simulated error conditions including scanner failure, simultaneous lot processing, and manual override scenarios. The validation report, not the SOP, is the CMC deliverable.

2. Dual-Person Verification Checkpoint Mapping. Map every custody transfer point in the manufacturing process — receipt of starting material, initiation of culture, final formulation, label application, cryopreservation, and product release — and for each point, document in the batch record template a mandatory dual-person verification field that cannot be bypassed or completed by the same operator who performed the preceding step. This structural embedding of the control in the batch record execution workflow, with audit trail documentation, is what CBER inspectors look for and what the CMC package must describe.

3. Temperature Monitoring Device Qualification and Data Record Integration. Qualify the temperature monitoring device used for apheresis-to-manufacturing and product-to-clinical-site shipments, establish out-of-specification temperature alert thresholds and response procedures, and integrate the continuous temperature monitoring data record as a required attachment to the batch record — not an optional quality document. The CMC package must identify the specific device, its qualification status, the data format, and the retention schedule.

4. 30-Year Traceability Documentation Architecture. For programs with EU clinical sites or anticipated EU marketing authorization, design a document management and retention system that addresses the 30-year obligation under EU Regulation 1394/2007 Article 15, specifying the record types, storage format (paper, electronic, hybrid), custodian responsibility, and recovery procedure for records that outlast the sponsoring organization’s current corporate structure.

The output of the XGene CoI/CoC Validation Architecture engagement is a pre-submission evidence dossier that maps each regulatory citation — Part 1271 donor traceability, cGTP 2011 shipping documentation, EU Regulation 1394/2007 Article 15 30-year retention, FACT-JACIE dual-identifier standards — to a specific validation report, batch record field, qualification document, or SOI record, producing not a gap list but a close-out package that preempts the deficiency cycle.

A CoI/CoC system described procedurally in the CMC package — without validation evidence, without dual-person verification mapped to batch record fields, without temperature monitoring device qualification — is a system that CBER reviewers will flag and that CBER inspectors will investigate. The cost of a CMC deficiency in this section is not merely a letter and a response cycle: it is a clinical hold risk, a program delay measured in months, and — in the inspection context — the potential for a Warning Letter finding tied to patient safety. For a Phase III autologous cell therapy program within 18 months of a BLA filing, discovering that the CoI validation package does not exist, or does not meet the specificity CBER requires, at the pre-BLA meeting is not a recoverable gap on a reasonable timeline. The sponsors who close this gap before the pre-BLA meeting are the ones whose CoI/CoC sections do not generate deficiencies.

For your autologous cell therapy program, can you identify today the specific validation report confirming that your chain-of-identity system prevents patient mix-up, the dual-person verification checkpoints documented in your batch record for label application and product release, and the temperature monitoring device and data record for the apheresis-to-manufacturing shipment for your most recent clinical lot?