1What the two terms mean.
Chain of identity is the link between a patient or donor and their cells, kept through every step from collection to treatment. Chain of custody is the continuous record of who had charge of the material from its origin to its final disposition. In autologous therapy, the cells go back to “the individual from whom the cells or tissue were recovered”.¹
21 CFR Part 1271 doesn’t use either phrase. FDA’s January 2024 guidance on CAR T cell products uses chain of identity and ties it to the regulations: “To maintain the Chain of Identity (COI), labeling and tracking of material, from collection all the way through CAR T cell administration, must be documented (21 CFR Part 1271 Subpart D).”²¹
The Foundation for the Accreditation of Cellular Therapy (FACT) added both terms to the third edition of its Common Standards for Cellular Therapies, using the definitions of the multi-stakeholder Chain of Identity/Chain of Custody Working Group of the Standards Coordinating Body.³
| Term | FACT definition |
|---|---|
| Chain of identity | “The permanent and transparent association of a cell or gene therapy’s unique identifiers from procurement of tissue or cells throughout the full product(s) lifecycle including post treatment monitoring.” |
| Chain of custody | “Concurrent, permanent, auditable documentation illustrating the guardianship of a cell or gene therapy product from its origin through its final disposition.” |
FACT accredits facilities against these standards; they are not regulation. They also call for an annual audit of the chain of identity and chain of custody of cellular therapy products.³
2What US regulations require.
Part 1271 sets the requirements both chains rest on. It applies directly to HCT/Ps regulated under section 361 of the PHS Act. HCT/Ps regulated as drugs or biological products under section 351, such as CAR T cells, must also comply with its donor eligibility rules in subpart C and its current good tissue practice rules in subpart D, alongside the drug CGMP regulations.¹⁴²
| Section | Requirement |
|---|---|
| 1271.290(b) | A tracking system that follows every HCT/P from the donor to the consignee or final disposition, and back from the consignee to the donor. |
| 1271.290(c) | Each HCT/P is assigned and labelled with a distinct identification code that relates it to the donor and to all its records. The code may not include a name, social security number or medical record number, except in the cases in 1271.55(a)(1), which include autologous donations. |
| 1271.290(d) and (e) | A method for recording the code and type of each HCT/P sent to a consignee, and for documenting each HCT/P’s disposition. |
| 1271.250(a) and (b) | Labelling procedures designed “to ensure proper HCT/P identification and to prevent mix-ups”, including verification of label accuracy, legibility and integrity. |
| 1271.265(b) and (d) | Shipment within or between establishments before the HCT/P is available for distribution goes in quarantine, in packaging that protects the HCT/P, under shipping conditions set for each type. |
| 1271.265(c) | Before distribution, manufacturing and tracking records are reviewed and a responsible person documents and dates the release. |
| 1271.265(e) | Receipt, shipment and distribution are documented with the HCT/P’s identification, the activities and results, dates, quantity and disposition. |
| 1271.90(c)(1) | An HCT/P stored for autologous use is labelled “FOR AUTOLOGOUS USE ONLY”. |
The tracking requirement exists “to facilitate the investigation of actual or suspected transmission of communicable disease and take appropriate and timely corrective action” (1271.290(a)).¹
3What FDA recommends for CAR T cells.
FDA’s CAR T guidance, which contains nonbinding recommendations, adds specific controls for autologous products.²
- Labels should carry “at least two unique identifiers”, with label checks built into the batch record before each processing step.
- The chain of identity should be maintained at the clinical site “with two independent patient and label checks at bedside”.
- The final product label should include at least two unique identifiers to confirm patient identification before administration, in addition to the “FOR AUTOLOGOUS USE ONLY” statement that 21 CFR 1271.90(c)(1) requires.
- HLA typing is not a sufficient identity test and “will not replace requirements for maintaining chain of identity”.
- Shipping of leukapheresis starting material should be controlled, for example for temperature, and the shipping process validated for licensure.
4What EU rules require.
In the EU the obligation is called traceability, and it is law. Article 15 of Regulation (EC) No 1394/2007 requires the marketing authorisation holder of an advanced therapy medicinal product (ATMP) to keep a system by which the product and its starting and raw materials “can be traced through the sourcing, manufacturing, packaging, storage, transport and delivery” to the hospital where it is used. The hospital keeps its own system “to allow linking of each product to the patient who received it and vice versa”. The holder keeps the data for at least 30 years after the product’s expiry date.⁵
The European Commission’s GMP guidelines for ATMPs, which manufacturers were to comply with by 22 May 2018, put this into manufacturing.⁶
- A bidirectional tracking system, manual or electronic, follows cells and tissues from donation through manufacturing to delivery to the recipient, from the first batches made for clinical use (6.35).
- The manufacturer keeps the donation identification code and its own internal code for the cells throughout manufacture, and “the link between the internal code and the donation identification code can always be established” (6.37).
- Traceability data should be accessible rapidly in case of an adverse reaction (6.39).
- Concurrent production of two different ATMPs or batches in the same area is not acceptable, with limited exceptions for closed systems (4.18 and 4.19).
- Particular attention goes to preventing “mix-ups of autologous products and other dedicated products” in storage (9.87).
EMA’s guideline on investigational ATMPs, in effect since 1 July 2025, asks for the same bidirectional traceability from donor to recipient in clinical trials, through a coding system that respects data protection law, with data kept for 30 years.⁷
5How it runs in Seal.
In Seal, autologous cell therapy manufacturing runs each patient’s therapy as one governed case created by the treatment order. Chain of identity relates the patient, collection, starting material, every intermediate and sample, the final product, the shipment and the treatment-centre handoff; chain of custody records who held each physical object, where, when and in what condition. At every critical handoff the expected identifiers and the physical object are verified, and a mismatch blocks normal progression and opens containment. Reprinting, relabelling and manual recovery keep the prior value and the reason for the change. Operational views use controlled pseudonymous identifiers, and access to protected identity is audited.
Patient orchestration runs the clinic workflow on the same platform: treatment orders, collection booking, identity and custody, and reviewed milestone updates linked to the batch, QC and release records behind them.
References
- 121 CFR Part 1271, Human Cells, Tissues, and Cellular and Tissue-Based Products, sections 1271.1, 1271.3, 1271.55, 1271.90, 1271.250, 1271.265 and 1271.290, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- L/ part- 1271 (read 6 November 2026) - 2Considerations for the Development of Chimeric Antigen Receptor (CAR) T Cell Products, Guidance for Industry, sections IV.B and IV.C, FDA, January 2024. https:/
/ www. fda. gov/ media/ 156896/ download (read 6 November 2026) - 3Summary of Changes, Third Edition FACT Common Standards for Cellular Therapies, STS.RES.5.016 R3, FACT, 6 April 2023. https:/
/ www. factglobal. org/ media/ eb2jokew/ sts- res- 5- 016_ summary- of- changes- third- edition- fact- common- standards- for- cellular- therapies_ r3_ 07apr2023. pdf (read 6 November 2026) - 421 CFR 210.1, Status of current good manufacturing practice regulations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 210/ section- 210. 1 (read 6 November 2026) - 5Regulation (EC) No 1394/2007 on advanced therapy medicinal products, Article 15, EUR-Lex, 13 November 2007. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:32007R1394 (read 6 November 2026) - 6Guidelines on Good Manufacturing Practice specific to Advanced Therapy Medicinal Products, C(2017) 7694 final, European Commission, 22 November 2017. https:/
/ health. ec. europa. eu/ document/ download/ ad33d9dd- 03f0- 4bef- af53- 21308ce2187d_ en?filename=2017_ 11_ 22_ guidelines_ gmp_ for_ atmps. pdf (read 6 November 2026) - 7Guideline on quality, non-clinical and clinical requirements for investigational advanced therapy medicinal products in clinical trials, EMA/CAT/22473/2025, EMA, 20 January 2025. https:/
/ www. ema. europa. eu/ en/ documents/ scientific- guideline/ guideline- quality- non- clinical- clinical- requirements- investigational- advanced- therapy- medicinal- products- clinical- trials_ en. pdf (read 6 November 2026)
AQuestions and answers
Is chain of identity a regulatory term?
FDA uses it in its CAR T cell guidance, but 21 CFR Part 1271 doesn’t define it. The regulation requires a tracking system, a distinct identification code linking each product to its donor and records, and labelling controls that prevent mix-ups. EU law uses the word traceability for the same obligation.
Why does chain of identity matter more for autologous therapies?
Each batch is made from one patient’s cells and can only go back to that patient. FDA recommends at least two unique identifiers on labels, label checks in the batch record before each processing step and two independent patient and label checks at the bedside, and EU GMP for ATMPs asks for particular care to prevent mix-ups of autologous products.
Can a patient’s name be used as the identifier?
Under 21 CFR 1271.290, the distinct identification code is created for tracking and generally may not include a name, social security number or medical record number. The exceptions, in 1271.55(a)(1), are autologous donations, directed reproductive donations and donations from first- or second-degree blood relatives. EU rules ask for a coding system that respects data protection law.
How long must traceability records be kept?
In the EU, at least 30 years after the product’s expiry date, under Article 15 of Regulation 1394/2007 and the ATMP GMP guidelines. The same 30-year period applies to investigational ATMPs unless the clinical trial authorisation requires longer.
Does HLA typing prove chain of identity?
No. FDA’s CAR T guidance says HLA typing does not detect the genetic modification, so it is not a sufficient identity test, and it does not replace the requirements for maintaining chain of identity.