How the FDA Regulates and Approves Vaccines

Vaccine regulation in the United States sits at the intersection of biologics law, clinical science, and public health emergency preparedness — making it one of the most technically demanding areas of FDA oversight. This page covers the full regulatory pathway from preclinical development through post-market surveillance, the statutory and structural framework that governs each stage, and the points of genuine complexity where scientific rigor and public health urgency create institutional tension. The FDA's vaccine regulation and approval framework applies to all vaccines licensed for use in the United States, regardless of manufacturer origin.

• Definition and scope
• Core mechanics or structure
• Causal relationships or drivers
• Classification boundaries
• Tradeoffs and tensions
• Common misconceptions
• Checklist or steps (non-advisory)
• Reference table or matrix

Definition and scope

Vaccines licensed in the United States require approval through one of the most intensive regulatory processes FDA administers. Unlike small-molecule drugs, which are regulated primarily under the Federal Food, Drug, and Cosmetic Act (FD&C Act), vaccines are classified as biological products under Section 351 of the Public Health Service Act (42 U.S.C. § 262), which requires a Biologics License Application (BLA) rather than a New Drug Application (NDA). This statutory distinction carries operational consequences: manufacturers must demonstrate both product safety and efficacy and that manufacturing processes consistently yield a product meeting defined potency, purity, and identity standards.

The Center for Biologics Evaluation and Research (CBER) holds primary jurisdiction over vaccines within FDA. CBER's Division of Vaccines and Related Products Applications (DVRPA) conducts scientific review of BLA submissions, while CBER's Office of Compliance and Biologics Quality oversees manufacturing inspections. This dual-track review — product science and manufacturing compliance — distinguishes vaccine regulation from most other FDA-regulated product categories, including conventional pharmaceuticals reviewed by the Center for Drug Evaluation and Research.

The full regulatory lifecycle for a vaccine spans from preclinical testing in animal models through Phase I, II, and III clinical trials, BLA submission and review, manufacturing facility inspection, post-licensure surveillance, and lot release testing. Each stage has defined criteria that must be met before progression, and FDA retains authority to require lot-by-lot release testing for specific vaccines even after licensure — a power exercised for select biologics including influenza and rabies vaccines.

Core mechanics or structure

Preclinical phase. Before any human exposure, vaccine candidates undergo laboratory and animal studies to characterize immunogenicity, identify a plausible mechanism of protection, and establish a preliminary safety profile. FDA does not formally review preclinical data until an Investigational New Drug (IND) application is submitted, but preclinical findings directly shape the IND package.

IND application. Under 21 C.F.R. Part 312, the IND establishes FDA oversight before human testing begins. The IND must include preclinical data, proposed clinical protocols, investigator qualifications, and manufacturing information. FDA has 30 days to place a clinical hold or allow the IND to proceed.

Phase I (safety and dosing). Typically enrolling 20 to 100 healthy volunteers, Phase I evaluates safety, tolerability, and preliminary immunogenicity. Dose-escalation designs are common. Adverse event monitoring drives go/no-go decisions before Phase II entry.

Phase II (expanded safety and immunogenicity). Hundreds of participants receive the candidate vaccine to assess immune response magnitude, identify common adverse events, and refine the dosing schedule. Phase II data inform the pivotal efficacy trial design.

Phase III (efficacy). Large-scale randomized controlled trials — typically enrolling thousands to tens of thousands of participants — establish whether the vaccine reduces disease incidence in the target population. FDA requires that a vaccine demonstrate at least 50% efficacy in preventing the target disease in the primary endpoint analysis as a minimum threshold for licensure consideration, consistent with FDA's Guidance for Industry: Development and Licensure of Vaccines to Prevent COVID-19. Statistical powering and endpoint definition are negotiated with FDA before trial initiation via Special Protocol Assessment (SPA).

BLA submission and review. Following successful Phase III results, the sponsor submits a BLA containing all clinical, nonclinical, and manufacturing data. CBER's standard review timeline is 12 months; priority review (granted for vaccines addressing serious unmet medical needs) compresses this to 6 months. An FDA Advisory Committee — typically the Vaccines and Related Biological Products Advisory Committee (VRBPAC) — convenes to publicly evaluate the data and vote on whether evidence supports licensure. VRBPAC recommendations are not binding, but FDA departs from them only with documented scientific justification.

Manufacturing inspection. Before licensure, FDA inspects all manufacturing facilities under 21 C.F.R. Part 600. Facilities must comply with current Good Manufacturing Practice (cGMP) requirements. A single facility finding can delay licensure regardless of clinical trial outcomes. FDA's Good Manufacturing Practices framework applies fully to vaccine facilities.

Lot release testing. For certain vaccines, FDA's CBER tests each manufactured lot independently before it reaches the public. This is a legacy control for high-potency or high-risk biologics and remains active for products including live attenuated viral vaccines.

Causal relationships or drivers

Three structural factors explain why vaccine review is more intensive than most pharmaceutical reviews.

Biologics complexity. Vaccines are not single defined molecules. They contain living attenuated organisms, killed pathogens, recombinant proteins, lipid nanoparticles, adjuvants, or nucleic acids — all of which interact with manufacturing process variables in ways that affect the final product's immunological profile. A process change that appears minor can alter antigenicity. FDA therefore requires comparability studies whenever manufacturing changes occur post-licensure, under 21 C.F.R. § 601.12.

Population-level administration context. Vaccines are administered to healthy individuals, not patients with active disease. This shifts the benefit-risk calculus: an adverse event rate that would be acceptable for a cancer therapy is often not acceptable for a preventive product given to millions of healthy people. FDA's pre-market safety standards for vaccines therefore require detection of adverse events occurring at frequencies as low as 1 in 10,000 in Phase III trials.

Immunogenicity as a surrogate. For pathogens where large-scale efficacy trials are not feasible — because disease incidence is too low or outbreaks are unpredictable — FDA permits immunogenicity endpoints as surrogates for clinical protection, provided a correlate of protection has been established. The influenza hemagglutination inhibition (HAI) titer is the canonical example. This pathway accelerates annual influenza vaccine updates without requiring new efficacy trials each season.

Classification boundaries

Vaccines sit within a larger regulatory category — biological products — but occupy a distinct subcategory. The critical classification boundaries are:

Vaccines vs. therapeutics. Vaccines are prophylactic: they are administered before disease exposure. Therapeutic biologics administered after disease onset (e.g., monoclonal antibodies for treatment) follow different endpoints and benefit-risk frameworks even if they use similar platforms.

Licensed vaccines vs. Emergency Use Authorization (EUA). A BLA-licensed vaccine has completed full review and manufacturing inspection under the standard statutory pathway. An Emergency Use Authorization is a separate mechanism under Section 564 of the FD&C Act that permits use before full licensure when the HHS Secretary has declared a qualifying emergency. EUA products must meet the statutory standard of "may be effective" — a lower evidentiary bar than the "safe and effective" standard required for full licensure.

Vaccines vs. allergen immunotherapy. Allergen extracts used in immunotherapy are also regulated by CBER but under a separate product category with distinct potency standards and lot release requirements. The two categories are not interchangeable in regulatory treatment.

Combination vaccines. Vaccines that prevent more than one disease in a single formulation — such as MMR (measles, mumps, rubella) — require demonstration of immunogenicity and safety for each component. These are reviewed under CBER's combination product protocols and are distinct from FDA combination products regulation addressing device-biologic or device-drug combinations.

Tradeoffs and tensions

Pre-market thoroughness vs. speed. Large Phase III trials require years of enrollment and follow-up. For pathogens causing active outbreaks, the time required for full licensure may result in preventable deaths during the review window. The EUA mechanism partially addresses this, but it introduces a separate tension: products authorized under EUA lack the complete safety database that full licensure requires, and public communication of this distinction has historically been difficult.

Surrogate endpoints vs. clinical outcomes. Reliance on immunogenicity surrogates accelerates approval but introduces uncertainty. A vaccine that achieves the target HAI titer may still underperform clinically if the correlate of protection is imprecise or if the circulating strain drifts from the strain used in the immunogenicity study. FDA's accelerated approval pathways framework acknowledges this tradeoff explicitly.

Advisory committee independence vs. institutional authority. VRBPAC meetings are public, and votes are recorded. When FDA acts contrary to an advisory committee majority vote, the decision attracts scrutiny from Congress, academic researchers, and the press. This dynamic creates institutional pressure that can cut in both directions — toward premature approval or toward excessive caution — depending on the political environment at the time of review.

Post-market surveillance limitations. Pre-licensure trials, even at 30,000+ participants, cannot detect adverse events occurring at rates below approximately 1 in 10,000. Rare adverse events are only detectable through post-market systems including the Vaccine Adverse Event Reporting System (VAERS) and the Vaccine Safety Datalink (VSD). VAERS accepts reports from any source and does not establish causation; this architectural feature of the system is the source of persistent public confusion (addressed below).

Common misconceptions

Misconception: VAERS reports establish that a vaccine caused an adverse event. VAERS is a passive surveillance system that accepts unverified reports of adverse events following vaccination. A VAERS report documents temporal association — the event occurred after vaccination — not causal attribution. FDA and CDC both document this limitation on the VAERS website. Signal detection from VAERS requires follow-up investigation through active surveillance systems such as VSD before causation is assessed.

Misconception: FDA approval means a vaccine has no risks. FDA's standard is "safe and effective" — meaning the demonstrated benefits outweigh the demonstrated risks for the intended population. Every licensed vaccine has a prescribing label documenting known adverse reactions, contraindications, and warnings. The existence of risks does not indicate a regulatory failure; it reflects the statutory standard's benefit-risk framing.

Misconception: Accelerated approval pathways bypass safety review. Pathways such as Breakthrough Therapy designation or Priority Review compress review timelines but do not eliminate any required data submission. Priority Review shortens CBER's review clock from 12 months to 6 months but does not reduce the data requirements for licensure. Only EUA operates under a modified evidentiary standard.

Misconception: All vaccines are approved the same way regardless of platform. Platform technology matters. mRNA vaccines, live attenuated vaccines, viral-vectored vaccines, and protein subunit vaccines each carry platform-specific preclinical requirements, stability testing protocols, and manufacturing controls. CBER issues platform-specific guidance documents that shape the development program from the IND stage onward.

Checklist or steps (non-advisory)

The following sequence maps the formal FDA-required stages for vaccine licensure under 21 C.F.R. Parts 312 and 600–680:

1. Preclinical studies completed — animal immunogenicity and toxicology data characterizing the candidate
2. IND submitted to CBER — includes proposed Phase I protocol, manufacturing information, and preclinical data package
3. FDA 30-day review window — clinical hold issued or trial proceeds
4. Phase I trial initiated — safety and dose-finding in ≥20 healthy volunteers
5. Phase I data reviewed — CBER reviews safety data; Phase II protocol submitted as IND amendment
6. Phase II trial initiated — expanded immunogenicity and safety assessment
7. Special Protocol Assessment (SPA) requested — Phase III endpoints and statistical plan agreed with FDA before enrollment
8. Phase III efficacy trial conducted — randomized controlled design with pre-specified primary endpoint
9. BLA submitted — complete clinical, nonclinical, manufacturing, and labeling package filed with CBER
10. PDUFA review clock begins — 12-month standard review or 6-month priority review
11. VRBPAC advisory committee convened (if applicable) — public meeting with recorded vote
12. Manufacturing facility inspection completed — cGMP compliance verified at all production sites
13. FDA action letter issued — Approval (license granted), Complete Response Letter (deficiencies identified), or refuse-to-file determination
14. Post-market surveillance initiated — VAERS reporting obligations begin; VSD enrollment and lot release testing continue per license conditions

Reference table or matrix

For a broader view of how vaccine oversight fits within the FDA's organizational structure, the FDA centers and offices reference page covers CBER's mandate alongside the agency's other major operational units. A full summary of the agency's regulatory scope is available from the FDA authority overview.