An operator fills a batch record field incorrectly. The deviation is opened, the investigation runs, and the conclusion arrives in the familiar shape: human error. The CAPA is retraining. The effectiveness check, scheduled thirty days out, confirms the operator was retrained. The deviation closes.
Fourteen months later, a different operator on a different shift makes the same entry error, and the whole sequence runs again.
Every quality professional recognizes this loop. What fewer people notice is that FDA has already written down, in detail, why it does not work – just not in a document most drug manufacturers ever read.
What FDA published, and what it is not
On 3 August 2026, FDA’s Center for Devices and Radiological Health reissued Applying Human Factors and Usability Engineering to Medical Devices, originally published in February 2016.
Two caveats worth stating plainly, because they shape how you should use it.
First, this is a device guidance. It sits under CDRH and speaks to design controls and premarket submissions. Since 2 February 2026, those requirements live in the Quality Management System Regulation, which incorporates ISO 13485:2016 by reference into 21 CFR Part 820. None of that binds a drug manufacturer running a deviation investigation.
Second, the 2026 revision is narrow. By its own guidance history, it updated definitions and the documentation section for consistency with a companion guidance, and deleted an appendix. This is not a new FDA position on human error. It is a housekeeping revision to a document that has been saying the same thing for a decade.
So why should a sterile fill-finish site care?
Because the guidance is the clearest existing statement of how FDA reasons about people making mistakes around regulated products. The logic does not stop at the device boundary. And measured against that logic, the standard pharma “human error” CAPA fails on its own terms.
FDA does not say “user error.” It says “use error.”
The vocabulary is the first tell. The guidance defines use error as a user action or lack of action that differed from what the manufacturer expected, produced a result the user did not expect, was not caused solely by device failure, and did or could result in harm.
Read that definition again and notice what is absent. There is no reference to carelessness, inattention, or competence. The error is defined by the gap between what the system expected and what the person did – not by a deficiency in the person.
This is deliberate. “User error” locates the fault in a human being. “Use error” locates it in an interaction. The guidance also carves out a separate category, abnormal use, for conscious deliberate acts that violate normal use and lie beyond reasonable design control. That distinction does real work: FDA is explicit that a manufacturer is responsible for foreseeable misuse, and only genuinely deliberate violation falls outside the design obligation.
If your investigations conclude “human error” at the same rate you would expect deliberate violation, something is wrong with the classification.
The hierarchy that should end the retraining reflex
The most useful thing in the guidance for a pharma audience is a ranked list it inherits from ISO 14971. Risk control options, in FDA’s stated order of preference and effectiveness:
- Inherent safety by design – connectors that cannot be attached wrongly, removal of features that can be mistakenly selected, improved readability of controls and labels, automation of error-prone manual tasks.
- Protective measures – interlocks, guards, warning screens, alerts for hazardous conditions.
- Information for safety – written warnings in the manual, and training users to avoid the error.
Training is not merely last. The guidance explains why it is last: addressing hazards by modifying design is usually more effective than revising labeling or training, because labeling may not be accessible at the moment of use, and training depends on memory, which may not be accurate or complete.
Now hold that against a typical pharma CAPA population. Retraining and SOP revision – options 3 and 3 – dominate. The two categories FDA ranks as more effective are the two that appear least often, because they cost money, require change control, and take longer than a thirty-day closure target.
The result is a CAPA system that systematically selects the least effective control available and then measures itself on closure timeliness.
“We will add training” is not an acceptable answer
This is where the guidance stops being philosophical.
In the context of a premarket submission, FDA states that if validation testing surfaces use errors on critical tasks, saying you will mitigate the risk by modifying instructions for use is not acceptable unless you supply additional test data demonstrating the modification actually reduced the risk. It says the same thing again about training: an intention to provide “additional training” is not acceptable without data showing it would be effective.
Translate that into deviation language and it reads: a corrective action is not credible until you have evidence it worked.
That is precisely what a CAPA effectiveness check is supposed to be. It is also precisely what most effectiveness checks are not. A check that confirms training records were completed is verification of implementation, not evidence of effectiveness. It answers “did we do the thing?” and not “did the thing work?”
FDA goes further still. It notes that finding serious use errors during validation testing may itself indicate that insufficient analysis and modification was undertaken earlier in development. The failure is treated as a signal about the quality of the preceding investigation – not just as a finding to be closed.
Training decays, and FDA says so out loud
Buried in the testing methodology is a sentence that ought to be read into every human error CAPA review. FDA advises that validation testing should not occur immediately after training, because retention of training decays over time. It suggests letting an hour pass in some cases, and one or more days in others, specifically where training decay is itself a risk to be evaluated.
Consider what that means for an effectiveness check performed thirty days after retraining, on the same operator, on a task performed twice a month. You are measuring recall under near-best-case conditions and calling it proof of a systemic fix.
The use environment is part of the design
The guidance requires manufacturers to characterize the environments where a device will be used, and its examples are worth reading with a cleanroom in mind:
- Lighting too low or too high to read displays or controls
- Noise levels that make feedback or alarms hard to hear or distinguish
- Multiple models of the same device or component in one room, making correct selection difficult
- Clutter, crowding, and competing activity that distract or overwhelm
- Vibration or motion that impairs fine motor control
Now describe an aseptic core. Vision restricted by a visor and reduced by glare off stainless steel. Constant HVAC noise under a hood. Double gloves eliminating tactile feedback and dexterity. Near-identical components staged within arm’s reach. Movement constrained by gowning and by the requirement not to disrupt first air.
Every one of the guidance’s environmental hazard categories is present in a Grade A/B environment – and the “user interface” is the equipment layout, the label design, the batch record structure, and the physical arrangement of the line. When an investigation concludes “operator technique,” it is describing an interaction between a person and all of that, and then assigning the whole interaction to the person.
Five things that transfer directly to a GMP investigation
Nothing here is binding on drug manufacturing. All of it is usable.
Stop writing “human error” as a conclusion. It is a description of what happened, not an explanation of why. FDA’s own framing treats it as the starting point of analysis, not the end.
Rank your CAPAs against the hierarchy. Pull twelve months of human-error CAPAs and classify each as design, protective, or informational. If the third category is most of them, you have quantified your own problem in a form leadership can act on.
Make the effectiveness check measure effect. Define the threshold before the data arrives – recurrence rate over a defined period, not training completion. A threshold set after you see the results is not a check; it is a justification.
Go and look. The guidance’s contextual inquiry method is Gemba by another name: observe representative users doing the real task in the real environment. Investigations conducted entirely from records cannot see the interaction that caused the error.
Record the close calls. FDA asks that instances where a user erred but recovered be captured and discussed. In pharma these are near misses that never generate a deviation and therefore never generate data – the richest available source of information about where your process is fragile.
The uncomfortable implication
If FDA’s reasoning is right – and it has been consistent on this for a decade – then a quality system whose dominant response to error is retraining is not preventing recurrence. It is documenting recurrence in an acceptable format.
That distinction is invisible in a metrics review, because closure rates look identical either way. It becomes visible in exactly one place: the recurrence rate, which is the only measure that cannot be satisfied by paperwork.
Most sites already have the data to find out. Very few have looked at it.
Source: Applying Human Factors and Usability Engineering to Medical Devices, FDA/CDRH, issued 3 August 2026 (originally 3 February 2016), docket FDA-2011-D-0469.
Related reading: Quality Investigations, CAPAs & Change Controls and the Rapid Diagnostic.