.webp)
.webp)
.webp)
.webp)
Traditionally, a company must hold a license in a state if it resides in, or ships product into, that state.
Accountability across the entire pharmaceutical supply chain has been growing, thanks in part to the federal implementation of the Drug Supply Chain Security Act (DSCSA). This has influenced states to look beyond the company on the label of the product to the company that physically manufactures it. Alabama, South Carolina, and Arizona are examples of these states.
In the case of a virtual manufacturer that partners with a Contract Manufacturing Organization (CMO), the state expects the CMO to hold a state license even if the CMO never ships product into the state.
Regulatory agencies are identifying unlicensed CMOs through the applications of virtual manufacturers. This documented partnership can trigger the state licensing agency to contact the CMO.
Some statutes reach any entity that ships a drug into the state or causes it to be shipped there. A board has little ability to inspect or discipline an out-of-state plant that holds no license with it. Requiring the virtual manufacturer to list its CMOs and show they are licensed brings those plants under the board's jurisdiction.
Ala. Code § 34-23-32(g) provides that no manufacturer, packager, repackager, third-party logistics provider (3PL), wholesaler, private label distributor, or similar entity identified in the supply chain of a legend drug may ship, or cause to be shipped, that drug into Alabama without a Board permit.
The Board applies this through the virtual manufacturer's application. A virtual company selling into Alabama applies for the Private Label Distributor (Virtual) permit, and must provide its CMO contracts and its 3PL contracts (Alabama Board of Pharmacy). The Board checks those partners for Alabama permits, and a U.S. CMO without one can delay its client's application.
A CMO whose product is distributed in Alabama through a virtual manufacturer should apply for Alabama's Manufacturer permit, which covers any facility that prepares, produces, compounds, or packages a drug. All permits expire December 31, and the Board reports average processing of about 90 business days for new applications.
Alabama requires applicants to provide proof of:
Since January 1, 2024, the facility's designated representative (DR) must also hold an Alabama DR registration.
South Carolina created a permit specifically for CMOs earlier this year. Since May 22, 2026, any company that manufactures, packages, or labels a finished drug or device to another party's specifications needs a Non-Resident Contract Manufacturer/Repackager Permit if that product enters South Carolina (LighthouseAI, July 2026).
The Board approved the requirement on June 18, 2025, and adopted it through rulemaking published in the State Register, Vol. 50, Issue 5.
On July 7, 2026, the Board asked CMOs that hold a South Carolina manufacturer permit and perform only contract work to contact it within 90 days to convert to the new permit type. That window closed on October 5, 2026. CMOs that do not yet hold a South Carolina permit must submit an application before June 30, 2027.
International CMOs are required to hold licensing as well. A South Carolina Board member confirmed in direct communication with LighthouseAI that the permit applies to both international and domestic CMOs whose products are distributed into South Carolina.
The application for virtual manufacturers requests:
Also, non-resident applicants meet with the Board's Non-Resident Application Review Committee in place of an on-site inspection.
A.R.S. § 32-1980(B), added by SB 1234 and signed June 21, 2024 (Laws 2024, Ch. 234), requires a virtual manufacturer of prescription drugs to contract with a drug manufacturer permitted by Arizona (Ch. 234 text). If a domestic CMO lacks an Arizona permit, its client cannot be licensed.
The Board applied this requirement before the statute passed. Beginning in 2019, it required U.S.-based CMOs to hold an Arizona manufacturer permit before it would license their virtual manufacturer clients, and it accepted an unredacted FDA inspection report from the past two years for international CMOs. SB 1234 codified the domestic requirement.
The Board's online application asks for each domestic CMO’s:
The CMO would need a nonresident manufacturer permit under A.A.C. R4-23-607.
The application states that contract manufacturers for virtual device manufacturers do not need Arizona permits (AZBOP application).
Arizona does not license international facilities, so an international CMO does not need an Arizona permit. The virtual manufacturer must instead submit the CMO’s FDA registration, inspection records, and 483 responses on the CMO’s behalf.
Under § 32-1980(A), a virtual manufacturer located in Arizona, or responsible for shipping prescription drugs or devices into the state, must make professionally reasonable efforts to ensure its CMO complies with current good manufacturing practice (cGMP).
Since 2019, Vermont has required U.S.-based CMOs to hold a Vermont license before it will license their virtual manufacturer clients, and it accepts a recent unredacted FDA inspection report for international CMOs.
New Hampshire requires licensure of virtual manufacturers, virtual distributors, brokers, and contract manufacturers that repackage or relabel. These details come from industry reports rather than board documents, so confirm them with each board.
CMOs should plan their licensing around where their clients' products are sold, not only where they ship.
Virtual manufacturers should address CMO licensing in the supply agreement, including which states the CMO will be licensed in and how quickly it must apply when a state is added.
Verify CMO licenses on each board's website before filing.
Maintain a single register of CMOs, 3PLs, and wholesalers with their license numbers by state, since states like Alabama, South Carolina, and Arizona request CMO details and, in some cases, 3PL details.
Document your CMO oversight procedures, which South Carolina requires and Arizona's cGMP provision supports.
Plan separately for international CMOs: Arizona does not license them, South Carolina's new permit covers them, and states differ on the evidence they accept instead.
State boards increasingly hold CMOs accountable for where their product goes. Alabama does it by statute, South Carolina through a dedicated CMO permit, and Arizona by refusing to license virtual manufacturers whose domestic CMOs lack an Arizona permit. Twelve states now require CMO licensure, and South Carolina’s 2026 rule and Arizona’s 2024 statute show the list is still growing.
The consequence for CMOs is that a client’s distribution plan is also a licensing plan. A missing permit in one of these states does not stop the CMO from operating, but it can stop its client from selling there. CMOs that track client distribution and apply ahead of launch remove that risk, and virtual manufacturers that put licensing obligations in their supply agreements avoid discovering the gap during their own application.
A virtual manufacturer’s application can put a CMO’s licensing status in front of a state board before the CMO knows a license is required. Knowing which states require licensure, including states where you never ship, turns that surprise into a plan.
LighthouseAI’s Rapid Assessments identify all state licensing requirements across all 56 US jurisdictions, combining software precision with the expertise of our state licensing professionals to ensure your licensing portfolio is complete and compliant.
Sandy Carter is Director of Intelligence, Research and Development at LighthouseAI with over a decade of experience in the pharmaceutical life sciences industry. She specializes in regulatory compliance research and analysis across the pharmaceutical sector. Sandy focuses on developing high-quality compliance insights and research methodologies that help organizations navigate complex regulatory frameworks and maintain compliance throughout the pharmaceutical supply chain.
.svg){kind=small}
