TL;DR: Of the therapies the FDA approved in 2024, 74% had their active ingredient made by someone else and 61% had their finished dose made by someone else. For small-biopharma innovators the figures were 85% and 77%, both record highs. The strain inside that dependency falls unevenly: it concentrates where unit operations repeat least, capital structure determines what a CDMO is allowed to turn down, and geography has been reshuffled by a statute that passed in December and has not yet taken effect. If you are choosing a CDMO, ask how long the senior QA requisition has been open. It will tell you more than the capacity slide or the price.
This is part two of a five-Thursday series on the CDMO industry. Part one laid out the three-list selection mechanism and the math that inverted at the end of 2022. This piece is about what the headline fragmentation number hides. Upcoming Thursdays: the challenges and trappings of growth, what CDMO leadership actually develops, and the large brand CDMO problem.
Last time I described a structural mismatch. Ten clients with four programs each became forty clients with one program each. Same program count, four times the methodological complexity. The strain lands on the systems (tech transfer, analytical, change control, quality assurance) rather than on the suites.
The arithmetic holds. What it does not tell you is where the strain actually lands, and that varies more than a single number can carry: by modality, by who owns the balance sheet, and by a statute that passed in December and has already moved demand around the map.
A CDMO is a repetition business. Margin comes from doing the same unit operation enough times that it stops surprising you. Fragmentation attacks repetition unevenly, because modalities differ in how much of the work is standard. A small-molecule oral solid dose site can absorb a higher client count than a viral vector site: the unit operations are more reproducible, the methods more standardized, the regulatory precedent deeper. Sterile fill-finish sits in the middle. A cell or gene therapy site cannot run forty clients without breaking the comparability case for every one of them.
Be careful here, because this is where the industry lies to itself with numbers. There is no published batch-failure rate for AAV or lentiviral drug substance, and none for oral solid dose to compare it against. Anyone quoting you a per-modality complexity ratio is quoting a vendor page. What does exist is narrower. The Alliance for Regenerative Medicine and the ASGCT, in a 2022 workshop paper written with FDA participants in the room, describe cell and gene therapies as an order of magnitude more complex than small molecules and protein biologics.
The delivery evidence points the same way, though it has to be read carefully. A UK national panel followed 981 lymphoma patients approved for CAR-T and recorded manufacturing failure in 38 of them, 3.87%. The cilta-cel pivotal trial carried an 18% manufacturing failure rate, printed on the FDA-approved label. Those two figures are not a before and after of the same process. Different products, different patient populations, different eras, different denominators. What they jointly establish is narrower and enough: manufacturing failure in autologous cell therapy is a routine, measurable event, and it is not one in oral solid dose.
Most of the mid-size CDMOs I work with are sponsor-owned. In the modelling that precedes a deal, an ideal utilization rate gets identified. It is the number that makes the returns work on paper, and it is arrived at before anyone knows which programs will actually walk through the door. In some places it hardens into something closer to a promise between the chief executive and the backer. Either way, it becomes the number the chief executive is measured against, and that is where the pressure comes from.
Being measured against a rate that was set before the client base existed puts a poorly fitting program on one side of the decision and, on the other, the number they are judged by. Every program they decline widens a gap they are accountable for closing. The revenue arrives this quarter. The platform damage arrives in eighteen months, in somebody else's reporting period, described in language the board will need a translator for.
So when a chief executive argues for selectivity, what they are really asking for is to protect the long-term vision when many PEs are focused on the short-term business. Understandably, this is a hard task, and it explains why the argument so often loses. When it gets won, it tends to be won by changing the unit of measurement itself, from suite occupancy to gross margin contribution per suite-month. Boards can be resistant to this, but they get there eventually. In more cases than not, they get there after a warning letter has already made the argument for them.
There is also a structural input. Much of the capacity now under strain was created by Big Pharma divesting internal manufacturing: Roche sold Genentech's Vacaville site to Lonza for $1.2 billion, and AstraZeneca, Novartis, GSK and Sanofi did versions of the same thing. Those assets were stable when their owners ran them with a narrow product set. And the traffic now runs both ways. Novo Holdings took Catalent private for roughly $16.5 billion, and Novo Nordisk immediately took three fill-finish sites for $11 billion upfront to run captive. Eli Lilly bought the Nexus injectables site for $924.7 million and does no contract work there at all. Sponsors are buying capacity out of the merchant market at the exact moment that market is most fragmented.
BIOSECURE was signed on 18 December 2025, as Section 851 of the FY2026 defense authorization. It does not name WuXi. It captures companies through a list. On 8 June 2026, WuXi AppTec was added to the Section 1260H list. WuXi Biologics was not, and that distinction gets collapsed constantly.
Here is the part almost nobody has priced. A 1260H listing triggers no prohibition by itself. OMB must publish its list of biotechnology companies of concern, due around December 2026, and separately designate. Then guidance. Then the FAR Council revises the acquisition regulation, with a year to do it. Then prohibitions take effect sixty days later. Existing contracts are grandfathered five years. The realistic date on which any of this bites is 2027.
So the demand has moved and the statute has not. After BIOSECURE, confidence in working with Chinese CDMOs fell by roughly half, from 6.1 to 3.1 on a ten-point scale. Twenty-six percent of firms were evaluating a shift away. Two percent had taken an actual step. And through the year BIOSECURE became law, WuXi AppTec's revenue from US clients grew 34.3% and its backlog rose 28.8%. Whatever the industry says it intends to do about China, that has not shown up in the cash flows yet.
Large CDMOs oversubscribe. A site running sixty programs may have signed eighty, on the expectation that a proportion will fall away before they ever reach a suite. Measured against a utilization number, that is arithmetic rather than greed. Across 2014 to 2023, a drug entering Phase I had a 6.7% chance of eventual approval, and the worst single step is Phase II to Phase III, where only 28% advance. A book of clinical-stage programs will thin. The open question is who absorbs the variance when it thins on a different schedule than the model assumed.
A large CDMO can take that on the balance sheet. A smaller one takes it in the senior team's calendar. And the client takes a share too, as a program sitting behind two others that were supposed to have failed by now.
There is no published drop rate. It sits inside each CDMO's commercial model and it is competitively sensitive, so anyone quoting one is quoting a guess.
The diligence question is no longer whether the CDMO will customize for you. Most will. It is whether the site has enough repeated unit operations across its current book to absorb your customization without compromising the platform underneath.
None of those appear in a typical selection process, and I should be careful about what they do. They do not predict a tech transfer outcome. Nobody has published a tech transfer failure rate to predict against. What they measure is the strain the site is carrying, and a site under strain transfers process badly. It is a weaker claim than the industry usually makes, and it is as far as the evidence goes.
Open headcount deserves more attention than it gets. A requisition open thirty days is a planned hire. A senior QA requisition open six months means a thin bench has been absorbing the gap, and somebody on that bench has been carrying two jobs since spring. Listen for the duration rather than the count.
The last question usually gets the longest pause. Ask it anyway. A site head who answers it from memory is telling you something they probably do not mean to, which is that the relationship between your program and the one in the next suite is held in somebody's head, and would not surface on its own if that person were on holiday.
It is worth turning that lens around, because the strain is not something CDMOs do to their clients. A biotech under its own pressure contributes to it. The runway is short, the board wants a date, and the date reaches the CDMO before the process is stable. The scope changes in month four. The comparability plan arrives late. The program that was pitched as platform-standard turns out to need three custom steps. None of it is bad faith. A biotech with eleven months of cash behaves like a biotech with eleven months of cash, in exactly the way a CDMO measured on utilization behaves like one. Both sides are being held to numbers that were set before the facts were known, and both sides are absorbing the difference.
Which is where the middle ground sits, and it is wider than the contracting usually admits. A client who scopes to the platform gets a program that transfers cleanly and a site with capacity when it matters. A CDMO that can decline poorly fitting work keeps the repetition that makes everybody's batches predictable. Those are the same outcome viewed from two sides of a contract. The tiered agreements, the exclusivity buy-ins and the co-investment in a dedicated suite are all attempts to write that down: the deeper client earns better terms and better priority, and the CDMO earns the forecastable book that lets it say no to the rest. Nobody has to lose for that to work. The conversation that gets there starts with both sides saying out loud what they are measured on.
There is a prize underneath all of this. What every CDMO wants is to be in the frame when a product goes commercial, because that is the moment the revenue turns long-term and predictable, and it is worth more than any quarter of suite occupancy. It is also why the poorly fitting clinical program gets taken in the first place. You cannot supply the commercial product if you were not in the room for the clinical one.
The difficulty is that saying yes to everything is what gets a CDMO into the room, and reproducibility is what keeps it there. Those two pull in opposite directions, and the moment they collide is the first commercial client. We will cover more on this next time out.
The reason this belongs in front of a CEO and not only a QA director is what it does to the valuation. Fully integrated CDMOs trade at roughly 19.5 times forward EBITDA; niche, sub-scale ones trade at 14.0. Suites are a commodity, and anyone with capital can build one. What the buyer is paying up for is the probability that the next batch behaves like the last one, and that probability lives in the firm's systems rather than in whoever happens to be running the line that week.
The same logic runs one level up, through your cap table. When an investor prices your program, they are pricing the probability of an approvable filing on a date. Every dependency that lives in an individual rather than in a system is an unpriced probability of slippage. It never appears as a line item. It appears as a discount rate. A CMC leader who can answer those six questions about their own CDMO is removing variance from the model that decides what the company is worth. That is a different job from quality assurance, and it is priced differently.
None of those structures are theoretical. They are running today, at varying scale, and at the far end sponsors are buying manufacturing platforms outright to guarantee access. The constraint is time: restructuring a commercial model around an operating model takes sales discipline that boards must defend in quarters when growth at any cost looks safer than selectivity.
There is a sign the argument is landing. In FY2024 the FDA issued 105 drug-quality warning letters to human drug manufacturing sites, the highest in five years. Underneath the total sat an inversion: domestic letters fell from 59 to 41, while foreign letters rose from 35 to 64. Nobody is being let off. The inspectors are simply getting to more sites than they used to.
The CDMOs that protect the time to redesign their commercial model around their operating model will be the ones whose teams are not still working weekends in 2028.
Which brings it back to the numbers. Every CDMO pitch opens with them, and they are all true: suites, liters, headcount, turnaround, price per batch. Not one of them measures strain, but strain is what will decide whether a program transfers cleanly or joins a queue behind somebody else's deviation. The numbers that reveal this are unlikely to be on the sales slide. They are the things that have to be uncovered, in the room, and asking is the diligence.
The people on the floor have earned a better operating model than the one they have been holding together.
Next week in the CDMO series: The Challenges and Trappings of Growth.
Every engagement begins with a diagnostic — a structured read on the role and the company you are actually inheriting.
Start a diagnostic