FDA cGMP Risk 2026: 10 Things OEM Buyers Should Verify

FDA DIETARY SUPPLEMENT cGMP ALERT — 2026

Buyer Takeaway:

For OEM buyers, cGMP should not be treated as a certificate-checking exercise. The more important question is whether the manufacturer can demonstrate control over materials, specifications, production, records and finished-product release.

Executive Summary

When U.S. dietary supplement OEM buyers evaluate a manufacturer, the first question is often: "Are you FDA cGMP compliant?" But the more important question is: who is responsible for quality control decisions, how are component specifications established, how are raw-material suppliers qualified, how are deviations investigated, are batch production records maintained for every lot, who approves finished-product release, and how are complaints handled?

FDA's dietary supplement cGMP requirements under 21 CFR Part 111 cover these operational manufacturing controls. Recent FDA enforcement actions in 2026 continue to identify failures related to finished-product specifications, sanitation, equipment requirements, and batch production records.

A Certificate Shows Compliance. A Quality System Shows Control.

The difference between a compliant manufacturer and a risky manufacturer is often not the certificate on the wall. It is the quality system behind it.

The following 10 verification points are designed to help OEM buyers move beyond certificate-checking and into meaningful supplier qualification.

What OEM Buyers Risk by Choosing the Wrong Manufacturing System

These risks do not appear on a cGMP certificate. They appear during an FDA inspection, a customer complaint, or a marketplace compliance review.

1. What Does FDA Dietary Supplement cGMP Actually Mean?

1.1 21 CFR Part 111 Is the Core cGMP Framework

The FDA's current Good Manufacturing Practice regulations for dietary supplements are set forth in 21 CFR Part 111. These regulations establish minimum cGMP requirements pertaining to the manufacturing, packaging, labeling, and holding of dietary supplements to ensure their quality.

The cGMP framework requires manufacturers to establish and follow specifications for components and finished batches, including applicable requirements for identity, purity, strength, composition, and limits on contaminants.

Foreign facilities that manufacture, package, label, or hold dietary supplements for the U.S. market are subject to the applicable FDA requirements, including 21 CFR Part 111 where applicable. FDA performs foreign inspections of dietary supplement manufacturers to determine compliance, and may detain without physical examination (DWPE) and refuse admission of affected products if a firm is found not operating in conformity with current GMPs.

1.2 cGMP Compliance Is Not FDA Product Approval

A critical distinction for OEM buyers: FDA cGMP compliance does not mean the FDA has approved the product.

Under DSHEA, dietary supplements do not require pre-market FDA approval. They are regulated as a subcategory of food—not as drugs—provided they do not make drug claims. The cGMP framework governs how products are manufactured, not whether they are approved for sale.

The practical implication: cGMP compliance should be viewed as a baseline, not a guarantee of product-specific quality. Compliance with the applicable requirements establishes a required manufacturing control framework; it does not by itself confirm that a specific product meets every brand specification or quality expectation.

2. cGMP Is a System, Not a Certificate

This is the first and most important verification point.

A third-party cGMP certificate can provide evidence that a facility has been audited against a particular certification standard. It does not, by itself, demonstrate compliance with every requirement applicable to a specific product or production process.

The applicable cGMP framework for dietary supplements is 21 CFR Part 111—a regulatory requirement, not a certificate. FDA does not issue a "cGMP certificate" to compliant manufacturers. Compliance is determined through inspection and enforcement, not through a credential on the wall.

The real question is not "Do you have cGMP?" The real question is: "How does your cGMP system control my product?"

FDA's own regulations emphasize that the recordkeeping, documenting, planning, control, and improvement processes of a quality control system serve as the backbone to cGMP. Records must show what is being manufactured and whether the controls in place ensure the product's identity, purity, strength, and composition.

Buyer Check: Can the manufacturer demonstrate a functioning quality system—not just a certificate?

3. Quality Control Is More Than Final Product Testing

A common misconception among brand buyers is that passing a finished-product test is equivalent to cGMP compliance.

Testing is one part of quality control. It is not the entire quality system.

The cGMP framework requires controls at multiple stages:

FDA regulations require that manufacturers establish specifications for the identity, purity, strength, and composition of finished batches, as well as limits on contaminants. Recent FDA Warning Letters in 2026 continue to cite failures related to inadequate finished-product specifications as a common cGMP violation.

Buyer Check: Who is responsible for quality control decisions, and how are those decisions documented?

4. Component Specifications Come Before Production

Component specifications define what raw materials must meet before they enter production. Without defined specifications, there is no objective basis for accepting or rejecting a material.

For components used in dietary supplements, FDA requires specifications covering applicable characteristics such as identity, purity, strength, composition, and limits on contaminants.

A COA does not replace a defined component specification.

Under 21 CFR 111.75, manufacturers must determine whether component specifications are met before use. The verification approach varies by component type; when relying on a supplier's certificate of analysis for applicable components, the manufacturer must qualify the supplier and establish the reliability of the supplier's COA through appropriate confirmation of the supplier's test results.

The component specification is the baseline against which all incoming materials are evaluated. Without it, material acceptance becomes subjective.

Buyer Check: How does the manufacturer establish and maintain component specifications for the materials used in your product?

5. Supplier Qualification Is Part of Manufacturing Risk Control

Supplier qualification is not a separate activity from cGMP compliance. It is a core requirement of the cGMP framework.

Under 21 CFR 111.75, manufacturers must determine whether component specifications are met before use. The verification approach varies by component type. For dietary ingredients, the regulation generally requires at least one appropriate identity test or examination before use. For other components, when relying on a supplier's certificate of analysis, the manufacturer must qualify the supplier and establish the reliability of the supplier's COA through appropriate confirmation of the supplier's test results.

Your OEM's supplier qualification system is part of your product's risk profile.

If the manufacturer does not have a structured process for approving raw-material suppliers, the risk of specification inconsistency, contamination, or adulteration transfers directly to your finished product.

Buyer Check: How are raw-material suppliers qualified, and can the manufacturer demonstrate the verification that supports each supplier approval?

6. Master Manufacturing Record vs. Batch Production Record

The cGMP framework distinguishes between two critical production documents:

Master Manufacturing Record (MMR) — defines what should happen for each unique formulation

Batch Production Record (BPR) — documents what actually happened for each specific batch

The MMR establishes the procedures and specifications for manufacturing a specific formulation. The BPR is prepared every time a batch is manufactured and must accurately follow the appropriate MMR. The BPR includes batch number, ingredients, actual quantities used, equipment, processing steps, in-process controls, yield, testing results, and any deviations.

FDA enforcement actions have cited manufacturers for failing to prepare a batch production record every time a batch of dietary supplements was manufactured with the required information. In 2026, FDA issued Warning Letters to firms including Nupack for failure to prepare batch production records for each batch.

Buyer Check: Can the manufacturer prove what happened to your batch? Is a complete BPR available for each lot?

7. Deviations Must Be Controlled, Investigated and Documented

Manufacturing is not always a perfectly controlled process. What matters is how deviations are handled.

Under the cGMP framework, deviations from established control processes must be documented and evaluated, with appropriate material review, disposition and corrective action as required by the applicable cGMP procedures.

FDA regulations require records to show whether and what deviations from control processes occurred, facilitate evaluation and corrective action, and enable a manufacturer to assure that the corrective action was effective.

A deviation is not automatically a failure of the manufacturer. An uncontrolled deviation is.

Buyer Check: How does the manufacturer investigate deviations, and can they demonstrate that corrective actions are effective?

8. Packaging and Labeling Are Part of cGMP Risk

Many brand owners focus on formulation and overlook packaging and labeling controls. But FDA cGMP requirements cover packaging and labeling operations as a distinct control area.

The cGMP framework requires:

• Control of components, packaging, and labels

• Packaging and labeling control systems

• Documentation of packaging and labeling operations, including unique identifiers for packaging and labels used

Packaging and labeling errors—incorrect label, wrong lot number, mix-up of packaging components—can render a finished product non-compliant even when the formulation itself is correct.

Buyer Check: How does the manufacturer control packaging and labeling to prevent mix-ups and ensure the correct label is applied to the correct batch?

9. Finished-Product Release Is a Quality Decision

Finished-product release is not simply a matter of "the product passed testing." It is a quality decision that requires review of records, specifications, and QC evaluation.

Under 21 CFR Part 111, quality control personnel are responsible for reviewing applicable records and determining whether a finished batch meets established specifications before release.

Buyer Check: Who has the authority to release the finished batch, and what records are reviewed before release?

This is a more meaningful question than simply asking whether the manufacturer has a laboratory.

10. Complaints, Records and Traceability Continue After Shipment

cGMP compliance does not end when the product leaves the factory.

The cGMP framework requires written procedures for receiving, reviewing, and investigating product complaints, as well as maintaining records of complaints and investigations.

Certain records must be retained for specified periods under 21 CFR Part 111, with retention generally tied to the shelf life of the product or the date of distribution of the last batch associated with the records, depending on the applicable record requirement.

Buyer Check: How are product complaints investigated, and can the manufacturer trace a complaint back to the relevant batch records?

10 Questions to Ask Your OEM Manufacturer

The most important question of all: What documentation can you provide to demonstrate control—not simply compliance?

HHC Supply Chain Perspective

For OEM buyers, FDA dietary supplement cGMP should be evaluated as a manufacturing control system rather than a certificate-checking exercise. The real value of cGMP is not the document itself, but the systems used to control materials, specifications, production, records, deviations, and finished-product release.

A qualified OEM partner should be able to demonstrate not only that a product was manufactured, but how the manufacturing process was controlled and documented. This means providing visibility into component specifications, supplier qualification records, batch production records, deviation investigations, and release decisions.

The objective is not simply to work with a cGMP-certified manufacturer. It is to work with a manufacturer whose quality system can be verified—not just certified.

📌 HHC Supply Chain Intelligence

Raw Material Intelligence → Cost Analysis → Supplier Evaluation → OEM Production Planning

📧 Email: lisa@hhc-healthy.com
🌐 Website: www.hhc-healthy.com

Market Intelligence

2026 Enforcement Signal

FDA

• Warning Letters — cGMP deficiencies identified in 2026 include incomplete batch production records (Nupack, March 2026), inadequate finished-product specifications, component specifications, equipment and sanitation deficiencies (Meta Labs, May 2026)

• Import Alert 54-14 — Detention Without Physical Examination (DWPE) of dietary supplement products from firms that have not met dietary supplement GMP requirements; current version dated August 26, 2026

Marketplace

• Amazon — continues to apply third-party Testing, Inspection, and Certification (TIC) requirements for dietary supplements on its U.S. marketplace. The policy, introduced in 2024, requires sellers to work with approved third-party TIC providers for applicable compliance verification.

OEM Buyer Action: Verify manufacturer controls before production—not after a regulatory or marketplace issue arises.

FDA's cGMP framework does not end with a certificate. It ends with documented, verifiable control over materials, production, records, and finished-product release.

Disclaimer

This article is provided for informational and supply-chain intelligence purposes only. It does not constitute regulatory, legal, procurement, or compliance advice.

cGMP requirements, FDA enforcement priorities, and marketplace policies vary by product, facility, and market. The information provided reflects the best available public information as of the publication date but should not be relied upon as a substitute for professional regulatory or legal advice.

OEM and private-label buyers should verify current cGMP compliance, documentation practices, and regulatory requirements directly with qualified manufacturers and regulatory consultants before making purchasing or production decisions.