Supplement cGMP rules are federal law for anyone who makes dietary supplements in the United States. This guide explains them in plain words.
What the rule is
The rule is 21 CFR Part 111. cGMP stands for current good manufacturing practice. In short, it says a maker must write down how a product is made, follow those steps, and check the result.
The rule covers companies that make, package, label, or hold supplements. It also covers supplements brought in from other countries. A firm that only stores supplements in a store for direct sale to shoppers is exempt from the holding rules, but a warehouse is not.
The rule is not a suggestion. It is a federal regulation and has the force of law. FDA's guide for small firms, by contrast, is only advice on how to meet it, and it does not bind anyone beyond what the rule itself requires.
Sources: eCFR, 21 CFR Part 111 (ecfr.gov); FDA, Small Entity Compliance Guide: Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements, December 2010 (fda.gov)
Who had to follow it, and when
FDA finished the rule in 2007 and phased it in by company size. The biggest firms, with 500 or more full-time workers, had to comply by June 25, 2008. Mid-size firms, with at least 20 but fewer than 500 workers, had until June 25, 2009. The smallest firms, under 20 workers, had until June 25, 2010.
All of those dates have passed. In May 2026, no maker can claim it is too new or too small to be covered.
Sources: FDA, Small Entity Compliance Guide: Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements, December 2010 (fda.gov)
What the rule asks a maker to do
The rule is long, but it follows the path of a product. Each part answers a plain question.
People. Staff must be qualified for their jobs. Quality control duties are kept clear of other duties. Workers who are sick must be kept away from materials.
Buildings and equipment. The plant must be clean, sound and free of pests. Equipment must be built, checked and kept up so it does not harm the product. Scales and similar tools must be calibrated.
Production controls. A maker sets written specifications for ingredients, steps in the process, packaging, labels and the finished product. It then keeps a master record for each product and a batch record each time it runs one.
Quality control. A quality control team approves or rejects ingredients, processes and finished lots. It decides what happens to anything that fails.
Complaints, returns and records. Makers must keep written files on complaints that relate to good manufacturing practice. They must also handle returned product by rule, and keep their records.
Sources: eCFR, 21 CFR Part 111 (ecfr.gov); FDA, Small Entity Compliance Guide: Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements, December 2010 (fda.gov)
What testing the rule requires
Many buyers think cGMP means every batch is tested for everything. That is not quite right. The rule asks for testing that fits the risk, and it lets a maker rely on paperwork in some cases.
For a dietary ingredient, a maker must run at least one test to confirm identity. For other ingredients, the maker must confirm identity and other specifications either by testing or by relying on the supplier's certificate of analysis. Relying on a certificate has conditions. The maker must qualify the supplier and show how it did so. The certificate must list test methods, limits and real results. The maker must re-check the supplier from time to time.
For finished batches, the maker must check that the product meets its own specifications for identity, purity, strength, composition and limits on contaminants. It can test every batch or a sound sample of batches. A maker may skip a finished-batch test only if no valid test exists. It must then record why, and quality control must approve it.
Any test used must be scientifically valid. If a spec is not met, the maker needs a plan for what to do next.
Sources: eCFR, 21 CFR Part 111 (ecfr.gov); FDA, Small Entity Compliance Guide: Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements, December 2010 (fda.gov)
What a cGMP badge does and does not prove
Many labels carry phrases such as "made in a cGMP facility." Read them with care. FDA enforces the rule through inspections. Our reading of FDA's materials is that the agency does not hand out a cGMP certificate that a company can print on a label, so a plain badge is the company's own statement.
A badge that names an outside auditor, and a report you can ask for, tells you more. Even then, an audit is a snapshot. It shows how a plant ran on the days someone looked.
The rule also sets the bar for paperwork, not for a given result. A maker that follows its written plan is following the rule, even if the plan is weak in places. That is why a cGMP statement is a starting point. Pair it with a certificate of analysis for the lot you hold, and check that the lab and methods are named.
Records give you one more clue. Makers must keep them for a set time: one year past the shelf life date for a dated product, or two years after the last batch is sent out if there is no shelf life date. A firm that cannot say how long it keeps records is worth a second look.
Sources: eCFR, 21 CFR Part 111 (ecfr.gov)
A short checklist for readers
Ask four things. Who made the product, and where? Does the label name an outside auditor, or only claim a standard? Is there a lot-specific certificate of analysis with methods and limits? Will the company answer questions about its complaint and record practices? Clear answers do not guarantee quality, but silence is useful information.
Sources: eCFR, 21 CFR Part 111, Sections 111.1, 111.75 and 111.605 (ecfr.gov); FDA, Small Entity Compliance Guide for dietary supplement CGMP, December 2010 (fda.gov).