How Do I Know If My Supplement Manufacturer Is GMP Certified?

If you're selling supplements online, "GMP certified" can't be a vague promise on a sales deck. It has to be real, current, and tied to the exact facility that will make your product. Otherwise you're taking on avoidable risk: inconsistent potency, failed micro testing, label mismatches, and platform headaches when Amazon or a retail partner asks for documentation.

Here's the uncomfortable truth we see when brands switch manufacturers: many companies say "GMP" when what they mean is "we try to follow GMP." That's not the same thing as operating under a verified, audited quality system. And if you're planning a fast turnaround launch, low MOQ test run, or rapid scale after a viral moment, you need your quality paperwork to move as fast as your marketing does. (Related: Which Manufacturer Is Best for Testing Viral Product Ideas?)

This guide shows you exactly how to confirm GMP status (not just "GMP compliant"), what documents to request, how to spot red flags in audit certificates, and what other certifications matter for supplements and cosmetics. We'll also cover what happens if a batch fails third-party testing and how to protect your lead times and costs when switching manufacturers.

You'll get better answers (and faster) if you come prepared. This also helps you compare manufacturers on an apples-to-apples basis.

• Your dosage form (capsules, tablets, softgels, gummies, powder, liquid). Peakfinity Labs supports multiple formats—see Supplement Manufacturing Overview and specific lines like Capsule Manufacturing, Tablet Manufacturing, Softgel Manufacturing, Gummy Manufacturing, and Powder Manufacturing.
• Your target markets and channels (Amazon, Shopify, TikTok Shop, clinics, influencers). Channel requirements affect labeling, claims, and documentation. Relevant resources: Amazon FBA Brands, Shopify Brands, TikTok Shop Sellers.
• Your "must-pass" quality attributes (identity testing, micro limits, heavy metals, allergens, banned substances, stability expectations).
• A packaging plan (D2C ready packaging, induction seal, lot/expiry coding, inserts, multi-SKU kitting). If you need fulfillment support, factor in 3PL: Supplement 3PL.
• A realistic launch timeline. A true fast turnaround (often 3–4 weeks from order to production for many projects) only works if the documentation and approvals don't stall.

In the U.S., dietary supplement GMPs are defined in 21 CFR Part 111 (FDA's current Good Manufacturing Practice rules for supplements). FDA doesn't "certify" facilities the way some people assume; instead, FDA inspects and enforces. Many manufacturers use third-party audits to prove they operate under a GMP quality system.

So when a manufacturer says "GMP certified," you should immediately ask: Certified by whom? A credible answer includes an accredited audit program (or a well-known certification body), an audit scope that matches your product type, and current documentation that matches the facility address where your batch will be made.

Founders confuse "FDA approved," "FDA registered," and "GMP certified" all the time — and so do some manufacturers. Use this comparison to keep them straight before you read a single certificate.

Bottom line: "FDA registered" tells you the address is on file. "GMP certified" tells you an independent auditor walked the floor, reviewed batch records, and signed off on a documented quality system. You want both, plus a scope that matches your dosage form. See our full credential register for how Peakfinity Labs documents every standard above.

GMP vs cGMP — what is the difference?

GMP (Good Manufacturing Practice) is the general framework for producing a safe, consistent product. cGMP (current Good Manufacturing Practice) is the FDA's enforced version of that framework, with the word current meaning manufacturers must use up-to-date systems, equipment, and controls — not just whatever was acceptable years ago. For U.S. dietary supplements, cGMP requirements are codified in 21 CFR Part 111. In day-to-day procurement, "GMP certified" usually refers to a third-party audit confirming a facility operates in line with those cGMP rules.

FDA registration vs FDA approval — what your manufacturer can and cannot say

The FDA does not approve dietary supplements or their manufacturers before they go to market. A facility can be FDA-registered under the Bioterrorism Act / FSMA, which simply means it has filed required facility information with the FDA and is subject to inspection. Registration is not an endorsement, a certification, or a quality stamp. Any manufacturer (or brand) that claims its products are "FDA approved" is using non-compliant language. Use phrases like "manufactured in an FDA-registered facility" or "produced under FDA 21 CFR Part 111 GMP requirements" instead.

ISO 9001 vs ISO 22716 — which one applies to you?

ISO 9001:2015 is a general quality management system standard: documented processes, training records, corrective and preventive actions, and internal audits. ISO 22716 is the international cosmetic GMP standard covering hygiene, production, equipment, and storage for personal care products. If you sell supplements, ISO 9001 complements 21 CFR Part 111. If you sell skincare, hair care, or color cosmetics, ISO 22716 alignment is the proof point retailers and EU partners look for.

What is a COA, and what should it actually contain?

A Certificate of Analysis (COA) is a lot-specific document showing the test results for a finished good or raw material against a written specification. A defensible COA names the product, lot/batch number, manufacture and expiry dates, the laboratory (in-house or third party), the test methods used (e.g., HPLC, ICP-MS, USP <61>/<62> for microbial), the specification, the actual result, and a pass/fail disposition. A "COA" with only marketing copy and no methods or specs is not a COA — it is a flyer.

Can my manufacturer help with compliance and labeling?

A serious contract manufacturer supports compliant Supplement Facts / Drug Facts panels, allergen and "Contains" statements, structure-function claim boundaries, MoCRA registration for cosmetics, and lot-coded traceability. They will not, however, replace your regulatory counsel for novel claims, drug-adjacent positioning, or international filings. See our Certifications hub for the current credential register and our Our Process page for how labels are reviewed in the production workflow.

What quality standards do I need to sell supplements online?

At minimum: produce in a facility audited to 21 CFR Part 111 dietary supplement GMP, keep a current third-party GMP certificate on file, hold a finished-goods COA for every lot you ship, and align your label to the formula on the Master Manufacturing Record. For Amazon and major retailers, add traceable lot codes, stability data supporting your expiry, and a written recall procedure. For TikTok Shop, the bar is the same — platforms increasingly request the same documentation when a listing is challenged.

Any contract manufacturer worth signing should be able to produce a credential register like the one below — with real certificate numbers, real issuing bodies, and current renewal dates tied to the legal facility name on your purchase order. The example below is the structure Peakfinity Labs publishes on its Certifications hub; ask any prospective partner for the same.

A GMP certificate is a snapshot. The proof you can defend in a retailer review, an Amazon document request, or an FDA-style audit is the trail — initial certification, every surveillance audit, recertification, and any corrective actions closed in between. Ask any prospective manufacturer for a verification trail in the format below.

Use this as a checklist. If a manufacturer can't clear these steps quickly, that's a signal—especially if you care about speed, low MOQ, and smooth scaling.

Step 1: Ask for the GMP certificate and the most recent audit report summary

Request a PDF of the current GMP certificate plus either an audit report summary or a letter stating audit completion and outcome. You are not asking for their whole Quality Manual; you're asking for proof of a recent, legitimate audit.

What you want to see: issue date, expiry date (or surveillance schedule), facility legal name, facility address, and the scope (dietary supplements, cosmetics, specific dosage forms).

Fast test: the certificate should not look like a generic template with no scope, no address, and no traceable certification body.

Step 2: Confirm the certification body is real and the certificate is traceable

A credible certificate should be verifiable. Look for a certificate number and a certification body that can confirm validity. If the "certifier" has no public presence, no accreditation references, or no way to validate, treat it as marketing—not compliance.

If you're evaluating Peakfinity Labs, start with our Certifications page and then cross-check what matters to your exact product and facility.

Step 3: Match the scope to your product (this is where brands get burned)

GMP isn't one-size-fits-all. A facility might have a quality system for capsules and powders but not for gummies or softgels. Or they might be audited for "packaging" but outsource manufacturing.

Ask a direct question: "Will my SKU be manufactured and packaged at the address listed on the certificate, and is my dosage form included in the audit scope?"

Step 4: Ask for the Master Manufacturing Record (MMR) approach and batch record controls

You don't need proprietary formulas to confirm GMP behavior. You need to confirm they run controlled documentation.

• Do they have a controlled process for Master Manufacturing Records and Batch Production Records?
• Do they record lot traceability for each raw material and packaging component?
• Do they document in-process checks (weights, fill counts, tablet hardness, gummy moisture, etc.)?

At Peakfinity Labs, our quality approach is built for repeatability across low MOQ runs and rapid scale. You can review how we think about quality here: Certifications & Quality Standards.

Step 5: Verify their testing program (incoming, in-process, finished goods)

GMP certification matters, but testing is where quality becomes measurable. Ask for a sample COA package (with sensitive info removed) showing:

• Incoming raw material tests: identity testing at minimum; additional tests based on risk (micro, heavy metals, solvents).
• In-process checks: uniformity/weight checks; blend validation approach.
• Finished goods testing: identity, potency, micro, and contaminants appropriate to ingredients and dosage form.

Step 6: Confirm labeling and claim review is part of the workflow

Many costly problems come from labels, not manufacturing. Ask whether the manufacturer supports compliant Supplement Facts, allergen statements, and claim boundaries for your channel.

For Amazon-specific compliance, see Compliant Supplement Amazon and Amazon FBA Supplement Manufacturing. For process transparency, see Our Process.

Before any MSA, SQA, or first PO, get this short proof bundle in writing. Every item below is something a credible GMP-certified contract manufacturer should be able to share within one to two business days under mutual NDA.

1. Current GMP certificate (PDF): facility legal name, full address, audit scope including your dosage form, issue and expiry dates, certificate number, and named issuing body.
2. Most recent surveillance audit summary: a one-page letter or report confirming the latest annual audit closed without open major findings.
3. FDA facility registration confirmation: FEI number or registration confirmation tied to the same address on the GMP certificate.
4. Redacted finished-goods COA: from a lot produced in the last 12 months in your dosage form, showing identity, potency, micro, and contaminant results with methods and specs.
5. Master Manufacturing Record (MMR) overview: not the recipe — a description of how MMRs and Batch Production Records are controlled, approved, and retained.
6. OOS / deviation procedure summary: a written description of how out-of-spec results are quarantined, investigated, and dispositioned.
7. Recall and traceability procedure: lot-coding strategy, mock recall frequency, and record retention period.
8. Allergen and cross-contact control program: a written program — not "we clean well."
9. Insurance certificate: product liability and general liability with limits appropriate to your sales channels and order volume.
10. Sub-contracted operations disclosure: any step (e.g. gummy depositing, softgel encapsulation, third-party testing) that is outsourced, with the sub-contractor's GMP status.

GMP is the baseline, but it's not the full picture. The right "stack" depends on what you sell and where you sell it.

What does ISO mean in practice? ISO certification typically signals the manufacturer runs a formal quality management system with documented processes, training, corrective actions, and internal audits. It doesn't replace supplement GMP; it complements it—especially when you're scaling and need fewer surprises during rapid scale.

If you want a quick view of Peakfinity Labs' facility standards, start here: Facilities, Certifications, and About.

• They won't share the facility address on the certificate. Real audits tie to real sites.
• The certificate scope is vague. "Nutraceuticals" with no dosage form or activity listed is not enough.
• They say they're "GMP compliant" but can't name the audit standard. Ask what standard and who audited.
• They outsource key steps without telling you. For example, they "make gummies" but actually broker to another plant.
• COAs look like marketing flyers. You want specs, methods, lab identity, and pass/fail results.
• Hidden costs show up after you commit. Common ones: rush fees, changeover fees, label revisions, additional testing, or storage.

If you only have 10 minutes on a call, ask these. A serious manufacturer answers directly.

Yes, and it usually shows up as cost and time problems—not just quality problems.

• Platform risk: Amazon and payment processors can request documentation after a complaint or spike in returns.
• Retail risk: buyers often ask for audit status, COAs, and traceability details.
• Operational risk: uncertified operations tend to have weaker batch record discipline, which shows up as inconsistent fills, variable taste/texture, or avoidable rework.
• Legal risk: poor documentation makes recalls slower and more expensive.

If you're building for eCommerce velocity, you need compliance that doesn't slow you down. That's the reason we built Peakfinity Labs around fast turnaround, low MOQ test runs, and GMP & ISO certified systems—so launches don't turn into paperwork fires.

Plan for this before it happens. A good manufacturer will tell you exactly how they handle OOS (out-of-spec) results and what your options are.

Typical outcomes (and what you should do)

1. Confirm the method and sampling plan. A failure can come from a flawed method, wrong storage, or non-representative sampling.
2. Open an investigation and document it. GMP systems require a documented deviation/OOS investigation.
3. Quarantine product. Do not ship while results are unresolved.
4. Decide disposition. Depending on cause, the batch may be reworked, relabeled (rare), or destroyed.

Many brands sell both supplements and cosmetics, but the rules differ. Supplements fall under dietary supplement regulations (including 21 CFR Part 111 GMP). Cosmetics have different FDA oversight and often follow cosmetic GMP guidance (commonly aligned to ISO 22716).

If you're launching skincare, start with Skincare Manufacturing and the broader Cosmetic Manufacturing Overview. For specific product types, see Serum Manufacturing, Face Cream Manufacturing, Lotion Manufacturing, Shampoo Manufacturing, and Conditioner Manufacturing.

As of 2026, Amazon treats dietary supplements as a documentation-first category. Before a listing goes live — or stays live after a Seller Performance request — you need a defined bundle of facility, lot, and label paperwork. The table below maps the documents Amazon (and most major retailers) ask for, what each one proves, and who is responsible for producing it. For the full marketplace context, see Which Certifications Are Needed to Sell on Amazon?

One of the most common questions we get from D2C founders is: "If I manufacture with you, how much of the Amazon and FDA compliance work is already done?" The table below maps each requirement to what is handled inside our facility versus what stays with the brand. The goal is to make compliance a launch accelerator instead of a 90-day fire drill.

In practice, that means 8 of the 10 most-requested Amazon and FDA documents are produced inside our facility as part of a normal production run — not as a paid add-on. The brand owns its label claims, its insurance, and the TIC submission itself. For the full credential register, see Certifications; to see how this integrates with the production timeline, see Our Process.

"How do I create a compliant supplement product for Amazon without a huge upfront investment?" usually comes down to one decision: launch on a proven stock formula at a low MOQ, or invest in a custom formulation that becomes a defensible asset. Both paths can be Amazon-compliant — they trade off speed, cost, differentiation, and how much R&D risk you carry. The table below makes the trade-offs explicit so you can pick the path that matches your capital and timeline.

A practical sequencing tip we share with new Amazon brands: launch on a stock formula at the lowest viable MOQ to validate listing, creative, and conversion, then roll the proven SKU into a custom formulation once you have repeat orders and review velocity. The Amazon compliance bundle (rows 1–8 in the previous table) is the same on both paths, so switching from stock to custom does not restart your compliance work — it extends it. For a deeper comparison, see Private Label vs Custom Manufacturing, and for ready-to-launch SKUs browse our stock product catalog.

"Safe to sell" is really three things: compliant product, compliant listing, and consistent quality that keeps returns low.

• Build a defensible quality file. Keep GMP certificate, COAs, specs, allergen statements, and traceability info organized per SKU.
• Align your label to your formula. Never launch with "close enough" Supplement Facts. One mismatch can cause complaints and platform flags.
• Control claims. Avoid disease claims; keep structure/function claims supportable and consistent across label, PDP, and ads.
• Match dosage form to channel reality. Gummies and flavored powders can win on TikTok, but they also raise sensory consistency expectations. That means tighter specs and change control.

If Amazon is a key channel, read Amazon FBA Supplement Manufacturing. If Shopify is your home base, see Shopify Brands. If you're deciding between "ready-to-sell" options and deeper customization, see Private Label vs Custom Manufacturing.

Switching can be smooth, but only if you manage it like a controlled transition.

Our practical transition plan (works even during rapid scale)

1. Run a documentation sprint first. Before you move anything, collect specs, COAs, label files, and ingredient statements from your current manufacturer.
2. Mirror the formula, then improve it. If you're changing suppliers and excipients at the same time, you'll struggle to isolate issues. Start with a match, then optimize.
3. Approve a pilot at low MOQ. Low minimum order quantities let you validate appearance, taste, fill weights, and COA results without overbuying inventory.
4. Lock change control. Require written approval for any raw material, flavor, capsule shell, or packaging change.
5. Build a continuity buffer. Keep 4–8 weeks of coverage during the first transition cycle, especially for gummies and flavored powders.

For brands planning a fast launch, prototyping saves time. See Prototyping Services and our team approach via R&D.

• Problem: "They sent a certificate but it's expired." — Fix: Ask for the most recent surveillance audit proof and the updated certificate. If they can't provide it quickly, pause the project.
• Problem: "The certificate name doesn't match the company I'm talking to." — Fix: Ask who the legal manufacturer of record is and whether you're dealing with a broker or a manufacturing partner. Your agreement should name the facility that produces the goods.
• Problem: "COA doesn't include potency tests for actives." — Fix: Require a written testing spec per SKU that includes identity and potency for actives where applicable, plus micro and contaminants based on risk.
• Problem: "They can't explain what happens if a batch fails." — Fix: Ask for their deviation/OOS workflow and a sample (redacted) investigation report format.

If you remember one thing, make it this: GMP is verifiable. A real manufacturing partner can show you current certificates, clear audit scope, sensible testing specs, and controlled documentation tied to the exact facility making your product.

If you want a GMP & ISO certified partner built for fast turnaround, low MOQ runs, custom formulation, and D2C ready packaging, start here: Start Project or reach out via Contact. If you want to vet us first, review Certifications & Quality Standards and Facilities.

For terms and data handling, see Terms and Privacy Policy.