Dietary Supplement GMP: 21 CFR 111 Compliance & FDA Enforcement

Overview

The dietary supplement industry in the United States generates approximately $69 billion in annual revenue, with an estimated 80,000 or more products on the market sold by roughly 15,000 manufacturers. Unlike pharmaceutical drugs, dietary supplements do not require FDA pre-market approval. The regulatory framework governing their manufacture rests on 21 CFR Part 111 — the Current Good Manufacturing Practice (CGMP) regulation for dietary supplements — and the foundational statute that preceded it, the Dietary Supplement Health and Education Act of 1994 (DSHEA).

Understanding these two pillars is essential for any company manufacturing, packaging, labeling, or holding dietary supplements. DSHEA defines what supplements are and limits the FDA's pre-market authority. 21 CFR 111 tells manufacturers how to make them safely. Together they create a regulatory environment where companies bear the primary responsibility for product quality and safety — and where the FDA's enforcement tools, while real, operate after the fact.

Policy Canary tracks 34 regulatory items tied to dietary supplement CGMP enforcement, predominantly FDA warning letters issued to companies for violations of 21 CFR 111. The pattern is consistent and instructive: the same handful of failures appear again and again across the industry.

Current Regulatory Status

The DSHEA Foundation (1994)

The Dietary Supplement Health and Education Act, signed into law on October 25, 1994, fundamentally shaped the supplement regulatory landscape. DSHEA established that dietary supplements are a category of food — not drugs — and defined them broadly to include vitamins, minerals, herbs, botanicals, amino acids, concentrates, metabolites, and extracts.

The practical consequence: manufacturers can bring supplements to market without demonstrating safety or efficacy to the FDA beforehand. The burden of proof falls on the FDA to show that a product is unsafe after it reaches consumers. This is the inverse of the pharmaceutical model, where drugs must prove safety and efficacy before approval.

DSHEA also introduced the concept of structure/function claims — statements like "supports immune health" or "promotes joint flexibility" — which do not require FDA pre-approval (though they must be truthful, not misleading, and accompanied by the standard disclaimer that the product has not been evaluated by the FDA).

Critics, including the FDA itself, have long argued that DSHEA's framework is inadequate for a market that has grown from roughly $4 billion in 1994 to nearly $69 billion today. The agency does not even know how many supplement products exist on the market because there is no mandatory product listing requirement.

21 CFR Part 111 — The GMP Rule

On June 25, 2007, the FDA published the final rule establishing 21 CFR Part 111, creating CGMP requirements specifically for dietary supplements. The rule was phased in over three years:

• June 2008: Companies with 500+ employees
• June 2009: Companies with 20-499 employees
• June 2010: Companies with fewer than 20 employees

Since June 2010, all dietary supplement manufacturers have been required to comply regardless of size.

The regulation is organized into 15 subparts covering every aspect of manufacturing operations:

Subpart	Coverage
A	General Provisions
B	Personnel
C	Physical Plant and Grounds
D	Equipment and Utensils
E	Requirement to Establish a Production and Process Control System
F	Production and In-Process Control System
G	Components, Packaging, and Labels
H	Master Manufacturing Record
I	Batch Production Record
J	Laboratory Operations
K	Manufacturing Operations
L	Packaging and Labeling Operations
M	Holding and Distributing
N	Returned Dietary Supplements
O	Product Complaints

The core obligation is straightforward: manufacturers must establish and follow written procedures that ensure each batch of finished product meets specifications for identity, purity, strength, composition, and limits on contaminants. Every step — from receiving raw ingredients to shipping finished product — must be documented, verified, and traceable.

FDA Enforcement Posture (2024-2026)

The FDA's Office of Dietary Supplement Programs (ODSP), led by Director Cara Welch, has articulated three strategic priorities for 2026: safety, product integrity, and informed decision-making. In practical terms, this means the agency is focused on ensuring supplements are safe, contain what their labels claim, and are manufactured in compliance with CGMP requirements.

ODSP has signaled a shift toward encouraging compliance rather than defaulting to punitive action, aiming to help responsible firms understand expectations while reserving enforcement tools for companies that choose not to comply. However, the FDA has also made clear that firms developing new ingredients or relying on novel substances should expect closer scrutiny, clearer guidance, and increasing emphasis on safety substantiation.

The Human Foods Program's 2026 priority deliverables include evaluating modernized regulatory approaches for dietary supplements — acknowledging that some regulations, including the GMP rule itself, are nearly 20 years old and may need updating. Notably, this modernization effort does not include renewed pursuit of mandatory product listing through regulation; that remains a legislative question.

Key Deadlines

Date	Event	Status
October 25, 1994	DSHEA signed into law	Enacted
June 25, 2007	21 CFR 111 final rule published	Enacted
June 25, 2008	GMP compliance required: 500+ employee firms	Passed
June 25, 2009	GMP compliance required: 20-499 employee firms	Passed
June 25, 2010	GMP compliance required: all firms (including <20 employees)	Passed
January 15, 2026	Dietary Supplement Listing Act of 2026 (S.3677) introduced by Sen. Durbin	Pending in Congress
Late 2026 (target)	FDA final guidance on New Dietary Ingredients (NDI) — first section	Pending
TBD	DSHEA labeling requirements modernization — FDA rulemaking	Under review

Detailed Analysis

The Five Most Common GMP Violations

FDA inspection data reveals a remarkably stable pattern of violations. The same deficiencies that dominated Form 483 observations a decade ago continue to account for the majority of citations today. For companies tracking compliance risk, these are the areas that matter most.

1. Failure to Establish Product Specifications (21 CFR 111.70(b)(1))

The single most cited violation — appearing in roughly 33% of facilities that receive a Form 483. Manufacturers must establish specifications for the identity, purity, strength, and composition of finished products, as well as limits on contaminants. Many firms simply do not have written specifications, or their specifications are incomplete. This is the regulatory equivalent of building a house without blueprints.

2. Failure to Establish Component Specifications (21 CFR 111.70(b)(2))

The second most common violation, cited at approximately 20% of inspected facilities. Before a raw ingredient goes into production, the manufacturer must have written specifications ensuring that the component will result in a finished product meeting its own specifications. Firms that skip this step are gambling that their incoming ingredients are what they claim to be.

3. Failure to Verify Component Identity (21 CFR 111.75(a)(1))

Cited at roughly 18% of facilities receiving 483s. Manufacturers must conduct at least one appropriate test or examination to verify the identity of each component (dietary ingredient or other ingredient) before use. Relying on a supplier's certificate of analysis alone — without independent verification — does not satisfy this requirement.

4. Inadequate Written Procedures

Across multiple subparts, FDA inspectors find that companies either lack written procedures entirely or have procedures that are too vague to be actionable. Master manufacturing records, batch production records, and laboratory SOPs must be specific enough that a trained employee can follow them consistently.

5. Documentation Failures

Missing contemporaneous entries, incomplete batch records, and inconsistent procedures appear repeatedly in enforcement records. If an activity is not documented at the time it occurs, the FDA treats it as if it did not happen.

Warning Letter Patterns in Our Database

Policy Canary's database contains 34 regulatory items related to dietary supplement CGMP enforcement. The companies cited — including LXR Biotech, Cosmax NBT USA, Eniva USA, CC Pollen, and M.O.M. Enterprises — span the spectrum from small operations to major contract manufacturers.

LXR Biotech, LLC received a warning letter dated December 23, 2025, following an inspection from February 25 through March 12, 2025. The FDA found that LXR's products (Eternal Energy Grape and Eternal Energy Tropical Punch) were adulterated because the company failed to establish product specifications for identity, purity, strength, and composition — the number-one violation in the industry.

Cosmax NBT USA, a contract manufacturer, was cited for the same core failure: products prepared, packed, or held under conditions that do not meet CGMP requirements, with missing product and ingredient specifications. Contract manufacturers face particular scrutiny because their failures cascade across every brand they produce for.

The recurring theme is not exotic or surprising. These are not companies caught using dangerous ingredients or making fraudulent claims. They are companies that failed to do the basic blocking and tackling of manufacturing documentation — specifications, identity testing, and written procedures.

The Inspection Gap

The FDA inspects approximately 500-600 dietary supplement facilities per year out of roughly 13,000-15,000 registered facilities. That translates to an inspection rate of roughly 4-5% annually. In FY2023, nearly half of all supplement firms inspected received Form 483 observations citing GMP violations.

This creates an asymmetric risk environment. Most facilities are never inspected in any given year, which can breed complacency. But when an inspection does occur, the odds of receiving a 483 are high — and the consequences of a subsequent warning letter include potential import alerts, injunctions, and seizures.

Third-Party Certification Programs

Given the FDA's limited inspection capacity, third-party certification has emerged as both a quality signal and a competitive differentiator. The three major programs are:

NSF International offers multiple certification tiers: NSF Contents Tested and Certified (verifying label accuracy and contaminant limits), NSF Certified for Sport (additional banned substance testing for athletic products), and NSF GMP Registered (facility-level GMP audit). NSF developed the first independent testing standard for dietary supplements in the United States.

USP (United States Pharmacopeia) runs the USP Verified program, which includes manufacturing facility audits for FDA CGMP compliance, review of quality documentation, laboratory testing against USP quality standards, and ongoing off-the-shelf testing. The USP Verified mark is widely regarded as one of the most rigorous certifications available.

ConsumerLab.com was the first national third-party verification program for dietary supplements, launched in 1999. ConsumerLab tests products for identity, quality, strength, purity, and contamination, and publishes results publicly — including failures. This transparency model has made it a consumer-facing trust signal.

All three programs test finished products for identity, ingredient quality, strength (quantity), purity, and contamination with heavy metals, pesticides, and microbes. While voluntary, these certifications provide a layer of assurance that supplements meet quality standards — something the FDA's inspection frequency alone cannot guarantee.

Adulteration and Spiked Products

Beyond GMP documentation failures, the FDA continues to encounter supplements spiked with undeclared pharmaceutical ingredients. In 2024, dozens of products were flagged for containing sildenafil (erectile dysfunction), sibutramine (weight loss, withdrawn from market in 2010), diclofenac (anti-inflammatory), and even yellow oleander (a toxic plant compound). These are not GMP issues in the traditional sense — they represent deliberate adulteration, often by manufacturers operating at the margins of the industry.

The distinction matters. CGMP compliance prevents accidental quality failures. It does not prevent intentional fraud. This is one reason the FDA and public health advocates push for mandatory product listing — knowing what products exist is a prerequisite for identifying and removing dangerous ones.

Legislative Reform Efforts

The Dietary Supplement Listing Act of 2026 (S.3677), introduced by Senator Dick Durbin (D-IL) on January 15, 2026, would require all dietary supplement manufacturers to register their products with the FDA. Companies would be required to provide product names, a complete ingredient list, an electronic copy of the label, allergen statements, and all health and structure/function claims. Within two years of enactment, the FDA would establish a publicly searchable electronic database.

This is the third time Senator Durbin has introduced this legislation, following failed attempts in 2022 and 2024. The bill has support from the Council for Responsible Nutrition (CRN), Consumer Federation of America, USP, U.S. PIRG, and supplement company Ritual. It faces opposition from the Natural Products Association (NPA), which argues the bill would fundamentally alter the DSHEA regulatory framework and push the industry toward a drug-style regulatory regime.

The bill's fate remains uncertain in the current Congress, but the underlying policy question — should the FDA know what supplement products are on the market? — will not go away. The FDA has included mandatory product listing in its legislative wish list for multiple consecutive budget cycles.

A separate bill, S.3797 (119th Congress), would establish new prohibited acts relating to dietary supplements, signaling broader Congressional interest in supplement reform beyond just product listing.

Affected Product Categories

CGMP requirements apply uniformly to all dietary supplement categories. However, enforcement patterns in our database show concentration in specific product types:

• Botanicals and Herbal Products — Identity testing is particularly challenging for botanical ingredients, where species adulteration and substitution are common. The FDA has emphasized botanical identity verification as an inspection priority.
• Multivitamins — High-volume products where specification failures affect large consumer populations.
• Specialty Supplements — Products making targeted health claims (joint support, cognitive function, etc.) that may attract regulatory scrutiny for both GMP compliance and labeling claims.
• Weight Management — A category with elevated risk for both GMP violations and intentional adulteration with undeclared active pharmaceutical ingredients.
• Sports Performance and Protein Powders — NSF Certified for Sport and Informed Sport certifications have become near-mandatory for products targeting professional athletes, creating a de facto compliance tier above baseline CGMP.
• Probiotics and Prebiotics — Live organism products present unique manufacturing challenges, including viability testing and storage conditions that go beyond standard CGMP requirements.

Products containing kratom and NMN (nicotinamide mononucleotide) face additional regulatory complexity beyond GMP compliance. Kratom's legal status as a dietary ingredient remains contested, while NMN's classification has been the subject of ongoing dispute between the FDA and supplement manufacturers regarding whether it qualifies as a dietary ingredient or should be regulated as a drug.

What Companies Should Do

Immediate Priorities

1. Audit your specifications. The number-one violation is the absence of written product and component specifications. Every finished product must have documented specifications for identity, purity, strength, composition, and contaminant limits. Every incoming component must have specifications that ensure the finished product will meet its own specifications. If these documents do not exist, create them before doing anything else.

2. Verify component identity independently. A certificate of analysis from your supplier is not sufficient. You must conduct at least one appropriate test or examination to verify the identity of each dietary ingredient before it enters production. For botanical ingredients, this may require microscopic examination, chemical fingerprinting (HPTLC, HPLC), or DNA barcoding depending on the ingredient and the risk of adulteration.

3. Fix your documentation. Batch production records must be completed contemporaneously — at the time each step occurs, not reconstructed after the fact. Master manufacturing records must be specific enough to produce consistent results. Laboratory SOPs must be written, followed, and documented.

4. Establish a complaint system. 21 CFR 111 Subpart O requires a written procedure for reviewing and investigating product complaints. Many small manufacturers lack any formal complaint handling process, which is both a regulatory violation and a missed opportunity to catch quality problems early.

Strategic Investments

5. Consider third-party certification. NSF, USP, or ConsumerLab certification provides independent verification of GMP compliance and product quality. For companies selling through major retailers, healthcare practitioners, or athletic channels, certification is increasingly a market access requirement rather than a nice-to-have.

6. Monitor the legislative landscape. The Dietary Supplement Listing Act of 2026 may or may not pass, but the policy direction is clear: more transparency, more accountability, more data flowing to the FDA. Companies that build product listing and registration capabilities now will be ahead of the curve if and when legislation passes.

7. Prepare for NDI scrutiny. If your products contain ingredients that were not marketed in the United States before October 15, 1994, you may need a New Dietary Ingredient Notification (NDIN). The FDA is working toward final NDI guidance with a target of publishing the first section by late 2026. Companies relying on novel ingredients should evaluate their NDI status and prepare notifications proactively.

8. Track your supply chain. CGMP compliance starts with knowing what is in your ingredients. Establish supplier qualification programs, conduct periodic audits, and maintain full traceability from raw material to finished product. Contract manufacturers should be held to the same standards as in-house operations — and audited accordingly.

For Contract Manufacturers

Companies using contract manufacturers (like Cosmax NBT USA, which appeared in our database) should recognize that outsourcing production does not outsource regulatory responsibility. The brand owner remains responsible for ensuring that the contract manufacturer operates in compliance with 21 CFR 111. This means conducting pre-qualification audits, reviewing batch records, verifying specifications, and maintaining oversight throughout the manufacturing relationship.

The FDA has shown willingness to issue warning letters to both contract manufacturers and the brands they produce for. A single contract manufacturer's failure can cascade across dozens of product lines and brand names.

Regulatory Outlook

The dietary supplement GMP landscape in 2026 sits at an inflection point. The CGMP rule is nearly 20 years old and the FDA has acknowledged that modernization is needed. The ODSP is evaluating updates to the GMP framework, reviewing DSHEA labeling requirements, and working toward final NDI guidance — all within existing statutory authority.

Meanwhile, legislative efforts to establish mandatory product listing continue. Whether the Durbin bill passes in this Congress or not, the gap between the FDA's knowledge of the supplement market and the market's actual size remains a fundamental regulatory challenge. An agency that does not know what products exist cannot effectively enforce manufacturing standards for those products.

For companies, the practical takeaway is that the compliance floor is rising. Firms that treat CGMP as a box-checking exercise — or worse, ignore it entirely — face increasing risk. Those that invest in genuine quality systems, third-party verification, and supply chain transparency will be better positioned regardless of how the regulatory environment evolves.

The FDA inspects only 4-5% of supplement facilities in any given year. But when inspectors arrive, nearly half of the facilities they visit receive citations. The odds are not in favor of companies relying on the inspection gap as a compliance strategy.