Guide
What is 21 CFR Part 111, and what does it mean for a brand that doesn't manufacture?
By Jake, founder · Published · Updated
21 CFR Part 111 is the FDA regulation that sets current Good Manufacturing Practice (cGMP) for dietary supplements in the United States. It contains no numeric limits: it is a structural and documentary rule that requires written specifications, identity testing of ingredients, a quality control unit, and records that prove each batch met its specifications. A brand that outsources manufacturing is still fully responsible for compliance, because the duty cannot be contracted out.
Most people who search for 21 CFR Part 111 want two things: to know what it actually says, and to know whether it applies to them if they never touch a machine. The answers are “less than you fear, in a different way than you expect” and “yes.”
What Part 111 is
Title 21 of the Code of Federal Regulations, Part 111, is FDA's rule on current Good Manufacturing Practice in manufacturing, packaging, labeling, or holding operations for dietary supplements. It was issued in 2007 and applies to every firm that performs any of those operations for a supplement sold in the United States. Its purpose is stated in its first section: to ensure the quality of the dietary supplement and that it is packaged and labeled as specified.
The single most useful thing to understand about Part 111 is what it does not contain. It contains no numeric limits. There is no table of maximum lead, no microbial count, no potency tolerance anywhere in the rule. Part 111 is structural and documentary: it says you must have specifications, you must have a way of confirming that materials and batches meet them, you must have people responsible for making that call, and you must keep the records that show it happened. What the numbers in your specifications are is left to you, informed by compendial standards, retailer programmes, and state law. That is why a page like the requirements library exists at all: Part 111 requires that a limit be set and met; it does not tell you the limit.
The structure that matters, subpart by subpart
The rule is organised into subparts. A brand owner does not need to memorise all of them, but four ideas recur throughout and are the ones a reviewer will ask about.
| Requirement | Where in Part 111 | What it means in practice |
|---|---|---|
| Quality control unit | Subpart F | Named personnel with the authority to approve or reject components, in-process material, and finished batches, and to review records. Someone must be able to say no. |
| Specifications | Subpart E | Written specifications for identity, purity, strength, and composition of components and finished product, and limits on contaminants that may adulterate it. The rule requires the specifications to exist and be met; the values are yours to set. |
| Identity testing | Subpart E | Every dietary ingredient must be confirmed as what it claims to be, by at least one appropriate scientifically valid method, before use. Documented, not assumed. |
| Master Manufacturing Record (MMR) | Subpart H | The written recipe and process for each product at each batch size: ingredients, weights, steps, controls, and the specifications each step must meet. |
| Batch Production Record (BPR) | Subpart I | The record of one batch actually made against the master: what was weighed, by whom, what was tested, the results, and the quality control unit's release decision. |
| Records and record-keeping | Subpart P | Records must be kept for one year past the shelf-life date (or two years past distribution where no shelf-life is stated) and made available to FDA on request. |
Subpart references are to the structure of 21 CFR Part 111 as published in the eCFR. Read the rule text itself for the operative language; this table is a map, not a substitute.
Specifications and identity testing
Specifications are the spine of the rule. Part 111 requires written specifications for the identity, purity, strength, and composition of every component and every finished batch, plus limits on any contaminant that could adulterate the product. It then requires that those specifications be met, and that meeting them be established by testing or examination, not by assumption, and not by a supplier's word alone.
Identity testing is the part of this that most often surprises brands. Before a dietary ingredient is used, its identity must be confirmed by at least one appropriate, scientifically valid method. A supplier's certificate does not satisfy this on its own. An ingredient used without a documented identity confirmation renders the finished product adulterated under the rule, however clean the finished-product test comes back.
The quality control unit
Part 111 requires a quality control operation with named personnel who have the authority to approve or reject components, packaging, labels, in-process material, and finished batches, and who review the records that support each decision. The point is independence: the person who decides a batch can ship must be able to say it cannot. In a contract-manufacturing arrangement this unit lives at the manufacturer, but the release decision for your product against your specifications is a decision you should see documented, not infer from a shipment arriving.
MMR and BPR: the plan and the proof
Subpart H requires a Master Manufacturing Record for each unique formulation and batch size: every ingredient and its weight or measure, each step of the process, the controls at each step, and the specifications each step must satisfy. Subpart I requires a Batch Production Record for every batch actually made, following the master and recording what happened: the actual weights, who performed each step, the tests run and their results, and the quality control unit's review and release. If the MMR is the recipe, the BPR is the receipt. When a reviewer or an inspector wants to know whether a specific lot was made properly, the BPR is what answers.
Records
Everything above generates records, and Subpart P says how long they must be kept and that they must be available to FDA on request. In practice, the records live at the facility that made the product. That is fine for an FDA inspection of the facility. It is not fine for a brand that is asked for its file by a platform, a retailer, or its own customer and discovers that it has never held a copy of anything.
What this means for a brand that does not manufacture
Part 111 applies to any person who manufactures, packages, labels, or holds a dietary supplement, and FDA has been consistent that a brand owner who has a product made under its name is responsible for that product complying with the rule. The manufacturer performs the operations and holds the records; the brand owner answers for the outcome. You can allocate every task in a quality agreement. You cannot allocate the responsibility. This is covered in more depth in what your contract manufacturer is responsible for, and what stays yours.
The operational consequence is modest and specific. A non-manufacturing brand meets its share of Part 111 by holding, per product and per lot, the documents that show the rule was followed on its behalf: the manufacturer's cGMP certificate for the facility that made the product, the specifications the product was made to, and a Certificate of Analysis for each lot showing the batch was tested against them. Not the BPRs themselves, which stay at the factory, but enough to prove, on demand, that they exist and that the batch passed.
Why Amazon is the reason it now matters day to day
For most small brands, FDA is a remote possibility and a marketplace is a daily fact. Amazon's verification programme for dietary supplements requires evidence that the product was manufactured under cGMP (a current certificate for the manufacturing facility, reviewed by an Amazon-approved TIC provider) together with a Certificate of Analysis for the product, and it withholds or removes the listing until that evidence is reviewed. FDA inspects factories; Amazon asks the brand for the file. In practice the platform is the first party that ever asks a brand to demonstrate what Part 111 already required, and it asks on its own clock. That is the practical forcing function: not the regulation, but the marketplace that made the regulation's paperwork a condition of selling.
Where the numbers actually come from
Because Part 111 sets no limits, the values a Certificate of Analysis is judged against come from other authorities: compendial standards, retailer programmes, and state law. Those tables, with the citation and verification date for every value, are published in the requirements library. If you want to know whether the documents you hold today would clear a review against them, the free gap check reads a COA and names what is missing, line by line, with the citation.
Frequently asked questions
- Does 21 CFR Part 111 set limits for heavy metals or microbes?
- No. Part 111 sets no numeric limits for any contaminant. It requires the manufacturer to establish specifications, including limits on contaminants that may adulterate the product, and to test or examine against them. The actual numbers come from elsewhere: compendial standards, retailer programmes, and state law. Part 111 requires that a limit exist and be met; it does not say what the limit is.
- My contract manufacturer is cGMP certified. Am I covered?
- Not automatically. Part 111 applies to anyone who manufactures, packages, labels, or holds a dietary supplement, and FDA's position is that a brand owner who has a product made under its name is responsible for the product complying with the rule. A quality agreement allocates tasks between you and the manufacturer; it does not transfer the responsibility.
- What are the MMR and the BPR?
- The Master Manufacturing Record (Subpart H) is the written recipe and process for a product at a given batch size: every ingredient, weight, step, and specification. The Batch Production Record (Subpart I) is the record of one actual batch made against that master, showing what was weighed, who did what, what was tested, and whether the batch met specification. The MMR is the plan; the BPR is the proof.
- What is identity testing under Part 111?
- Before a dietary ingredient is used, the manufacturer must confirm it is what it claims to be, using at least one appropriate scientifically valid test or examination. It is a documented requirement of the rule, not a best practice: an ingredient used without identity confirmation makes the finished product adulterated regardless of how the finished product tests.
- Why does Amazon come up in a question about an FDA regulation?
- Because Amazon's supplement verification programme asks for evidence that the product was made under cGMP (a current certificate for the manufacturing facility, reviewed by an approved TIC provider) and a Certificate of Analysis for the product. FDA inspects factories; Amazon asks brands for the file. For most brands, the platform is the first party that ever asks to see it.