What is a cGMP certificate, and how does a brand that doesn't manufacture get one?

What a cGMP certificate is

"cGMP" is current Good Manufacturing Practice, and for U.S. dietary supplements the standard set out in FDA's 21 CFR Part 111. A cGMP certificate is a private certification body's statement that it audited a specific facility against a GMP standard and found the facility met it. Intertek describes its own certification as aligning with the International Alliance of Dietary/Food Supplement Associations' Global Guide to GMP for Supplements, covering areas such as documentation, self-inspections, laboratory testing, and complaint and recall procedures. SGS describes its Amazon-facing verification as confirming that "supplements are manufactured in facilities that meet U.S. FDA cGMP (21 CFR 111/117) or equivalent standards." In both cases the certifying party is a private organization, not FDA, and what it certifies is the facility, not any single product made there.

What it is not: FDA facility registration

Every facility that manufactures, packs, or holds a dietary supplement for the U.S. market must separately register with FDA under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, as later amended by the FDA Food Safety Modernization Act. FDA's own registration page describes what that registration requires: facilities must submit registration information and "an assurance that FDA will be permitted to inspect the facility," and registered facilities must renew "every other year." Nothing in that description involves FDA auditing the facility's manufacturing practices or issuing a pass/fail finding. It is a notification and inspection-access mechanism, not a certification. A facility can be fully registered with FDA and hold no cGMP certificate at all; the two are independent, and a reviewer checking compliance evidence wants the certificate, not proof of registration.

The renewal window above is FDA's own facility-registration cycle, not the certificate's expiry, and is read from operational configuration, last verified 2026-07-24.

What a reviewer checks on the certificate itself

A TIC provider or retailer reviewing a cGMP certificate is not re-running the audit; it is checking that the document on file actually covers the product in front of it. Three things carry the most weight:

• Facility name and address. The certificate must name the exact facility that manufactured the product, not the brand, not a parent company, and not a different plant the same manufacturer operates elsewhere.
• Dates. The certificate's issue date and expiry date, both printed on the document. A certificate past its own expiry is treated the same as one that never existed.
• Scope. What the audit actually covered. Some certificates are scoped to specific product categories or manufacturing activities, and a certificate scoped to, say, capsule manufacturing does not automatically cover a powder blending line at the same site.

This is the same discipline as reading a Certificate of Analysis: identification first, then whether the document actually says what it needs to say. See how to read a Certificate of Analysis for the parallel process on the product-testing side.

How a brand that doesn't manufacture gets one

A cGMP certificate names a facility, and a brand with no facility of its own cannot be the subject of one. What a non-manufacturing brand needs is not its own certificate but a copy of its contract manufacturer's current certificate for the specific plant that makes its product. In practice:

• Ask the manufacturer which certifier audits their facility and request the current certificate directly. Most manufacturers already have one on file for exactly this purpose.
• Confirm the certificate names the facility that actually produces your SKUs, not a sister facility under the same corporate umbrella.
• Confirm it is inside its own validity window on the date you need it, and request a renewal from the manufacturer well before it lapses if you have an upcoming verification.
• Keep the certificate on file per manufacturer, not per product. One facility certificate can cover every SKU that plant makes, as long as the scope matches.

What your contract manufacturer is responsible for beyond this document, and what stays yours regardless, is covered in what your contract manufacturer is responsible for. Questions worth asking before you sign with a new manufacturer, including which certifier they use, are in choosing a contract manufacturer: compliance questions.

Where this fits in an Amazon verification

Amazon's TIC providers ask for the facility's cGMP certificate as one half of a supplement verification, alongside the product's Certificate of Analysis. SGS's own Amazon-verification page states that "each product must be verified annually for every ASIN". Even a certificate that is still valid by its own certifier's clock can need to be handed to a TIC provider again each year, simply because Amazon's review cadence, not the certificate's expiry, is what's forcing the request. What a TIC provider is and why Amazon routes verification through one is covered in what a TIC provider is for Amazon supplements. Compliant Always's free check reads the dates on an uploaded cGMP certificate the same way it reads a COA, and flags when it's missing, mismatched, or aged out, before a paid review does.