Guide
What is your contract manufacturer responsible for, and what stays yours?
By Jake, founder · Published · Updated
A contract manufacturer is responsible for making the product under cGMP and holding the manufacturing records. The brand owner remains responsible for the product itself: under the cannot-contract-out doctrine, ultimate responsibility for a non-adulterated, correctly documented product stays with the brand even when every operational task is outsourced. A quality agreement allocates tasks; it cannot transfer responsibility.
Most supplement brands do not run a factory, and the division of labour with a contract manufacturer works well until a platform review or an audit asks for the file. Then the question of who was responsible for what stops being theoretical. The governing principle is simple and widely misunderstood.
The cannot-contract-out doctrine
The brand owner carries the ultimate responsibility for a non-adulterated, correctly documented product, even when formulation, manufacturing, testing, and packaging are all outsourced. This is the position taken in the cGMP framework for dietary supplements (FDA's regulation at 21 CFR Part 111) and mirrored in practice by retail platforms: the party whose name is on the label answers for the product. Outsourcing distributes the work; it does not distribute the accountability.
The practical asymmetry follows directly: the manufacturer holds the records, the brand holds the liability. Batch records, test data, and facility certifications live at the factory, but when a marketplace, retailer, or regulator asks, they ask the brand, and “my manufacturer has that” is the beginning of a document chase, not an answer.
What a quality agreement does, and does not do
A quality agreement is a written allocation of tasks between brand and manufacturer: who sets specifications, who performs which tests, who holds which records and for how long, who notifies whom when something deviates. Every brand outsourcing manufacture should have one, because ambiguity in these tasks is where documentation gaps are born. What a quality agreement cannot do is transfer responsibility. It determines who does the work; the brand remains answerable for the outcome regardless of what the document says.
What to expect the manufacturer to provide
| Document | Cadence | Notes |
|---|---|---|
| Certificate of Analysis | Every lot | Per-lot, matching the lot code shipped. A COA for one lot does not cover the next. |
| cGMP certificate | On request and at each renewal | For the facility that actually made the product, which is relevant when a manufacturer runs multiple sites. |
| Facility registration attestation | On request and at each renewal cycle | FDA's registration database is not public, so verification is attestation-based: a written statement of registration status. |
FDA food facility registration renews on a biennial cadence (even years), during a fixed window each renewal year (10-01 to 12-31). Last verified 2026-07-24. An attestation predating the most recent renewal window is worth refreshing.
Note the third row carefully. Because there is no public registry to consult, a brand's verification of its manufacturer's registration rests on the manufacturer's written word. That makes the attestation a document to obtain, date, and renew like any other, not a fact to assume.
What remains yours alone
- Specifications. The brand decides what the product is supposed to be, meaning identity, strength, composition, and limits on contaminants, and owns the document that says so. A manufacturer can propose specifications; only the brand can adopt them.
- Release decisions.Accepting a lot for sale is the brand's call, made against its own specifications and the lot's COA. Shipping whatever arrives is a release decision too, just an undocumented one.
- Complaint records. Product complaints arrive at the brand, and the record of them (what was reported, what was investigated, what was concluded) belongs to the brand.
- Having the file ready when asked.Platform reviews, retailer onboarding, and audits are addressed to the brand and run on the requester's clock. Holding a current copy of every document above, per SKU and per lot, is the one duty that cannot be delegated even in principle, because it is the duty of answering.
The operational conclusion
Treat the manufacturer as the source of documents and yourself as their keeper. The arrangement fails only in the gap between those roles: the manufacturer has the records but was never asked; the brand is asked but never had them. A standing cadence, with every lot's COA collected on receipt and certificates and attestations refreshed at renewal, closes that gap for the price of an email routine.
Frequently asked questions
- If my contract manufacturer holds all the records, am I off the hook?
- No. The manufacturer holds the records, but the brand owner holds the liability. Regulators and platforms treat the brand whose name is on the label as responsible for the product being non-adulterated and correctly documented, regardless of who physically made it.
- Does a quality agreement transfer responsibility to the manufacturer?
- It cannot. A quality agreement allocates tasks (who tests, who holds which records, who notifies whom) and it is worth having for exactly that reason. But the ultimate responsibility for the product remains with the brand owner; no contract clause changes that.
- What documents should a contract manufacturer provide as standard?
- Per lot: a Certificate of Analysis. On request and at renewal: the facility's cGMP certificate and an attestation of its FDA facility registration. Note that FDA's registration database is not public, so registration is verified by attestation, not by lookup.
- Can I verify my manufacturer's FDA registration myself?
- Not directly. FDA does not publish a public database of food facility registrations, so brands verify registration through the manufacturer's written attestation of its registration status and renewal. Registration renews on a fixed biennial cycle.