FDA cGMP requirements for nutraceutical gummies

Part 111 in one paragraph

21 CFR Part 111 is the FDA's current Good Manufacturing Practice regulation for dietary supplements. It's the legal floor every supplement made in or imported into the United States has to clear. It covers everything from how the facility is built and cleaned to who's allowed to release a finished lot for distribution. Compliance isn't optional and it isn't graded on a curve — either the regulation is met or it isn't, and the FDA enforces through periodic inspections and warning letters.

This is the practical brand-owner's overview. It's not legal advice and it doesn't substitute for reading the actual regulation. But by the end of it you should know what your manufacturer is supposed to be doing and what to look for when you audit them.

The eight subparts, summarized

Part 111 is organized into subparts A through P. Most brand owners never read past the table of contents. Here's what each one actually requires:

Subpart A — General provisions

Definitions and scope. Defines "dietary supplement," "batch," "lot," "component," and the difference between "ingredient" and "raw material" in a way that becomes important when you read the rest of the regulation. This is the section that tells you the rule applies to everyone who manufactures, packages, labels, or holds dietary supplements — including brokers and warehouses, not just the factory.

Subpart B — Personnel

Everyone touching product must be qualified by education or experience for their role, must wear protective gear, and cannot work production if they have an illness that could contaminate product. Sounds obvious; FDA cites people on this regularly. Personnel records have to exist on file showing training has been completed and reviewed.

Subpart C — Physical plant and grounds

The facility has to be designed, constructed, and maintained to prevent contamination. Real-world implications: separate quarantine area for incoming raw materials, segregated production lines for allergens, controlled access (locked rooms with logged entry for sensitive areas), positive air pressure cascades from cleaner to dirtier zones, and pest control programs documented in writing.

Subpart D — Equipment and utensils

Anything that contacts product must be cleanable, designed not to leach contaminants, and on a documented cleaning schedule. Critical for gummy manufacturing: starch molds, depositors, cooling tunnels, and coating drums all have cleaning validation requirements. The equipment file should have cleaning SOPs, validation records, and calibration logs for everything that measures temperature, weight, or time.

Subpart E — Production and process controls

This is the heart of the regulation. Every product must have a master manufacturing record (MMR) — the recipe and procedure document — and every batch must have a batch production record (BPR) — the actual execution record proving the MMR was followed. The MMR is approved by quality before any batch is made. The BPR is reviewed and signed by quality after the batch is finished. No BPR signoff = no release = product cannot legally ship.

Subpart F — Quality control

Quality control must be a separate function from production, with the authority to reject lots that don't meet spec. This is structural — the QC manager cannot report to the production manager, because that creates pressure to release marginal lots. The QC function approves specs, reviews BPRs, releases or rejects every lot, handles investigations, and maintains the change control system.

Subpart G — Components, packaging, and labels

Every incoming raw material (called a "component" in Part 111) must be identified, quarantined, sampled, tested, and released before use. Identity testing on at least one attribute is required by regulation, with an exemption process for "components that are unlikely to be misidentified" that the FDA has been progressively tightening. Most CMOs test by HPLC, FTIR, or microscopy depending on the ingredient.

Labels are also components under Part 111. You need supplier qualification, incoming inspection, and reconciliation at the end of every run (printed labels in vs. labels applied vs. labels destroyed must balance). Missing labels at end-of-run is a common audit finding.

Subpart H — Master and batch records

Detailed requirements for the MMR and BPR documents themselves. The MMR specifies the formula, the manufacturing instructions, the in-process specs, the finished product specs, the equipment, and the testing required. The BPR is the contemporaneous record proving each step was executed with the right inputs and outputs.

Subpart I — Laboratory operations

Methods must be validated. Equipment must be calibrated on a documented schedule. Reference standards must be tracked. Whether testing is done in-house or contracted to an outside lab, the principal manufacturer is still responsible for verifying the lab's competence and maintaining the records.

Subpart J — Manufacturing operations

In-process controls — the monitoring that happens during the run. For gummies this typically includes slurry brix, slurry pH, deposit weight (per-piece weight check at intervals), drying time and temperature, finished-piece dimensions, and water activity at coating. Each in-process spec has an acceptable range and an out-of-spec response in the MMR.

Subpart K — Packaging and labeling operations

Procedures for the packaging and labeling step. Includes line clearance (verifying the previous product's labels are removed before starting the next product), label reconciliation, tamper-evident packaging requirements, and lot number application on every saleable unit.

Subpart L — Holding and distributing

How finished product and raw materials are stored. Temperature monitoring, FIFO rotation, traceability so a recall can pull every unit of a specific lot from distribution.

Subpart M — Returned products

Procedures for handling returns. Returned product cannot be sold again without quality review and, if appropriate, retesting.

Subpart N — Complaints

Every consumer complaint must be logged, investigated, and assessed for whether it represents a quality issue. Serious adverse event reports (SAERs) have their own statutory reporting timeline under separate law (FDAAA Title 9), but the complaint file feeds into that process.

Subpart O — Records and recordkeeping

How long records must be kept (at least one year past the date of distribution, or one year past expiration, whichever is later — for most supplements this is 3+ years). What records are required. Who's allowed to sign them. Whether they can be electronic (yes, under 21 CFR Part 11 if so).

Subpart P — Reserved

Empty. Reserved for future use.

What this looks like in practice

For a finished gummy lot to legally ship in the US, the manufacturer's QC function has to have:

1. Identity-tested every active ingredient and every excipient in that lot
2. Confirmed the master manufacturing record was followed (signed BPR)
3. Verified all in-process checks fell within spec
4. Tested the finished product for identity, potency, and microbiological release
5. Tested for heavy metals (lead, arsenic, cadmium, mercury) at a minimum
6. Issued a Certificate of Analysis (COA) tied to the specific lot, signed by QA
7. Pulled retain samples and filed them in a controlled location
8. Reviewed and resolved any deviations or out-of-spec results from the run

Until every one of those is done, the lot is in quarantine status and can't be released for distribution. A manufacturer that skips steps to make a deadline is either taking on regulatory risk on your behalf or, more often, charging you for tests they're not actually running.

Where brands have liability under Part 111

Here's the part that surprises a lot of brand owners: if your name is on the label, you have manufacturer responsibility under Part 111. Even if you don't own a factory, even if you've outsourced 100% of production, the FDA can hold you accountable as the "manufacturer of record."

What this means in practice:

• You should have a written supplier qualification process for your CMO
• You should review the CMO's Part 111 audit history before signing
• You should have a copy of the master manufacturing record for every SKU on file
• You should receive and retain a COA with every shipment
• You should have a recall procedure that doesn't depend on the CMO being responsive
• You're responsible for adverse event reports for your branded product, even if a third party makes it

The contract you sign with the CMO should make clear which Part 111 obligations sit with them and which sit with you. A handshake won't protect you when a warning letter arrives.

What an FDA inspection looks like

Part 111 facilities can be inspected by the FDA at any time, with or without notice. A routine inspection typically lasts 3–5 days and covers:

• Walking the facility (cleaning practices, traffic flow, equipment condition)
• Reviewing the master and batch records for several recent lots
• Reviewing personnel training files
• Reviewing the QC laboratory (methods, calibration, reference standards)
• Reviewing supplier qualification files
• Reviewing complaint and adverse event files
• Pulling and testing samples of finished product

Findings are issued on Form 483. A serious 483 can lead to a Warning Letter, which is publicly posted on the FDA website and visible to every retailer, partner, and prospective customer. A repeat or unresolved warning letter can lead to seizure, injunction, or import alert.

If you're considering a manufacturer, you can check the FDA's Warning Letters database for their name. A clean record isn't proof of quality, but a Warning Letter is real evidence of a problem.

The short list

If you only remember a few things from this article:

• Part 111 is the law, not an aspirational standard. Every SKU sold in the US has to comply.
• Quality has to be structurally separate from production. One person signing both roles is a red flag.
• Identity testing on every component is required, not optional. Ask your CMO to walk you through their identity testing methodology.
• No BPR = no release. If a lot ships without a signed batch record, it shipped illegally.
• Your brand has manufacturer-of-record liability even if you don't own a factory. Treat your CMO as a regulated business partner, not a vendor.

Part 111 isn't glamorous, but it's the foundation everything else in this category sits on. A brand built on a Part 111-compliant manufacturer can scale into retail, raise capital, and exit. A brand built on a non-compliant one can spend years cleaning up problems that should never have happened.