Identity testing, which the rule requires
Updated
On this page5
Dietary supplements are one of the few small-manufacturer categories with an explicit federal cGMP rule, and it applies to everyone.
What 21 CFR 111 actually demands
21 CFR Part 111 sets current good manufacturing practice for manufacturing, packaging, labeling and holding dietary supplements. Since June 2010 it has applied to all manufacturers regardless of size. There is no small-operator exemption.
In practice it means written specifications, testing or verification against them, production and process control records, a quality unit that reviews and approves, and retention of records and reserve samples.
Why identity is the one they insist on
Of everything in the rule, identity testing of incoming components is the requirement that catches small manufacturers most often, and the reasoning is straightforward: if you do not know what the material is, nothing downstream is meaningful.
Botanical powders in particular are substitutable, adulterable and frequently mislabeled in the supply chain. A certificate of analysis from a supplier is evidence of what the supplier believes; identity testing is how you know.
The rule allows verification approaches rather than testing everything yourself, but the obligation to establish identity does not go away because a supplier asserted it.
What it costs and who does it
Contract laboratories run identity, potency, heavy metals and microbial panels. Cost per test is modest; testing every component of every lot is not, which is why a supplier qualification program exists: test thoroughly at qualification, then verify on a defined schedule.
That is a written program rather than a habit, and writing it down is itself part of what the rule asks for.
The records are the obligation
Much of 21 CFR 111 is documentary. Specifications, batch records, deviations, the quality unit's approval, and reserve samples held for a defined period.
A small manufacturer who blends carefully and keeps nothing is non-compliant in a way that is invisible until somebody asks. The records are not evidence of compliance; they are a large part of what compliance is.