If you sell your own supplement brand on Amazon and a contract manufacturer makes the product, the short answer is yes, you still need a GMP program. It will not look like the one your manufacturer runs, and it will be smaller, but FDA does not treat the name on the label as a bystander. This is one of the most commonly misunderstood points in the supplement industry, and it tends to surface at the worst possible moment: an Amazon listing suspension, a customer complaint, or an FDA investigator asking for your records.
This article walks through what the regulation says, what Amazon expects, what you can hand off to your contract manufacturer, and what you cannot. I'm writing it as someone who has sat on both sides of this conversation, with brand owners who assumed the manufacturer's certificate covered them and with manufacturers who were tired of carrying a brand's quality gaps.
Does a Contract Manufacturer Make You GMP Compliant?
No. A contract manufacturer being compliant with 21 CFR Part 111 does not make your brand compliant by association, because the responsibility for the finished product follows the product to the person who puts their name on it and sells it.
Here is the legal logic. Section 402(g)(1) of the FD&C Act (21 U.S.C. 342(g)(1)) says a dietary supplement is adulterated if it has been prepared, packed, or held under conditions that do not meet current good manufacturing practice regulations. Part 111 is that regulation. Under 21 CFR 111.1, it applies to anyone who manufactures, packages, labels, or holds dietary supplements. When FDA published the final rule in the Federal Register on June 25, 2007 (72 FR 34752), FDA's preamble discussion of contract manufacturing and own-label distributors takes the position that a firm that contracts out operations remains responsible for ensuring the finished product complies. Read that discussion directly in the preamble rather than relying on a summary, including for how it treats firms that sell product under their own label.
Notice what that does and doesn't say. It doesn't say you must run a plant. It says the product has to be made in compliance, and you are accountable for that outcome. A brand owner who never touches a capsule can still be the party FDA writes to when the product is adulterated or misbranded.
Think of it this way: your contract manufacturer is responsible for doing the work correctly, and you are responsible for knowing that they did.
What Does FDA Actually Expect From the Brand Owner?
FDA expects the brand owner to make sure the product is manufactured to specifications that you set. It also expects a facility that you have qualified and quality decisions that someone on your side can defend. Part 111 is written for the manufacturer, but several of its requirements land squarely on the party who owns the specifications and the release decision.
The practical expectations break down like this:
- Specifications. Under 21 CFR 111.70, specifications for the finished batch, including identity, purity, strength, composition, and limits on contaminants, have to be established. If your contract manufacturer wrote them from a template and you never reviewed them, that is a gap you own.
- Verification that specifications are met. 21 CFR 111.75 requires testing or examination to verify that specifications are met, including identity testing of dietary ingredients. If you cannot show that the finished batch was verified against specifications you approved, you have little to stand on.
- Quality control authority. 21 CFR 111.105 requires a quality control function, and 111.123 requires that quality control personnel review the batch production record and make the release decision. When a contract manufacturer releases a lot, it should be releasing against your requirements, and your quality agreement should say who can release, who can reject, and who decides when a deviation occurs.
- Product complaints. 21 CFR 111.553 and 111.560 require that complaints related to CGMP be reviewed by quality control and investigated where appropriate. Customer reviews and returns on Amazon land on you, not on your manufacturer.
- Records. 21 CFR 111.605 requires records to be kept for one year past the shelf life date, or, if no shelf life dating is used, two years beyond the date of distribution of the last batch of dietary supplements associated with those records. This is a records requirement under Subpart P, separate from the complaint requirements above. Someone has to make sure the batch records that support your product still exist and can be produced.
If you want a closer look at how to structure the vendor side of this, the article on GMP supplier and vendor qualification procedures covers the qualification mechanics that apply when a contract manufacturer is your most important supplier.
Which Obligations Stay With You Regardless of the Contract?
Three obligations stay with the brand owner almost no matter how the contract is written: labeling accountability, serious adverse event reporting, and the response to a complaint or recall.
Labeling. Under 21 CFR 101.5, the label must carry the name and place of business of the manufacturer, packer, or distributor. If the name on the label is not the manufacturer, the label has to say "Manufactured for," "Distributed by," or a similar phrase. That statement is a quiet admission of who is accountable. Your claims, your Supplement Facts panel under 21 CFR 101.36, and your allergen declarations are yours to get right, even if the contract manufacturer's graphic designer built the file.
Serious adverse event reporting. Section 761 of the FD&C Act (21 U.S.C. 379aa-1), added by the Dietary Supplement and Nonprescription Drug Consumer Protection Act of 2006, makes the "responsible person" the one whose name appears on the label. That person must submit a serious adverse event report to FDA within 15 business days of receiving it, and the label must carry a domestic address or phone number for reporting. New medical information about the event received within one year of the initial report must also be submitted to FDA within 15 business days of receipt. Section 761(e) also requires you to keep records related to the report, which the statute sets at six years, so confirm the current period against the statute when you write your procedure. Your contract manufacturer is not the one receiving the email from a customer who ended up in the emergency room. You are.
Complaints, investigations, and recalls. When a customer on Amazon reports a foreign object, an unexpected reaction, or a product that doesn't match the label, the clock starts with you. A recall decision, the public communication, and the notice to Amazon sit with the brand owner. A contract manufacturer will usually cooperate, but only as well as your agreement and your relationship allow.
What Does Amazon Require for Supplement Sellers?
Amazon's dietary supplement policy has asked sellers to provide supporting documentation, such as third-party GMP certification, along with ingredient and label information. Certifiers that have historically been referenced include NSF, UL, and USP. We did not check Amazon's current policy as of the date of this article, and the accepted programs and document requirements change, so read the current version in Seller Central before you assume you are covered.
This matters for a reason that has nothing to do with FDA. A listing that gets suspended for a documentation gap can cost you more revenue in a week than a quality program costs in a year. Brand owners often discover the Amazon requirement first and the regulatory one second, which is a backwards way to learn it, but it gets them to the table.
Two cautions are worth stating plainly. First, a certificate held by your contract manufacturer is evidence about their facility, not a substitute for your own controls. Second, the scope of the certificate matters: a certification that covers tablets does not necessarily cover the powder blend or the gummy you just launched.
What Can You Delegate and What Do You Have to Keep?
You can delegate the physical work to a contract manufacturer, and you can delegate a good deal of the quality testing, but you cannot delegate the decision about whether you are comfortable selling the product. The table below is how I usually frame it with brand owners.
| Responsibility | Can the contract manufacturer perform it? | What the brand owner must retain |
|---|---|---|
| Receiving and testing ingredients (21 CFR 111.75) | Yes | Approved specifications and review of identity test results or certificates |
| Manufacturing per master manufacturing record | Yes | Approval of the formulation and any change to it |
| Batch record review and release (21 CFR 111.123) | Yes, for the manufacturing portion | Review of batch records or a release package, and final release authority for sale |
| Finished product testing | Yes | Specifications, choice of lab, and review of results including out-of-specification investigations |
| Label content and claims (21 CFR 101.36, 101.5) | Can assist with layout | Final approval and accountability for accuracy |
| Complaint handling (21 CFR 111.553, 111.560) | Can support investigations | Intake, review, decision, and records |
| Serious adverse event reporting (FD&C Act section 761) | No | Entire process |
| Recall decisions and communication | Supports | Decision and execution |
| Supplier audit of the contract manufacturer | No | Initial qualification and periodic requalification |
If you read down the right-hand column, you can see the shape of a brand-owner program. It is a document control habit, a supplier qualification file, a complaint log, an adverse event process, and a release decision that someone signs.
What Does a Right-Sized GMP Program Look Like for a Brand Owner?
A right-sized program for a brand owner is a short set of written procedures and records that prove you know what is being made, who is making it, and what you will do when something goes wrong. It does not need to mirror the manufacturer's quality manual, and copying one would mostly create paperwork you can't follow.
Here is the minimum I would expect to see at a brand-owner company with one to twenty SKUs.
- A qualified contract manufacturer file. Facility registration status, a copy of their most recent third-party or FDA inspection history to the extent they will share it, your own audit or a documented remote assessment, and a requalification schedule.
- A quality agreement. A separate document from the supply agreement that spells out specifications, who tests what, who releases, how deviations and out-of-specification results are handled, how changes are notified, who keeps which records and for how long, and what access you have to the facility and records. This is the single most useful document in the whole arrangement, and it is often the one that doesn't exist.
- Approved specifications and master records. Finished product specifications you signed, a copy of or access to the master manufacturing record, and a change control process so that a formula or supplier change at the manufacturer cannot reach your customers without your knowledge.
- A release procedure. A named person who reviews the certificate of analysis and batch record summary against your specifications before inventory is shipped to Amazon's fulfillment centers.
- A complaint and adverse event procedure. A way to capture Amazon reviews, returns, customer service emails, and direct contacts, with a log, investigation, and the 15 business day serious adverse event pathway.
- A recall plan. Lot traceability from the manufacturer's batch to your Amazon inventory and shipments, and a written plan for who calls whom.
- Training and records. The people running these procedures need to know they exist, and the records need to be retrievable.
For a company just starting out, the dietary supplements GMP page outlines how this kind of program is typically built and what an engagement involves.
What Are the Most Common Gaps I See in Brand-Owner Programs?
The same few gaps appear again and again, and most of them come from a reasonable-sounding assumption that the contract manufacturer is handling it.
No one on the brand side has ever read the batch record. The certificate of analysis arrives, it says "pass," and the product ships. If the testing method was wrong, the specification was too loose, or an identity test was skipped, nobody on your side would know.
Specifications are the manufacturer's defaults. A default specification may be fine, or it may allow a heavy metal limit, a microbial limit, or an assay range that does not match what your label claims. Your label says 500 mg, and the specification says 80 to 120 percent. That is a conversation worth having before a customer has it for you.
Changes happen without notice. A raw material supplier is swapped, a flow agent is added, a facility moves a line. Without a change notification clause in a quality agreement, you may not find out until a complaint arrives.
Adverse events go nowhere. Customer messages about hives or heart palpitations sit in the Amazon seller inbox with no one assigned to evaluate whether they are serious adverse events under section 761.
The undeclared ingredient problem. Brands that sell weight loss, sexual enhancement, or muscle-building products carry the most exposure to adulteration with undeclared drug ingredients. A brand owner who relies solely on a manufacturer's word can be the firm named in an FDA warning letter. FDA's public warning letter database includes cases involving supplements found to contain undeclared drug ingredients. The article on preventing undeclared drug ingredients in supplements goes deeper on the testing and supplier controls that reduce this risk.
What Happens in an FDA Inspection If You Don't Make the Product?
FDA can and does inspect and take action against firms that hold, distribute, or label dietary supplements without manufacturing them. Part 111 applies to those who manufacture, package, label, or hold, so a brand owner that packages, labels, or holds product, including product held at a third-party warehouse, falls within the rule for those operations. A pure brand owner that never holds product is still reached through its role in labeling the product. The FD&C Act's prohibited acts also let FDA act against a person who introduces or delivers adulterated or misbranded product into interstate commerce, which can include the distributor.
If an investigator arrives, the questions tend to go in a predictable direction. How did you qualify this manufacturer? Where are your specifications? Who released this lot and on what basis? Show me your complaint file. Show me how you handle serious adverse events. A brand owner that can hand over a quality agreement, a release record, and a complaint log is in a very different conversation from one who says, "Our manufacturer handles that."
I would not tell anyone that having a program prevents an observation. What it does is turn an investigation about whether you have any control into an investigation about whether your control is working, which is a far better place to stand. If you want to prepare for that scenario specifically, the FDA inspection preparation page lays out how we approach it.
How Do You Get Started If You Have Nothing in Place Today?
Start with the three documents that give you the most protection for the least effort: the quality agreement, the finished product specifications, and the complaint and adverse event procedure. Those cover the places where brand owners most often get hurt, and none of them require a facility or a large team.
After that, a sensible order looks like this. Review the contract manufacturer's compliance history and request a copy of their most recent audit summary. Reconcile your label against your specifications and your master record. Set a release step that a real person signs before inventory ships. Then build the recall and traceability piece, which you can test with a mock recall using one of your lots and an Amazon shipment.
Don't wait for a trigger. Amazon requests, a new retailer, an investor's diligence team, or a customer complaint will force the conversation eventually, and it is cheaper and calmer to have the documents already written.
I would also ask yourself an honest question: if your manufacturer disappeared tomorrow, how much of your product knowledge would disappear with them? If the answer is most of it, the program you need is less about regulatory compliance and more about owning your own brand.
Frequently Asked Questions
Does my contract manufacturer's GMP certificate cover my brand? No. It is evidence about their facility and scope. You still need your own specifications, release decision, complaint handling, and adverse event process.
Do I need a full quality manual? No. A short set of procedures and records that fit your SKUs and your role is enough, as described above.
Who submits serious adverse event reports? The responsible person whose name is on the label, not the contract manufacturer.
What is the first document to write? The quality agreement with your contract manufacturer.
Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, RAC, is a GMP compliance consultant at Certify Consulting. This article is general information about FDA regulations and is not legal advice for your specific situation.
Last updated: 2026-10-02
Frequently Asked Questions
Do I need my own GMP program if my contract manufacturer is GMP certified?
Yes. A manufacturer's certificate shows the status of their facility, but FDA holds the firm whose name is on the label responsible for ensuring the finished supplement complies with 21 CFR Part 111 (see the preamble at 72 FR 34752, June 25, 2007). You need your own qualification file, specifications, release decision, complaint handling, and adverse event process.
Who is responsible for serious adverse event reporting if a contract manufacturer makes my product?
The responsible person is the manufacturer, packer, or distributor whose name appears on the label under section 761 of the FD&C Act (21 U.S.C. 379aa-1). For most Amazon brand owners, that is the brand. A serious adverse event report must be submitted to FDA within 15 business days of receipt, and the label must include a domestic address or phone number for reporting.
What is a quality agreement and do I need one with my contract manufacturer?
A quality agreement is a written document, separate from the supply contract, that defines who sets specifications, who tests, who releases product, how deviations and changes are handled, and who keeps which records. Part 111 does not use the term, but it is the most practical way to document the division of responsibilities, and I recommend one for every contract manufacturing relationship.
Does Amazon require GMP documentation for supplements?
Amazon's dietary supplement policy requires sellers to show that products are made in compliance with Part 111, and it has asked for supporting documentation such as third-party GMP certification. The specific requirements and accepted certifiers change over time, so check the current policy in Seller Central.
Can FDA take action against a brand that does not manufacture its own supplements?
Yes. A supplement made under non-compliant conditions is adulterated under section 402(g)(1) of the FD&C Act, and a mislabeled one is misbranded. FDA can act against the product and the firms that distribute it, which includes brand owners who contract out manufacturing.
Jared Clark
GMP Compliance Consultant, Certify Consulting
Jared Clark is a GMP compliance consultant and founder of Certify Consulting, specializing in FDA GMP requirements for pharmaceuticals, dietary supplements, cosmetics, and food manufacturing.