Contract Manufacturing QMS for Dietary Supplements: Brand-Owner Responsibility, Quality Agreement and the 21 CFR 111 Own-Label Rule

21 CFR 111 applies to anyone who manufactures, packages, labels or holds a dietary supplement — including a brand-owner who outsources the manufacturing but holds the finished product, applies its label and distributes it. The FDA's consistent enforcement posture, reflected in the Compliance Programme Guidance Manual and a long history of Warning Letters to brand-owners whose CMOs caused the violation, is that the brand-owner cannot contract out compliance responsibility. The brand-owner must qualify and audit the CMO, hold and approve the master manufacturing record, maintain a quality unit that reviews batch records, hold finished-product specifications, approve release for distribution, handle complaints and recalls, and maintain records. The contract reassigns activities; it does not reassign liability. A brand-owner that says 'our CMO handled that' in response to an FDA Warning Letter is a brand-owner with a Warning Letter.

The FDA's 2016 Contract Manufacturing Arrangements for Drugs: Quality Agreements guidance, while titled for drugs, is consistently cited in supplement enforcement contexts and reflects the FDA's expectation. A Quality Agreement is a written, signed document distinct from the commercial supply agreement, covering: (1) responsibility allocation across the GMP control set — facilities and equipment, materials management, production, laboratory controls, packaging and labelling, batch records, quality unit, change control, deviation and OOS handling, complaints, recalls, returns, retention samples, stability, validation, regulatory inspections. (2) Communication — notification of deviations, OOS results, customer complaints, regulatory inspections, supplier changes, equipment changes, formula changes, label artwork changes. (3) Audit rights — the brand-owner's right to audit the CMO facility, frequency, scope, response timelines. (4) Term, termination, transition of records and reserve samples on termination. Supplement Quality Agreements add 21 CFR 111-specific allocations: who runs identity testing of components, who runs finished-product testing, who owns the master manufacturing record, who handles label artwork approval.

Qualifying a CMO begins before the supply agreement is signed and continues for the life of the relationship. Pre-engagement: facility GMP inspection (the brand-owner's own quality unit or a qualified third-party auditor), regulatory history review (FDA Warning Letters, 483s, recalls; international regulator findings), insurance and financial review, capability review for the specific dosage forms required, customer reference checks, certifications held (NSF/ANSI 455-2, USP Verified, NSF Dietary Supplement GMP, sport certifications, organic, kosher, halal). Ongoing: scheduled audits (annual or risk-based), unannounced visits where the Quality Agreement permits, monthly or quarterly performance review (on-time delivery, complaint rate, OOS rate, deviation rate, CAPA closure time), participation in mock recall exercises, sharing of regulatory inspection outcomes. NSF/ANSI 455-1 Dietary Supplement Brand-Owner Standard, published as the brand-owner counterpart to 455-2, formalises the qualification programme.

21 CFR 111 requires the quality unit to review the batch record and approve release of every batch. In the contract manufacturing model, the CMO's quality unit performs the first batch-record review; the brand-owner's quality unit performs a second-tier review and holds the release decision for distribution. Practical patterns: the CMO uploads the batch production record (BPR), in-process test results, finished-product test results, deviation reports and CoA into a shared system; the brand-owner reviewer checks completeness, deviation impact, specification compliance, label artwork match, certification scope (organic, halal, allergen) and releases for distribution. The brand-owner reviewer is the final gate, with authority to reject a lot the CMO has cleared.

Four operational hot zones in contract manufacturing. (1) Change control — any change to the formulation, the manufacturing process, a supplier of any active or major excipient, the packaging, the label or the manufacturing site needs prior brand-owner approval. The Quality Agreement should require advance notification with a defined response window; in practice CMOs serving multiple customers attempt to push changes through without per-customer notification — the brand-owner must enforce the clause. (2) Complaints — every consumer complaint flows from the brand-owner's contact channel to the CMO for investigation, with a closure timeline and trending obligation. (3) Recall — the brand-owner leads the recall decision, the CMO supplies the production and distribution records, the brand-owner notifies the FDA. (4) Regulatory inspection — when the FDA inspects the CMO, the inspection scope can include the brand-owner's products on the CMO floor; the brand-owner must be informed in real time and may be required to participate. The Quality Agreement should require immediate inspection notification and access to 483 observations and EIR.