Guide
Dietary Supplement Readiness: One Spine From 21 CFR 111 to NDI, AER and Third-Party Certification
Dietary supplement manufacturers and brand-owners operate inside the most fragmented regulatory frame of any FDA-regulated category. 21 CFR 111 is the cGMP base. DSHEA defines what a supplement is and what claims it can make. 21 CFR 190 governs new dietary ingredient (NDI) notifications. 21 CFR 111 Subpart B and DSHEA Title II govern serious adverse event reporting. And on top of FDA, the major retailers (Amazon, Costco, Whole Foods, Walmart) effectively require NSF/ANSI 173 or USP <2750> third-party certification as a market-access condition. A contract manufacturer or brand-owner that wants to ship product needs all five running at once. This hub maps the path and links to the detailed spoke guides.
Start free trial Free trial, no credit card, onboard in days, not months.
The five readiness paths a supplement operation actually runs
Path 1 — 21 CFR 111 cGMP: the federal manufacturing baseline, with Subpart E (component identity testing) and Subpart F (production and process control records) as the two FDA-483 hot zones. Path 2 — NDI notification: any dietary ingredient not marketed before October 15, 1994 needs a 75-day pre-market notification under 21 CFR 190.6. Path 3 — Structure/function claims under DSHEA §6: 30-day FDA notification, mandatory disclaimer, substantiation file. Path 4 — Serious adverse event reporting under DSHEA Title II / 21 CFR 111: 15-business-day MedWatch 3500A clock with one-year recordkeeping. Path 5 — Third-party certification (NSF 173, USP <2750>, NSF Certified for Sport): voluntary on paper, mandatory in practice for retailer placement.
Why 21 CFR 111 dominates the FDA-483 picture
FDA enforcement summaries for dietary supplement plants consistently place Subpart E (component identity verification at 21 CFR 111.75) and Subpart F (production and process control records at 21 CFR 111.103) at the top of the citation list. Identity-test failures are the single most common observation — a botanical labelled as one species turning out to be another, or a component released on a supplier COA without confirmatory in-house testing. Production-record gaps come second — missing batch records, incomplete master manufacturing records, or specification deviations not investigated. Both are paperwork problems, not chemistry problems, which is why a system that generates the records automatically closes most of the gap.
DSHEA, NDI, and the claim/ingredient discipline that runs in parallel
DSHEA defines a dietary supplement and limits its claims to structure/function ("supports immune health") not disease ("treats flu"). A structure/function claim triggers a 30-day FDA notification under DSHEA §6 plus a substantiation file the brand-owner must hold. An ingredient not marketed before October 15, 1994 triggers an NDI notification under 21 CFR 190.6 — 75 days pre-market, with safety dossier. FDA's NDI rejection rate is high (~75% historically) because most notifications under-document history-of-use and safety. The discipline is more dossier than manufacturing, but it is the gate to legally market a product.
Third-party certification: NSF 173, USP <2750>, and retailer market access
NSF/ANSI 173 (Dietary Supplements) and USP <2750> (Good Manufacturing Practices for Dietary Supplements) are voluntary third-party certification standards layered on top of 21 CFR 111. They are de facto market access requirements for Amazon (NSF or USP certification for many supplement categories), Costco (NSF Certified for Sport for some categories), Whole Foods (Premium Body Care), and increasingly Walmart and Target. A brand-owner that does not hold one of these certifications is effectively locked out of the largest retail channels, regardless of FDA compliance.
Adverse event reporting: the 15-day clock most supplement firms underestimate
DSHEA Title II (Dietary Supplement and Nonprescription Drug Consumer Protection Act, 2006) requires manufacturers, packers and distributors of dietary supplements to report serious adverse events to FDA within 15 business days of receipt, using MedWatch Form 3500A, with one-year recordkeeping. The definition of "serious" tracks the human drug definition — death, life-threatening, hospitalisation, persistent or significant disability, congenital anomaly, or medical intervention to prevent same. Most supplement firms have an SOP but underestimate the intake-to-report clock and the upstream evidence (lot, expiry, complaint narrative) that has to be assembled inside 15 business days.
A 90-day five-path readiness path
Days 1–15: portfolio mapping — which products run NDI vs grandfathered, which claims are structure/function vs disease, which retailers require which certification. Days 16–35: 21 CFR 111 Subpart E + Subpart F internal audit. Days 36–55: NDI dossier currency review and structure/function claim substantiation refresh. Days 56–75: third-party certification gap (NSF 173 / USP <2750>) and audit-pack assembly. Days 76–85: AER process and 15-business-day clock rehearsal. Days 86–90: integrated management review and mock FDA / NSF inspection.
Standards covered in this guide
Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.
21 CFR 111
The FDA cGMP for dietary supplements — identity testing on every incoming component, MMR/BPR, quality unit sign-off on every batch.
NDI Notification
An NDI (New Dietary Ingredient) Notification is the 75-day premarket safety filing required under FD&C Act §413 and 21 CFR 190.6 before a dietary supplement containing a 'new' dietary ingredient — one
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Industries this hits hardest
Frequently asked
Is 21 CFR 111 the same as 21 CFR 211?
No. 21 CFR 111 is the dietary supplement cGMP. 21 CFR 211 is the human drug cGMP. They share concepts (master records, batch records, identity testing) but differ in specifics — 111 has its own identity-test rule (Subpart E), its own production-record rule (Subpart F), and a narrower scope. A facility making both supplements and drugs runs both regulations on the relevant lines.
Do I need an NDI notification for every new product?
No — only for products containing a new dietary ingredient (one not marketed in the US before October 15, 1994). A reformulation using grandfathered ingredients does not need an NDI notification. A new botanical extract, a new synthetic, or a chemically altered form usually does.
Is NSF 173 or USP <2750> legally required?
Neither is federally required — both are voluntary third-party certifications. But major retailers (Amazon, Costco, Whole Foods) require one of them as a condition of placement for many supplement categories, so for any brand selling through national retail they are effectively mandatory.
What is the difference between a structure/function claim and a disease claim?
A structure/function claim describes the role of a nutrient or dietary ingredient in maintaining normal structure or function ("calcium supports bone health"). A disease claim states or implies the product diagnoses, treats, cures or prevents a disease, and is not allowed on a supplement label without drug approval. The line is enforced strictly — "supports cardiovascular health" is allowed, "lowers cholesterol" is not.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.
Related reading
- 21 CFR 111 Readiness: Dietary Supplement cGMP Subparts E & F
- NDI Notification Readiness: 21 CFR 190.6 New Dietary Ingredient Dossier
- NSF 173 & USP <2750> Readiness: Third-Party Supplement Certification
- Structure/Function Claims Readiness: DSHEA §6, Disclaimers & Substantiation
- Supplement AER Readiness: DSHEA Title II Serious Adverse Event Reporting
- Supplement Identity Testing Readiness: 21 CFR 111 Subpart E
Spot something off? .