Heavy Metal Testing for Private-Label Supplement Manufacturers

This guide covers how heavy metal testing responsibility actually works in private-label and contract manufacturing relationships: who carries cGMP duties when manufacturing is outsourced, who should own specifications, how supplier certificates of analysis flow through the chain, and how contract manufacturers can turn testing and certification support into a service differentiator. It is written for contract manufacturers and the brands that rely on them.

Private label is where supplement quality responsibility gets blurriest in practice and clearest in law. The brand assumes the manufacturer "handles testing." The manufacturer assumes the brand knows what specifications it bought. Both assumptions survive right up until a retailer, a plaintiff's attorney, or a state regulator asks a question neither party can answer alone. The relationships that work are the ones that decide, in writing and in advance, who owns which piece of the heavy metal question.

Who is responsible for cGMP when manufacturing is outsourced?

The brand owner who puts its name on the label and distributes the product carries cGMP responsibility, even when every manufacturing step is outsourced. This is the point private-label brands most often get wrong, and the one FDA has been most consistent about.

FDA's dietary supplement cGMP rule applies to anyone who manufactures, packages, labels, or holds dietary supplements (21 CFR Part 111; see also FDA's Small Entity Compliance Guide). In warning letters and guidance, FDA has repeatedly described the own-label distributor, the company that contracts out manufacturing and sells the product under its own brand, as ultimately responsible for the quality of the supplements it releases into commerce, with an obligation to know what manufacturing activities are performed and how, so it can decide whether finished product conforms to specifications and whether to release it.

The practical translation:

• The brand cannot delegate away responsibility by hiring a good manufacturer. It can delegate the work, not the accountability.
• The manufacturer performing the work has its own direct Part 111 obligations for the operations it performs, including establishing specifications and verifying that batches meet them (21 CFR 111.70, 111.75).
• Both parties are exposed under the FD&C Act's adulteration provisions (21 U.S.C. § 342) if the product contains a poisonous or deleterious substance that may render it injurious to health.

Responsibility is shared, in other words, but it is not divided: each party carries duties the other cannot absorb. Any private-label agreement that does not reflect this is drafted against the regulatory reality.

Who owns heavy metal specifications in a co-man relationship?

Because there are no generally applicable federal numeric limits for lead, arsenic, cadmium, or mercury in finished supplements, somebody in the relationship has to pick the numbers. The mature arrangement looks like this:

Two failure modes dominate. First, the silent default: no one chooses limits, so the de facto specification is whatever the ingredient suppliers' COAs happen to show. Second, the proprietary wall: the manufacturer treats specs and methods as trade secrets, leaving the brand unable to answer basic buyer diligence. Both are solvable with a quality agreement that names the numbers, the benchmark, the cadence, and the document access each party gets.

Serving size deserves special attention in private label. Heavy metal benchmarks are dose-based, micrograms per day, so the same bulk formula can conform at one brand's serving size and exceed a benchmark at another's. A manufacturer running one formula across many labels needs the spec conversation per label, not per formula.

How should supplier COAs flow through the chain?

Private-label quality lives or dies on chain-of-custody for test data. The flow that works:

1. Ingredient suppliers provide COAs for each lot of mineral and agricultural inputs, the places metals actually enter, since metals occur naturally in soil, water, and mineral sources.
2. The manufacturer verifies those COAs rather than filing them. Under Part 111, a manufacturer relying on a supplier's COA must qualify the supplier and confirm the certificate's reliability, which in practice means periodic independent retesting of incoming materials. Our guide to supplier certificate of analysis verification covers what qualification actually involves.
3. Finished-product testing confirms what the label ultimately promises, because ingredient-level data alone cannot account for blending, concentration through processing, or contributions from processing aids. The tradeoffs are covered in ingredient testing vs finished product testing: mature programs use ingredient data to control risk upstream and finished-product data to verify the result.
4. The brand receives, and contractually has the right to receive, the finished-product COAs with methods and reporting limits, plus summary visibility into ingredient-level results. A brand that cannot produce this paper trail cannot pass retail diligence or defend its release decisions.

The most common breakdown is step four. Manufacturers accustomed to treating test data as internal records leave their brand customers documentation-poor, and the brands discover it during their first serious retail review, at the worst possible moment.

How can manufacturers offer testing and certification support as a differentiator?

For contract manufacturers, the tightening environment is a commercial opening. Brand customers are being asked harder questions: state disclosure laws are arriving (California's SB 646, mandating heavy metal testing and disclosure for prenatal vitamins, was enacted in October 2025, and SB 1033 would extend testing and public disclosure to protein products), retail verification programs keep expanding, and buyers increasingly expect independently verifiable answers. Most small and mid-size brands cannot build that capability alone. Their manufacturer can.

A manufacturer that packages quality as a service offers:

• Spec sheets brands can hand to buyers: finished-product heavy metal limits with a named benchmark, per label and serving size
• COA transparency by default: methods (validated ICP-MS, per USP <233>-type procedures or FDA's EAM 4.7), reporting limits, and accredited lab identity on every certificate
• A documented testing cadence written into the standard quality agreement rather than negotiated from scratch
• Certification support: sampling access, documentation, and formula-level data that let a brand customer complete third-party certification quickly

That last item converts directly into sales conversations. "Our platform formulas are pre-qualified for heavy metal certification" is a differentiated answer to a question every prospective brand customer is starting to ask.

How does multi-brand efficiency work?

The economics of private-label certification favor the manufacturer-led model. When one manufacturer produces one well-controlled formula for many labels, the underlying quality evidence, ingredient supplier qualification, finished-product results, and testing history are substantially shared. Each additional label is largely the same product with a different serving size and name.

Done well, this means:

• The heavy testing investment (formula qualification, supplier vetting, method validation with the lab) is made once and amortized across every label the formula supports
• Per-label work narrows to what genuinely differs: serving-size dose math against the benchmarks, label claims, and brand-specific documentation
• Simple, well-controlled formulations gain the most, which is why categories like vitamins, creatine, amino acids, electrolytes, and simple whey proteins are the natural starting point; complex botanical blends multiply inputs and variability

For brands, the takeaway is a diligence question worth asking any prospective co-man: how many labels run on this formula, and what testing history exists across them? A formula with deep multi-label history and consistent results is lower risk than a custom formula tested twice.

How does certification work when the manufacturer drives quality?

Heavy Metal Certified is a certification program rather than a laboratory: products are evaluated against a transparent published standard, testing is coordinated through qualified independent laboratories, certified products get a public verification page, and status is maintained through ongoing testing. That structure fits private-label arrangements in either direction:

• Brand-led: the brand applies, and the manufacturer supports with formula documentation, sampling access, and testing history. The certification and the mark attach to the brand's product.
• Manufacturer-led: the manufacturer builds its platform formulas to conform to the published standard and supports each brand customer's certification with an established evidence package, so individual labels can move to certification with less duplicated work.

In both models, the public layer does the commercial work. The brand gets a verification page and a published standard to hand to retail buyers, and the manufacturer gets a credential its sales team can bring to every prospective customer. What certification does not do is move the legal lines: cGMP responsibility stays where FDA put it, certification remains voluntary, and it neither guarantees compliance nor eliminates liability for either party. It makes the quality system visible; the system itself still has to be real. For the full picture, see our guide to heavy metal certification for supplements.

Private-label quality agreement checklist

Before the first production run, the quality agreement should answer, in writing:

• Finished-product limits for lead, arsenic, cadmium, and mercury, per daily serving, with the benchmark named
• Serving-size dose math confirmed per label sharing the formula
• Ingredient COA requirements and the supplier qualification/retest cadence
• Finished-product testing frequency, sampling method, and who selects lots
• Laboratory identity and ISO/IEC 17025 accreditation scope
• Document access: which records the brand receives, in what timeframe, on request
• Out-of-specification procedure: hold, investigate, disposition, and who decides
• Recall and quarantine responsibilities and cost allocation
• Who may make testing claims, with approved language, and who substantiates them
• Whether and how third-party certification will be pursued, and who supports it

If any line is unanswered, that is the line a retail reviewer, a plaintiff's attorney, or a regulator will eventually ask about.

Faq: Heavy Metal Testing for Private-Label Supplements

Who is responsible for heavy metal testing in a private-label supplement? Both parties carry duties. The manufacturer must establish and verify specifications for the operations it performs under 21 CFR Part 111, and FDA holds the own-label distributor, the brand selling the product, ultimately responsible for the quality of what it releases. Neither can contract the responsibility away.

Does a brand need its own testing if the contract manufacturer already tests? The brand needs access to the manufacturer's specifications and results, and a documented basis for trusting them; many brands also commission periodic independent verification testing. What the brand cannot do is release product with no knowledge of how it was tested and still meet FDA's expectations for an own-label distributor.

Are supplier COAs enough to control heavy metals in private label? No. Supplier COAs are the upstream control, and Part 111 requires qualifying suppliers before relying on their certificates. Finished-product testing is what confirms the label's promise after blending and processing. Mature programs use both.

Can one certification cover multiple brands using the same formula? The evidence base is substantially shared when labels run on one qualified formula, but dose-based limits mean each label's serving size must be evaluated, and program mechanics govern how certification and the mark apply per product. Confirm structure with the certification program directly.

What heavy metal limits should a private-label quality agreement specify? There is no federal numeric limit to default to, so agreements typically anchor to USP <2232> daily-dose limits (for example, 10 µg/day lead) or the stricter California Prop 65 safe harbor levels (0.5 µg/day lead), stated per daily serving for each label.

How can a contract manufacturer use certification commercially? By building platform formulas to a published standard and offering certification support (documentation, sampling, testing history) as part of its service, a manufacturer gives prospective brand customers a faster path to retail-grade quality evidence, which is a concrete differentiator in sales conversations.

Whether you are a manufacturer building quality into your platform or a brand that needs verifiable answers from your co-man, a preliminary certification assessment can map what certification would involve for your formulas. Review the published standard at heavy metal testing and certification, or apply for certification.