Third-Party Testing vs. Certification vs. FDA Compliance: What Each Layer Actually Covers

FDA compliance, third-party testing, and voluntary certification are three different layers with three different jobs: one is a legal duty, one is a verification activity, and one is a public trust structure. This guide explains what each layer actually covers, where brands routinely confuse them, and why the phrase "FDA approved supplement" should never appear in your marketing or your investor deck. It is written for founders and quality leads who need the regulatory picture straight before they spend on any of the three.

The confusion is understandable. All three layers involve testing, all three involve standards, and all three get compressed in marketing copy into a single word: "compliant." But a retail buyer, a plaintiff's attorney, and an FDA investigator each care about a different layer, and a brand that cannot say which layer covers which obligation will eventually answer that question under pressure instead of at leisure.

Does the FDA approve dietary supplements?

No, and this is the myth to retire first because everything else builds on it. By law, FDA does not approve dietary supplements or their labeling before they are sold. The agency states this directly in its consumer guidance: unlike drugs, supplements do not receive premarket review for safety or effectiveness, and firms generally do not have to provide FDA with safety evidence before marketing a product (FDA, Questions and Answers on Dietary Supplements; FDA 101: Dietary Supplements).

That does not mean supplements are unregulated. It means the regulatory model is post-market and duty-based: the firm is responsible for ensuring its products are not adulterated or misbranded, FDA can act against products that violate the law, and the adulteration provisions of the FD&C Act (21 U.S.C. § 342) apply if a product contains a poisonous or deleterious substance that may render it injurious to health.

So strike "FDA approved" from your vocabulary for supplements. It is not a claim any supplement can truthfully make, and making it invites exactly the regulatory attention it pretends to have survived.

What does cGMP compliance actually require?

The operative regulation is FDA's current good manufacturing practice rule for dietary supplements, 21 CFR Part 111. It is a process regulation: it tells you what systems you must run, not what numbers you must hit. For contaminants, the load-bearing sections are two:

• 21 CFR 111.70 requires you to establish specifications, including limits on those types of contamination that may adulterate the finished product. Heavy metals are the textbook example. The rule requires that a limit exist; it does not tell you what the limit should be.
• 21 CFR 111.75 requires you to verify that specifications are met, through testing or examination of components and finished batches, with documented, scientifically valid methods.

Notice what is absent: there are no generally applicable federal numeric limits for lead, arsenic, cadmium, or mercury in finished dietary supplements. The number is yours to set and defend. Most serious quality programs borrow benchmarks to fill the gap: USP <2232> daily-dose limits (for example, 10 µg/day for lead, 5 µg/day for cadmium, mandatory only for products labeled as conforming to USP standards) and California Prop 65 safe-harbor levels, whose 0.5 µg/day lead MADL functions as the strictest widely used benchmark because Prop 65 is enforced largely through private litigation. Our guide to heavy metal limits in dietary supplements walks through all the numbers and where they come from.

cGMP compliance, then, is a legal floor made of duties: qualified suppliers, written specifications, verified batches, documented deviations, held records. It is mandatory, it is audited by FDA inspection, and no seal or certificate substitutes for it.

Where does third-party testing fit inside compliance?

Testing is the verification engine inside the cGMP duty. Section 111.75 requires that you confirm specifications are met using scientifically valid methods, and for elemental contaminants the standard of practice is ICP-MS, following validated procedures such as USP <233> or FDA's own EAM 4.7 elemental analysis method.

"Third-party" adds one specific thing to that engine: the lab is not you and not your co-manufacturer, which removes a conflict of interest from the measurement itself. That matters, and buyers weight it accordingly. But keep its limits in view:

• Third-party testing verifies your specifications. If your internal lead limit is generous, an independent lab confirming you meet it proves little.
• A test covers the lots tested. Frequency and sampling design determine how much the results generalize, which is why how often supplements should be tested for heavy metals is a design question, not a formality.
• Testing produces private documents. Nothing about commissioning an outside lab makes results public, current, or checkable by a customer. What the phrase does and does not promise is covered in what does third-party tested mean for supplements.

Third-party testing is necessary infrastructure for both of the other layers. It is not, by itself, either compliance (which requires the full Part 111 system around it) or certification (which requires an independent standard and verifier above it).

What does voluntary certification add on top?

Certification sits above both layers and does a job neither can: it makes quality claims verifiable by strangers. An independent program publishes numeric limits, coordinates testing through qualified laboratories, evaluates conformance, licenses a mark, and maintains the status through ongoing surveillance. The full anatomy is in our pillar guide to heavy metal certification for supplements, and the commercial decision logic in heavy metal testing vs certification.

Three properties distinguish this layer:

1. The standard is external. "We pass our spec" becomes "we conform to a published independent benchmark." Established program scopes differ: NSF/ANSI 173 combines label-claim verification, contaminant limits, and GMP audits; USP Verified adds off-the-shelf surveillance; Clean Label Project tests retail-purchased samples against Prop 65-derived benchmarks. Comparing scopes is legitimate diligence.
2. The verdict is not yours. An independent body, with its own reputation at stake, stands behind the conformance decision.
3. The status is public and ongoing. A mark backed by a verification page and periodic retesting communicates a maintained practice, not a one-time result.

Under the FTC's Health Products Compliance Guidance, a certification seal is an endorsement: it must come from a genuinely independent certifier and must not imply coverage the certification did not evaluate. Used within scope, it is among the strongest substantiation a purity claim can have.

And to be equally clear about what certification does not do: it is voluntary, it does not make you cGMP compliant, it does not immunize you against adulteration liability, and it is not FDA endorsement of anything. A certified product from a facility with broken batch records is still a compliance problem. The layers stack; they do not substitute.

What are the myths that get brands in trouble?

The direction of travel makes these distinctions more consequential, not less. California enacted SB 646 in October 2025, mandating heavy-metals testing and disclosure for prenatal vitamins, a pending California bill (SB 1033) would extend testing and public disclosure to protein products, and the federal Dietary Supplement Listing Act of 2026 proposes a transparency registry without setting limits. The gap between "legally compliant" and "publicly verified" is exactly where legislation and buyer diligence are now aiming.

How should the three layers fit together in practice?

Think of it as a stack you build in order:

• Layer 1, compliance (mandatory): Part 111 systems in place, written heavy metal specifications with a defensible basis, batch verification, documented deviations, supplier qualification
• Layer 2, testing (the engine): ICP-MS through a qualified independent laboratory, sampling frequency designed rather than defaulted, results benchmarked against USP <2232> and Prop 65 levels, supplier COAs verified rather than filed
• Layer 3, certification (voluntary, public): independent published standard, third-party conformance decision, licensed mark, public verification status, ongoing surveillance

A brand with layer 1 only is legal and invisible. A brand with layers 1 and 2 is well run and still invisible. Layer 3 is what makes the first two legible to customers, retailers, and anyone else who cannot audit your quality system personally. Skipping layers in the other direction does not work: a mark on top of weak specifications and untested lots is a liability with a logo.

Faq: Testing, Certification, and FDA Compliance

Does FDA approve dietary supplements? No. By law, FDA does not approve dietary supplements or their labeling before they are marketed. Firms are responsible for ensuring their products are not adulterated or misbranded, and FDA acts post-market against violations.

Is heavy metal testing required by the FDA? Indirectly, yes. FDA's cGMP rule (21 CFR Part 111) requires manufacturers to establish contamination specifications and verify batches against them with scientifically valid methods. What the rule does not do is set numeric heavy metal limits; those are the manufacturer's to define.

Does certification make a supplement FDA compliant? No. Certification is a voluntary, private program layered on top of legal duties. cGMP compliance depends on your manufacturing systems, specifications, and records, and only those. Certification adds independent verification and public trust; it does not replace compliance and does not eliminate liability.

What is the difference between cGMP compliance and third-party testing? Compliance is the whole legal system: specifications, verification, records, supplier controls. Third-party testing is one verification activity inside it, distinguished by the lab being independent of the brand and manufacturer. Testing supports compliance; it is not the whole of it.

Are there legal limits for lead in supplements? There is no generally applicable federal numeric limit for finished supplements. USP <2232> sets a 10 µg/day voluntary benchmark for lead, and California Prop 65's safe-harbor level of 0.5 µg/day, enforced through private litigation, is the de facto strictest widely used standard.

Can a brand advertise "FDA certified" or "FDA approved"? No. FDA neither approves nor certifies dietary supplements, so both phrases are false for supplements and invite regulatory and FTC scrutiny. Accurate language distinguishes cGMP compliance, third-party testing, and voluntary certification, and claims each only where true.

If your compliance and testing layers are solid and the missing piece is public verification, that is what certification is for. Request a preliminary certification assessment to see how your current specifications and lot data compare to a published independent standard, review our heavy metal testing and certification program, or apply for certification.