LAW: Dietary Supplement Manufacturing and Quality Compliance
GMP Record Retention Laws for Dietary Supplement Companies
What 21 CFR Part 111 Requires You to Keep and for How Long
Record retention under 21 CFR Part 111 is not a filing preference. It is a federal compliance requirement that determines whether your facility can defend its manufacturing operations during an FDA inspection. FDA issued a notice to OMB in June 2026 confirming continued enforcement of Part 111 recordkeeping across nearly one million annual industry compliance hours. This guide covers which records must be kept, for how long, in what format, and what happens when they are not.
1yr+shelf
Primary Retention Rule
When a product carries a shelf life date, all associated Part 111 records must be kept for one year beyond that date. This is the primary retention standard under 21 CFR 111.605(a).
21 CFR 111.605(a)
2yr
No Shelf Life Date Rule
When no shelf life date is used, records must be kept for two years beyond the date of distribution of the last batch of dietary supplements associated with those records.
21 CFR 111.605(a)
46%
Rise in 483 Observations
FDA 21 CFR Part 111 observations increased 46% from 2023 to 2024. Inadequate records, missing batch documentation, and absent investigation records are among the most frequently cited findings.
FDA 483 Enforcement Data, 2024
The Legal Framework: Who Must Comply and Why Records Matter
21 CFR Part 111 applies to every person who manufactures, packages, labels, or holds dietary supplements in the United States, as well as to every importer of dietary supplements into the US market. It is the FDA’s current Good Manufacturing Practice (cGMP) regulation for dietary supplements, issued as a final rule in 2007 under authority granted by Section 402(g) of the Federal Food, Drug, and Cosmetic Act and the Dietary Supplement Health and Education Act of 1994 (DSHEA).
A dietary supplement that is manufactured, packaged, labeled, or held in violation of Part 111 requirements is considered adulterated under the FD&C Act. This classification is the legal mechanism that enables FDA to pursue warning letters, import alerts, consent decrees, injunctions, and product seizures against non-compliant companies. The record-keeping provisions of Subpart P (21 CFR 111.605 through 111.610) are the evidentiary foundation for every other requirement in Part 111. Without records, a manufacturer cannot demonstrate compliance, and FDA has no obligation to assume it.
In June 2026, FDA submitted a proposed information collection renewal to the Office of Management and Budget specifically addressing Part 111 recordkeeping, confirming that enforcement of these requirements will continue and that the agency views the approximately one million annual industry compliance hours as appropriate and necessary. This is not a regulation in wind-down. It is an active enforcement priority.
Legal Disclaimer
This article provides educational information about FDA dietary supplement cGMP record retention requirements under 21 CFR Part 111. It is not legal or regulatory advice. Dietary supplement manufacturers should consult qualified regulatory affairs professionals and legal counsel to develop and maintain records programs that meet all applicable requirements. State and local regulations may impose additional requirements.
Key Regulatory Reference Points
21 CFR Part 111, Subpart P
The records and recordkeeping subpart of the dietary supplement cGMP regulation. Sections 111.605 through 111.610 set the retention period requirements, acceptable record formats, and FDA access obligations.
FDA, 21 CFR Part 111
21 CFR Part 11
The electronic records and electronic signatures standard. 21 CFR 111.605(c) requires that all electronic records maintained under Part 111 comply with Part 11. This governs audit trails, access controls, system validation, and electronic signature requirements.
FDA, Electronic Records; Electronic Signatures
FD&C Act Section 402(g)
The statutory authority under which FDA may deem a dietary supplement adulterated if it is manufactured, packaged, labeled, or held in violation of cGMP requirements. Non-compliant records are a basis for adulteration findings.
Federal Food, Drug, and Cosmetic Act
DSHEA (1994)
The Dietary Supplement Health and Education Act created the legal category of dietary supplements and authorized FDA to develop cGMP requirements. Part 111 is the direct regulatory product of this legislative authority.
Dietary Supplement Health and Education Act
The Retention Rule: How Long You Must Keep Records
21 CFR 111.605(a) establishes the retention period for all records required under Part 111 using a two-condition rule. The condition that applies depends on whether the product carries a shelf life date.
Condition
Retention Period
How It Works in Practice
Product carries a shelf life date
1 year past the shelf life date
If a product has a “best by” or expiration date of June 2026, all records associated with the last batch distributed must be retained until June 2027. This applies regardless of when the batch was actually manufactured or distributed.
Product does not carry a shelf life date
2 years from date of distribution of the last batch
If no shelf life date is used and the last batch associated with a record set was distributed in March 2024, those records must be retained through March 2026. The clock starts on distribution, not manufacture.
Source: FDA | 21 CFR 111.605(a) | eCFR, current edition
Practical Note: The retention clock is tied to the last batch associated with the records, not the first or any intermediate batch. A master manufacturing record used for a product line spanning multiple batches over several years must be retained for the full retention period measured from the distribution date of the most recent batch produced under that record. Do not start the clock from the batch that created the record.
Which Records Must Be Kept
Part 111 generates a substantial body of required records across the manufacturing, testing, quality control, packaging, labeling, distribution, complaint, and returned product processes. The following table maps the primary record categories to their generating regulation and describes what they must capture.
Record Type
CFR Section
What It Must Capture
Master Manufacturing Record (MMR)
111.205
Product name and dosage form, complete list of components and quantities, weight/measure for each component, theoretical yield at each step, description of manufacturing and in-process controls, specifications for finished batch, description of packaging and labeling.
Batch Production Record (BPR)
111.255
Batch number, date of manufacture, identity and weight/measure of each component used, actual yield at each step, results of in-process testing, documentation of deviations, and identity of persons who performed each significant step.
Component and ingredient testing records
111.75, 111.320
Identity test results for every component before use. For components subject to specification testing: purity, strength, and composition test results. Certificate of analysis records from suppliers and documentation of verification testing where conducted.
Finished product testing records
111.75, 111.355
Results of all finished batch testing against specifications for identity, purity, strength, and composition. Documentation of the test methods used. Release or rejection decision and the basis for it.
Specification records
111.70
Written specifications for each component, in-process material, finished batch, packaging, and labels. Including identity, purity, strength, and composition limits. (Failure to establish finished product specifications was the top FDA observation in both 2023 and 2024.)
Laboratory records
111.320
Raw data from all testing, method validation data, instrument calibration records, analyst identifications, and calculations. Must be captured at the time of observation, not reconstructed after the fact.
Equipment cleaning and maintenance records
111.35
Cleaning schedules and results, calibration logs, maintenance records, and documentation that equipment was inspected before use for each batch.
Packaging and labeling records
111.410, 111.430
Documentation of label examination and approval, reconciliation of packaging materials, and confirmation that label examinations were performed and met specifications for each batch released.
Distribution records
111.480
Records documenting the distribution of each batch: batch number, distribution date, consignee name and address, and quantity shipped. Distribution records are essential for recall traceability.
Complaint records
111.570
All written and oral complaints, investigation decisions and results, and any follow-up actions taken. The record must show that every complaint was reviewed and a determination made about whether investigation was warranted.
Returned product records
111.535
Documentation of the reason for return, evaluation of the returned product, disposition decision (reprocessing, destruction, or return to supplier), and any follow-up action taken.
Reserve sample records
111.465
Documentation of reserve samples held for each batch. Reserve samples must be retained for 1 year past shelf life date, or 2 years from distribution of the last associated batch. Quantity must be at least twice that needed for all required testing.
QC unit records and release decisions
111.105, 111.127
Records demonstrating that a qualified quality control unit reviewed and approved or rejected each batch. No batch may be released without QC unit review and documentation of the release or rejection decision.
Source: FDA | 21 CFR Part 111 | eCFR, current edition
Format Requirements: Paper, Electronic, and Original Records
21 CFR 111.605(b) specifies that records must be kept as original records, as true copies (photocopies, microfilm, microfiche, or other accurate reproductions), or as electronic records. The key requirement is fidelity: the record must accurately reproduce the original in every material respect.
Original Paper Records
Permitted Format
Paper records must be legible, completed at the time of each activity (not reconstructed from memory), signed by the person who performed the activity, and dated. Corrections must be made by single strikethrough with initials and date, never by obscuring the original entry. White-out is never acceptable.
True Copies
Permitted Format
Photocopies, microfilm, microfiche, and scanned documents are acceptable as true copies if they accurately and completely reproduce the original. Scanned copies of paper records must be legible and complete. FDA expects true copies to be managed with the same controls as originals.
Electronic Records
21 CFR Part 11 Required
All electronic records must comply with 21 CFR Part 11. This requires: validated computer systems, audit trails that capture creation, modification, and deletion with operator identity and timestamp, access controls limiting record access to authorized personnel, and electronic signatures that link the signature to the record. See the Part 11 requirements summary below.
21 CFR Part 11 Requirements for Electronic Records
When dietary supplement manufacturers maintain Part 111 records electronically, 21 CFR Part 11 imposes specific technical and procedural requirements. These requirements are not optional for manufacturers who have chosen electronic records. They apply in full to every system used to create, modify, maintain, or transmit Part 111 records.
Core 21 CFR Part 11 Requirements for Electronic Records Systems
System validation
Computer systems used to create and maintain Part 111 records must be validated to ensure accuracy, reliability, and consistent performance. Validation documentation must be maintained and updated when systems are changed.
Audit trail
Systems must generate computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Audit trails must be retained for the same period as the records they support.
Access controls
System access must be limited to authorized individuals. User IDs and passwords must be unique to each individual. Generic, shared, or group logins do not satisfy Part 11 access control requirements. Personnel who leave the company must have access terminated promptly.
Electronic signatures
Electronic signatures used to satisfy Part 111 signature requirements must comply with Part 11. Each signature must include the printed name of the signer, date and time, and the meaning of the signature (reviewed, approved, performed). Signatures must be uniquely linked to the individual and cannot be reused or transferred.
Record protection
Electronic records must be protected from unauthorized alteration, destruction, or access. Backup and recovery procedures must be in place. A corrupted or lost electronic record is treated the same as a missing paper record: the associated batch has no documentation of compliance.
Source: FDA | 21 CFR Part 11 | 21 CFR 111.605(c)
FDA Access: What You Must Be Able to Produce
21 CFR 111.610 requires that all records required under Part 111, or copies of such records, be readily available during the retention period for inspection and copying by FDA when requested. This is not a courtesy obligation. It is a legal requirement that FDA inspectors enforce during facility inspections.
“Readily available” means that records can be produced promptly in a format that FDA investigators can review on site. Records stored off site that require days or weeks to retrieve are not readily available in the regulatory sense. Electronic records must be retrievable and viewable during the inspection, and the manufacturer must be able to produce complete records for any batch or time period the investigator requests.
On-Site Availability
Records or certified copies must be available at the facility during the inspection. If original records are maintained off site, certified copies must be kept at the facility. FDA does not accept “we can get them to you next week” as compliance with the ready availability requirement.
Readable Format
Electronic records must be viewable in a human-readable format during the inspection. A database that requires specialized software unavailable to FDA investigators does not satisfy the availability requirement. PDF exports, printouts, or standard-format reports from ERP or QMS systems are the typical compliance approach.
Complete Retention Period Coverage
Records must be available throughout the entire retention period, not just for recent batches. A record that was accessible six months ago but is now unavailable because a system was replaced, a hard drive was lost, or a storage contract expired is a missing record during the retention period. System migrations must include verified record transfer and confirmation of ongoing accessibility.
Most Common Part 111 Record-Keeping Violations
Frequently Cited FDA 483 Observations in Dietary Supplement Record-Keeping (2023 to 2025)
No established product specifications
Top Observation 2023 and 2024
FDA’s top observation in both 2023 and 2024: failure to establish written specifications for the identity, purity, strength, and composition of finished dietary supplements under 21 CFR 111.70. Without specifications, no testing result can be evaluated against a standard, making every batch release decision indefensible.
No component identity testing records
Very Common
21 CFR 111.75 requires identity testing of every component before use, including dietary ingredients received from suppliers. Accepting supplier certificates of analysis without verification testing, or without documented justification for why verification testing is not needed, is a citable deficiency.
Incomplete or missing batch production records
Common
Batch production records missing required fields: personnel identifications, actual yields, in-process test results, or documentation that the BPR was reviewed and approved by the QC unit before release. A partially completed BPR is not a compliant BPR.
No written production and process control procedures
Common
Manufacturing conducted without a master manufacturing record, or manufacturing that deviates from written procedures without documentation of the deviation and its evaluation. Oral procedures and tribal knowledge are not records.
Electronic records without Part 11 compliance
Increasing
Manufacturers using spreadsheets, shared drives, or unvalidated software to maintain Part 111 records without Part 11 audit trails, access controls, or system validation. As more manufacturers shift to electronic systems, Part 11 compliance gaps are generating an increasing share of 483 observations.
Source: FDA 483 Enforcement Data 2023 to 2025 | 21 CFR Part 111
Contract Manufacturers and Brand Owners: Who Holds the Records
A significant portion of the dietary supplement industry operates through contract manufacturing arrangements where a brand owner markets a product manufactured by a third-party contract manufacturer. Under Part 111, both parties have compliance obligations, and record-keeping responsibilities must be explicitly allocated in the manufacturing agreement.
The contract manufacturer who physically performs the manufacturing operations is responsible for maintaining the batch production records, component testing records, laboratory records, and equipment records for operations they perform. The brand owner (if they also perform any manufacturing, packaging, labeling, or holding operations) is responsible for records associated with the operations they control. Brand owners who rely entirely on contract manufacturers for manufacturing operations remain responsible for ensuring that their contract manufacturer is Part 111 compliant, and for maintaining distribution records and complaint records for the products they market.
Contract Manufacturer Audit Note: FDA inspects contract manufacturers for compliance with Part 111 regardless of what the manufacturing agreement says. A contract manufacturer that is found non-compliant during an FDA inspection creates a compliance problem for every brand owner whose products were manufactured there during the non-compliance period. Brand owners should conduct periodic audits of their contract manufacturers’ record systems and confirm that all required records are being maintained and will be available throughout the retention period.
Building a Defensible Records Program
- Map every record type to its generating process and retention obligation. Create a record inventory that identifies every Part 111 record generated by your operations, where it is stored, the format it is maintained in, and when its retention period expires. Review this inventory annually and after any process change.
- Set retention end dates at the time of distribution. For each batch distributed, calculate and document the retention end date at the time of distribution. Do not leave this as a calculation to be performed years later when a record disposal decision must be made.
- Validate electronic systems before use. Any software used to create, modify, or store Part 111 records must be validated before it is put into regulated use. Validation documentation must be maintained throughout the life of the system.
- Audit records before FDA does. Conduct internal record audits that look for the same gaps FDA inspectors look for: missing signatures, incomplete batch records, no investigation decisions on complaint files, missing component identity test results. Find and correct gaps before an inspection surfaces them.
- Control record corrections. Train every person who creates records on the correct procedure for corrections: single strikethrough, initials, date, and reason for correction. Establish a written procedure for record correction and document that personnel have been trained on it.
- Ensure off-site records are truly accessible. If any Part 111 records are stored off site, verify that certified copies are maintained at the facility and that retrieval from off-site storage can be accomplished within the timeframe FDA would expect during an inspection.
Key Takeaways
The Retention Clock Starts at Distribution
The two-year retention period (where no shelf life date is used) runs from the date of distribution of the last batch associated with those records, not from the date of manufacture or the date the record was created. A batch manufactured in 2023 but distributed in 2024 has records retained through 2026.
Specifications Are the Foundation of Everything
FDA’s top observation in both 2023 and 2024 was failure to establish product specifications. Without written specifications for identity, purity, strength, and composition, no testing result can be evaluated, no batch can be properly released, and no record system can demonstrate compliance with Part 111’s substantive requirements.
Electronic Records Need Part 11 Compliance
Choosing to maintain Part 111 records electronically triggers full Part 11 compliance: validated systems, audit trails, access controls, and compliant electronic signatures. A spreadsheet on a shared drive is not a compliant electronic record system under Part 11.
FDA Enforcement Is Increasing
Part 111 observations increased 46% from 2023 to 2024, and FDA’s June 2026 OMB notice confirmed continued commitment to enforcement of Part 111 recordkeeping. This is not a declining priority. Manufacturers who have deferred record system investments are operating with increasing regulatory risk.
Frequently Asked Questions
Does the one-year-past-shelf-life rule mean we must keep records longer than two years?
Yes, in many cases. If a product has a shelf life of three years, records associated with a batch distributed on day one of that shelf life period would need to be retained for four years from distribution (three-year shelf life plus one additional year). The shelf life date, not the distribution date, anchors the retention calculation when shelf life dating is used. Manufacturers of long-shelf-life products should factor this into their document management systems.
Can we scan paper records and discard the originals?
FDA permits true copies, which includes scanned reproductions, as long as the scan accurately and completely reproduces the original. However, if your scanning system is electronic, it must comply with Part 11. If FDA later finds that a scanned record is missing information that was on the original, and the original was destroyed, the missing information is considered a compliance gap. Establish clear procedures for scan quality verification before discarding paper originals.
Our contract manufacturer maintains the batch records. Do we need copies?
Brand owners should contractually ensure that their contract manufacturer maintains all required Part 111 records and that those records are accessible to the brand owner and to FDA during inspections. Distribution records and complaint records for products you market are your responsibility regardless of contract manufacturing arrangements. Some brand owners also maintain copies of key batch records (MMR, BPR, component testing) at their own facilities to ensure availability independent of the contract manufacturer’s cooperation.
What happens if FDA finds we are missing records during an inspection?
Missing records generate Form 483 observations. Systemic record-keeping failures can result in Warning Letters. A manufacturer that cannot demonstrate Part 111 compliance through its records may have its products classified as adulterated under FD&C Act Section 402(g), which can lead to import alerts, product seizures, injunctions, and consent decrees. The consequences scale with the scope and severity of the deficiencies found.
Government and Regulatory Sources
Industry References
Related VelSafe Articles
Records Are Your Defense Before, During, and After an Inspection
FDA inspectors do not give credit for quality practices that cannot be demonstrated through records. Every batch you produce, every component you test, every deviation you investigate, and every complaint you review either has a complete, accessible, compliant record or it does not. There is no middle ground in an FDA inspection. Build your record system before you need to defend it, maintain it throughout the retention period, and audit it regularly against the requirements that FDA will use to evaluate it. Find more dietary supplement compliance resources at velsafe.com.
