Under FDA’s drug manufacturing rules, a supplier’s certificate of analysis can stand in for your own testing of an ingredient’s purity, strength and quality, on two conditions. You run at least one identity test on it yourself, and you establish, at appropriate intervals, that the supplier’s results are reliable.

Accepting certificates without meeting those conditions is part of what FDA cited in an April 2026 warning letter to a Michigan drug manufacturer. The same letter’s paragraph on artificial intelligence is covered in a separate article.

What a certificate of analysis is

A certificate of analysis (CoA) is a supplier’s report of its own test results for one lot of the material it ships, a lot being a batch, or part of one, “having uniform character and quality within specified limits.” The drug rule calls it a “report of analysis.” Either way, it is the supplier’s statement about its own material, and the rule leaves the work of deciding whether to believe it with the manufacturer that uses it.

What the drug rule requires before you rely on one

Current good manufacturing practice (CGMP) regulations set minimum manufacturing requirements for drugs, in 21 CFR parts 210 and 211 for finished products. A drug made without following them is considered adulterated under federal law. A component is “any ingredient intended for use in the manufacture of a drug product.”

Section 211.84 holds each lot of a component until it has been sampled, tested or examined, and released by the firm’s quality control unit. Its paragraph (d) sets the terms for a supplier’s certificate:

• Identity, always. “At least one test shall be conducted to verify the identity of each component of a drug product.” An identity test confirms that the material is what it is supposed to be.
• The rest, on conditions. Each component must be tested against its written specifications for purity, strength and quality. “In lieu of such testing by the manufacturer, a report of analysis may be accepted from the supplier of a component, provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals.”

The rule does not say what validating a supplier’s results involves. FDA’s guidance for makers of active pharmaceutical ingredients, the substances that give a drug its effect, is not binding but is more specific: “a complete analysis should be performed at appropriate intervals and compared with the certificates of analysis.” In plain terms, you test some lots yourself and compare your numbers with the supplier’s for the same lot.

What FDA found in the April 2026 letter

A warning letter is FDA’s written notice to a company of significant violations, here found at inspection. FDA inspected the Michigan facility in October 2025 and wrote on April 2, 2026. Its second violation cites 211.84(d) and finds that “you relied on your suppliers’ certificates of analysis (COA) without establishing the reliability of your component suppliers’ test analyses at appropriate intervals,” alongside inadequate testing of components for purity, strength, quality and identity.

Twenty days later an Orlando maker of topical over-the-counter (OTC), or nonprescription, drugs received the same finding in nearly the same words, with FDA’s request spelled out:

The ingredients behind these findings often carry a contamination hazard. A July 2026 letter to a California OTC maker cites glycerin, whose identity test under the drug standards of the United States Pharmacopeia (USP) includes a limit test for two hazardous impurities, diethylene glycol and ethylene glycol. The firm’s response committed “to verifying supplier certificates of analysis prior to raw material release,” and FDA found it inadequate for lack of “sufficient details and supporting data.” Reading a certificate more carefully is not the same as establishing that it can be believed.

How often the finding appears, and how it reaches cosmetics companies

Of the warning letters FDA’s Center for Drug Evaluation and Research issued from October 17, 2025, to October 17, 2026, and posted by October 27, at least 32 went to drug makers in the United States and Canada with a numbered violation under 211.84(d). In 25, FDA found the firm had not established, or could not show, that its suppliers’ results were reliable. Twelve remind the firm that some of its products “may be regulated as cosmetics.” These are counts of letters, not of how often the problem occurs.

The route is the drug product. A product can be both a cosmetic and a drug when it has more than one intended use, an antidandruff shampoo for example, or “moisturizers and makeup marketed with sun-protection claims.” Such products “must comply with the requirements for both cosmetics and drugs.” A February 2026 letter in the count notes equipment “shared to manufacture both your OTC drug products and cosmetics.”

Cosmetics on their own have no such rule yet. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) requires FDA to set good manufacturing practice regulations for cosmetic facilities, by December 29, 2025 according to FDA. As of October 2026 no proposed rule has been published, and the latest federal regulatory agenda projects one for November 2027. FDA’s 2013 draft guidance, which is not binding, recommends that raw materials be sampled and tested against specifications before use.

How the dietary supplement rule compares

Dietary supplement makers work under 21 CFR part 111, whose section 111.75 sets close but different terms. The difference turns on dietary ingredients, such as vitamins, minerals, botanicals and amino acids, as opposed to other ingredients such as fillers, binders and flavorings.

What the supplement rule’s three required items mean on a test report is covered in “None Detected” on a CoA. A June 2026 warning letter to an Arizona supplement maker states the identity line plainly: “21 CFR 111.75(a)(2) does not allow firms to rely on a certificate of analysis to confirm the identity of a dietary ingredient.”

Checking the certificates you rely on

• For each ingredient accepted on a certificate, list which specifications the certificate covers and which tests you still run. Under the drug rule, the identity test is always yours.
• Keep, per supplier and ingredient, your own results beside the supplier’s for the same lots, with dates. That is the evidence the certificate can be believed.
• Compare like with like: the same parameter, method, units and limit.
• Set the re-testing interval and record why, for example the supplier’s history with you.
• If you also make an OTC drug, such as a sunscreen or an acne treatment, the drug rule’s conditions apply to each of its components, even where the same ingredient also goes into your cosmetics.

Reading each certificate against the specification and the record is document work. Smart-Suited Tech’s document agent, Elara, does that work: it reads supplier certificates against the client’s specifications, resolves conflicts with the record by rule, with the reason recorded, and surfaces compliance-critical changes for a person to decide. The identity test and the comparison testing remain laboratory work.

A certificate tells you what the supplier found. Whether to believe it takes numbers of your own.