CGMP and certificates of analysis: the quality paperwork at the center of HHS's peptide policy

By · Published · 7 min read · 8 sources, 8 checked at the source

Sign reading U.S. Department of Health and Human Services, Food and Drug Administration, with a campus office building behind it.
FDA campus entrance sign, with Building 21 behind it. Illustrative photo. Photo: The U.S. Food and Drug Administration, Public domain. Image credits

Picture a pharmacist opening a box of peptide ingredient under HHS's new six-peptide policy. Before anything gets compounded, there's a piece of paper that has to be right: a certificate of analysis from a manufacturer registered with FDA. Two terms do a lot of work in that moment, "CGMP" and "certificate of analysis," and you'll also see both on supplement labels and product pages. Here's what each one means in US rules, and why HHS built its access plan around them.

Facts are as of November 1, 2026. Sources, with retrieval dates, are at the bottom.

Four things to know

  • CGMP means Current Good Manufacturing Practice, FDA's minimum rules for how drugs are made, tested and controlled. [V]
  • A certificate of analysis (often shortened to CoA) is a test report for one batch of an ingredient or product. [V]
  • HHS's October 2026 policy lets licensed pharmacies compound six peptides when the ingredient comes with a valid certificate from an FDA-registered, CGMP-compliant maker. [V]
  • Drugs and dietary supplements have separate CGMP rulebooks, so the same four letters can mean different things on different products. [V]
  • 5kinds of results HHS wants on a peptide certificate, from identity to contaminants [V]
  • 3federal rulebooks that use the CGMP idea: drugs, supplements, compounding [V]
  • Nov 13last day to comment on the policy that relies on these papers [V]

What CGMP actually covers

FDA describes CGMP as a set of rules for how manufacturing is designed, watched and controlled, so that what's in a drug matches its label for identity and strength, and meets its quality and purity standards. [V] That reaches past the lab bench: quality systems, good raw materials, written procedures, investigating anything that goes off plan, and reliable testing labs. [V] The "C" stands for current, which FDA says means makers are expected to keep their technology and systems up to date. [V]

FDA makes a point that's easy to miss. Testing alone can't prove quality, because a lab only checks a small sample from each batch. FDA's example: a maker might test 100 tablets out of a 2-million-tablet batch. [V] So the rules aim to build quality into every step, not just catch problems at the end. FDA also says most companies it inspects are found fully compliant. [V]

What a certificate of analysis is

A certificate of analysis is the lab report that travels with a batch. For drugs, FDA's CGMP rules say every component must get at least one identity test, and must be tested against written specs for purity, strength and quality. [V] A maker may lean on a supplier's report in place of some of that testing, but only if it still runs at least one specific identity test itself and checks the supplier's results at intervals. [V] Finished batches also need a lab check before release confirming that every active ingredient is the right one, at the right strength. [V]

The supplement rules ask for something similar. Under 21 CFR part 111, a supplement maker can rely on a supplier's certificate only if it first qualifies that supplier, and the certificate lists the test methods, the limits and the actual results. [V] The maker has to recheck that supplier periodically, too. [V]

Why HHS built its peptide access plan on these papers

This is where the paperwork turns into an access story. Federal compounding law already says a 503ASection of federal drug law covering compounding by state-licensed pharmacies and doctors, usually for a prescription written for one patient. Glossary entry pharmacy's bulk ingredients must come from an FDA-registered establishment and arrive with valid certificates of analysis. [V] HHS's October 2026 policy leans on that same idea and spells it out for six peptides, including BPC-157, TB-500 and MOTS-c. [V]

Condition 3 of the policy asks for a certificate showing identity, purity, potency and the absence of contaminants such as endotoxins, heavy metals, microbes and impurities. [V] Condition 4 asks that the original maker be FDA-registered and in compliance with CGMP, with the facility's location printed on the certificate. [V] HHS says the point is to give pharmacists confidence that what arrives is what it claims to be. [V]

The certificate also shows up in HHS's reasoning. For BPC-157, HHS says part of what changed since FDA's earlier review was a certificate tied to one specific lot, from a facility registered with FDA, with the test results (identity, impurities, endotoxin, microbes and leftover solvents) that the earlier review said were missing. [V] In other words, quality documentation helped move a peptide from "no" toward a supervised "yes." HHS frames the whole policy as giving patients a more controlled option than research-use-only products from overseas. [V] Our brief on the six-peptide policy covers the full list of conditions.

“the policy advances patient choice and freedom while appropriately protecting patient safety”

HHS, enforcement discretion policy for peptide compounding

When "CGMP" shows up on a label

You'll often see "made in a CGMP facility" on supplements. That points to part 111, the supplement rulebook, which is a different set of requirements from the drug rules in parts 210 and 211. [V] Neither phrase on its own means FDA reviewed the product before sale. Our label decoder covers "research use only," and the glossary has a short CGMP entry.

Peptide Policy Watch

CGMP and certificates of analysis: the quality paperwork at the center of HHS's peptide policy

Published November 1, 2026 · https://peptidepolicywatch.com/2026/11/01/cgmp-certificate-of-analysis-peptides-what-they-mean/

Printable checklist

Questions for your clinician

Print or copy these questions for your next visit with a clinician or pharmacist.

  1. Is this an approved drug, a compounded drug or a supplement, and which quality rules apply to it?
  2. For a compounded peptide under the HHS policy, does the pharmacy have a certificate from the original FDA-registered maker?
  3. What did the certificate test for, and does it list actual results and methods?
  4. Does the product name a lot number that ties back to that certificate?

Print view Select it, then use your browser’s Print command to print only this box.

Limits and unknowns

A certificate describes one batch at one point in time; it says nothing about how well a peptide works. The HHS policy is enforcement discretion while the 503A bulks list goes through rulemaking, not an FDA approval, and HHS says it may revisit the policy if a quality or safety signal appears. [V] FDA's own page notes that CGMP rules are a minimum, and that many makers run quality systems above that floor. [V]

What to watch

Public comments on the HHS policy (docket HHS-OASH-2026-0496) close at 11:59 PM Eastern on November 13, 2026. [V] Pharmacies, makers and patients can weigh in on the conditions, including the certificate rules. Our comment-period explainer tracks the docket count.

The next time you see "CGMP" or "CoA" on a page, you'll know the follow-up: which rulebook, which batch, and tested for what?

Common questions

What does CGMP stand for?

Current Good Manufacturing Practice. FDA describes it as the minimum rules for how drugs are designed, made, tested and controlled so each one matches its label for identity and strength and meets quality and purity standards. Dietary supplements follow a separate CGMP rule in 21 CFR part 111. Source: FDA, Facts About CGMP

Why does HHS's peptide policy ask for a certificate of analysis?

Condition 3 of HHS's October 2026 policy asks that each peptide ingredient come from an FDA-registered facility with a valid certificate reporting identity, purity, potency and contaminant results. HHS says this gives compounders confidence the ingredient is what it claims to be. Source: HHS peptide enforcement discretion policy

Diagram titled Two quality words, three rulebooks. Top row lists what a certificate of analysis reports under condition 3 of HHS's October 2026 peptide policy: identity, purity, potency, endotoxins, and microbes and heavy metals. Bottom row: drug CGMP under 21 CFR parts 210 and 211, where each component is tested and a supplier's report counts only with an identity test and checked reliability; supplement CGMP under 21 CFR part 111, where a supplier's certificate must show methods, limits and actual results from a qualified supplier; and 503A compounding under 21 U.S.C. 353a, where bulk ingredients come from an FDA-registered maker with a valid certificate of analysis. Footer: CGMP on a label points to one of these rulebooks, depending on what the product is.
Diagram: what a certificate of analysis reports, and the three US rulebooks that use the word CGMP.

Sources (retrieved November 1, 2026 unless noted)

  1. FDA, "Facts About the Current Good Manufacturing Practice (CGMP)" [V] — https://www.fda.gov/drugs/pharmaceutical-quality-resources/facts-about-current-good-manufacturing-practice-cgmp
  2. 21 CFR 211.84, testing and approval or rejection of components (eCFR) [V] — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-E/section-211.84
  3. 21 CFR 211.165, testing and release for distribution (eCFR) [V] — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-I/section-211.165
  4. 21 CFR 111.75, dietary supplement specifications and supplier certificates (eCFR) [V] — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111/subpart-E/section-111.75
  5. 21 U.S.C. 353a(b)(1)(A), 503A bulk drug substance conditions (Cornell LII copy of the US Code) [V] — https://www.law.cornell.edu/uscode/text/21/353a
  6. HHS, "Enforcement Discretion Policy Regarding 503A Compounding Using Certain Peptide Bulk Drug Substances," conditions 3 and 4 and Appendix B (retrieved October 29–30, 2026) [V] — https://www.hhs.gov/sites/default/files/hhs-503a-peptide-enforcement-discretion-policy-appendix-b.pdf
  7. Federal Register, document 2026-22192, 91 FR 68526, published October 30, 2026 [V] — https://www.federalregister.gov/d/2026-22192
  8. Regulations.gov, docket HHS-OASH-2026-0496 (comment close 11:59 PM Eastern, November 13, 2026) [V] — https://www.regulations.gov/docket/HHS-OASH-2026-0496

Spot a mistake? See how we source and our corrections policy.