What the label must tell you, and what it may leave out

There are two separate contact requirements in U.S. law, they exist for different reasons, and the difference is the spine of this article.

Requirement one: who the firm is. The food labeling regulation says: "The label of a food in packaged form shall specify conspicuously the name and place of business of the manufacturer, packer, or distributor."

Three details follow from how that is written:

• The address may be a headquarters, not a factory. The rule permits the principal place of business in place of the actual production site.
• "Distributed by" means the named firm did not make it. Where the named company is not the manufacturer, the name must be qualified by a phrase revealing the connection: "Manufactured for" or "Distributed by." That phrase is informative, and most people read past it.
• The street address can lawfully be absent altogether. The regulation states: "The street address may be omitted if it is shown in a current city directory or telephone directory."

Requirement two: a route for serious adverse events. A separate statutory provision requires that a supplement label include "a domestic address or domestic phone number through which the responsible person… may receive a report of a serious adverse event."

Note the "or." An address alone satisfies it, and so does a phone number alone. A label need not show both.

Is a website, an email address or a customer service line required? No such requirement could be located. So a fully compliant label can show a company name, a city and a phone number, and nothing else.

Which means the first practical step is often a search rather than a reading: the label gives you the firm's identity, and you go looking for a contact route from there.

The asymmetry at the center of this

Before the questions, one fact that shapes every answer you will get.

Supplement manufacturers are required to create and keep a great deal of documentation: component and product specifications, supplier qualification records, a master manufacturing record for each formulation, a batch production record for every batch, reserve samples, and a written record of every product complaint.

They must keep those records for one year past the shelf life date, or two years beyond the date of distribution of the last batch.

The provision that decides what you can get comes next:

"have all records required under this part, or copies of such records, readily available during the retention period for inspection and copying by FDA when requested."

The duty of availability runs to FDA, and only to FDA.

No provision requires a manufacturer to give any record, including a certificate of analysis for a specific lot, to a member of the public. Freedom of Information law does not reach private companies, so there is no public-records route either.

That is the honest frame for everything below. You are asking for something the company is free to decline. Many companies share readily, but nothing compels any of them.

The four questions

1. "Can I see the certificate of analysis for my lot?"

The lot number is on the bottle, usually stamped near the expiry date. A certificate of analysis is the testing record for that specific production run.

Why it is the most useful question. Testing records are lot-specific. A company that tests will have one; a company that relies entirely on what a supplier told it will have something thinner. And a result for your lot is worth more than a generic statement that products are tested.

What to look for if you get one. The manufacturing regulation itself sets out what makes a certificate meaningful, in the context of supplier certificates: it should include "a description of the test or examination method(s) used, limits of the test or examinations, and actual results." A document with a list of substances and the word "pass" next to each is a summary of somebody's judgment, not a result. Methods, limits and numbers are what you want.

What a refusal means. This is where most articles overreach. A declined request is not evidence of concealment. A certificate may name the supplier, which is commercially sensitive. It may contain data the company cannot reasonably interpret for a layperson. Legal may simply have a blanket policy. What you learn from a refusal is the company's disclosure policy, not something about the product.

2. "Is the company on the label the company that made it?"

Read the qualifying phrase first. "Manufactured by" and "Distributed by" answer this before you ask.

Why it matters. The obligations are different. A firm that manufactures carries the full weight of the manufacturing regulations (specifications, identity testing, batch records, complaint investigation). A firm that receives finished product for packaging and labeling only has a lighter duty: to establish specifications "to provide sufficient assurance that the product you receive is adequately identified and is consistent with your purchase order."

Neither arrangement is wrong. Contract manufacturing is normal and much of the industry works that way. But knowing which one you are dealing with tells you where the quality decisions are being made, and a follow-up ("who manufactures it, and do they do their own identity testing?") often produces more than the first question did.

3. "How was the identity of the ingredient verified, and by what method?"

This one separates firms more than any other, because the lawful answers vary enormously.

Manufacturers must test the identity of every dietary ingredient themselves; a supplier's paperwork does not substitute. But the permitted methods include "Gross organoleptic analysis; Macroscopic analysis; Microscopic analysis; Chemical analysis; or Other scientifically valid methods."

A trained person looking at and smelling the material is a legally sufficient identity method. So "we test every ingredient" is a true statement from a company doing chemical fingerprinting and from a company doing a visual examination. Asking how is the only way to tell them apart.

Ask the same question about finished product, because the rule allows verification of "a subset of finished dietary supplement batches… through a sound statistical sampling plan (or for every finished batch)." "We test every batch" and "we test a statistically selected subset" are both lawful and mean different things.

4. "What happens if someone reports a problem?"

Less obvious than the others, and revealing.

What the rules require. A manufacturer must have written complaint procedures. A qualified person must review all product complaints, and must investigate any complaint involving a possible failure that could result in illness or injury. Quality control personnel "must review and approve decisions about whether to investigate."

And a written record must be kept of every complaint, including the product, batch or lot number, the date received, the complainant's contact details, the nature of the complaint, the findings, any follow-up, and "the reply sent (if any)."

That parenthetical is the most quietly informative phrase in the whole regulation. It contemplates that a company may lawfully send no reply at all. There is no legal requirement to respond to a customer.

Serious adverse events are a different and stricter matter. These are defined narrowly: death, a life-threatening experience, inpatient hospitalization, persistent or significant disability, a congenital anomaly, or an event requiring medical or surgical intervention to prevent one of those. Where a company receives such a report, the statute requires it to submit to the Secretary any report received of a serious adverse event, accompanied by a copy of the product label, and sets the deadline at "no later than 15 business days after the report is received." Records of those reports must be kept for six years.

The company carrying those duties is whoever's name is on the label, so a distributor that never touched the product owns the obligation if its name is the one you are reading.

Two things you may have been told to do, which you cannot

"Check that the facility is FDA-registered." Supplement manufacturing facilities must register with FDA. But the registration rule states: "The list of registered facilities and registration documents submitted under this subpart are not subject to disclosure under 5 U.S.C. 552 (the Freedom of Information Act)."

You cannot look a company up in that registry. It is not public. And "FDA registered" on a product page means only that a form was filed: FDA evaluated nothing, approved nothing, and inspected nothing as a consequence of that filing.

"Check the FDA recall page." You can, and you should know its limits. FDA's own recalls page states: "Not all recalls have press releases or are posted on this page." The more complete source is FDA's Enforcement Report database.

A common error needs correcting too: supplement recalls are not all voluntary. FDA states that recalls "may be conducted on a firm's own initiative, by FDA request, or by FDA order under statutory authority." Three routes, not one. (No agency figure for the proportion in each category could be located, so no percentage is given here.)

For reference, recall classes: Class I means "a reasonable probability that the use of or exposure to a violative product will cause serious adverse health consequences or death." Class II means effects that "may cause temporary or medically reversible adverse health consequences." Class III means "not likely to cause adverse health consequences." A market withdrawal is a minor violation not subject to FDA legal action.

If something has gone wrong

Report it to the company, which has a legal duty to record it and a duty to submit it to FDA within 15 business days if it meets the serious-adverse-event definition.

And report it to FDA yourself. FDA's dietary supplement page directs consumers to file through the Safety Reporting Portal at safetyreporting.hhs.gov, choosing "Start a new report" and then the option for a private citizen submitting a voluntary report. FDA also maintains a Human Foods Program information center for questions.

Reporting to both matters. The company's obligation is triggered by a report it receives; FDA's picture of a product is built from reports it receives directly. They are not the same channel.

One caution about interpreting adverse event data, in either direction. A report is a report, not a finding of causation: nobody has established that the product caused the event. And the system is passive and substantially under-reported, so an absence of reports is not evidence of safety. Adverse event counts are a signal to investigate, not a verdict.

How to read the answers

This is the part worth getting right, because the temptation to over-read is strong and the inferences are mostly unsupported.

A fast, detailed reply tells you the company has customer service staff and a disclosure policy that permits sharing. It does not tell you the product is well made. Response speed measures a call centre, not a manufacturing floor.

A slow reply, or none, tells you the company either lacks that capacity or has a policy against it. It is not evidence of wrongdoing, and the regulation itself contemplates no reply.

A certificate of analysis with methods, limits and actual numbers is informative about that lot, because it is a record of something having been measured.

A one-page document listing substances with "pass" beside each is a summary, not a result.

"We are FDA registered" means only that a form was filed.

"We are GMP certified" is worth a follow-up: certified by whom, against what standard, and when? Recall the twenty-year-old heavy metals research in which 75 percent of products found to contain metals carried a GMP claim. The claim did not predict the outcome.

A company that cannot answer where a botanical came from is telling you about its supply chain visibility.

What none of these answers tells you is whether the product works, or whether it is safe. Those are different questions, and no amount of correspondence settles them.

What this article deliberately does not say

You will find versions of this advice that conclude a company answering quickly "has nothing to hide," and that one declining to share a document does.

Neither inference holds, and here is why:

• Declining to share a certificate is permitted, and there are ordinary commercial and legal reasons for it.
• The facility registry not being public is a statutory non-disclosure rule that applies to every registered food facility in the country, not a sign of a secretive industry.
• Having adverse event reports does not mean a product is dangerous; causation is not established by a report.
• Having none does not mean it is safe; the system is passive.
• Replying quickly measures staffing.

What you can legitimately conclude is narrower and more useful: how much the company knows about its own product, and how much of that it is willing to put in writing. Both are worth knowing. Neither is a verdict on the bottle.