GMP Violations + Online Disease Claims = Warning Letter
Old social posts are active marketing
This dietary supplement company was inspected by FDA in November and issued 483s and several months later, the FDA reviewed its website and social media. Online disease claims, along with GMP violations, led to this warning letter. Lots of good learning opportunities here.
Let’s start with the GMP violations, which in my opinion were likely “enough” for the warning letter.
Batch Production Records: These are very important reminders of the essentials of GMP compliance. If it’s not written down, it didn’t happen.
From warning letter. “Your written batch production records (BPRs) did not include complete information relating to the production and control of each batch…
- The time of the maintenance, cleaning, and sanitizing of the equipment and processing lines used in producing the batch, or a cross-reference to records where this information is retained. [21 CFR 111.260(c)]
- The initials of the person responsible for weighing or measuring each component used in the batch. [21 CFR 111.260(j)(2)(i)]
- The initials of the person responsible for verifying the weight or measure of each component used in the batch. [21 CFR 111.260(j)(2)(ii)]
- The initials of the person responsible for adding the component to the batch. [21 CFR 111.260(j)(2)(iii)]
- The initials of the person responsible for verifying the addition of components to the batch. [21 CFR 111.260(j)(2)(iv)].”
Relying on Certificates of Analysis is not enough. Here, FDA goes into some detail on this basic but important reminder.
From warning letter. “21 CFR 111.75(a)(2) does not allow firms to rely on a certificate of analysis to confirm the identity of a dietary ingredient. Rather, under 21 CFR 111.75(a)(1)(i), you must conduct at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient, prior to using a component.”
Incomplete 483 responses are a common trigger for warning letters. In this warning letter, there are numerous examples of incomplete responses. A good best practice when submitting 483 responses is to “show your work,” which helps prove that violations have been addressed.
From warning letter. “We have reviewed your responses to the FDA 483, dated December 18, 2025, and April 30, 2026, in which you stated that the batch production records will be updated. However, we are unable to evaluate the adequacy of your response because you did not provide documentation supporting that your batch production records have been updated.”
From warning letter. “You stated, “suppliers will be qualified establishing the reliability of the supplier’s certification of analysis through confirmation of the results of their tests or examinations.” On May 1, 2026, you provided component specification sheets that include instructions to confirm suppliers’ certificates of analyses with testing; however, we are unable to evaluate the adequacy of your response because you did not provide documentation supporting that the relevant suppliers have been qualified.”
To round it out, there are even online disease claims such as this one from a 2018 Instagram post. We haven’t seen FDA cite older social posts in a while, so this is another reminder that old posts are “active” marketing. Btw, Apex Compliance can scan full Instagram/Facebook accounts for issues in moments. It took months to get this Meta API approval, and I think it’s pretty great!
From warning letter. “been taking … and has noticed not only a drop in his blood pressure, but less pain in his joints…”
There’s much more to this letter. Check it out here.
Written by
