A food supplement manufacturer running GMP, HACCP, ISO 22000 and ISO 9001 together must document four layers: GMP prerequisite programmes, a Codex HACCP plan, an ISO 22000:2018 food safety management system, and batch quality controls. ISO 22000:2018 with its 2024 amendment is still current, while ISO 9001:2015 was withdrawn when ISO 9001:2026 was published in September 2026.
This guide is for quality and food safety managers at supplement brands with their own plants and at contract manufacturers.
Is a food supplement regulated as a food or as a medicine?
It depends on the market and on the product. The answer decides which GMP applies, so settle it before you write a single procedure.
In Saudi Arabia, the SFDA's Guidance for Borderline Products Classification (version 3.0, 2023) defines a food supplement as a product that supplements the normal diet. Typical ingredients include vitamins, minerals, amino acids, probiotics, collagen and herbal extracts.
The SFDA looks at three things: the claims on the label and in advertising, the composition, and the product form. A claim to treat or prevent a disease moves a product towards the drug rules. So do vitamins or minerals above the upper limit of the daily allowance. Manufacturers can ask the SFDA's Products Classification Department to classify a borderline product.
In the United States, dietary supplements have their own GMP rule, 21 CFR Part 111. It applies to anyone who manufactures, packages, labels or holds a dietary supplement, including products imported into the US. Classification rules differ from market to market, including within the GCC. Confirm the classification of each product with the authority in every market you sell to.
Which editions apply in 2026?
Three of the four frameworks have a fixed edition you can name in your manual. GMP is the exception, because it is set by the regulator of each market.
| Framework | Edition to cite | Status in October 2026 | What it gives a supplement plant |
|---|---|---|---|
| ISO 22000 | ISO 22000:2018 + Amd 1:2024 | Current. ISO lists it as "to be revised", so no new edition yet | The certifiable food safety management system around PRPs and HACCP |
| HACCP | Codex General Principles of Food Hygiene, CXC 1-1969 (revised 2020, 2022) | Current | Seven principles applied in 12 steps, with good hygiene practices as the base |
| ISO 9001 | ISO 9001:2026 | Published September 2026. ISO 9001:2015 is withdrawn | Quality controls for specifications, suppliers, customer requirements and improvement |
| GMP | The regulator's own rule, for example 21 CFR Part 111 in the US | Depends on the market | Specifications, testing, batch records and release decisions |
Certificates issued against ISO 9001:2015 remain under a transition period. ISO advises organisations certified to the 2015 edition to ask their certification body about transition arrangements. Our ISO 9001:2026 transition guide covers the changes and the timetable.
What does GMP mean for a supplement plant?
Food hygiene GMP covers premises, cleaning, pest control and personal hygiene. Supplement GMP adds control over what is in the capsule. The US rule is a useful benchmark even outside the US, because it spells out the documents a regulator expects.
Under 21 CFR Part 111, a manufacturer must set specifications for identity, purity, strength and composition, and limits on contaminants (§111.70). It must run at least one appropriate identity test on every dietary ingredient before use (§111.75). It needs a master manufacturing record for each formulation and batch size (§111.205) and a batch production record for every batch (§111.255).
It must also keep reserve samples of each distributed lot (§111.83). Records are kept for one year past the shelf-life date, or two years after the last batch is distributed (§111.605). Check the rule for your own market, but expect a regulator anywhere to ask for the same kinds of evidence.
Where do HACCP and ISO 22000 fit?
HACCP is the hazard analysis method. ISO 22000 is the management system that holds it, with leadership, planning, internal audit and management review. The Codex text sets the method. Our ISO 22000:2018 guide covers the standard's structure clause by clause.
A supplement hazard analysis looks different from a bakery's. The examples below are AGS's practical list for supplement plants, not a quote from any standard:
- Biological: microbial load in botanicals, powders and probiotic blends, and growth in liquids and gummies with high water activity.
- Chemical: heavy metals and pesticide residues in botanicals, undeclared allergens, and cross-contact between products on shared blenders and tablet presses.
- Formulation: wrong ingredient, wrong weight or a missed addition at dispensing, which can push a vitamin above its safe level.
- Physical: metal from punches, screens and sieves, and glass or hard plastic near open product.
Each significant hazard is then controlled at a CCP or by an operational prerequisite programme. Line clearance between products, dispensing checks and metal detection are common examples. Our guide to the Codex HACCP system walks through the 12 steps.
What does ISO 9001 add?
ISO 22000 asks whether the product is safe. ISO 9001 asks whether it meets its specification and what the customer was promised. For a supplement, that means the label. A capsule can be perfectly safe and still fail on potency.
ISO 9001 brings supplier evaluation, control of customer requirements, complaint handling, nonconformity and corrective action, and measurement of whether the system works. The two standards share the same high-level structure. One manual, one document control procedure, one internal audit programme and one management review can serve both.
What records will an auditor or regulator ask to see?
Certification auditors and regulators tend to trace one batch from start to finish. Each step should have a record that someone can produce on the day:
- Supplier approval files and certificates of analysis, with your own identity test results for each dietary ingredient.
- The master formula and the completed batch record, showing weights, line clearance, in-process checks and yield.
- HACCP monitoring records for each CCP, with corrective actions when a limit was missed.
- Finished-product test results against specification and a signed release decision.
- Reserve samples, traceability records and the result of your last recall exercise.
- Complaint log, internal audit reports and management review minutes.
How AGS can help
The VITALEDGE Nutraceuticals kit contains 62 editable Microsoft Word documents. They include an integrated manual and policy, 18 procedures covering PRPs and GMP, HACCP, traceability, recall and food fraud, and 18 forms such as a batch manufacturing record and a hazard analysis worksheet. There are also 8 checklists, training packs and an ISO 22000:2018 interpretation guide. Its ISO 9001 content references the 2015 edition.
Frequently asked questions
Can a supplement manufacturer be certified to ISO 22000?
Yes. ISO 22000 applies to any organisation in the food chain, and a certification body audits and certifies the organisation. Whether your products count as food in a given market is a separate question for the regulator.
Does ISO 22000 certification replace a regulator's GMP inspection?
No. Certification is voluntary and issued by a certification body. GMP compliance is a legal requirement checked by the authority in each market.
Should a new system be built on ISO 9001:2015 or ISO 9001:2026?
ISO 9001:2015 is withdrawn, so a new system should plan for the 2026 edition. Ask your certification body which edition it will audit against and when.
Does buying documentation mean the plant will pass its audit?
No. Documents are a starting point. The outcome depends on how the system is implemented and on the auditor's or inspector's findings.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by ISO, the Codex Alimentarius Commission, the SFDA or the US FDA. They do not guarantee any certification, inspection or registration outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
