Supplement COAs: What Amazon, the FDA & Your Customers Each Expect

If you make or sell dietary supplements, the certificate of analysis stopped being back-office paperwork somewhere in the last couple of years. Three different parties now expect one — for different reasons, in different formats — and the sellers who treat COAs as an organized, per-batch system instead of a folder of PDFs are the ones not scrambling when each of them asks.

1. The FDA: COAs inside your supply chain

Federal cGMP rules for supplements (21 CFR Part 111) require manufacturers to set specifications for the identity, purity, strength, and composition of what they make, and to verify those specs are met (§111.70, §111.75). Two COA-specific points trip people up:

• You can rely on a supplier's COA for some component specs — but only if it's a real one. The rule spells out what a usable COA must include: the test methods used, the limits, and the actual results. A one-line "conforms" letter doesn't qualify.
• Identity testing of dietary ingredients can't be delegated to a supplier's COA at all — you have to test identity yourself unless the FDA has granted an exemption you petitioned for.

The FDA's interest is your manufacturing records, not your marketing — but it's the foundation the rest is built on: if your batches don't have real COAs behind them, the next two parties have nothing to look at.

2. Amazon: no per-batch COA, no listing

This is the change that made COAs urgent for anyone selling online. Amazon's dietary supplement policy — which as of late 2025 applies to all supplement categories — requires a finished-product COA for the specific batch being sold, issued by an ISO/IEC 17025-accredited lab (or a compliant in-house lab), typically dated within the last 12 months, showing the amount of each dietary ingredient claimed on the facts panel, with the product name and batch number on the document.

Two details sellers learn the hard way:

• COAs now go through Amazon-approved testing/inspection/certification (TIC) companies — Amazon stopped accepting them directly from sellers.
• An expired COA or lapsed cGMP document can deactivate a listing overnight. The sellers who survive audits are the ones who can produce the right batch's paperwork in minutes, not days.

3. Customers: the expectation hemp normalized

There's no federal rule requiring a QR code or published lab results on a supplement label — worth saying plainly, since plenty of marketing implies otherwise. But the expectation has traveled: hemp buyers learned to scan labels for lab results (in eleven states, that's now the law), kratom buyers made published labs the price of entry, and sports-nutrition customers — especially tested athletes worried about banned substances — increasingly treat "where are your third-party results?" as a first question rather than a last one.

For a supplement brand, publishing per-batch results does two jobs at once: it answers the customer standing in front of your label, and it signals the operational maturity that the FDA and Amazon layers already forced you to build. You did the testing anyway — the only question is whether anyone can see it.

What belongs on a supplement COA

• Batch/lot number matching the physical product — the anchor for everything else
• Label-claim verification — the measured amount of each dietary ingredient on the facts panel
• Contaminant panels — heavy metals, microbials, and whatever else your product category warrants
• The lab's identity and accreditation (ISO/IEC 17025 is the standard both Amazon and serious buyers look for), test methods, dates, and actual numbers — not just "pass"

New to reading lab reports? Our plain-English COA guide covers the anatomy, including the red flags.

The mechanics: one permanent link per batch

The pattern that works is the same one hemp compliance forced: every batch gets its own hosted page — product, batch number, test date, lab, and the COA document itself — with a permanent link and a QR code you can print on the label or drop in a listing. New batch, new page. When anyone asks about any batch, the answer is a link, not an archaeology project through email attachments.