What does getting GMP certified actually cost, and how long does it take?

Who this is written for. This is about dietary supplements sold into the United States, and about one scheme: NSF/ANSI 455-2, the American National Standard for good manufacturing practices in dietary supplements. If your product is a cosmetic, an over-the-counter drug, a food or an animal product, a different standard governs and none of the numbers below transfer to it. If you are outside the United States, the federal registration and the federal rule described here are US requirements; the certification scheme itself is used internationally, and your own market’s rules sit on top of it.

When a retailer, a marketplace or a customer writes and says they need you GMP certified, or cGMP certified, NSF/ANSI 455-2 is usually what they mean. It is worth confirming rather than assuming: several schemes get called “GMP certification,” and the cheapest question you will ever ask is which one they want and whose certificate they will accept. Everything below assumes the answer is this one.

Start with what the words mean, because two different things are being run together. 21 CFR part 111 is FDA’s good manufacturing practice regulation for dietary supplements, and it binds you if you manufacture, package, label or hold one, except that its holding requirements do not reach you if you hold product at a retail establishment purely for direct retail sale to consumers (21 CFR 111.1(a) and (b)). That rule is enforced by inspection. It issues no certificate to your facility — every use of the word certification inside it is about a supplier’s certificate of analysis, a supplier’s invoice or guarantee on a shipment, or the certification of accuracy of a reference standard. The certificate your customer is asking for comes from somewhere else entirely, and the standard’s own annex says as much: meeting its requirements is not by itself certification, and a manufacturer wanting to give the public more confidence than that does it by going through an independent conformity assessment (NSF/ANSI 455-2, Annex I-1.1).

If you hold no facility, this is not a purchase you can make. What gets certified is a facility. The audit scope is site or campus specific and covers operations run under one quality system (NSF/ANSI 455-2, 5.3.4), and the published listing of certified companies carries the facility address and the facility type — contract manufacturer, manufacturer, packaging, or distribution (NSF/ANSI 455-2, 5.8.4). NSF states that facilities involved in manufacturing, packaging, and warehouse and distribution of dietary supplements are in scope and may apply (NSF, NSF/ANSI 455-2: Dietary Supplements GMP Certification, February 22, 2024), while its own published answers about the program list standalone warehouse and distribution, e-commerce, brokers and label designers among the scopes it does not certify (NSF, NSF/ANSI 455 Frequently Asked Questions). Those two published statements point in different directions for a warehouse standing on its own, and which of them describes yours is a question for the certification body rather than one this page can settle.

Where they do not point in different directions is the case most people are in. If you own a brand, somebody else makes the product and somebody else warehouses it, you hold nothing that can be audited. The certificate you need is your manufacturer’s, and the work in front of you is reading it rather than buying one. You do not have to ask them for it first: NSF publishes the whole listing, searchable, with each facility’s address, type, product technologies, product categories and any exclusions on its scope (NSF, Product and Service Listings, NSF/ANSI 455-2, read August 20, 2026). Look your maker up there before you accept a PDF from them.

And if what you were asked for is product testing, this is a different purchase. Testing a finished lot for heavy metals, microbial contaminants or adulterants is a laboratory buying anything. Certification is an audit of a facility, and it renews annually (NSF/ANSI 455-2, 5.8.3). The two get discussed in the same email and they are not the same money, not the same evidence, and not the same clock. This page is about the audit.

On this page: Why nobody publishes a price · What sets the number · The clock, from the day you apply · The costs that never appear on the proposal · The certificate that does not cover the thing you were asked about · What the grade does to next year · The published numbers, and what they are worth · What you can settle before you call anyone · Common questions

Why nobody publishes a price

Because the standard does not set one, and it says so in the only place it mentions audit fees at all. In an informative annex it says the certification body should write down its own procedures and criteria, and one of the items it lists is whatever the body will charge for an audit, where a charge applies (NSF/ANSI 455-2, Annex I-1.4). The fee is the certifying body’s to write down, not the standard’s. Everything else the standard has to say about money is about what happens when something goes wrong.

Every clause of NSF/ANSI 455-2, searched on August 20, 2026 for fee, fees, cost, costs, price, prices, charge, charges, charged, pay, payment, payments, invoice, invoices and financial, matching whole words only. Eight clauses matched. Four of them are about a supplier’s invoice in a receiving record or about an auditor’s financial conflict of interest and have nothing to do with what the audit costs; the four in the table are the rest. No clause in the standard carries a currency symbol or a figure. What the count shows is that the standard leaves the price open. It is not evidence about what any certification body actually charges. (NSF/ANSI 455-2, 5.6.1, 5.8.5, 5.8.6 and Annex I-1.4)

The certification bodies write the same thing on their own pages. NSF answers the cost question by telling you that the cost and duration for dietary supplements are similar to its older program, that bundling scopes may affect both, and to contact your account manager if you need a quote (NSF, NSF/ANSI 455 Frequently Asked Questions). Perry Johnson Registrars Food Safety, another body offering 455-2 certification, publishes no price and offers a free quote instead (PJRFSI, NSF/ANSI 455-2 Dietary Supplements). There is no list price being kept from you. There is a scope, and a scope has to be settled before anyone can count days.

What sets the number

Audit days. That is what you are buying, and the standard is explicit about what adds them.

An audit is made of administrative work, meaning writing the audit plan, producing the forms it runs on and closing out the paperwork afterward, plus time at the facility. The time at the facility splits again. There is a fairly standard block for support systems such as personnel, training, maintenance, laboratories, the internal audit process and recall. Then there is a variable block for the plant itself, and that one moves with the number and complexity of the product technologies you run and the number of product categories you make (NSF/ANSI 455-2, 5.4.2).

The standard gives duration guidance against those two counts. A facility with a specialized, limited product — its worked example is a non-aqueous, non-microbially-sensitive supplement — may be audited in one day by one auditor. Its base case for two days is a manufacturer with up to five product categories and up to three technologies in a single building, using water as an ingredient and needing microbiological testing on something. A larger facility with multiple buildings, more than five product categories and more than three technologies may require additional audit time, or more than one auditor, or both. The standard also allows the duration and the resourcing to be adjusted on what the body knows about the manufacturer and its operation, its regulatory history and the focus of the audit (NSF/ANSI 455-2, 5.4.2). NSF, applying that, says its typical 455-2 audit runs three days and may run longer depending on facility size and other factors; that figure is the certification body’s own published guidance rather than a commitment (NSF, NSF/ANSI 455 Frequently Asked Questions).

Which raises the obvious question: how do you count your own technologies and categories? The standard does not tell you. Its definitions clause hands the terminology to a companion standard, NSF/ANSI 455-1, which is not read here (NSF/ANSI 455-2, 3). What they look like in practice is on the public listing, because every certified facility has its own printed on its entry. Product technologies appearing there include baking, coating, drying, dry formulation, encapsulation, extraction, fermentation, granulation, liquid formulation, milling, mixing, spray drying, sterilization, tablet compression, warehousing and packaging or labeling operations, the last of those split further into primary, secondary and bulk. Product categories appearing there include capsule, tablet, powder, granule, ingestible liquid and ingestible oil (NSF, Product and Service Listings, NSF/ANSI 455-2, read August 20, 2026). Reading a few entries from plants that look like yours is the fastest way to see how your own operation would be written down.

None of it is settled by you alone. The scope of the audit is determined by the number and type of products and the manufacturing processes used at the site, it is agreed between you and the certification body before the audit, and that same information is what supports the choice of a qualified auditor and the determination of the duration (NSF/ANSI 455-2, 5.3.4). The body determines the duration and the number of auditors (NSF/ANSI 455-2, 5.4.2), and it selects the audit team from the details you supply about your products and process technologies (NSF/ANSI 455-2, 5.4.6). So the scope conversation is the pricing conversation. Walk into it without a clear list of what you make and what you make it with and the body has to build the scope on assumptions instead of on your operation.

The clock, from the day you apply

NSF recommends allowing a 60 to 90 day window between submitting the application and the audit date you want. Asked how long the whole thing takes, it says there are too many variables to give a definitive timeline: if you meet every required criterion you could be listed in as little as four months, and it could take up to eighteen months to complete the entire process (NSF, NSF/ANSI 455 Frequently Asked Questions). Read that spread as the certification body’s own published guidance, and read its refusal to narrow it literally: it does not name a single cause, and neither will we.

The standard itself sets no deadline on the part that takes longest. It says only that the site and the certification body agree a mutually convenient date, that the timing has to allow both sides to prepare, and that it has to accommodate travel and the planned audit duration. It also settles a question people ask hoping for a cheaper answer: the first certification audit has to happen at the site. A virtual audit stands in for an on-site certification audit only at the annual one, only where travel is suspended or restricted, and only where the previous audit earned a grade of A or B — every audit is graded, and the grades run A to D — after which the next one has to be on site again. Monitoring audits, and the separate audits described below, may be in person or run as desk audits, as the body decides (NSF/ANSI 455-2, 5.4.4).

Before the visit, the site supplies background information to the certification body at least one week ahead. What the body asks for should include, and is not limited to, the organization chart, site plan, process flow diagram, the list of products and technologies in scope, shift patterns, the standard operating procedure index, five years of regulatory inspection history, and the site’s regulatory registration. If your last 455 audit was done by a different body, you also hand over that year’s audit report with its corrective action plans (NSF/ANSI 455-2, 5.4.5). The audit plan comes back to you at least one week before the start date (NSF/ANSI 455-2, 5.4.7).

After the last day of the audit, the standard does put deadlines on the paperwork, and they are worth knowing because they are the part you can plan around.

• The final review and publication of the report has to be completed within ten business days of the end of the audit (NSF/ANSI 455-2, 5.6.3).
• You submit a corrective action plan, with an implementation date against each nonconformance, within ten business days of receiving the final report. If you need longer you have to ask for it (NSF/ANSI 455-2, 5.7.1).
• The certification body reviews that plan within ten business days of receiving it, and either approves it, rejects it, or asks for more (NSF/ANSI 455-2, 5.7.2).
• Where a certificate is awarded, it is issued within ten business days of the certification decision (NSF/ANSI 455-2, 5.8.1).

Those are outer limits on the certification body and on you, not a forecast. They also only start running on the last day of the audit, which is the day the four-to-eighteen-month range was about getting to.

It also helps to know how many different audits are in play, because the words get used loosely. The standard has two types: a certification audit, run against the requirements to decide certification, and a monitoring audit, run to check progress on corrective actions and confirm they are complete (NSF/ANSI 455-2, 5.3.1). Two more things sit outside that pair. A separate audit may be needed to cover a process that was not running when the auditor was there (NSF/ANSI 455-2, 5.4.3). And a gap analysis audit, described further down, is not a certification body’s audit at all (NSF/ANSI 455-2, 5.3.2).

The costs that never appear on the proposal

The plant has to be running. The site is required to make sure the scope of certification is in operation during the audit, and the auditor has the discretion to keep going until satisfied the intended scope has been assessed. Where a significant process runs seasonally or only occasionally, the standard gives two ways out and both cost something: either the audit is scheduled for the time that process runs, or the general audit goes ahead as planned and a separate audit is required to assess that process (NSF/ANSI 455-2, 5.4.3). Where a technology was not observed and a separate audit is required for it, that one may be done in person or as a desk audit, as the certification body decides on the complexity of the technology (NSF/ANSI 455-2, 5.4.4).

Read those together and the production schedule becomes part of the price. If a significant process only runs at one time of year, the audit date is not a matter of convenience.

Then there is the plant’s own time. The audit is not a document review with a walk around at the end. It is an opening meeting with senior managers who can authorize corrective action, a facility tour following production flow from receiving through processing, packaging, warehousing, testing, release and shipping, employee interviews with people picked at random from different parts of the operation, a document review across your procedures and records, a traceability challenge including a mock recall, and a closing meeting (NSF/ANSI 455-2, 5.5.1 to 5.5.8). Every one of those hours is an hour your people are not making product, and none of them is on the proposal.

The certificate that does not cover the thing you were asked about

This is the expensive mistake, and it is expensive in both directions — for the plant that bought a narrower certificate than it meant to, and for the brand owner who accepted it as proof of something it never covered.

Excluding products or processes from the scope of a certification audit is permitted. Excluding products is acceptable only where the excluded products can be clearly differentiated from the products in scope and only where they are produced in a physically segregated area of the site. Products under development or in trial production are outside the scope in any case. Whatever is excluded has to be described in the audit plan, in the audit report, and on any certificate issued (NSF/ANSI 455-2, 5.3.4). The published listing carries exclusions and limitations too (NSF/ANSI 455-2, 5.8.4).

That is not theoretical. Reading NSF’s published 455-2 listing on August 20, 2026, twenty entries carried a scope exclusion printed on the face of the listing. Some exclude a product category: ingestible liquid, powder, capsule and tablet. Some exclude a technology: coating, sterilization, tablet compression. One excludes five things at once (NSF, Product and Service Listings, NSF/ANSI 455-2, read August 20, 2026).

So a real certificate, issued by an accredited body, in good standing and not expired, can sit in a folder and not cover the product line your customer is asking about. Nothing about the document says so on its face. The exclusions say so, and the exclusions are the part nobody reads. If you are the one holding the certificate, closing that gap means another audit, not another copy of the certificate. If you are the one being handed it, the scope and the exclusions are where the answer to your question is, and the public listing shows both without going through the supplier.

What the grade does to next year

Certification is annual, and the grade you get shapes how many audits you are buying in the twelve months after it.

The grade comes from the number and severity of the nonconformances written during the audit, classified critical, major or minor on the auditor’s judgment of severity and risk, then read again by a technical reviewer at the certification body who is independent of the auditor who did the visit (NSF/ANSI 455-2, 5.5.9, 5.6.2 and 5.6.3). Where several findings land in one system element, that element’s classification is raised, so a run of small training findings can be grouped into a major one (NSF/ANSI 455-2, 5.6.2).

A grade of C requires a monitoring audit as follow-up (NSF/ANSI 455-2, 5.3.1), and the certification body sets its duration from the number and severity of the nonconformances and the corrective actions attached to them (NSF/ANSI 455-2, 5.4.2). That is a second audit inside the same year. A grade of D is not eligible for certification at all, and a new certification audit is required (NSF/ANSI 455-2, 5.7.3). NSF puts the same thing plainly: certification cannot be granted on a failed audit, a full re-audit is needed, and where the failure involved a critical finding you re-apply and show objective evidence that it has been corrected (NSF, NSF/ANSI 455 Frequently Asked Questions).

The clean version of all this is worth stating too, because most of a page like this describes what goes wrong. A single building with up to five product categories and up to three technologies is the standard’s two-day base case, one auditor (NSF/ANSI 455-2, 5.4.2). A grade of A or B with only minor nonconformances is eligible for certification once the corrective action plans are approved, and their effectiveness is looked at next year rather than in a separate visit (NSF/ANSI 455-2, 5.7.3). That is one audit a year and no monitoring visit. If that is your plant, the number you are budgeting for is one audit, not three.

Even the clean version recurs. The certificate is valid for 75 days beyond the twelve-month anniversary of the last day of your certification audit, unless the next certification audit grades D — in which case certification is not granted and any previous certification is withdrawn (NSF/ANSI 455-2, 5.8.1). The next certification audit is expected within thirty calendar days either side of that anniversary (NSF/ANSI 455-2, 5.8.3). This is a subscription, and the first year is the cheap way to think about it.

The published numbers, and what they are worth

One number in this whole chain is genuinely published and genuinely applies to everyone. The standard itself is sold as a PDF by the ANSI webstore for $285.00 (ANSI Webstore, NSF/ANSI 455-2-2024, read August 20, 2026). Before you can run the self-assessment the standard asks for, somebody has to read the standard, and that is what reading it costs.

After that the published figures stop coming from anyone who certifies. What you will find instead is ranges on pages that are not certification bodies. One contract manufacturer’s own guide to supplement certifications puts NSF GMP certification at $15,000 to $40,000 and up, depending on facility size and complexity, and in a comparison table on the same page puts certification by a reputable organization at $5,000 to $50,000 and up and certification by an unknown entity at $500 to $3,000 (Superior Supplement Manufacturing, Supplement Manufacturing Certifications, read August 20, 2026). We have reproduced those figures because they are what a search returns, not because we can stand behind them. That page is not a certification body, it does not say where its numbers came from, and its own spread runs across two orders of magnitude.

What the spread is worth checking against is the recognition test, which is published and is not a matter of opinion. An audit to this standard is recognized only where the body conducting it is itself recognized and approved by the American National Standards Institute (NSF/ANSI 455-2, 5.3.3). Before comparing two quotes, confirm that both bodies clear that bar. A quote from a body that does not is not a cheaper version of the same thing.

What you can settle before you call anyone

The standard expects work from you before a certification audit, and it is specific about it. You assess your own operation against the standard to get ready, and whatever that assessment finds is closed by the facility before the certification audit happens. The standard then names an option: someone other than the certification body, a third-party consultant, may run a gap analysis audit of the site (NSF/ANSI 455-2, 5.3.2). NSF, listing what you need in order to apply, sends you back to the same section: familiarize yourself with the standard, conduct a self-assessment, address identified gaps and implement corrective actions, identify the products and technologies in scope, and register the facility with FDA (NSF, NSF/ANSI 455 Frequently Asked Questions).

One thing to know before you engage anybody for that pre-work. An auditor assigned to your certification audit cannot have been involved in a gap analysis or provided consulting services for your company within the previous two years (NSF/ANSI 455-2, 5.4.6). That is a constraint on which auditor the body may put on your audit, not a bar on having the work done. If you have a preference about who audits you, raise it with the body before you engage anyone.

Settle the shape of the site too, because it changes the count. The scope is site or campus specific and operating under one quality system, but the standard allows activities at several locations in close proximity to sit inside one audit — a corporate office where procedures are controlled, two nearby locations that share a production process, offsite testing, complaint management. Storage facilities, on-site and off-site, are inside the scope, and a remote storage facility the company manages is either audited as part of the site audit or specifically excluded and identified in the report (NSF/ANSI 455-2, 5.3.4). Whether your two buildings are one campus or two sites is worth resolving before anybody quotes you.

Doing the pre-work does not change the audit’s length by much; what the standard lets a body adjust duration on is its knowledge of your operation, your regulatory history and the focus of the audit (NSF/ANSI 455-2, 5.4.2). What it changes is the grade, and the grade is what decides whether next year holds one audit or two.

The document review at the audit reaches specifications for ingredients, components, batches and finished products, along with your manufacturing, packaging, shipping, deviation, change control, maintenance, cleaning, training and complaint records (NSF/ANSI 455-2, 5.5.4). If the specifications are where you already suspect you are thin, where those numbers legitimately come from is its own question.

Which leaves two different next steps, depending on which reader you are. If you own the brand and somebody else makes the product, yours is free and you can do it this afternoon: look your manufacturer up on the public listing, read the facility type, the product technologies, the product categories and the exclusions, and see whether what you sell is inside them. If you run the plant, yours is the self-assessment the standard asks for, and that is what the rest of this section is about.