Case Study · 3PL / Kitting / Co-Pack & the Contract-Clause Shield

The contract said the brands owned compliance. FDA regulates what you do to the food.

Keystone Fulfillment & Kitting stored, kitted, re-labeled and shipped food and supplements for a dozen brands, certain it was “just pick-pack-ship.” But holding food makes you a registered food facility; kitting and re-labeling makes you a packaging-and-labeling operation; and a clause assigning all of it to the client transfers none of it.

A constructed teaching case · built from real regulatory patterns, not a real company

Summit Trail Reset Box — a kitted bundle of trail protein bars and a daily probiotic assembled by the 3PL — The unit at the center of the file — a subscription “Reset Box” a 3PL kits from a brand’s protein bars and a 50-billion-CFU probiotic, then labels and ships.

Why we built this one

A file like this follows a pattern we know well. Not this company — Keystone, its people, its lot numbers are invented — but the pattern: a logistics operator growing fast on a single conviction, that the brands it serves own all the compliance and it just moves boxes.

It doesn’t just move boxes. It holds food, it kits and re-labels supplements, and it ships refrigerated product — and FDA regulates each of those activities at the facility performing them, no matter what the contract says.

So we built the case, because the lesson is worth more than the recall — or the shipped temperature excursion — it usually arrives with.

— Regulatory Options

Read this if it sounds like your operation

Your MSA assigns “all regulatory compliance” to the brand and says you’re “not the holder, packer or labeler of record.”
You kit, re-pack or re-label food or supplements and treat it as “value-added assembly,” not a labeling operation.
You hold refrigerated or FTL-listed food but capture lot codes only when a client setup sheet asks.
Your last mock recall reconciled quantity by SKU and called it a pass.

If two or more are true, this case is describing your operation, not a stranger’s.

The file, as it arrived

Every record behind the case — the services agreement, the GDP SOPs, the kitting work instruction, the temperature log, the mock-recall write-up. Each one, read on its own, looks like a tidy logistics operation.

An operation like this fails between the contract and the loading dock, never inside one document. Open the file and read what you’d catch — then see what we found, just below.

Open the full case file

What the records showed, together

No single page is alarming — read apart, each record is an ordinary logistics document. Read together, the same evidence resolves into four threads, all turning on one belief: that a contract clause can decide what you are.

“We just move boxes” — except they didn’t.

The agreement and the self-assessment classify Keystone as exempt warehousing and assign every duty to the brand. But the activities on the floor are regulated activities, and the facility’s own registration had quietly lapsed.

A blanket clause assigns all compliance to the brand and declares Keystone “not the holder, packer or labeler of record” — a contract cannot move FDA duties off the facility performing the activity. · 21 CFR 1 Subpart H · FDCA §301

Holding food makes it a registered food facility doing holding under 117; kitting and re-labeling supplements make it a 111 packaging/labeling operation — both self-disclaimed. · 21 CFR 117 · 21 CFR 111 Subpart L

The 2024 biennial registration renewal was never completed — the facility is holding food while its registration is lapsed, framed as “renewal pending.” · 21 CFR 1.230–1.235 · FDCA §415

The foundational classification was prepared by the office manager from web guidance, with no regulatory or legal review — the determination everything else rests on. · 21 CFR 117.4

Traceability breaks at the building.

Keystone holds and ships Food Traceability List foods and performs the receiving, shipping and kitting (transformation) events — yet captures none of the key data the rule requires, and the kitting step commingles lots into an untraceable bundle.

No FSMA-204 key data captured at receiving or shipping — lot codes recorded only where a client setup sheet asks; outbound manifests by SKU only. · 21 CFR 1.1345 / 1.1340 / 1.1455

Lot commingling at the kitting transformation CTE — components consumed from mixed lots, the kit identified by its own build date, component lots never transcribed. · 21 CFR 1.1350

The mock recall self-graded PASS on quantity by SKU, with lot-level tracing “not in scope” — it cannot say which lot went to which customer. · 21 CFR 7 Subpart C · 1.1455

No 24-hour electronic sortable-spreadsheet capability, and the exercise deliberately tested a shelf-stable SKU, not the regulated cold-chain product. · 21 CFR 1.1455(c)(3)(ii)

The cold chain caught it — and shipped it anyway.

A refrigerated cooler held a temperature-sensitive RTE deli salad above the limit for hours overnight. The monitor recorded it. No one had the authority to hold the product, so the whole receipt shipped the next morning.

The cooler held ~8.5 hours above 41°F (peak 51°F) on a TCS, FTL-listed deli salad; the event was logged as a maintenance note and 96 cases shipped to three customers. · 21 CFR 117.80 · FDCA §402(a)(4)

The alarm is audible at the panel only; manual twice-daily readings missed the overnight excursion entirely in an unattended building. · 21 CFR 117.40(e)

The agreement treats an excursion as a billing service credit, with disposition “left to the client” and no safety-hold authority at the facility. · 21 CFR 117.80 · 1 Subpart O

No product temperature taken at receipt and no written sanitary-transport agreements with any carrier — cold-chain verification absent at both handoffs. · 21 CFR 1.908

The kit itself created an undeclared allergen.

Assembling separate products into one consumer box is a labeling act. The new outer case carried a “what’s inside” list but no allergen statement — and the probiotic degraded in an unmonitored ambient zone before it ever reached the box.

The consolidated outer case bears no “Contains:” statement despite bars containing peanut, tree nut, milk and soy — a misbranded consumer unit created by the kitting step and applied by Keystone. · FALCPA · 21 CFR 101.4 · FD&C §403(w)

Keystone applies the kit UPC, marketplace code and date — a packaging/labeling operation — while QC verifies only count, scan and seal, never label content. · 21 CFR 111 Subpart L · 101

Ambient zones are not temperature-monitored; the 50-billion-CFU probiotic stages there and degrades toward zero before final kitting. · 21 CFR 111.455 · 117.80

No allergen segregation in storage and no allergen cleaning between kitting jobs — cross-contact risk on a shared table with no sanitation program. · 21 CFR 117.135(c)(2) · 117.35

Read apart, every record was an ordinary logistics document — a signed MSA, a GDP manual, a temperature log, a passing mock recall. Read together, they describe an operator that mistook a contract clause for a regulatory shield: holding food on a lapsed registration, kitting an undeclared allergen into a consumer box, shipping a temperature-abused TCS lot it had caught in its own data, and unable to trace any of it to a customer. The MSA said the brands owned compliance. FDA regulates what Keystone did.

None of it needed a new fact to see. It needed one honest read of what the facility actually does — hold, kit, label, ship — before the clause was signed, instead of “we just move boxes.”

What was at stake

What actually happened

A shipped excursion, a failed recall, a Form FDA 483

A temperature-abused TCS lot shipped to three customers with the deviation in Keystone’s own records; a contaminated lot couldn’t be bounded because nothing traced; and an undeclared-allergen kit was already in consumers’ hands. The 483 followed the same paperwork that had passed.

What catches it first

One honest read of what you do

A facility-classification review names Keystone a holder, packer and labeler — and a CTE/KDE traceability map plus hold authority stops the excursion, bounds the recall, and puts an allergen statement on the box before a single kit ships.

If this is your operation

You don’t need us to find out whether your operation has the same blind spot. Most of it you can check yourself, this week, with records you already have.

Does anything you do to the product — hold, kit, re-label, ship — make you a regulated facility?— or does your MSA simply say it doesn’t?
Can you trace one inbound lot to the customers who received it, in 24 hours?— or does your mock recall only reconcile quantity by SKU?
Who has the authority to hold product on a recorded temperature excursion?— the facility, or “the client” after it has already shipped?
When you kit products into one box, who owns the new unit’s allergen statement?— or does the consumer unit go out with only a contents list?

Nothing here is built around this one operator — each door points somewhere bigger, and no one of them is the “right” one. The case is just where they all meet.

Understand the process · Technology Kitting & co-packing How separate products become one consumer unit — and why the assembly step is a regulated packaging-and-labeling act that creates a new article, allergen statement and lot of its own. See the reference Check one decision · Service Facility Classification Opinion Holder? Packer? Labeler of record? One operation, one question, answered as a written determination of what you actually are — before a contract clause decides it for you. See the service Implement the system · Program The 3PL / FSMA-204 traceability & GDP program CTE/KDE capture at receiving, shipping and kitting, cold-chain hold authority, sanitary-transport roles, and a recall that bounds to a lot — a buy-and-go document system you run at your own pace. Coming soon Grade your readiness · Assessment 3PL / FSMA-204 Traceability Readiness Assessment A rubric-graded review of whether you can trace a lot to a customer in 24 hours, hold product on an excursion, and label a kit correctly — before an inspector or a recall grades it for you. Coming soon Learn the concept · Training Why a contract clause isn’t a regulatory shield The idea this case turns on — that you’re regulated by what you do to the product, not by what your MSA says you are — is what our forthcoming logistics-compliance course will teach. Coming soon

A contract clause was never the same thing as not being regulated.